man/systemd.netdev.xml

   1 <?xml version='1.0'?> <!--*-nxml-*-->
   2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
   3   "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
   4
   5 <!--
   6   SPDX-License-Identifier: LGPL-2.1+
   7
   8   This file is part of systemd.
   9
  10   Copyright 2013 Tom Gundersen
  11
  12   systemd is free software; you can redistribute it and/or modify it
  13   under the terms of the GNU Lesser General Public License as published by
  14   the Free Software Foundation; either version 2.1 of the License, or
  15   (at your option) any later version.
  16
  17   systemd is distributed in the hope that it will be useful, but
  18   WITHOUT ANY WARRANTY; without even the implied warranty of
  19   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  20   Lesser General Public License for more details.
  21
  22   You should have received a copy of the GNU Lesser General Public License
  23   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  24 -->
  25
  26 <refentry id="systemd.netdev" conditional='ENABLE_NETWORKD'>
  27
  28   <refentryinfo>
  29     <title>systemd.network</title>
  30     <productname>systemd</productname>
  31
  32     <authorgroup>
  33       <author>
  34         <contrib>Developer</contrib>
  35         <firstname>Tom</firstname>
  36         <surname>Gundersen</surname>
  37         <email>teg@jklm.no</email>
  38       </author>
  39     </authorgroup>
  40   </refentryinfo>
  41
  42   <refmeta>
  43     <refentrytitle>systemd.netdev</refentrytitle>
  44     <manvolnum>5</manvolnum>
  45   </refmeta>
  46
  47   <refnamediv>
  48     <refname>systemd.netdev</refname>
  49     <refpurpose>Virtual Network Device configuration</refpurpose>
  50   </refnamediv>
  51
  52   <refsynopsisdiv>
  53     <para><filename><replaceable>netdev</replaceable>.netdev</filename></para>
  54   </refsynopsisdiv>
  55
  56   <refsect1>
  57     <title>Description</title>
  58
  59     <para>Network setup is performed by
  60     <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
  61     </para>
  62
  63     <para>The main Virtual Network Device file must have the extension <filename>.netdev</filename>;
  64     other extensions are ignored. Virtual network devices are created as soon as networkd is
  65     started. If a netdev with the specified name already exists, networkd will use that as-is rather
  66     than create its own. Note that the settings of the pre-existing netdev will not be changed by
  67     networkd.</para>
  68
  69     <para>The <filename>.netdev</filename> files are read from the files located in the system
  70     network directory <filename>/usr/lib/systemd/network</filename>, the volatile runtime network
  71     directory <filename>/run/systemd/network</filename> and the local administration network
  72     directory <filename>/etc/systemd/network</filename>. All configuration files are collectively
  73     sorted and processed in lexical order, regardless of the directories in which they live.
  74     However, files with identical filenames replace each other. Files in <filename>/etc</filename>
  75     have the highest priority, files in <filename>/run</filename> take precedence over files with
  76     the same name in <filename>/usr/lib</filename>. This can be used to override a system-supplied
  77     configuration file with a local file if needed. As a special case, an empty file (file size 0)
  78     or symlink with the same name pointing to <filename>/dev/null</filename> disables the
  79     configuration file entirely (it is "masked").</para>
  80
  81     <para>Along with the netdev file <filename>foo.netdev</filename>, a "drop-in" directory
  82     <filename>foo.netdev.d/</filename> may exist. All files with the suffix <literal>.conf</literal>
  83     from this directory will be parsed after the file itself is parsed. This is useful to alter or
  84     add configuration settings, without having to modify the main configuration file. Each drop-in
  85     file must have appropriate section headers.</para>
  86
  87     <para>In addition to <filename>/etc/systemd/network</filename>, drop-in <literal>.d</literal>
  88     directories can be placed in <filename>/usr/lib/systemd/network</filename> or
  89     <filename>/run/systemd/network</filename> directories. Drop-in files in
  90     <filename>/etc</filename> take precedence over those in <filename>/run</filename> which in turn
  91     take precedence over those in <filename>/usr/lib</filename>. Drop-in files under any of these
  92     directories take precedence over the main netdev file wherever located. (Of course, since
  93     <filename>/run</filename> is temporary and <filename>/usr/lib</filename> is for vendors, it is
  94     unlikely drop-ins should be used in either of those places.)</para>
  95   </refsect1>
  96
  97   <refsect1>
  98     <title>Supported netdev kinds</title>
  99
 100     <para>The following kinds of virtual network devices may be
 101     configured in <filename>.netdev</filename> files:</para>
 102
 103     <table>
 104       <title>Supported kinds of virtual network devices</title>
 105
 106       <tgroup cols='2'>
 107         <colspec colname='kind' />
 108         <colspec colname='explanation' />
 109         <thead><row>
 110           <entry>Kind</entry>
 111           <entry>Description</entry>
 112         </row></thead>
 113         <tbody>
 114           <row><entry><varname>bond</varname></entry>
 115           <entry>A bond device is an aggregation of all its slave devices. See <ulink url="https://www.kernel.org/doc/Documentation/networking/bonding.txt">Linux Ethernet Bonding Driver HOWTO</ulink> for details.Local configuration</entry></row>
 116
 117           <row><entry><varname>bridge</varname></entry>
 118           <entry>A bridge device is a software switch, and each of its slave devices and the bridge itself are ports of the switch.</entry></row>
 119
 120           <row><entry><varname>dummy</varname></entry>
 121           <entry>A dummy device drops all packets sent to it.</entry></row>
 122
 123           <row><entry><varname>gre</varname></entry>
 124           <entry>A Level 3 GRE tunnel over IPv4. See <ulink url="https://tools.ietf.org/html/rfc2784">RFC 2784</ulink> for details.</entry></row>
 125
 126           <row><entry><varname>gretap</varname></entry>
 127           <entry>A Level 2 GRE tunnel over IPv4.</entry></row>
 128
 129           <row><entry><varname>ip6gre</varname></entry>
 130           <entry>A Level 3 GRE tunnel over IPv6.</entry></row>
 131
 132           <row><entry><varname>ip6tnl</varname></entry>
 133           <entry>An IPv4 or IPv6 tunnel over IPv6</entry></row>
 134
 135           <row><entry><varname>ip6gretap</varname></entry>
 136           <entry>A Level 2 GRE tunnel over IPv6.</entry></row>
 137
 138           <row><entry><varname>ipip</varname></entry>
 139           <entry>An IPv4 over IPv4 tunnel.</entry></row>
 140
 141           <row><entry><varname>ipvlan</varname></entry>
 142           <entry>An ipvlan device is a stacked device which receives packets from its underlying device based on IP address filtering.</entry></row>
 143
 144           <row><entry><varname>macvlan</varname></entry>
 145           <entry>A macvlan device is a stacked device which receives packets from its underlying device based on MAC address filtering.</entry></row>
 146
 147           <row><entry><varname>macvtap</varname></entry>
 148           <entry>A macvtap device is a stacked device which receives packets from its underlying device based on MAC address filtering.</entry></row>
 149
 150           <row><entry><varname>sit</varname></entry>
 151           <entry>An IPv6 over IPv4 tunnel.</entry></row>
 152
 153           <row><entry><varname>tap</varname></entry>
 154           <entry>A persistent Level 2 tunnel between a network device and a device node.</entry></row>
 155
 156           <row><entry><varname>tun</varname></entry>
 157           <entry>A persistent Level 3 tunnel between a network device and a device node.</entry></row>
 158
 159           <row><entry><varname>veth</varname></entry>
 160           <entry>An Ethernet tunnel between a pair of network devices.</entry></row>
 161
 162           <row><entry><varname>vlan</varname></entry>
 163           <entry>A VLAN is a stacked device which receives packets from its underlying device based on VLAN tagging. See <ulink url="http://www.ieee802.org/1/pages/802.1Q.html">IEEE 802.1Q</ulink> for details.</entry></row>
 164
 165           <row><entry><varname>vti</varname></entry>
 166           <entry>An IPv4 over IPSec tunnel.</entry></row>
 167
 168           <row><entry><varname>vti6</varname></entry>
 169           <entry>An IPv6 over IPSec tunnel.</entry></row>
 170
 171           <row><entry><varname>vxlan</varname></entry>
 172           <entry>A virtual extensible LAN (vxlan), for connecting Cloud computing deployments.</entry></row>
 173
 174           <row><entry><varname>geneve</varname></entry>
 175           <entry>A GEneric NEtwork Virtualization Encapsulation (GENEVE) netdev driver.</entry></row>
 176
 177           <row><entry><varname>vrf</varname></entry>
 178           <entry>A Virtual Routing and Forwarding (<ulink url="https://www.kernel.org/doc/Documentation/networking/vrf.txt">VRF</ulink>) interface to create separate routing and forwarding domains.</entry></row>
 179
 180           <row><entry><varname>vcan</varname></entry>
 181           <entry>The virtual CAN driver (vcan). Similar to the network loopback devices, vcan offers a virtual local CAN interface.</entry></row>
 182
 183           <row><entry><varname>vxcan</varname></entry>
 184           <entry>The virtual CAN tunnel driver (vxcan). Similar to the virtual ethernet driver veth, vxcan implements a local CAN traffic tunnel between two virtual CAN network devices. When creating a vxcan, two vxcan devices are created as pair. When one end receives the packet it appears on its pair and vice versa. The vxcan can be used for cross namespace communication.
