Fixed for 1.3 in commit https://github.com/vyos/vyos-1x/commit/21527ef4551613fe9b7eed9e4b2ce33ad46fe540
Feed Search
Jul 4 2021
Jul 4 2021
Jul 2 2021
Jul 2 2021
Viacheslav moved T3535: Rewrite vyatta-conntrack-sync in new XML and Python flavor from Need Triage to Finished on the VyOS 1.3 Equuleus board.
Viacheslav added a project to T3535: Rewrite vyatta-conntrack-sync in new XML and Python flavor: VyOS 1.3 Equuleus.
Viacheslav added a comment to T3045: Changes to Conntrack-Sync don't apply correctly (Mutlicast->UDP).
Viacheslav added a comment to T3076: Router reboot adds unwanted 'conntrack-sync mcast-group '225.0.0.50'' line to configuration.
Fixed for 1.3 in commit https://github.com/vyos/vyos-1x/commit/21527ef4551613fe9b7eed9e4b2ce33ad46fe540 and T3535
Viacheslav moved T3045: Changes to Conntrack-Sync don't apply correctly (Mutlicast->UDP) from Need Triage to Finished on the VyOS 1.3 Equuleus board.
Viacheslav added a comment to T3535: Rewrite vyatta-conntrack-sync in new XML and Python flavor.
Jun 29 2021
Jun 29 2021
Viacheslav added a comment to T3652: BGP handshake with cisco router ends in timeout.
Is it worked in 1.3/1.2?
Jun 28 2021
Jun 28 2021
Viacheslav changed the subtype of T3655: NAT doesn't work correctly with VRF from "Task" to "Bug".
Viacheslav added a comment to T3076: Router reboot adds unwanted 'conntrack-sync mcast-group '225.0.0.50'' line to configuration.
For 1.2.7 it adds unexpected multicast group per "save"
Configs for reproduce:
Viacheslav added a comment to T3045: Changes to Conntrack-Sync don't apply correctly (Mutlicast->UDP).
To reproduce (VyOS 1.3-beta-202106271614):
Viacheslav edited projects for T3045: Changes to Conntrack-Sync don't apply correctly (Mutlicast->UDP), added: VyOS 1.3 Equuleus; removed VyOS 1.2 Crux.
Viacheslav edited projects for T3076: Router reboot adds unwanted 'conntrack-sync mcast-group '225.0.0.50'' line to configuration, added: VyOS 1.2 Crux (VyOS 1.2.8), VyOS 1.3 Equuleus; removed VyOS 1.2 Crux.
Viacheslav closed T3567: Building Crux from Docker Image failing to download repo index as Resolved.
Viacheslav added a comment to T3648: op-mode: nat rules broken.
Doesn't work, VyOS 1.4-rolling-202106271939
Jun 27 2021
Jun 27 2021
Jun 26 2021
Jun 26 2021
Jun 25 2021
Jun 25 2021
Jun 24 2021
Jun 24 2021
Viacheslav added a comment to T2661: SSTP wrong certificates check.
@Dmitry Is it an actual task? Code was rewritten.
Viacheslav closed T2722: get_config_dict() and key_mangling=('-', '_') will alter CLI data for tagNodes as Resolved.
Already fixed with "no_tag_node_value_mangle=True"
https://github.com/vyos/vyos-1x/blob/705eddbc7a2caf09c37ecafb27418a764217975a/python/vyos/config.py#L218
Viacheslav added a project to T2770: Allow any character to be used in the SNMP community field: VyOS 1.4 Sagitta.
Viacheslav added a comment to T2773: EIGRP support for VRF.
Eigrp in the FRR doesn't work correctly.
The routes still live even if neighbors in a shutdown state.
Viacheslav added a comment to T2771: BGP VPNv4 & VPNv6 Address Family Support.
@Cheeze_It can you re-check it?
Viacheslav added a comment to T3640: Allow resetting Wireguard interface.
There is a link to the existing code for configuration mode, not pr.
So we can to add the op-mode function to re-add/reset with a similar logic. Only thoughts
Jun 23 2021
Jun 23 2021
Viacheslav added a comment to T3638: Passwords With Dollar Sign Set Incorrectly.
