@takodotid/circuit 0.34.3 → 0.35.0

package/src/integrations/peeringdb.ts

@@ -0,0 +1,173 @@
+// Keeps a network's exchange presence at PeeringDB in step with the config. Each interface with an `exchange` naming a `peeringdb_ixlan` is one record.
+//
+// Only globally reachable addresses are published: an exchange reached over a tunnel often lands on private or shared space, and publishing it would point others at a dead end. A record the config does not hold is reported, never deleted, and `operational` is never changed, since leaving an exchange is a decision made outside the config.
+
+import { Address } from "../core/address";
+import type { Network } from "../core/define";
+import { Secrets } from "../core/secrets";
+import type { Device, Interface } from "../schema";
+
+/** A network's presence at one exchange LAN, as PeeringDB holds it. */
+type NetIxLan = {
+    id: number;
+    net_id: number;
+    ixlan_id: number;
+    name: string;
+    speed: number;
+    ipaddr4: string | null;
+    ipaddr6: string | null;
+    is_rs_peer: boolean;
+    operational: boolean;
+};
+
+/** One record as the config describes it. */
+type Wanted = {
+    name: string;
+    ixlan_id: number;
+    speed: number;
+    ipaddr4: string | null;
+    ipaddr6: string | null;
+    is_rs_peer: boolean;
+};
+
+/** A change to send. `id` is set when the record exists and is updated in place. */
+export type PeeringDbChange = {
+    summary: string;
+    id?: number;
+    body: Record<string, unknown>;
+};
+
+export type PeeringDbPlan = {
+    changes: PeeringDbChange[];
+    /** Records PeeringDB holds that the config does not. */
+    unknown: string[];
+};
+
+type AnyInterface = Interface<string, string>;
+
+export class PeeringDb {
+    private static readonly API = "https://www.peeringdb.com/api";
+
+    /** What would change at PeeringDB. Reads the public API; needs no key. */
+    static async plan(network: Network): Promise<PeeringDbPlan> {
+        if (!network.asn) throw new Error("the network declares no asn");
+
+        const response = await fetch(`${PeeringDb.API}/netixlan?asn=${network.asn}`, {
+            headers: { Accept: "application/json" },
+            signal: AbortSignal.timeout(30_000),
+        });
+        if (!response.ok) throw new Error(`PeeringDB answered ${response.status}`);
+
+        const existing = ((await response.json()) as { data: NetIxLan[] }).data;
+        const desired = PeeringDb.wanted(network);
+
+        // The record that owns every presence. Taken from an existing one, since the API has no other lookup by ASN here.
+        const netId = existing[0]?.net_id;
+        const changes: PeeringDbChange[] = [];
+
+        for (const record of desired) {
+            const current = existing.find((candidate) => candidate.ixlan_id === record.ixlan_id);
+
+            const body = {
+                net_id: netId,
+                ixlan_id: record.ixlan_id,
+                asn: network.asn,
+                speed: record.speed,
+                ipaddr4: record.ipaddr4,
+                ipaddr6: record.ipaddr6,
+                is_rs_peer: record.is_rs_peer,
+                operational: current?.operational ?? true,
+            };
+
+            if (!current) {
+                changes.push({ summary: `+ ${record.name}: ${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s`, body });
+                continue;
+            }
+
+            const differs =
+                current.ipaddr4 !== record.ipaddr4 ||
+                current.ipaddr6 !== record.ipaddr6 ||
+                current.speed !== record.speed ||
+                current.is_rs_peer !== record.is_rs_peer;
+
+            if (differs) {
