NAME

  nwamcfg - create and modify network configuration profiles


SYNOPSIS

nwamcfg                            (interactive mode)
nwamcfg <subcommand> [options...]
nwamcfg [-d] -f <command-file>
nwamcfg help


DESCRIPTION

The nwamcfg utility manipulates system network configuration profiles.
nwamcfg can be invoked interactively, with an individual subcommand,
or by specifying a command file that contains a series of subcommands.

nwamcfg commands are performed within a scope.  There are three scopes:
global, profile, and NCP.  When nwamcfg is invoked without any arguments, the
editing session begins in the global scope.  In the global scope, NCPs and
location and enm profiles are available to operate on.  Selecting an NCP will
move the editing session to the NCP scope; from there, individual NCUs may be
created or selected to move into the profile scope.  Also at the global scope,
selecting or creating a Location or ENM will move the editing session to the
profile scope.

Within a given profile scope, profile properties may be viewed and modified.

In interactive mode, changes are not stored to persistent storage until
commit is invoked. Commit is implicitly invoked at "end" or "exit", or
may be explicitly invoked by the user.  When commit is invoked, the
entire profile is committed.  In order to maintain the
consistency of persistent storage, the commit operation includes
a verify step; if verification fails, the commit will also fail.  If
an implicit commit fails, the user will be given the option of ending/
exiting without committing the current changes, or remaining in the
current scope to make further changes.

See nwam(5) for an overview of profiles, and their usage in the nwam
framework.


Properties
NCU Properties
Properties common to all NCUs

type: enumerated value: link | ip
  Specifies the NCU type, either link or ip.  This property value
  is set when the NCU is created and may not be changed thereafter.
  
class: enumerated value: phys | iptun for link NCUs; ip for ip NCUs
  Specifies the NCU class, which depends on the type.  This property
  value is set when the NCU is created and may not be changed thereafter.
  
parent: string: name of parent NCP
  Specifies the NCP of which this NCU is a component.  The value is set
  when the NCU is created and may not be changed thereafter.
  
activation: enumerated value: always | never | manual | prioritized |
conditional
  The type of trigger for automatic activation of this NCU.
  The default value is "always."
  
priority-group: uint64: group priority number
  If activation is set to "prioritized," this property specifies the
  priority group to which this NCU belongs.  A group consists of one or
  more NCUs; smaller numbers are higher priority.  The highest priority
  group that is determined to be available will be activated by nwamd, and
  will remain so until it is no longer available, or a higher priority group
  becomes available.
  
priority-mode: enumerated value: exclusive | shared | all
  If activation is set to "prioritized," this property specifies the mode
  used to determine availability and activation behavior for a priority group.
    
    exclusive: at least one NCU must be available to make the group
	  available; and only one NCU will be activated.  If more than one
	  member NCU is available, nwamd will randomly choose one to activate.
	  
    shared: at least one NCU must be available to make the group
	  available; all available NCUs will be activated.

    all: all group member NCUs must be available to make the group
	  available; all member NCUs will be activated.
    
  
condition: string: NCU identifier
  If activation is set to "conditional," this property specifies the NCU
  or NCUs upon which this NCU depends.  An NCU is specified by the syntax
  <ncu_type>:<ncu_name>, i.e. "ip:net0" specifies the ip NCU named
  net0, while "link:net0" specifies the link NCU named net0.  An ip NCU will
  typically have the same name as the link upon which it is plumbed.
  
over: string: NCU identifier
  Identifies the NCU over which this NCU is arranged.  For example, an
  ip NCU will typically be over a link NCU, in which case the ip NCU's over
  property would be set to the link NCU's identifier string; for a phys link
  NCU, which corresponds to a physical device, this property will be empty.
  NCUs are specified by the "<ncu_type>:<ncu_name>" syntax
  described in the condition property section above.
  
under: string: NCU identifier
  Identifies the NCU under which this NCU is arranged.  For example, a
  link NCU may be under an ip NCU, in which case the link NCU's under property
  would be set to the ip NCU's identifier string; for an ip NCU, this property
  will be empty.  NCUs are specified by the "<ncu_type>:<ncu_name>"
  syntax described in the condition property section above.
  