 185           </entry></row>
 186
 187           <row><entry><varname>wireguard</varname></entry>
 188           <entry>WireGuard Secure Network Tunnel.</entry></row>
 189
 190         </tbody>
 191       </tgroup>
 192     </table>
 193
 194   </refsect1>
 195
 196   <refsect1>
 197     <title>[Match] Section Options</title>
 198
 199     <para>A virtual network device is only created if the
 200     <literal>[Match]</literal> section matches the current
 201     environment, or if the section is empty. The following keys are
 202     accepted:</para>
 203
 204     <variablelist class='network-directives'>
 205       <varlistentry>
 206         <term><varname>Host=</varname></term>
 207         <listitem>
 208           <para>Matches against the hostname or machine ID of the
 209           host. See <literal>ConditionHost=</literal> in
 210           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 211           for details.
 212           </para>
 213         </listitem>
 214       </varlistentry>
 215       <varlistentry>
 216         <term><varname>Virtualization=</varname></term>
 217         <listitem>
 218           <para>Checks whether the system is executed in a virtualized
 219           environment and optionally test whether it is a specific
 220           implementation. See
 221           <literal>ConditionVirtualization=</literal> in
 222           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 223           for details.
 224           </para>
 225         </listitem>
 226       </varlistentry>
 227       <varlistentry>
 228         <term><varname>KernelCommandLine=</varname></term>
 229         <listitem>
 230           <para>Checks whether a specific kernel command line option
 231           is set (or if prefixed with the exclamation mark unset). See
 232           <literal>ConditionKernelCommandLine=</literal> in
 233           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 234           for details.
 235           </para>
 236         </listitem>
 237       </varlistentry>
 238       <varlistentry>
 239         <term><varname>KernelVersion=</varname></term>
 240         <listitem>
 241           <para>Checks whether the kernel version (as reported by <command>uname -r</command>) matches a certain
 242           expression (or if prefixed with the exclamation mark does not match it). See
 243           <literal>ConditionKernelVersion=</literal> in
 244           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry> for details.
 245           </para>
 246         </listitem>
 247       </varlistentry>
 248       <varlistentry>
 249         <term><varname>Architecture=</varname></term>
 250         <listitem>
 251           <para>Checks whether the system is running on a specific
 252           architecture. See <literal>ConditionArchitecture=</literal> in
 253           <citerefentry><refentrytitle>systemd.unit</refentrytitle><manvolnum>5</manvolnum></citerefentry>
 254           for details.
 255           </para>
 256         </listitem>
 257       </varlistentry>
 258     </variablelist>
 259
 260   </refsect1>
 261
 262   <refsect1>
 263     <title>[NetDev] Section Options</title>
 264
 265       <para>The <literal>[NetDev]</literal> section accepts the
 266       following keys:</para>
 267
 268       <variablelist class='network-directives'>
 269         <varlistentry>
 270           <term><varname>Description=</varname></term>
 271           <listitem>
 272             <para>A free-form description of the netdev.</para>
 273           </listitem>
 274         </varlistentry>
 275         <varlistentry>
 276           <term><varname>Name=</varname></term>
 277           <listitem>
 278             <para>The interface name used when creating the netdev.
 279             This option is compulsory.</para>
 280           </listitem>
 281         </varlistentry>
 282         <varlistentry>
 283           <term><varname>Kind=</varname></term>
 284           <listitem>
 285             <para>The netdev kind. This option is compulsory. See the
 286             <literal>Supported netdev kinds</literal> section for the
 287             valid keys.</para>
 288           </listitem>
 289         </varlistentry>
 290         <varlistentry>
 291           <term><varname>MTUBytes=</varname></term>
 292           <listitem>
 293             <para>The maximum transmission unit in bytes to set for
 294             the device. The usual suffixes K, M, G, are supported and
 295             are understood to the base of 1024. This key is not
 296             currently supported for <literal>tun</literal> or
 297             <literal>tap</literal> devices.
 298             </para>
 299           </listitem>
 300         </varlistentry>
 301         <varlistentry>
 302           <term><varname>MACAddress=</varname></term>
 303           <listitem>
 304             <para>The MAC address to use for the device. If none is
 305             given, one is generated based on the interface name and
 306             the
 307             <citerefentry><refentrytitle>machine-id</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
 308             This key is not currently supported for
 309             <literal>tun</literal> or <literal>tap</literal> devices.
 310             </para>
 311           </listitem>
 312         </varlistentry>
 313       </variablelist>
 314   </refsect1>
 315
 316     <refsect1>
 317     <title>[Bridge] Section Options</title>
 318
 319       <para>The <literal>[Bridge]</literal> section only applies for
 320       netdevs of kind <literal>bridge</literal>, and accepts the
 321       following keys:</para>
 322
 323       <variablelist class='network-directives'>
 324         <varlistentry>
 325           <term><varname>HelloTimeSec=</varname></term>
 326           <listitem>
 327             <para>HelloTimeSec specifies the number of seconds between two hello packets
 328             sent out by the root bridge and the designated bridges. Hello packets are
 329             used to communicate information about the topology throughout the entire
 330             bridged local area network.</para>
 331           </listitem>
 332         </varlistentry>
 333         <varlistentry>
 334           <term><varname>MaxAgeSec=</varname></term>
 335           <listitem>
 336             <para>MaxAgeSec specifies the number of seconds of maximum message age.