+                const before = `${current.ipaddr4}, ${current.ipaddr6}, ${current.speed} Mbit/s, route server ${current.is_rs_peer}`;
+                const after = `${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s, route server ${record.is_rs_peer}`;
+                changes.push({ summary: `~ ${record.name}: ${before} to ${after}`, id: current.id, body });
+            }
+        }
+
+        const unknown = existing
+            .filter((record) => !desired.some((candidate) => candidate.ixlan_id === record.ixlan_id))
+            .map((record) => record.name);
+
+        if (changes.some((change) => !change.id) && !netId) {
+            throw new Error("PeeringDB holds no presence for this network yet, so its record id is unknown; add the first one by hand");
+        }
+
+        return { changes, unknown };
+    }
+
+    /** Send the changes, with the network's API key. */
+    static async send(network: Network, changes: PeeringDbChange[]): Promise<void> {
+        if (!network.peeringdb) throw new Error("the network declares no peeringdb api_key");
+        const apiKey = Secrets.reveal(network.peeringdb.api_key);
+
+        for (const change of changes) {
+            const response = await fetch(`${PeeringDb.API}/netixlan${change.id ? `/${change.id}` : ""}`, {
+                method: change.id ? "PUT" : "POST",
+                headers: { Authorization: `Api-Key ${apiKey}`, "Content-Type": "application/json" },
+                body: JSON.stringify(change.body),
+                signal: AbortSignal.timeout(30_000),
+            });
+
+            if (!response.ok) {
+                const reason = (await response.text()).slice(0, 300);
+                throw new Error(`${change.summary}: PeeringDB answered ${response.status} ${reason}`);
+            }
+
+            console.log(`  sent ${change.summary}`);
+        }
+    }
+
+    private static addressesOf(iface: AnyInterface): string[] {
+        return (iface.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
+    }
+
+    /** Whether the device peers with a route server on this interface's subnets. */
+    private static peersWithRouteServer(device: Device, iface: AnyInterface): boolean {
+        const bgp = device.routing?.bgp;
+        const subnets = PeeringDb.addressesOf(iface);
+
+        return Object.values(bgp?.neighbors ?? {}).some((neighbor) => {
+            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+            const role = neighbor.role ?? group?.role;
+            return role === "rs" && subnets.some((subnet) => Address.contains(subnet, neighbor.address));
+        });
+    }
+
+    /** Every exchange presence the config declares with a PeeringDB exchange LAN. */
+    private static wanted(network: Network): Wanted[] {
+        const records: Wanted[] = [];
+
+        for (const device of network.devices) {
+            for (const iface of Object.values(device.interfaces ?? {})) {
+                const exchange = iface.exchange;
+                if (!exchange?.peeringdb_ixlan) continue;
+
+                const published = PeeringDb.addressesOf(iface).map(Address.host).filter(Address.isGlobal);
+
+                records.push({
+                    name: exchange.name,
+                    ixlan_id: exchange.peeringdb_ixlan,
+                    speed: exchange.speed,
+                    ipaddr4: published.find((address) => Address.family(address) === "ipv4") ?? null,
+                    ipaddr6: published.find((address) => Address.family(address) === "ipv6") ?? null,
+                    is_rs_peer: PeeringDb.peersWithRouteServer(device, iface),
+                });
+            }
+        }
+
+        return records;
+    }
+}