Properties of IP NCUs

ip-version: list of enumerated values: ipv4 | ipv6 | all
  The version(s) of IP that should be used on this NCU.
  The default value is "all".
  
ipv4-addrsrc: list of enumerated values: dhcp | static
  Identifies the source of IPv4 addresses assigned to this NCU; multiple
  values may be assigned.  If one of the values assigned is "static," the
  ipv4-addr property must include at least one IPv4 address to be assigned to
  the NCU.
  The default value is "dhcp".
  
ipv4-addr: list of IPv4 address(es)
  One or more IPv4 addresses to be assigned to this NCU.
  
ipv6-addrsrc: list of enumerated values: dhcpv6 | autoconf | static
  Identifies the source of IPv6 addresses assigned to this NCU; multiple
  values may be assigned.  If one of the values assigned is "static," the
  ipv6-addr property must include at least one IPv6 address to be assigned to
  the NCU.
  The default value is "dhcpv6,autoconf".
  
ipv6-addr: list of IPv6 address(es)
  One or more IPv6 addresses to be assigned to this NCU.
  


Properties common to all LINK NCUs

link-mac-addr: string: 48-bit mac address
  The mac address assigned to this link.  By default, NWAM will request
  the factory-assigned or default mac address for the link; set a different
  value here to override that selection.
  
link-autopush: list of strings: modules to be pushed over the link
  Identifies a list of modules that should be automatically pushed over
  the link when it is opened.
  
link-mtu: uint64: the MTU size for this link
  This property will be automatically set to the default MTU for the
  physical link; that value may be overridden by setting this property to a
  different value.
  


Properties of IPTUN LINK NCUs

iptun-type: enumerated value: ipv4 | ipv6 | 6to4
  Identifies the tunnel type.
  
iptun-tsrc: string: IPv4 or IPv6 address<br>
iptun-tdst: string: IPv4 or IPv6 address
  The source and destination tunnel/outer address for this tunnel.
  Appropriate IP version depends on the tunnel type (IPv4 for ipv4 or 6to4
  tunnel; IPv6 for IPv6 tunnel).
  
iptun-encr: string: encryption algorithm
  The encryption algorithm to be used for IPsec ESP on this tunnel.
  The string value may be either a number (defined in /etc/inet/ipsecalgs)
  or an algorithm name; if the value is "none," tunnel security will be
  disabled.  ESP with no encryption may be specified by leaving this property
  empty and specifying an encryption authentication algorithm (by setting
  the iptun-encr-auth property).
  
iptun-encr-auth: string: authentication algorithm
  The authentication algorithm to be used for IPsec ESP on this tunnel.
  The string value may be either a number (defined in /etc/inet/ipsecalgs) or
  an algorithm name, including "any" or "none" to specify any algorithm or no
  authentication, respectively.  If an ESP encryption algorithm is specified
  (by setting the iptun-encr property) but ESP authentication is not, the
  default value will be "any."
  
iptun-auth: string: authentication algorithm
  The authentication algorithm to be used for IPsec AH on this tunnel.
  The string value may be either a number (defined in /etc/inet/ipsecalgs) or
  an algorithm name, including "any" to express no preference in algorithm.
  


Location Properties

activation: enumerated value: never | manual | conditional
  The type of trigger for automatic activation of this Location.
  The default value is "manual".
  
condition: string: conditional expression
  If activation is set to "conditional," this property specifies the 
  test to determine whether or not this Location should be activated.  The
  conditional expression is made up of a sequence of conditions that can be
  assigned a boolean value, such as "domain:sun.com is assigned" or
  "ip:bge0 is not up."  The attributes that may be tested include NCUs
  (is/is not up), WLANs (identified by an ESSID, is/is not connected), IP
  address or range (is/is not available), and domain (is/is not assigned).
  Conditions are joined by "and" or "or" operators.
  
nameservice-discover: boolean: true | false
  Specifies the way in which NWAM should gather Name Service
  configuration information.  If true, NWAM will use dhcpinfo to find this
  information, and all other name service related properties will be ignored.
  If false, the other name service properties should specify the desired
  name service configuration for this location.
  The default value is "true".
  
nameservices: enum value list: files | dns | nis | nisplus | ldap
  Specifies the name services that should be configured, such as DNS,
  NIS, and/or LDAP.
  
nameservices-config-file: string: path to nsswitch.conf file
  Specifies the nsswitch.conf file to be used.  If the nameservices
  property specifies a single name service, /etc/nsswitch.<nameservice> will
  be used by default; this property may be used to override that default.  If
  the nameservices property identifies more than one name service, this
  property must specify an nsswitch.conf file.
  
dns-nameservice-servers: string list: name server address(es)<br>
dns-nameservice-domain: string: domain name<br>
dns-nameservice-search: string: domain search string<br>
  If DNS is one of the configured name services, these properties
  specify the appropriate configuration parameters.  Only the servers property
  is required; domain and search are optional.
  