 337             If the last seen (received) hello packet is more than this number of
 338             seconds old, the bridge in question will start the takeover procedure
 339             in attempt to become the Root Bridge itself.</para>
 340           </listitem>
 341         </varlistentry>
 342         <varlistentry>
 343           <term><varname>ForwardDelaySec=</varname></term>
 344           <listitem>
 345             <para>ForwardDelaySec specifies the number of seconds spent in each
 346             of the Listening and Learning states before the Forwarding state is entered.</para>
 347           </listitem>
 348         </varlistentry>
 349         <varlistentry>
 350           <term><varname>AgeingTimeSec=</varname></term>
 351           <listitem>
 352             <para>This specifies the number of seconds a MAC Address will be kept in
 353             the forwarding database after having a packet received from this MAC Address.</para>
 354           </listitem>
 355         </varlistentry>
 356         <varlistentry>
 357           <term><varname>Priority=</varname></term>
 358           <listitem>
 359             <para>The priority of the bridge. An integer between 0 and 65535. A lower value
 360             means higher priority. The bridge having the lowest priority will be elected as root bridge.</para>
 361           </listitem>
 362         </varlistentry>
 363         <varlistentry>
 364           <term><varname>GroupForwardMask=</varname></term>
 365           <listitem>
 366             <para>A 16-bit bitmask represented as an integer which allows forwarding of link
 367             local frames with 802.1D reserved addresses (01:80:C2:00:00:0X). A logical AND
 368             is performed between the specified bitmask and the exponentiation of 2^X, the
 369             lower nibble of the last octet of the MAC address. For example, a value of 8
 370             would allow forwarding of frames addressed to 01:80:C2:00:00:03 (802.1X PAE).</para>
 371           </listitem>
 372         </varlistentry>
 373         <varlistentry>
 374           <term><varname>DefaultPVID=</varname></term>
 375           <listitem>
 376             <para>This specifies the default port VLAN ID of a newly attached bridge port.
 377             Set this to an integer in the range 1–4094 or <literal>none</literal> to disable the PVID.</para>
 378           </listitem>
 379         </varlistentry>
 380         <varlistentry>
 381           <term><varname>MulticastQuerier=</varname></term>
 382           <listitem>
 383             <para>A boolean. This setting controls the IFLA_BR_MCAST_QUERIER option in the kernel.
 384             If enabled, the kernel will send general ICMP queries from a zero source address.
 385             This feature should allow faster convergence on startup, but it causes some
 386             multicast-aware switches to misbehave and disrupt forwarding of multicast packets.
 387             When unset, the kernel's default setting applies.
 388             </para>
 389           </listitem>
 390         </varlistentry>
 391         <varlistentry>
 392           <term><varname>MulticastSnooping=</varname></term>
 393           <listitem>
 394             <para>A boolean. This setting controls the IFLA_BR_MCAST_SNOOPING option in the kernel.
 395             If enabled, IGMP snooping monitors the Internet Group Management Protocol (IGMP) traffic
 396             between hosts and multicast routers. When unset, the kernel's default setting applies.
 397             </para>
 398           </listitem>
 399         </varlistentry>
 400         <varlistentry>
 401           <term><varname>VLANFiltering=</varname></term>
 402           <listitem>
 403             <para>A boolean. This setting controls the IFLA_BR_VLAN_FILTERING option in the kernel.
 404             If enabled, the bridge will be started in VLAN-filtering mode. When unset, the kernel's
 405             default setting applies.
 406             </para>
 407           </listitem>
 408         </varlistentry>
 409           <varlistentry>
 410           <term><varname>STP=</varname></term>
 411           <listitem>
 412             <para>A boolean. This enables the bridge's Spanning Tree Protocol (STP). When unset,
 413             the kernel's default setting applies.
 414             </para>
 415           </listitem>
 416         </varlistentry>
 417       </variablelist>
 418   </refsect1>
 419
 420   <refsect1>
 421     <title>[VLAN] Section Options</title>
 422
 423       <para>The <literal>[VLAN]</literal> section only applies for
 424       netdevs of kind <literal>vlan</literal>, and accepts the
 425       following key:</para>
 426
 427       <variablelist class='network-directives'>
 428         <varlistentry>
 429           <term><varname>Id=</varname></term>
 430           <listitem>
 431             <para>The VLAN ID to use. An integer in the range 0–4094.
 432             This option is compulsory.</para>
 433           </listitem>
 434         </varlistentry>
 435         <varlistentry>
 436           <term><varname>GVRP=</varname></term>
 437           <listitem>
 438             <para>The Generic VLAN Registration Protocol (GVRP) is a protocol that
 439             allows automatic learning of VLANs on a network. A boolean. When unset,
 440             the kernel's default setting applies.</para>
 441           </listitem>
 442         </varlistentry>
 443         <varlistentry>
 444           <term><varname>MVRP=</varname></term>
 445           <listitem>
 446             <para>Multiple VLAN Registration Protocol (MVRP) formerly known as GARP VLAN
 447             Registration Protocol (GVRP) is a standards-based Layer 2 network protocol,
 448             for automatic configuration of VLAN information on switches. It was defined
 449             in the 802.1ak amendment to 802.1Q-2005. A boolean. When unset, the kernel's
 450             default setting applies.</para>
 451           </listitem>
 452         </varlistentry>
 453         <varlistentry>
 454           <term><varname>LooseBinding=</varname></term>
 455           <listitem>
 456             <para>The VLAN loose binding mode, in which only the operational state is passed
 457             from the parent to the associated VLANs, but the VLAN device state is not changed.
 458             A boolean. When unset, the kernel's default setting applies.</para>
 459           </listitem>
 460         </varlistentry>
 461         <varlistentry>
 462           <term><varname>ReorderHeader=</varname></term>
 463           <listitem>
 464             <para>The VLAN reorder header is set VLAN interfaces behave like physical interfaces.
 465             A boolean. When unset, the kernel's default setting applies.</para>
 466           </listitem>
 467         </varlistentry>
 468       </variablelist>
 469   </refsect1>
 470
 471   <refsect1>
 472     <title>[MACVLAN] Section Options</title>
 473
 474     <para>The <literal>[MACVLAN]</literal> section only applies for
 475     netdevs of kind <literal>macvlan</literal>, and accepts the
 476     following key:</para>
 477
 478     <variablelist class='network-directives'>
 479       <varlistentry>
 480         <term><varname>Mode=</varname></term>
 481         <listitem>
 482           <para>The MACVLAN mode to use. The supported options are
 483           <literal>private</literal>,
 484           <literal>vepa</literal>,
 485           <literal>bridge</literal>, and
 486           <literal>passthru</literal>.
 487           </para>
 488         </listitem>
 489       </varlistentry>
 490     </variablelist>
 491
 492   </refsect1>
 493
 494     <refsect1>
 495     <title>[MACVTAP] Section Options</title>
 496
 497     <para>The <literal>[MACVTAP]</literal> section applies for
 498     netdevs of kind <literal>macvtap</literal> and accepts the
 499     same key as <literal>[MACVLAN]</literal>.</para>
 500
 501     </refsect1>
 502
 503   <refsect1>
 504     <title>[IPVLAN] Section Options</title>
 505
 506     <para>The <literal>[IPVLAN]</literal> section only applies for
 507     netdevs of kind <literal>ipvlan</literal>, and accepts the
 508     following key:</para>
 509
 510     <variablelist class='network-directives'>
 511       <varlistentry>
 512         <term><varname>Mode=</varname></term>
 513           <listitem>
 514             <para>The IPVLAN mode to use. The supported options are
 515             <literal>L2</literal>,<literal>L3</literal> and <literal>L3S</literal>.
 516             </para>
 517           </listitem>
 518       </varlistentry>
 519        <varlistentry>
 520         <term><varname>Flags=</varname></term>
 521           <listitem>
 522             <para>The IPVLAN flags to use. The supported options are
 523             <literal>bridge</literal>,<literal>private</literal> and <literal>vepa</literal>.