package/src/integrations/prometheus.ts

@@ -0,0 +1,90 @@
+// Prometheus targets for snmp_exporter, in its file-based discovery format, and the `auths` section of its config: one auth per device, named after it, so each device is asked with its own credentials.
+//
+// The auths hold no secret. A password is written as `${NAME}`, the name of its secret, and snmp_exporter reads it from its environment when started with `--config.expand-environment-variables`.
+
+import { Document } from "yaml";
+import type { Network } from "../core/define";
+import type { Device, Secret } from "../schema";
+
+export type PrometheusTarget = { targets: string[]; labels: Record<string, string> };
+
+/** One auth in snmp_exporter's config. */
+type SnmpExporterAuth =
+    | {
+          version: 3;
+          username: string;
+          security_level: "authPriv";
+          password: string;
+          auth_protocol: string;
+          priv_protocol: string;
+          priv_password: string;
+      }
+    | { version: 2; community: string };
+
+export class Prometheus {
+    /** snmp_exporter's names for the algorithms. */
+    private static readonly AUTH = { sha1: "SHA", sha256: "SHA256" } as const;
+    private static readonly PRIVACY = { aes128: "AES", des: "DES" } as const;
+
+    private static readonly AUTHS_HEADER =
+        " Written by `circuit prometheus --auths`. Load it beside snmp.yml, with --config.expand-environment-variables.";
+
+    /** The targets, and the devices left out because their config turns SNMP off. */
+    static targets(network: Network): { targets: PrometheusTarget[]; withoutSnmp: Device[] } {
+        return {
+            targets: network.devices
+                .filter((device) => device.management?.snmp && device.connection.host)
+                .map((device) => ({
+                    targets: [device.connection.host!],
+                    // `__param_auth` picks the device's own auth in snmp_exporter.
+                    labels: { device: device.name, platform: device.platform, model: device.model, __param_auth: device.name },
+                })),
+            withoutSnmp: network.devices.filter((device) => !device.management?.snmp),
+        };
+    }
+
+    /** The `auths` section, as YAML, and what the operator must still fill in by hand. */
+    static snmpExporterAuths(network: Network): { yaml: string; notes: string[] } {
+        const notes: string[] = [];
+        const auths: Record<string, SnmpExporterAuth> = {};
+
+        for (const device of network.devices) {
+            const snmp = device.management?.snmp;
+            if (!snmp) continue;
+
+            const [name, user] = Object.entries(snmp.users ?? {})[0] ?? [];
+
+            if (name && user) {
+                auths[device.name] = {
+                    version: 3,
+                    username: name,
+                    security_level: "authPriv",
+                    password: Prometheus.fromEnvironment(user.auth_password, notes, `${device.name}'s SNMP password`),
+                    auth_protocol: Prometheus.AUTH[user.auth],
+                    priv_protocol: Prometheus.PRIVACY[user.privacy],
+                    priv_password: Prometheus.fromEnvironment(user.privacy_password, notes, `${device.name}'s SNMP privacy password`),
+                };
+            } else {
+                // snmp_exporter reads no community from the environment, and Circuit never writes a secret's value.
+                auths[device.name] = { version: 2, community: "FILL_IN" };
+                notes.push(
+                    `${device.name} has only an SNMP version 2c community, which snmp_exporter cannot read from its environment; write it in place of FILL_IN, or give the device a version 3 user`
+                );
+            }
+        }
+
+        // YAML 1.1 rules quote words such as `yes` and `on`, which older YAML readers take as true.
+        const document = new Document({ auths }, { version: "1.1" });
+        document.contents!.commentBefore = Prometheus.AUTHS_HEADER;
+
+        return { yaml: document.toString({ indent: 2 }), notes };
+    }
+
+    /** A password as snmp_exporter reads it from its environment, or a note when the secret is a file, which it cannot read. */
+    private static fromEnvironment(secret: Secret, notes: string[], where: string): string {
+        if ("secret" in secret) return `\${${secret.secret}}`;
+
+        notes.push(`${where} is read from a file; write its value in place of FILL_IN`);
+        return "FILL_IN";
+    }
+}

package/src/integrations/registries.ts

@@ -0,0 +1,25 @@
+// Registries the framework reads prefix sets from. PeeringDB, which it publishes to, is in ./peeringdb.ts.
+
+import type { Family } from "../schema";
+import type { Registry } from "../schema/policy";
+
+export class Registries {
+    /** The prefixes of one family a registry gives for a query. */
+    static prefixes(name: Registry, query: string, family: Family): Promise<string[]> {
+        const sources: Record<Registry, (query: string, family: Family) => Promise<string[]>> = { "ripe-stat": Registries.ripeStat };
+        return sources[name](query, family);
+    }
+
+    /** Prefixes an origin AS announces, from RIPEstat. */
+    private static async ripeStat(query: string, family: Family): Promise<string[]> {
+        if (!/^AS\d+$/i.test(query)) throw new Error(`ripe-stat takes an AS number, got '${query}'`);
+        const res = await fetch(`https://stat.ripe.net/data/announced-prefixes/data.json?resource=${query.toUpperCase()}`, {
+            signal: AbortSignal.timeout(90_000),
+        });
+        if (!res.ok) throw new Error(`ripe-stat answered ${res.status}`);
+        const data = (await res.json()) as { data: { prefixes: { prefix: string }[] } };
+        return [
+            ...new Set(data.data.prefixes.map((entry) => entry.prefix).filter((entry) => entry.includes(":") === (family === "ipv6"))),
+        ].sort();
+    }
+}