nis-nameservice-servers: string list: name server address(es)<br>
nis-nameservice-domain: string: domain name
  If NIS is one of the configured name services, these properties
  specify the appropriate configuration parameters.  The domain property is
  required; if the server property is not specified, the NIS client will be
  started in broadcast mode.
  
nisplus-nameservice-servers: string list: name server address(es)<br>
nisplus-nameservice-domain: string: domain name
  If NIS+ is one of the configured name services, these properties
  specify the appropriate configuration parameters.
  
ldap-nameservice-servers: string list: name server address(es)<br>
ldap-nameservice-domain: string: domain name
  If LDAP is one of the configured name services, these properties
  specify the appropriate configuration parameters.  The server property is
  required, and it is expected that the specified server will have a client
  profile which will be used to complete client configuration.  The domain
  may be optionally specified as well.
  
hosts-file: string: path to hosts/ipnodes database file
  Specifies the path to the file that should be used as the local
  hosts and ipnodes database, mapping hostnames to IP addresses.
  
nfsv4-domain: string: domain name to be used for NVSv4
  Specifies the NVSv4 domain to be used.  If this value is unspecified,
  the name service domain will be used.
  
ipfilter-config-file: string: path to ipfilter IPv4 configuration file<br>
ipfilter-v6-config-file: string: path to ipfilter IPv6 configuration file<br>
ipnat-config-file: string: path to ipnat configuration file<br>
ippool-config-file: string: path to ippool configuration file<br>
  These properties each specify the path to the rules file for a
  component of the ipfilter configuration.  If a given config-file property
  is set, the corresponding ipfilter component will be enabled, reading
  configuration from the specified file.
  
ike-config-file: string: path to IKE configuration file
  Specifies the IKE configuration file.  If a value is specified, the
  svc:/network/ipsec/ike service will be enabled, reading configuration from
  the specified file.
  
ipseckey-config-file: string: path to manual key configuration file
  Specifies the manual key file.  If a value is specified, the
  svc:/network/ipsec/manual-key service will be enabled, reading configuration
  from the specified file.
  
ipsecpolicy-config-file: string path to IPsec policy configuration file
  Specifies the IPsec policy configuration file.  If a value is
  specified, the svc:/network/ipsec/policy service will be enabled, reading
  configuration from the specified file.
  
svcs-enable: string list: list of FMRIs<br>
svcs-disable: string list: list of FMRIs
  Specifies the services that should be enabled or disabled when this
  location is active.
  


ENM Properties

activation: enumerated value: always | never | manual | conditional
  The type of trigger for automatic activation of this ENM.
  The default value is "manual".
  
condition: string: identification of conditional NCU or Location
  If activation is set to "conditional," this property specifies the 
  NCU(s) or Location upon which this ENM depends.  The ENM will be activated
  (its 'start' expression will be exec'ed) when the conditional objects become
  active.
  
fmri: string: service FMRI
  If this ENM is implemented as an SMF service, this property identifies
  that service.  If this property is specified, the ENM will be activated by
  enabling the service and deactivated by disabling the service.
  
start: string: start command
  If this ENM is not implemented as an SMF service, this property
  identifies the command that should be exec'ed to start/activate the ENM.
  This property will be ignored if the fmri property is set.
  
stop: string: stop command
  If this ENM is not implemented as an SMF service, this property
  identifies the command that should be exec'ed to stop/deactivate the ENM.
  This property will be ignored if the fmri property is set.
  


OPTIONS

  -d
  
    Removes all configuration before reading subcommands from the command-file.
  


  -f <command-file>
  
    Reads and executes nwamcfg subcommands from command-file.
  


SUBCOMMANDS

The following subcommands are supported.


cancel

End the current profile without committing the current changes to persistent
storage, and pop up to the next higher scope.

This subcommand is only meaningful in interactive mode.


clear <prop-name>

Clear the value for the specified property.


commit

Commit the current profile to persistent storage.  Since a configuration must
be correct to be committed, this operation automatically performs a verify on
the object as well.  The commit operation is attempted automatically upon
leaving the current scope (with either the 'end' or 'exit' subcommand).

This subcommand is only meaningful in interactive mode.  In non-interactive
mode, the commit is implicit in any subcommand which changes a value.


create [ -t <template> ] <object-type> [ <class> ]
    <object-name>

Create an in-memory profile of the specified type and name.  The
-t <template> option specifies that the new object should be identical
to <template>, where <template> is the name of an existing object
of the same type.  If the -t option is not used, the new object is created
with the values specified for that object type in automatic mode.


destroy { -a | <object-type> [ <class> ] <object-name> }

Remove all or the specified profile from memory and persistent storage.
This action is immediate; it does not need to be committed.  A destroyed object
cannot be reverted.


end

End the current profile specification, and pop up to the next higher
scope.  The current object is verified and committed before ending; if
either the verify or commit fails, an appropriate error message is issued
and the user is given the opportunity to end without committing the current
changes, or to remain in the current scope and continue editing.

