VyOS Configuration Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

Where VyOS sits

VyOS is a set, commit, and save router. set system host-name edge-01 is the hostname. commit applies the candidate. save writes it so a reboot keeps it. Commit without save is a lab that dies on reboot, which is a useful lesson once and an outage if you thought you had finished. Interfaces are eth names. A VLAN interface is a vif. Firewall rules are named and default to drop when you build them that way. Keep that default.

VyOS is not EdgeOS and not Junos, even though set and commit appear in all three. The hierarchy differs. Show the candidate before you commit. The generators for VyOS on this site follow that shape. Review them.

Use a lab or the first closet, not the core, for the first week you touch VyOS. The change window still needs a ticket, a test host, and the rollback above. Automation comes after you can do the boring change by hand and get back. The automation guide is that sequence. This page is the dialect.

Management belongs on a prefix you named, over SSH or the platform's equivalent, from a jump host. The hardening guide is the standard. This page does not open Telnet, does not permit the world, and does not put a password in the clear for you to copy. If a generator shows a placeholder password, replace it before the device is reachable.

A lab change, one step at a time

Step 1 on VyOS is about the hostname. The lab text is: hostname edge-01 VyOS is a set, commit, and save router. set system host-name edge-01 is the hostname. commit applies the candidate. save writes it so a reboot keeps it. Commit without save is a lab that dies on reboot, which is a useful lesson once and an outage if you thought you had finished. Interfaces are eth names. A VLAN interface is a vif. Firewall rules are named and default to drop when you build them that way. Keep that default. This is a starter for a switching platform with its own save and interface names. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: The prompted hostname matches the ticket.. If the check fails, stop. The way back is: the previous configuration you stored off-box, or the platform's rollback if you practised it. Do not type the next step on top of a failed one. VyOS only keeps a change the way its own save model describes: the platform save you practised, not a command borrowed from a neighbour. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into VyOS.

Step 2 on VyOS is about management. The lab text is: A management address in 192.0.2.10/24 on the platform's management interface, not on a user VLAN. Keep management off the user broadcast domain. This is a starter for a switching platform with its own save and interface names. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: Ping the management gateway from a jump host, not from a user port.. If the check fails, stop. The way back is: the previous configuration you stored off-box, or the platform's rollback if you practised it. Do not type the next step on top of a failed one. VyOS only keeps a change the way its own save model describes: the platform save you practised, not a command borrowed from a neighbour. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into VyOS.

Step 3 on VyOS is about SSH only. The lab text is: Enable SSH and do not enable Telnet. VyOS is not EdgeOS and not Junos, even though set and commit appear in all three. The hierarchy differs. Show the candidate before you commit. The generators for VyOS on this site follow that shape. Review them. This is a starter for a switching platform with its own save and interface names. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: Telnet is refused.. If the check fails, stop. The way back is: the previous configuration you stored off-box, or the platform's rollback if you practised it. Do not type the next step on top of a failed one. VyOS only keeps a change the way its own save model describes: the platform save you practised, not a command borrowed from a neighbour. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into VyOS.

Step 4 on VyOS is about one VLAN. The lab text is: Create VLAN 20 named Users before you assign it. The VLAN id is not an IP address. This is a starter for a switching platform with its own save and interface names. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: The VLAN exists in the table.. If the check fails, stop. The way back is: the previous configuration you stored off-box, or the platform's rollback if you practised it. Do not type the next step on top of a failed one. VyOS only keeps a change the way its own save model describes: the platform save you practised, not a command borrowed from a neighbour. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into VyOS.

Step 5 on VyOS is about one access port. The lab text is: Put eth1 in VLAN 20 as an access port, with edge or portfast only if it faces a host. The uplink is not an access port and does not get portfast. This is a starter for a switching platform with its own save and interface names. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: A test host lands in VLAN 20.. If the check fails, stop. The way back is: the previous configuration you stored off-box, or the platform's rollback if you practised it. Do not type the next step on top of a failed one. VyOS only keeps a change the way its own save model describes: the platform save you practised, not a command borrowed from a neighbour. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into VyOS.

Step 6 on VyOS is about one route. The lab text is: A static route for 203.0.113.0/24 via 192.0.2.1 is a lab route. Remove it before production. Documentation prefixes must not be advertised. This is a starter for a switching platform with its own save and interface names. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: The route is present in the lab and absent in production.. If the check fails, stop. The way back is: the previous configuration you stored off-box, or the platform's rollback if you practised it. Do not type the next step on top of a failed one. VyOS only keeps a change the way its own save model describes: the platform save you practised, not a command borrowed from a neighbour. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into VyOS.

Step 7 on VyOS is about the save. The lab text is: Use this platform's save, written on the card. A Cisco write memory typed into the wrong CLI is not a save. This is a starter for a switching platform with its own save and interface names. It uses documentation addresses where an address appears, and it uses the token prompt-for-this wherever a secret would go. Replace that token. Do not save a secret from a guide. After the step, check: After a lab reload the hostname remains.. If the check fails, stop. The way back is: the previous configuration you stored off-box, or the platform's rollback if you practised it. Do not type the next step on top of a failed one. VyOS only keeps a change the way its own save model describes: the platform save you practised, not a command borrowed from a neighbour. A neighbouring vendor's save command is not this one. The generators linked from this page draft the same kind of starter in the browser. They do not log in. Read their banner, then read this step, then decide. A line that looks familiar from Cisco IOS is not a reason to paste it into VyOS.

# VyOS lab shape. Review every line. Replace secrets.
# Interface example: eth1
# VLAN 20 Users, management 192.0.2.10/24, lab route 203.0.113.0/24 via 192.0.2.1
# Remove the lab route before production.

After the lab is boring

When the lab hostname, the management address, one user VLAN, and one route or one policy all behave, write the rollback and the save command on a card next to the console. The on-call will not reread this pillar at 2 a.m. They will read the card. If the card disagrees with this page, fix the card after you confirm which one matches the software version you run. Versions drift. A command that worked on the previous train may be refused or may mean something narrower.

Back up the configuration once you have saved it the platform's way. Keep that backup off the device. A device you can rebuild from a backup is a device you can harden without fear. A device whose only configuration is the running memory is a device people are afraid to secure, so they leave extra services on. The hardening pass comes after the backup exists, not before.

Compare the generator's draft to this lab before you point the generator at a real site. The draft should be smaller than your wish list. A VLAN, a management restriction, and a route are enough for a first production use. A draft that also turns on every feature the form offered is a draft to trim. The diff is the change. The vendor guide is not a reason to apply every example in one window.

Document the software version, the save command, and the out-of-band path in the same inventory line as the hostname. Migrations fail when that line is missing. The migration guide assumes you can still reach the box when the new path is wrong. VyOS does not suspend that rule.

VyOS checks before the first production save

Confirm this before you call the change done: The lab is not the production core. prompt-for-this was replaced and the secret is not in the ticket. Management is limited to a named prefix. The save command on the card matches VyOS, not a different vendor. A backup exists off the device before you harden it. The test host is in the VLAN you built, and a host outside it was not accidentally included. The rollback was used once in the lab. The generator draft was trimmed to the ticket. No route or policy permits the world as a convenience. Documentation prefixes are gone before production cutover. The software version is written next to the hostname. Out-of-band access was tested. A second person read the allowed VLAN or the policy aloud. And telnet and any wide web management stay off. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.