 524             </para>
 525           </listitem>
 526       </varlistentry>
 527     </variablelist>
 528
 529   </refsect1>
 530
 531   <refsect1>
 532     <title>[VXLAN] Section Options</title>
 533     <para>The <literal>[VXLAN]</literal> section only applies for
 534     netdevs of kind <literal>vxlan</literal>, and accepts the
 535     following keys:</para>
 536
 537     <variablelist class='network-directives'>
 538       <varlistentry>
 539         <term><varname>Id=</varname></term>
 540         <listitem>
 541           <para>The VXLAN ID to use.</para>
 542         </listitem>
 543       </varlistentry>
 544       <varlistentry>
 545         <term><varname>Remote=</varname></term>
 546         <listitem>
 547           <para>Configures destination IP address.</para>
 548         </listitem>
 549       </varlistentry>
 550       <varlistentry>
 551         <term><varname>Local=</varname></term>
 552         <listitem>
 553           <para>Configures local IP address.</para>
 554         </listitem>
 555       </varlistentry>
 556         <varlistentry>
 557         <term><varname>TOS=</varname></term>
 558         <listitem>
 559           <para>The Type Of Service byte value for a vxlan interface.</para>
 560         </listitem>
 561       </varlistentry>
 562       <varlistentry>
 563         <term><varname>TTL=</varname></term>
 564         <listitem>
 565           <para>A fixed Time To Live N on Virtual eXtensible Local
 566           Area Network packets. N is a number in the range 1–255. 0
 567           is a special value meaning that packets inherit the TTL
 568           value.</para>
 569         </listitem>
 570       </varlistentry>
 571       <varlistentry>
 572         <term><varname>MacLearning=</varname></term>
 573         <listitem>
 574           <para>A boolean. When true, enables dynamic MAC learning
 575           to discover remote MAC addresses.</para>
 576         </listitem>
 577       </varlistentry>
 578       <varlistentry>
 579         <term><varname>FDBAgeingSec=</varname></term>
 580         <listitem>
 581           <para>The lifetime of Forwarding Database entry learnt by
 582           the kernel, in seconds.</para>
 583         </listitem>
 584       </varlistentry>
 585       <varlistentry>
 586         <term><varname>MaximumFDBEntries=</varname></term>
 587         <listitem>
 588           <para>Configures maximum number of FDB entries.</para>
 589         </listitem>
 590       </varlistentry>
 591       <varlistentry>
 592         <term><varname>ReduceARPProxy=</varname></term>
 593         <listitem>
 594           <para>A boolean. When true, bridge-connected VXLAN tunnel
 595           endpoint answers ARP requests from the local bridge on behalf
 596           of remote Distributed Overlay Virtual Ethernet
 597           <ulink url="https://en.wikipedia.org/wiki/Distributed_Overlay_Virtual_Ethernet">
 598           (DVOE)</ulink> clients. Defaults to false.</para>
 599         </listitem>
 600       </varlistentry>
 601       <varlistentry>
 602         <term><varname>L2MissNotification=</varname></term>
 603         <listitem>
 604           <para>A boolean. When true, enables netlink LLADDR miss
 605           notifications.</para>
 606         </listitem>
 607       </varlistentry>
 608       <varlistentry>
 609         <term><varname>L3MissNotification=</varname></term>
 610         <listitem>
 611           <para>A boolean. When true, enables netlink IP address miss
 612           notifications.</para>
 613         </listitem>
 614       </varlistentry>
 615       <varlistentry>
 616         <term><varname>RouteShortCircuit=</varname></term>
 617         <listitem>
 618           <para>A boolean. When true, route short circuiting is turned
 619           on.</para>
 620         </listitem>
 621       </varlistentry>
 622       <varlistentry>
 623         <term><varname>UDPChecksum=</varname></term>
 624         <listitem>
 625           <para>A boolean. When true, transmitting UDP checksums when doing VXLAN/IPv4 is turned on.</para>
 626         </listitem>
 627       </varlistentry>
 628       <varlistentry>
 629         <term><varname>UDP6ZeroChecksumTx=</varname></term>
 630         <listitem>
 631           <para>A boolean. When true, sending zero checksums in VXLAN/IPv6 is turned on.</para>
 632         </listitem>
 633       </varlistentry>
 634       <varlistentry>
 635         <term><varname>UDP6ZeroChecksumRx=</varname></term>
 636         <listitem>
 637           <para>A boolean. When true, receiving zero checksums in VXLAN/IPv6 is turned on.</para>
 638         </listitem>
 639       </varlistentry>
 640       <varlistentry>
 641         <term><varname>RemoteChecksumTx=</varname></term>
 642         <listitem>
 643           <para>A boolean. When true, remote transmit checksum offload of VXLAN is turned on.</para>
 644         </listitem>
 645       </varlistentry>
 646       <varlistentry>
 647         <term><varname>RemoteChecksumRx=</varname></term>
 648         <listitem>
 649           <para>A boolean. When true, remote receive checksum offload in VXLAN is turned on.</para>
 650         </listitem>
 651       </varlistentry>
 652     <varlistentry>
 653       <term><varname>GroupPolicyExtension=</varname></term>
 654       <listitem>
 655         <para>A boolean. When true, it enables Group Policy VXLAN extension security label mechanism
 656         across network peers based on VXLAN. For details about the Group Policy VXLAN, see the
 657         <ulink url="https://tools.ietf.org/html/draft-smith-vxlan-group-policy">
 658         VXLAN Group Policy </ulink> document. Defaults to false.</para>
 659       </listitem>
 660     </varlistentry>
 661     <varlistentry>
 662       <term><varname>DestinationPort=</varname></term>
 663       <listitem>
 664         <para>Configures the default destination UDP port on a per-device basis.
 665         If destination port is not specified then Linux kernel default will be used.
 666         Set destination port 4789 to get the IANA assigned value. If not set or if the
 667         destination port is assigned the empty string the default port of 4789 is used.</para>
 668       </listitem>
 669     </varlistentry>
 670     <varlistentry>
 671       <term><varname>PortRange=</varname></term>
 672         <listitem>
 673           <para>Configures VXLAN port range. VXLAN bases source
 674           UDP port based on flow to help the receiver to be able
 675           to load balance based on outer header flow. It
 676           restricts the port range to the normal UDP local
 677           ports, and allows overriding via configuration.</para>
 678         </listitem>
 679       </varlistentry>
 680     <varlistentry>
 681       <term><varname>FlowLabel=</varname></term>
 682         <listitem>
 683           <para>Specifies the flow label to use in outgoing packets.