package/src/platforms/bgp-wait.ts

@@ -0,0 +1,41 @@
+// Waiting for BGP sessions to be established: `circuit bgp --wait`, and the check after an apply.
+
+import { setTimeout as sleep } from "node:timers/promises";
+import type { BgpSession } from "./platform";
+
+/** How long to wait, and how often to read again, both in seconds. */
+export type WaitLimits = { seconds: number; every: number };
+
+export class BgpWait {
+    /** `circuit bgp --wait` reads the sessions again every 15 seconds, for at most 600 seconds unless `--max` says otherwise. */
+    static readonly COMMAND: WaitLimits = { seconds: 600, every: 15 };
+
+    /**
+     * After an apply, the sessions established before have 180 seconds to be established again, read every 10 seconds. A session reset by a change opens again when one side retries; three minutes leaves room for a slow peer without holding the apply up for long. A session that never went down is seen at the first read, so a healthy apply does not wait.
+     */
+    static readonly AFTER_APPLY: WaitLimits = { seconds: 180, every: 10 };
+
+    /** Read the sessions until `enough` holds or time runs out, and give the last read. `waiting` is told of each read that fell short, before the pause. */
+    static async until(
+        read: () => Promise<BgpSession[]>,
+        enough: (sessions: BgpSession[]) => boolean,
+        limits: WaitLimits,
+        waiting: (sessions: BgpSession[]) => void = () => {}
+    ): Promise<BgpSession[]> {
+        const deadline = Date.now() + limits.seconds * 1000;
+        let sessions = await read();
+
+        while (!enough(sessions) && Date.now() < deadline) {
+            waiting(sessions);
+            await sleep(Math.min(limits.every * 1000, Math.max(0, deadline - Date.now())));
+            sessions = await read();
+        }
+
+        return sessions;
+    }
+
+    /** How many of these sessions are established. */
+    static upCount(sessions: readonly BgpSession[]): number {
+        return sessions.filter((session) => session.established).length;
+    }
+}

package/src/platforms/catalog.ts

@@ -0,0 +1,69 @@
+// Every model each platform supports. Types read from here, so a model or port name that does not exist fails to compile.
+
+import { models as fortios } from "./fortios/models";
+import { models as junos } from "./junos/models";
+import { models as raisecom } from "./raisecom-ros/models";
+import { models as routeros } from "./routeros/models";
+import { models as vrp } from "./vrp/models";
+
+/** What a model's hardware holds, where a real device held less than its datasheet lists. `validate` checks a config against it. */
+export type ModelLimits = {
+    /** The most member ports one LAG may have. More is an error. */
+    lag_members?: number;
+    /** About how many switch rules the switch chip held. More is a warning: a rule the chip cannot hold is invalid, and so is every rule after it, without a log line. */
+    switch_rules?: number;
+    /** How many distinct port ranges the switch rules held. More is a warning, for the same reason. */
+    switch_port_ranges?: number;
+};
+
+/** One hardware model: its ports per speed class, how the platform spells a port, and what its hardware holds. */
+export type ModelSpec = {
+    ports: Readonly<Record<string, number>>;
+    spelling: Readonly<Record<string, string>>;
+    limits?: ModelLimits;
+};
+
+export class Catalog {
+    static readonly MODELS = { routeros, vrp, "raisecom-ros": raisecom, junos, fortios } as const satisfies Record<
+        string,
+        Record<string, ModelSpec>
+    >;
+
+    /** Every port a model has, in order. */
+    static ports(platform: string, model: string): string[] {
+        const spec = (Catalog.MODELS as Record<string, Record<string, ModelSpec>>)[platform]?.[model];
+        if (!spec) throw new Error(`${platform} has no model ${model}`);
+        return Object.entries(spec.ports).flatMap(([speed, count]) => Array.from({ length: count }, (_, i) => `${speed}-${i + 1}`));
+    }
+
+    /** What the model's hardware holds. Empty for a model with no known limits, or a model the catalog does not have. */
+    static limits(platform: string, model: string): ModelLimits {
+        const spec = (Catalog.MODELS as Record<string, Record<string, ModelSpec>>)[platform]?.[model];
+        return spec?.limits ?? {};
+    }
+
+    /** The platform's own name for a port. */
+    static spell(platform: string, model: string, port: string): string {
+        const spec = (Catalog.MODELS as Record<string, Record<string, ModelSpec>>)[platform]?.[model];
+        const parts = /^(\d+[gm])-(\d+)$/.exec(port);
+        const template = parts && spec?.spelling[parts[1]!];
+        if (!template) throw new Error(`${model} has no port ${port}`);
+
+        // A platform that counts from 0, or numbers one class after another, shifts the position: `{n-1}`, `{n+47}`.
+        return template.replace(/\{n([+-]\d+)?\}/, (_, shift?: string) => String(Number(parts[2]) + Number(shift ?? 0)));
+    }
+}
+
+export type Models = typeof Catalog.MODELS;
+export type PlatformName = keyof Models;
+export type ModelName<Pl extends PlatformName> = keyof Models[Pl] & string;
+
+type Upto<N extends number, A extends unknown[] = [], R = never> = A["length"] extends N
+    ? R
+    : Upto<N, [...A, 0], R | `${[...A, 0]["length"]}`>;
+type PortsOf<Pl extends PlatformName, M extends ModelName<Pl>> = Models[Pl][M] extends { ports: infer P } ? P : never;
+
+/** `10g-1` to `10g-48` on a model with 48 10G ports. */
+export type PortName<Pl extends PlatformName, M extends ModelName<Pl>> = {
+    [S in keyof PortsOf<Pl, M>]: `${S & string}-${Upto<PortsOf<Pl, M>[S] & number>}`;
+}[keyof PortsOf<Pl, M>];