This subcommand is only meaningful in interactive mode.


exit

Exit the nwamcfg session.  The current profile is verified and
committed before ending; if either fails, an appropriate error message is
issued and the user is given the opportunity to exit without committing the
current changes, or to remain in the current scope and continue editing.

This subcommand is only meaningful in interactive mode.


export [ -d ] [ -f <output-file> ]

Print the current configuration to standard out, or to a file specified
with the -f option.  The -d option generates a "destroy -a" as the first output.  This subcommand produces output in a form suitable for
use in a command file.


get <prop-name>

Get the current (in-memory) value of the specified property.


help [ <subcommand> ]

Display general help or help about a specific subcommand.


list [ <object-type> [ <class> ] <object-name> ]

List all property-value pairs that exist at the current or specified scope.


revert

Delete any current changes to the current profile and revert to the values
from persistent storage.

This subcommand is only meaningful in interactive mode.


select <object-type> [ <class> ] <object-name>

Select one of the profiles available at the current scope level and jump down
into that object's profiles scope.  The selected object will be loaded into
memory from persistent storage.


set <prop-name>=<value1>[,<value2>...]

Set the current (in-memory) value of the specified property.  If performed in
non-interactive mode, the change is also committed to persistent storage.

The delimiter for values of multi-valued properties is "," (comma).  If any
of the individual values in such a property contains a comma, it must be
escaped (i.e., written as "\,").  Commas within properties that can only
have a single value are not interpreted as delimiters, and need not be escaped.


verify

Verify that the current in-memory object has a valid configuration.

This subcommand is only meaningful in interactive mode.


walkprop

Walk each property associated with the current profile.  For each property,
the name and current value are displayed, and a prompt is given to allow the
user to change the current value.

The delimiter for values of multi-valued properties is "," (comma).  If any
of the individual values in such a property contains a comma, it must be
escaped (i.e., written as "\,").  Commas within properties that can only
have a single value are not interpreted as delimiters, and need not be escaped.

This subcommand is only meaningful in interactive mode.


SEE ALSO

netcfgd(1M), nwamadm(1M), nwamd(1M)


EXAMPLES

Example 1: Set an NCU property from the command line (in non-interactive mode)
# nwamcfg "select ncp myncp; select ncu link net1; set mtu=1492"
#

Example 2: List all top-level profiles from the command line
# nwamcfg list
NCPs:
        myncp
Locations:
        home
        office
ENMs:
        myenm
        enmtest
#

Example 3: Destroy a Location profile from the command line
# nwamcfg destroy loc home
Destroyed location:home.
#

Example 4: Interactively create an NCU profile.
# nwamcfg
nwamcfg> select ncp myncp
nwamcfg:ncp:myncp> create ncu ip net1
nwamcfg:ncp:myncp:ncu:net1> walkprop
        activation (always) [always|never|manual|prioritized|conditional]> conditional
        condition ()> link:net1
        under (link:net1)>
        ip-version (all) [ipv4|ipv6|all]> ipv4
        ipv4-addr-src (dhcp) [static|dhcp]> static
        ipv4-static-addr ()> 168.1.2.3
nwamcfg:ncp:myncp:ncu:net1> list
NCU:IP:net1
        class:            ip
        parent-ncp:       myncp
        activation:       conditional
        condition:        link:net1
        under:            link:net1
        ip-version:       ipv4
        ipv4-addr-src:    static
        ipv4-static-addr: 168.1.2.3
nwamcfg:ncp:myncp:ncu:net1> commit
nwamcfg:ncp:myncp:ncu:net1> end
nwamcfg:ncp:myncp> exit
#

Example 5: Select an existing enm, display its contents,
           and change a property value
# nwamcfg
nwamcfg>select enm myenm
nwamcfg:enm:myenm>list
ENM:myenm
        state          disabled
        activation     manual
        condition      ""
        fmri           ""
        start          "/usr/local/bin/start_myenm"
        stop           "/usr/local/bin/stop_myenm"
nwamcfg:enm:myenm>set stop=/bin/alt_stop
nwamcfg:enm:myenm>list
ENM:myenm
        state          disabled
        activation     manual
        condition      ""
        fmri           ""
        start          "/usr/local/bin/start_myenm"
        stop           "/bin/alt_stop"
nwamcfg:enm:myenm>exit
nwamcfg:enm:myenm: committing changes...done
#