 684           The valid range is 0-1048575.
 685           </para>
 686         </listitem>
 687       </varlistentry>
 688     </variablelist>
 689   </refsect1>
 690   <refsect1>
 691     <title>[GENEVE] Section Options</title>
 692     <para>The <literal>[GENEVE]</literal> section only applies for
 693     netdevs of kind <literal>geneve</literal>, and accepts the
 694     following keys:</para>
 695
 696     <variablelist class='network-directives'>
 697       <varlistentry>
 698         <term><varname>Id=</varname></term>
 699         <listitem>
 700           <para>Specifies the Virtual Network Identifier (VNI) to use. Ranges [0-16777215].</para>
 701         </listitem>
 702       </varlistentry>
 703       <varlistentry>
 704         <term><varname>Remote=</varname></term>
 705         <listitem>
 706           <para>Specifies the unicast destination IP address to use in outgoing packets.</para>
 707         </listitem>
 708       </varlistentry>
 709       <varlistentry>
 710         <term><varname>TOS=</varname></term>
 711         <listitem>
 712           <para>Specifies the TOS value to use in outgoing packets. Ranges [1-255].</para>
 713         </listitem>
 714       </varlistentry>
 715       <varlistentry>
 716         <term><varname>TTL=</varname></term>
 717         <listitem>
 718           <para>Specifies the TTL value to use in outgoing packets. Ranges [1-255].</para>
 719         </listitem>
 720       </varlistentry>
 721       <varlistentry>
 722         <term><varname>UDPChecksum=</varname></term>
 723         <listitem>
 724           <para>A boolean. When true, specifies if UDP checksum is calculated for transmitted packets over IPv4.</para>
 725         </listitem>
 726       </varlistentry>
 727       <varlistentry>
 728         <term><varname>UDP6ZeroChecksumTx=</varname></term>
 729         <listitem>
 730           <para>A boolean. When true, skip UDP checksum calculation for transmitted packets over IPv6.</para>
 731         </listitem>
 732       </varlistentry>
 733       <varlistentry>
 734         <term><varname>UDP6ZeroChecksumRx=</varname></term>
 735         <listitem>
 736           <para>A boolean. When true, allows incoming UDP packets over IPv6 with zero checksum field.</para>
 737         </listitem>
 738       </varlistentry>
 739     <varlistentry>
 740       <term><varname>DestinationPort=</varname></term>
 741       <listitem>
 742         <para>Specifies destination port. Defaults to 6081. If not set or assigned the empty string, the default
 743         port of 6081 is used.</para>
 744       </listitem>
 745     </varlistentry>
 746     <varlistentry>
 747       <term><varname>FlowLabel=</varname></term>
 748         <listitem>
 749           <para>Specifies the flow label to use in outgoing packets.</para>
 750         </listitem>
 751       </varlistentry>
 752     </variablelist>
 753   </refsect1>
 754   <refsect1>
 755     <title>[Tunnel] Section Options</title>
 756
 757     <para>The <literal>[Tunnel]</literal> section only applies for
 758     netdevs of kind
 759     <literal>ipip</literal>,
 760     <literal>sit</literal>,
 761     <literal>gre</literal>,
 762     <literal>gretap</literal>,
 763     <literal>ip6gre</literal>,
 764     <literal>ip6gretap</literal>,
 765     <literal>vti</literal>,
 766     <literal>vti6</literal>, and
 767     <literal>ip6tnl</literal> and accepts
 768     the following keys:</para>
 769
 770     <variablelist class='network-directives'>
 771       <varlistentry>
 772         <term><varname>Local=</varname></term>
 773         <listitem>
 774           <para>A static local address for tunneled packets. It must
 775           be an address on another interface of this host.</para>
 776         </listitem>
 777       </varlistentry>
 778       <varlistentry>
 779         <term><varname>Remote=</varname></term>
 780         <listitem>
 781           <para>The remote endpoint of the tunnel.</para>
 782         </listitem>
 783       </varlistentry>
 784       <varlistentry>
 785         <term><varname>TOS=</varname></term>
 786         <listitem>
 787           <para>The Type Of Service byte value for a tunnel interface.
 788           For details about the TOS, see the
 789           <ulink url="http://tools.ietf.org/html/rfc1349"> Type of
 790           Service in the Internet Protocol Suite </ulink> document.
 791           </para>
 792         </listitem>
 793       </varlistentry>
 794       <varlistentry>
 795         <term><varname>TTL=</varname></term>
 796         <listitem>
 797           <para>A fixed Time To Live N on tunneled packets. N is a
 798           number in the range 1–255. 0 is a special value meaning that
 799           packets inherit the TTL value. The default value for IPv4
 800           tunnels is: inherit. The default value for IPv6 tunnels is
 801           64.</para>
 802         </listitem>
 803       </varlistentry>
 804       <varlistentry>
 805         <term><varname>DiscoverPathMTU=</varname></term>
 806         <listitem>
 807           <para>A boolean. When true, enables Path MTU Discovery on
 808           the tunnel.</para>
 809         </listitem>
 810       </varlistentry>
 811       <varlistentry>
 812         <term><varname>IPv6FlowLabel=</varname></term>
 813         <listitem>
 814           <para>Configures the 20-bit flow label (see <ulink url="https://tools.ietf.org/html/rfc6437">
 815           RFC 6437</ulink>) field in the IPv6 header (see <ulink url="https://tools.ietf.org/html/rfc2460">
 816           RFC 2460</ulink>), which is used by a node to label packets of a flow.
 817           It is only used for IPv6 tunnels.
 818           A flow label of zero is used to indicate packets that have
 819           not been labeled.
 820           It can be configured to a value in the range 0–0xFFFFF, or be
 821           set to <literal>inherit</literal>, in which case the original flowlabel is used.</para>
 822         </listitem>
 823       </varlistentry>
 824       <varlistentry>
 825         <term><varname>CopyDSCP=</varname></term>
 826         <listitem>
 827           <para>A boolean. When true, the Differentiated Service Code
 828           Point (DSCP) field will be copied to the inner header from
 829           outer header during the decapsulation of an IPv6 tunnel
 830           packet. DSCP is a field in an IP packet that enables different
 831           levels of service to be assigned to network traffic.
 832           Defaults to <literal>no</literal>.
 833           </para>
 834         </listitem>
 835       </varlistentry>
 836       <varlistentry>
 837         <term><varname>EncapsulationLimit=</varname></term>
 838         <listitem>
 839           <para>The Tunnel Encapsulation Limit option specifies how many additional
 840           levels of encapsulation are permitted to be prepended to the packet.
 841           For example, a Tunnel Encapsulation Limit option containing a limit
 842           value of zero means that a packet carrying that option may not enter
 843           another tunnel before exiting the current tunnel.
 844           (see <ulink url="https://tools.ietf.org/html/rfc2473#section-4.1.1"> RFC 2473</ulink>).
 845           The valid range is 0–255 and <literal>none</literal>. Defaults to 4.
 846         </para>
 847         </listitem>
 848       </varlistentry>
 849       <varlistentry>
 850         <term><varname>Key=</varname></term>
 851         <listitem>
 852           <para>The <varname>Key=</varname> parameter specifies the same key to use in
 853           both directions (<varname>InputKey=</varname> and <varname>OutputKey=</varname>).
 854           The <varname>Key=</varname> is either a number or an IPv4 address-like dotted quad.
 855           It is used as mark-configured SAD/SPD entry as part of the lookup key (both in data
 856           and control path) in ip xfrm (framework used to implement IPsec protocol).
 857           See <ulink url="http://man7.org/linux/man-pages/man8/ip-xfrm.8.html">
 858           ip-xfrm — transform configuration</ulink> for details. It is only used for VTI/VTI6
 859           tunnels.</para>
 860         </listitem>
 861       </varlistentry>
 862       <varlistentry>
 863         <term><varname>InputKey=</varname></term>
 864         <listitem>
 865           <para>The <varname>InputKey=</varname> parameter specifies the key to use for input.
 866           The format is same as <varname>Key=</varname>. It is only used for VTI/VTI6 tunnels.</para>
 867         </listitem>
 868       </varlistentry>
 869       <varlistentry>
 870         <term><varname>OutputKey=</varname></term>
 871         <listitem>
 872           <para>The <varname>OutputKey=</varname> parameter specifies the key to use for output.
 873           The format is same as <varname>Key=</varname>. It is only used for VTI/VTI6 tunnels.</para>
 874         </listitem>
 875       </varlistentry>
 876       <varlistentry>
 877         <term><varname>Mode=</varname></term>
 878         <listitem>
 879           <para>An <literal>ip6tnl</literal> tunnel can be in one of three
 880           modes
 881           <literal>ip6ip6</literal> for IPv6 over IPv6,
 882           <literal>ipip6</literal> for IPv4 over IPv6 or
 883           <literal>any</literal> for either.
 884           </para>
 885         </listitem>
 886       </varlistentry>
 887       <varlistentry>
 888         <term><varname>Independent=</varname></term>
 889         <listitem>
 890           <para>A boolean. When true tunnel does not require .network file. Created as "tunnel@NONE".
 891           Defaults to <literal>false</literal>.
 892           </para>
 893         </listitem>
 894       </varlistentry>
 895       <varlistentry>
 896         <term><varname>AllowLocalRemote=</varname></term>
 897         <listitem>
 898           <para>A boolean. When true allows tunnel traffic on <varname>ip6tnl</varname> devices where the remote endpoint is a local host address.
 899           Defaults to unset.
 900           </para>
 901         </listitem>
 902       </varlistentry>
 903     </variablelist>
 904   </refsect1>
 905   <refsect1>
 906     <title>[Peer] Section Options</title>
 907
 908       <para>The <literal>[Peer]</literal> section only applies for
 909       netdevs of kind <literal>veth</literal> and accepts the
 910       following keys:</para>
 911
 912       <variablelist class='network-directives'>
 913         <varlistentry>
 914           <term><varname>Name=</varname></term>
 915           <listitem>
 916             <para>The interface name used when creating the netdev.