package/src/platforms/derive.ts

@@ -0,0 +1,117 @@
+// Values more than one adapter derives from a device in the same way.
+
+import { Address } from "../core/address";
+import type { Device } from "../schema";
+
+/** A feature a platform renders once proved on one of its devices. */
+export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter";
+
+export class Derive {
+    /** Each LAG's number: its own `id`, or its position among the device's LAGs. */
+    static lagIds(device: Device): Map<string, number> {
+        const numbers = new Map<string, number>();
+        let position = 0;
+
+        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+            if (iface.type !== "lag") continue;
+
+            position++;
+            numbers.set(name, iface.id ?? position);
+        }
+
+        return numbers;
+    }
+
+    /** The IPv4 networks of a port's or an interface's addresses. */
+    static ipv4Networks(device: Device, iface: string): string[] {
+        const settings = device.interfaces?.[iface] ?? device.ports?.[iface as keyof typeof device.ports];
+        const addresses = (settings?.addresses ?? []).map((entry) => (typeof entry === "string" ? entry : entry.address));
+
+        return addresses.filter((address) => Address.family(address) === "ipv4").map((address) => Address.prefixOf(address));
+    }
+
+    /** Fields a platform renders only once they are proved on one of its devices. */
+    private static readonly UNPROVED_PORT_FIELDS = ["mac_limit", "ethertypes"] as const;
+
+    /** Fields a platform refuses until it has proved them on a device. A platform names the ones it has proved, and the rest are refused. */
+    static unproved(device: Device, proved: readonly ProvedFeature[] = []): string[] {
+        const found: string[] = [];
+        const routing = device.routing;
+        const unproved = "not proved on a device yet";
+        const has = (feature: ProvedFeature) => proved.includes(feature);
+
+        if (routing?.bfd && !has("bfd-timers")) found.push(`routing.bfd, BFD timers are ${unproved}`);
+
+        for (const route of routing?.static ?? []) {
+            if (route.bfd && !has("static-route-bfd"))
+                found.push(`routing.static ${route.prefix} bfd, BFD on a static route is ${unproved}`);
+        }
+
+        const bgp = routing?.bgp;
+
+        for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+            const bfd = neighbor.bfd ?? group?.bfd;
+            const multihop = neighbor.multihop ?? group?.multihop;
+
+            if (bfd && multihop && !has("multihop-bfd"))
+                found.push(`routing.bgp.neighbors.${name}.bfd, BFD on a multihop session is ${unproved}`);
+        }
+
+        if (!has("alarm-severity")) {
+            for (const name of Object.keys(device.system?.alarms ?? {})) {
+                found.push(`system.alarms.${name}, an alarm's severity is ${unproved}`);
+            }
+        }
+
+        const holders = [
+            ...Object.entries(device.ports ?? {}).map(([name, settings]) => ({ where: `ports.${name}`, settings })),
+            ...Object.entries(device.interfaces ?? {}).map(([name, settings]) => ({
+                where: `interfaces.${name}`,
+                settings: settings.type === "lag" ? settings : undefined,
+            })),
+        ];
+
+        for (const { where, settings } of holders) {
+            for (const field of Derive.UNPROVED_PORT_FIELDS) {
+                const feature = field === "mac_limit" ? "mac-limit" : "ethertype-filter";
+                if (settings?.[field] !== undefined && !has(feature)) found.push(`${where}.${field}, ${unproved}`);
+            }
+        }
+
+        return found;
+    }
+
+    /** Services the switch platforms run. Each takes its sources from `management.allow`, on the protocol's own port. */
+    private static readonly SWITCH_SERVICES = ["ssh", "telnet", "snmp"] as const;
+
+    /** Fields neither switch platform, VRP nor Raisecom ROS, expresses: a service's own sources or port, a user's description or keys, the IP stack's host settings, a point-to-point address, and offload per interface. `ownSources` names the services a platform gives their own sources. */
+    static switchUnsupported(device: Device, ownSources: readonly ("ssh" | "telnet" | "snmp")[] = []): string[] {
+        const found: string[] = [];
+
+        for (const service of Derive.SWITCH_SERVICES) {
+            const settings = device.management?.[service];
+            if (settings?.allow && !ownSources.includes(service))
+                found.push(`management.${service}.allow, every service takes management.allow`);
+            if (settings?.port) found.push(`management.${service}.port`);
+        }
+
+        for (const [name, user] of Object.entries(device.users ?? {})) {
+            if (user.description) found.push(`users.${name}.description`);
+            if (user.ssh_keys?.length) found.push(`users.${name}.ssh_keys`);
+        }
+
+        if (device.system?.ip) found.push("system.ip");
+
+        for (const [name, port] of Object.entries(device.ports ?? {})) {
+            if (port?.hardware_offload !== undefined) found.push(`ports.${name}.hardware_offload`);
+        }
+
+        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+            if (iface.addresses?.some((entry) => typeof entry !== "string")) found.push(`interfaces.${name}.addresses with a peer`);
+            if (iface.hardware_offload !== undefined) found.push(`interfaces.${name}.hardware_offload`);
+        }
+
+        return found;
+    }
+}