 917             This option is compulsory.</para>
 918           </listitem>
 919         </varlistentry>
 920         <varlistentry>
 921           <term><varname>MACAddress=</varname></term>
 922           <listitem>
 923             <para>The peer MACAddress, if not set, it is generated in
 924             the same way as the MAC address of the main
 925             interface.</para>
 926           </listitem>
 927         </varlistentry>
 928       </variablelist>
 929   </refsect1>
 930   <refsect1>
 931   <title>[VXCAN] Section Options</title>
 932       <para>The <literal>[VXCAN]</literal> section only applies for
 933       netdevs of kind <literal>vxcan</literal> and accepts the
 934       following key:</para>
 935
 936       <variablelist class='network-directives'>
 937         <varlistentry>
 938           <term><varname>Peer=</varname></term>
 939           <listitem>
 940             <para>The peer interface name used when creating the netdev.
 941             This option is compulsory.</para>
 942           </listitem>
 943         </varlistentry>
 944       </variablelist>
 945   </refsect1>
 946   <refsect1>
 947     <title>[Tun] Section Options</title>
 948
 949     <para>The <literal>[Tun]</literal> section only applies for
 950     netdevs of kind <literal>tun</literal>, and accepts the following
 951     keys:</para>
 952
 953     <variablelist class='network-directives'>
 954       <varlistentry>
 955         <term><varname>OneQueue=</varname></term>
 956         <listitem><para>Takes a boolean argument. Configures whether
 957         all packets are queued at the device (enabled), or a fixed
 958         number of packets are queued at the device and the rest at the
 959         <literal>qdisc</literal>. Defaults to
 960         <literal>no</literal>.</para>
 961         </listitem>
 962       </varlistentry>
 963       <varlistentry>
 964         <term><varname>MultiQueue=</varname></term>
 965         <listitem><para>Takes a boolean argument. Configures whether
 966         to use multiple file descriptors (queues) to parallelize
 967         packets sending and receiving. Defaults to
 968         <literal>no</literal>.</para>
 969         </listitem>
 970       </varlistentry>
 971       <varlistentry>
 972         <term><varname>PacketInfo=</varname></term>
 973         <listitem><para>Takes a boolean argument. Configures whether
 974         packets should be prepended with four extra bytes (two flag
 975         bytes and two protocol bytes). If disabled, it indicates that
 976         the packets will be pure IP packets. Defaults to
 977         <literal>no</literal>.</para>
 978         </listitem>
 979       </varlistentry>
 980       <varlistentry>
 981         <term><varname>VNetHeader=</varname></term>
 982         <listitem><para>Takes a boolean argument. Configures
 983         IFF_VNET_HDR flag for a tap device. It allows sending
 984         and receiving larger Generic Segmentation Offload (GSO)
 985         packets. This may increase throughput significantly.
 986         Defaults to
 987         <literal>no</literal>.</para>
 988         </listitem>
 989       </varlistentry>
 990       <varlistentry>
 991         <term><varname>User=</varname></term>
 992         <listitem><para>User to grant access to the
 993         <filename>/dev/net/tun</filename> device.</para>
 994         </listitem>
 995       </varlistentry>
 996       <varlistentry>
 997         <term><varname>Group=</varname></term>
 998         <listitem><para>Group to grant access to the
 999         <filename>/dev/net/tun</filename> device.</para>
1000         </listitem>
1001       </varlistentry>
1002
1003     </variablelist>
1004
1005   </refsect1>
1006
1007   <refsect1>
1008     <title>[Tap] Section Options</title>
1009
1010     <para>The <literal>[Tap]</literal> section only applies for
1011     netdevs of kind <literal>tap</literal>, and accepts the same keys
1012     as the <literal>[Tun]</literal> section.</para>
1013   </refsect1>
1014
1015   <refsect1>
1016     <title>[WireGuard] Section Options</title>
1017
1018     <para>The <literal>[WireGuard]</literal> section accepts the following
1019     keys:</para>
1020
1021     <variablelist class='network-directives'>
1022       <varlistentry>
1023         <term><varname>PrivateKey=</varname></term>
1024         <listitem>
1025           <para>The Base64 encoded private key for the interface. It can be
1026             generated using the <command>wg genkey</command> command
1027             (see <citerefentry project="wireguard"><refentrytitle>wg</refentrytitle><manvolnum>8</manvolnum></citerefentry>).
1028             This option is mandatory to use WireGuard.
1029             Note that because this information is secret, you may want to set
1030             the permissions of the .netdev file to be owned by <literal>root:systemd-networkd</literal>
1031             with a <literal>0640</literal> file mode.</para>
1032         </listitem>
1033       </varlistentry>
1034       <varlistentry>
1035         <term><varname>ListenPort=</varname></term>
1036         <listitem>
1037           <para>Sets UDP port for listening. Takes either value between 1 and 65535
1038             or <literal>auto</literal>. If <literal>auto</literal> is specified,
1039             the port is automatically generated based on interface name.
1040             Defaults to <literal>auto</literal>.</para>
1041         </listitem>
1042       </varlistentry>
1043       <varlistentry>
1044         <term><varname>FwMark=</varname></term>
1045         <listitem>
1046           <para>Sets a firewall mark on outgoing WireGuard packets from this interface.</para>
1047         </listitem>
1048       </varlistentry>
1049     </variablelist>
1050   </refsect1>
1051
1052   <refsect1>
1053     <title>[WireGuardPeer] Section Options</title>
1054
1055     <para>The <literal>[WireGuardPeer]</literal> section accepts the following
1056     keys:</para>
1057
1058     <variablelist class='network-directives'>
1059       <varlistentry>
1060         <term><varname>PublicKey=</varname></term>
1061         <listitem>
1062           <para>Sets a Base64 encoded public key calculated by <command>wg pubkey</command>
1063             (see <citerefentry project="wireguard"><refentrytitle>wg</refentrytitle><manvolnum>8</manvolnum></citerefentry>)
1064             from a private key, and usually transmitted out of band to the
1065             author of the configuration file. This option is mandatory for this
1066             section.</para>
1067         </listitem>
1068       </varlistentry>
1069       <varlistentry>
1070         <term><varname>PresharedKey=</varname></term>
1071         <listitem>
1072           <para>Optional preshared key for the interface. It can be generated
1073             by the <command>wg genpsk</command> command. This option adds an
1074             additional layer of symmetric-key cryptography to be mixed into the
1075             already existing public-key cryptography, for post-quantum
1076             resistance.
1077             Note that because this information is secret, you may want to set
1078             the permissions of the .netdev file to be owned by <literal>root:systemd-networkd</literal>
1079             with a <literal>0640</literal> file mode.</para>
1080         </listitem>
1081       </varlistentry>
1082       <varlistentry>
1083         <term><varname>AllowedIPs=</varname></term>
1084         <listitem>
1085           <para>Sets a comma-separated list of IP (v4 or v6) addresses with CIDR masks
1086             from which this peer is allowed to send incoming traffic and to
1087             which outgoing traffic for this peer is directed. The catch-all
1088             0.0.0.0/0 may be specified for matching all IPv4 addresses, and
1089             ::/0 may be specified for matching all IPv6 addresses. </para>
1090         </listitem>
1091       </varlistentry>
1092       <varlistentry>
1093         <term><varname>Endpoint=</varname></term>
1094         <listitem>
1095           <para>Sets an endpoint IP address or hostname, followed by a colon, and then
1096             a port number. This endpoint will be updated automatically once to
1097             the most recent source IP address and port of correctly
1098             authenticated packets from the peer at configuration time.</para>
1099         </listitem>
1100       </varlistentry>
1101       <varlistentry>
1102         <term><varname>PersistentKeepalive=</varname></term>
1103         <listitem>
1104           <para>Sets a seconds interval, between 1 and 65535 inclusive, of how often
1105             to send an authenticated empty packet to the peer for the purpose
1106             of keeping a stateful firewall or NAT mapping valid persistently.
1107             For example, if the interface very rarely sends traffic, but it
1108             might at anytime receive traffic from a peer, and it is behind NAT,
1109             the interface might benefit from having a persistent keepalive
1110             interval of 25 seconds. If set to 0 or "off", this option is
1111             disabled. By default or when unspecified, this option is off.
1112             Most users will not need this.</para>
1113         </listitem>
1114       </varlistentry>
1115     </variablelist>
1116   </refsect1>
1117
1118   <refsect1>
1119     <title>[Bond] Section Options</title>
1120
1121     <para>The <literal>[Bond]</literal> section accepts the following
1122     key:</para>
1123
1124     <variablelist class='network-directives'>
1125       <varlistentry>
1126         <term><varname>Mode=</varname></term>
1127         <listitem>
1128           <para>Specifies one of the bonding policies. The default is
1129           <literal>balance-rr</literal> (round robin). Possible values are
1130           <literal>balance-rr</literal>,
1131           <literal>active-backup</literal>,
1132           <literal>balance-xor</literal>,
1133           <literal>broadcast</literal>,
1134           <literal>802.3ad</literal>,
1135           <literal>balance-tlb</literal>, and
1136           <literal>balance-alb</literal>.
1137           </para>
1138         </listitem>
1139       </varlistentry>
1140
1141       <varlistentry>
1142         <term><varname>TransmitHashPolicy=</varname></term>
1143         <listitem>
1144           <para>Selects the transmit hash policy to use for slave
1145           selection in balance-xor, 802.3ad, and tlb modes. Possible
1146           values are
1147           <literal>layer2</literal>,
1148           <literal>layer3+4</literal>,
1149           <literal>layer2+3</literal>,
1150           <literal>encap2+3</literal>, and
1151           <literal>encap3+4</literal>.
1152           </para>
1153         </listitem>
1154       </varlistentry>
1155
1156       <varlistentry>
1157         <term><varname>LACPTransmitRate=</varname></term>
1158         <listitem>
1159           <para>Specifies the rate with which link partner transmits
1160           Link Aggregation Control Protocol Data Unit packets in
1161           802.3ad mode. Possible values are <literal>slow</literal>,
1162           which requests partner to transmit LACPDUs every 30 seconds,
1163           and <literal>fast</literal>, which requests partner to
1164           transmit LACPDUs every second. The default value is
1165           <literal>slow</literal>.</para>
1166         </listitem>
1167       </varlistentry>
1168
1169       <varlistentry>
1170         <term><varname>MIIMonitorSec=</varname></term>
1171         <listitem>
1172           <para>Specifies the frequency that Media Independent
1173           Interface link monitoring will occur. A value of zero
1174           disables MII link monitoring. This value is rounded down to
1175           the nearest millisecond. The default value is 0.</para>
1176         </listitem>
1177       </varlistentry>
1178
1179       <varlistentry>
1180         <term><varname>UpDelaySec=</varname></term>
1181         <listitem>
1182           <para>Specifies the delay before a link is enabled after a
1183           link up status has been detected. This value is rounded down
1184           to a multiple of MIIMonitorSec. The default value is
1185           0.</para>
1186         </listitem>
1187       </varlistentry>
1188
1189       <varlistentry>
1190         <term><varname>DownDelaySec=</varname></term>
1191         <listitem>
1192           <para>Specifies the delay before a link is disabled after a
1193           link down status has been detected. This value is rounded
1194           down to a multiple of MIIMonitorSec. The default value is
1195           0.</para>
1196         </listitem>
1197       </varlistentry>
1198
1199       <varlistentry>
1200         <term><varname>LearnPacketIntervalSec=</varname></term>
1201         <listitem>
1202           <para>Specifies the number of seconds between instances where the bonding
1203           driver sends learning packets to each slave peer switch.
1204           The valid range is 1–0x7fffffff; the default value is 1. This option
1205           has an effect only for the balance-tlb and balance-alb modes.</para>
1206         </listitem>
1207       </varlistentry>
1208
1209       <varlistentry>
1210         <term><varname>AdSelect=</varname></term>
1211         <listitem>
1212           <para>Specifies the 802.3ad aggregation selection logic to use. Possible values are
1213           <literal>stable</literal>,
1214           <literal>bandwidth</literal> and
1215           <literal>count</literal>.
1216           </para>
1217         </listitem>
1218       </varlistentry>
1219
1220       <varlistentry>
1221         <term><varname>FailOverMACPolicy=</varname></term>
1222         <listitem>
1223           <para>Specifies whether the active-backup mode should set all slaves to
1224           the same MAC address at the time of enslavement or, when enabled, to perform special handling of the
1225           bond's MAC address in accordance with the selected policy. The default policy is none.
1226           Possible values are
1227           <literal>none</literal>,
1228           <literal>active</literal> and
1229           <literal>follow</literal>.
1230           </para>
1231         </listitem>
1232       </varlistentry>
1233
1234       <varlistentry>
1235         <term><varname>ARPValidate=</varname></term>
1236         <listitem>
1237           <para>Specifies whether or not ARP probes and replies should be
1238           validated in any mode that supports ARP monitoring, or whether
1239           non-ARP traffic should be filtered (disregarded) for link
1240           monitoring purposes. Possible values are
1241           <literal>none</literal>,
1242           <literal>active</literal>,
1243           <literal>backup</literal> and
1244           <literal>all</literal>.
1245           </para>
1246         </listitem>
1247       </varlistentry>
1248
1249       <varlistentry>
1250         <term><varname>ARPIntervalSec=</varname></term>
1251         <listitem>
1252           <para>Specifies the ARP link monitoring frequency in milliseconds.
1253           A value of 0 disables ARP monitoring. The default value is 0.
1254           </para>
1255         </listitem>
1256       </varlistentry>
1257
1258       <varlistentry>
1259         <term><varname>ARPIPTargets=</varname></term>
1260         <listitem>
1261           <para>Specifies the IP addresses to use as ARP monitoring peers when
1262           ARPIntervalSec is greater than 0. These are the targets of the ARP request
1263           sent to determine the health of the link to the targets.
1264           Specify these values in IPv4 dotted decimal format. At least one IP
1265           address must be given for ARP monitoring to function. The
1266           maximum number of targets that can be specified is 16. The
1267           default value is no IP addresses.
1268           </para>
1269         </listitem>
1270       </varlistentry>
1271
1272       <varlistentry>
1273         <term><varname>ARPAllTargets=</varname></term>
1274         <listitem>
1275           <para>Specifies the quantity of ARPIPTargets that must be reachable
1276           in order for the ARP monitor to consider a slave as being up.
1277           This option affects only active-backup mode for slaves with
1278           ARPValidate enabled. Possible values are
1279           <literal>any</literal> and
1280           <literal>all</literal>.
1281           </para>
1282         </listitem>
1283       </varlistentry>
1284
1285       <varlistentry>
1286         <term><varname>PrimaryReselectPolicy=</varname></term>
1287         <listitem>
1288           <para>Specifies the reselection policy for the primary slave.  This
1289           affects how the primary slave is chosen to become the active slave
1290           when failure of the active slave or recovery of the primary slave
1291           occurs. This option is designed to prevent flip-flopping between
1292           the primary slave and other slaves.  Possible values are
1293           <literal>always</literal>,
1294           <literal>better</literal> and
1295           <literal>failure</literal>.