package/src/{adapters/devices → platforms}/fortios/TRAPS.md

@@ -27,6 +27,10 @@ Behaviour that looks like something else. Each one has been hit on a FortiGate 3
 - A tunnel's interface takes an IPv4 address only as a host, with the far end in `remote-ip`: `set ip 10.0.0.1 255.255.255.252` on one is dropped without a word.
 - A GRE or VXLAN tunnel creates an interface of its own, named after it, which goes when the tunnel goes. VXLAN has no local address: it leaves from the address of the interface it points to.
 - A static route has no VRF of its own. It lands in the VRF of the interface it leaves through, as `get router info routing-table all` shows, so a blackhole route cannot go in a VRF. OSPF and BGP have no VRF setting.
+- BFD's timers, `bfd-desired-min-tx`, `bfd-required-min-rx` and `bfd-detect-mult` under `config system settings`, exist only while `bfd` is on there: `get` hides them otherwise. They default to 250, 250 and 3, which `show` does not print. So the render sets `bfd` before them, and a plan unsets them before `bfd`.
+- A static route takes `set bfd enable`, IPv4 and IPv6 alike. The route stays in the table while its BFD session has never come up.
+- BGP asks for a BFD session only once its session is up: `get router info bfd requests` lists nothing for a neighbor still `Active`, with `ebgp-enforce-multihop` or without.
+- On a multihop BGP session BFD runs single-hop: it sends to UDP port 3784, and ignores the multihop BFD the peer sends to port 4784. Against a CCR2216 on RouterOS 7.23.5, with BGP up between the router's loopback and `update-source` on the FortiGate, `get router info bfd neighbor` stayed `DOWN` with remote discriminator `0`, the router's BFD session counted `packets-rx=0`, and the BGP session dropped 11 times in 3 minutes. `config router bfd` holds only single-hop neighbors. Circuit refuses BFD on a multihop session.
 - The stateless ACL, `firewall acl` and `acl6`, only drops: it has no action.
 - A route map stops at the first rule that matches, with no way to go on to the next, and its rules permit unless told to deny.
 - `show vpn certificate local` prints a certificate without its text or key. `show full-configuration` prints both, the key encrypted.
@@ -34,6 +38,8 @@ Behaviour that looks like something else. Each one has been hit on a FortiGate 3
 - A GRE or VXLAN interface takes no flow sampler, and says so without `Command fail`: `Netflow sampler isn't supported on Tunnel interface..`, and the same for sFlow and for VXLAN.
 - A port in an aggregate has no `icmp-send-redirect`, `command parse error`, and loses it when it joins one.
 - `purge` empties a table after asking `(y/n)`.
+- A VLAN interface has no LLDP settings: `set lldp-transmission` on one is `command parse error`. An aggregate's LLDP sends and receives on each of its ports.
+- `diagnose lldprx neighbor summary` names our port by an index of its own, `port 23` for `port5`. `diagnose lldprx neighbor details` names it in `port.txt`, and Circuit reads that. Both print nothing at all when no neighbor was received.
 - A loopback has no MTU of its own and runs no VRRP. An interface's name has at most 15 characters.
 - There is no WireGuard and no RPKI, `command parse error`. A route map has no large community and a BGP neighbor no role: neither is among their settings. SNMPv3 offers no SHA256.
 - `execute backup config flash <comment>` keeps a revision on the device, and `execute restore config flash <id>` restores one.