1296           </para>
1297         </listitem>
1298       </varlistentry>
1299
1300       <varlistentry>
1301         <term><varname>ResendIGMP=</varname></term>
1302         <listitem>
1303           <para>Specifies the number of IGMP membership reports to be issued after
1304           a failover event. One membership report is issued immediately after
1305           the failover, subsequent packets are sent in each 200ms interval.
1306           The valid range is 0–255. Defaults to 1. A value of 0
1307           prevents the IGMP membership report from being issued in response
1308           to the failover event.
1309           </para>
1310         </listitem>
1311       </varlistentry>
1312
1313       <varlistentry>
1314         <term><varname>PacketsPerSlave=</varname></term>
1315         <listitem>
1316           <para>Specify the number of packets to transmit through a slave before
1317             moving to the next one. When set to 0, then a slave is chosen at
1318             random. The valid range is 0–65535. Defaults to 1. This option
1319             only has effect when in balance-rr mode.
1320           </para>
1321         </listitem>
1322       </varlistentry>
1323
1324       <varlistentry>
1325         <term><varname>GratuitousARP=</varname></term>
1326         <listitem>
1327           <para>Specify the number of peer notifications (gratuitous ARPs and
1328             unsolicited IPv6 Neighbor Advertisements) to be issued after a
1329             failover event.  As soon as the link is up on the new slave,
1330             a peer notification is sent on the  bonding device and each
1331             VLAN sub-device.  This is repeated at each link monitor interval
1332             (ARPIntervalSec or MIIMonitorSec, whichever is active) if the number is
1333             greater than 1. The valid range is 0–255. The default value is 1.
1334             These options affect only the active-backup mode.
1335           </para>
1336         </listitem>
1337       </varlistentry>
1338
1339       <varlistentry>
1340         <term><varname>AllSlavesActive=</varname></term>
1341         <listitem>
1342           <para>A boolean. Specifies that duplicate frames (received on inactive ports)
1343           should be dropped when false, or delivered when true. Normally, bonding will drop
1344           duplicate frames (received on inactive ports), which is desirable for
1345           most users. But there are some times it is nice to allow duplicate
1346           frames to be delivered. The default value is false (drop duplicate frames
1347           received on inactive ports).
1348           </para>
1349         </listitem>
1350       </varlistentry>
1351
1352       <varlistentry>
1353         <term><varname>MinLinks=</varname></term>
1354         <listitem>
1355           <para>Specifies the minimum number of links that must be active before
1356           asserting carrier. The default value is 0.
1357           </para>
1358         </listitem>
1359       </varlistentry>
1360     </variablelist>
1361
1362     <para>For more detail information see
1363     <ulink url="https://www.kernel.org/doc/Documentation/networking/bonding.txt">
1364     Linux Ethernet Bonding Driver HOWTO</ulink></para>
1365
1366   </refsect1>
1367
1368   <refsect1>
1369     <title>Example</title>
1370     <example>
1371       <title>/etc/systemd/network/25-bridge.netdev</title>
1372
1373       <programlisting>[NetDev]
1374 Name=bridge0
1375 Kind=bridge</programlisting>
1376     </example>
1377
1378     <example>
1379       <title>/etc/systemd/network/25-vlan1.netdev</title>
1380
1381       <programlisting>[Match]
1382 Virtualization=no
1383
1384 [NetDev]
1385 Name=vlan1
1386 Kind=vlan
1387
1388 [VLAN]
1389 Id=1</programlisting>
1390     </example>
1391     <example>
1392       <title>/etc/systemd/network/25-ipip.netdev</title>
1393       <programlisting>[NetDev]
1394 Name=ipip-tun
1395 Kind=ipip
1396 MTUBytes=1480
1397
1398 [Tunnel]
1399 Local=192.168.223.238
1400 Remote=192.169.224.239
1401 TTL=64</programlisting>
1402     </example>
1403     <example>
1404       <title>/etc/systemd/network/25-tap.netdev</title>
1405       <programlisting>[NetDev]
1406 Name=tap-test
1407 Kind=tap
1408
1409 [Tap]
1410 MultiQueue=true
1411 PacketInfo=true</programlisting> </example>
1412
1413     <example>
1414       <title>/etc/systemd/network/25-sit.netdev</title>
1415       <programlisting>[NetDev]
1416 Name=sit-tun
1417 Kind=sit
1418 MTUBytes=1480
1419
1420 [Tunnel]
1421 Local=10.65.223.238
1422 Remote=10.65.223.239</programlisting>
1423     </example>
1424
1425     <example>
1426       <title>/etc/systemd/network/25-gre.netdev</title>
1427       <programlisting>[NetDev]
1428 Name=gre-tun
1429 Kind=gre
1430 MTUBytes=1480
1431
1432 [Tunnel]
1433 Local=10.65.223.238
1434 Remote=10.65.223.239</programlisting>
1435     </example>
1436
1437     <example>
1438       <title>/etc/systemd/network/25-vti.netdev</title>
1439
1440       <programlisting>[NetDev]
1441 Name=vti-tun
1442 Kind=vti
1443 MTUBytes=1480
1444
1445 [Tunnel]
1446 Local=10.65.223.238
1447 Remote=10.65.223.239</programlisting>
1448     </example>
1449
1450     <example>
1451       <title>/etc/systemd/network/25-veth.netdev</title>
1452       <programlisting>[NetDev]
1453 Name=veth-test
1454 Kind=veth
1455
1456 [Peer]
1457 Name=veth-peer</programlisting>
1458     </example>
1459
1460     <example>
1461       <title>/etc/systemd/network/25-bond.netdev</title>
1462       <programlisting>[NetDev]
1463 Name=bond1
1464 Kind=bond
1465
1466 [Bond]
1467 Mode=802.3ad
1468 TransmitHashPolicy=layer3+4
1469 MIIMonitorSec=1s
1470 LACPTransmitRate=fast
1471 </programlisting>
1472     </example>
1473
1474     <example>
1475       <title>/etc/systemd/network/25-dummy.netdev</title>
1476       <programlisting>[NetDev]
1477 Name=dummy-test
1478 Kind=dummy
1479 MACAddress=12:34:56:78:9a:bc</programlisting>
1480     </example>
1481     <example>
1482       <title>/etc/systemd/network/25-vrf.netdev</title>
1483       <para>Create a VRF interface with table 42.</para>
1484       <programlisting>[NetDev]
1485 Name=vrf-test
1486 Kind=vrf
1487
1488 [VRF]
1489 Table=42</programlisting>
1490     </example>
1491
1492     <example>
1493       <title>/etc/systemd/network/25-macvtap.netdev</title>
1494       <para>Create a MacVTap device.</para>
1495       <programlisting>[NetDev]
1496 Name=macvtap-test
1497 Kind=macvtap
1498       </programlisting>
1499     </example>
1500     <example>
1501       <title>/etc/systemd/network/25-wireguard.netdev</title>
1502       <programlisting>[NetDev]
1503 Name=wg0
1504 Kind=wireguard
1505
1506 [WireGuard]
1507 PrivateKey=EEGlnEPYJV//kbvvIqxKkQwOiS+UENyPncC4bF46ong=
1508 ListenPort=51820
1509
1510 [WireGuardPeer]
1511 PublicKey=RDf+LSpeEre7YEIKaxg+wbpsNV7du+ktR99uBEtIiCA=
1512 AllowedIPs=fd31:bf08:57cb::/48,192.168.26.0/24
1513 Endpoint=wireguard.example.com:51820</programlisting>
1514     </example>
1515   </refsect1>
1516   <refsect1>
1517     <title>See Also</title>
1518     <para>
1519       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
1520       <citerefentry><refentrytitle>systemd-networkd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
1521       <citerefentry><refentrytitle>systemd.link</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
1522       <citerefentry><refentrytitle>systemd.network</refentrytitle><manvolnum>5</manvolnum></citerefentry>
1523     </para>
1524   </refsect1>
1525
1526 </refentry>