Not sure about double quotes, but for example for cloud-init configs, it is necessary to use single quotes.
Ideally, the configuration should look like in show configuration commands
Viacheslav added a comment to T3640: Allow resetting Wireguard interface.
I think it will be enough to remove the peer and add again.
@hagbard what do you think?
https://github.com/vyos/vyos-1x/blob/d48dddab0509e562209adfb115b0e691b8e47f54/python/vyos/ifconfig/wireguard.py#L197
Viacheslav added a comment to T3643: show vpn ipsec sa doesn't show tunnels in "down" state.
PR https://github.com/vyos/vyos-1x/pull/897
Fix path for swanctl.conf file
@Harliff Try 1.2.7/1.3 it was fixed with commit https://github.com/vyos/vyos-build/pull/138/files#diff-c7d29a506307d9cf8d86c3cd3f65ca4e4058ea442cacdf9a89d2485b56c7417aR67
T2061
Jun 22 2021
Jun 22 2021
Viacheslav edited projects for T3582: 'delete log file' does not work, added: VyOS 1.2 Crux (VyOS 1.2.8); removed VyOS 1.2 Crux (VyOS 1.2.7).
Viacheslav added a comment to T1790: OSPF Exchanged Routes marked as invalid when run through a GRE PTMP/PTP OSPF between peers .
@SquirePug Can you check 1.2.7 release?
Viacheslav added a comment to T2892: Remove command: "set firewall options interface <interface> disable".
I don't see the reason to delete the "disable" option, as it uses for adjust-mss and adjust-mss6.
And you need temporarily disable it.
Viacheslav reassigned T3629: IPoE server shifting address in the range from Viacheslav to Unknown Object (User).
Viacheslav added a comment to T3636: SSTP / L2TP ipv6 support broken.
Viacheslav added a comment to T3638: Passwords With Dollar Sign Set Incorrectly.
Try to set single quotes.
Viacheslav added a comment to T3643: show vpn ipsec sa doesn't show tunnels in "down" state.
Different format
vyos@r1-roll:~$ show vpn ipsec sa Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------------------ ------- -------- -------------- ---------------- ---------------- ----------- ---------- peer_192-0-2-2_tunnel_1 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_10 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_11 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_12 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_13 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_14 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_15 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_16 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_17 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_18 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_19 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_2 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_20 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_3 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_4 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_5 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_6 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_7 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_8 down N/A N/A N/A N/A N/A N/A peer_192-0-2-2_tunnel_9 down N/A N/A N/A N/A N/A N/A vyos@r1-roll:~$
Jun 21 2021
Jun 21 2021
Viacheslav updated the task description for T3643: show vpn ipsec sa doesn't show tunnels in "down" state.
Viacheslav changed the subtype of T3636: SSTP / L2TP ipv6 support broken from "Bug" to "Feature Request".
Viacheslav renamed T3643: show vpn ipsec sa doesn't show tunnels in "down" state from show vpn ipsec sa doesn't show tunnel in "down" state to show vpn ipsec sa doesn't show tunnels in "down" state.
Viacheslav added a comment to T3640: Allow resetting Wireguard interface.
We don't use any configuration file for it, so I think we can't use wg-quick
We use "wg set"
$ sudo wg set --help Usage: wg set <interface> [listen-port <port>] [fwmark <mark>] [private-key <file path>] [peer <base64 public key> [remove] [preshared-key <file path>] [endpoint <ip>:<port>] [persistent-keepalive <interval seconds>] [allowed-ips <ip1>/<cidr1>[,<ip2>/<cidr2>]...] ]...
Viacheslav added a comment to T3640: Allow resetting Wireguard interface.
Is it helps in your case?
set interfaces wireguard wg0 disable commit del interfaces wireguard wg0 disable commit
There is no any native command for reset wireguard interface in Linux (as I know). Also, we don't use any daemons which we can restart to "re-establish" session.
Is one host behind nat?
Jun 18 2021
Jun 18 2021
Viacheslav moved T3633: Add LRO offload for interface ethernet from Open to Backport Candidates on the VyOS 1.4 Sagitta board.
Works fine VyOS 1.4-rolling-202106180929
vyos@r1-roll# set interfaces ethernet eth1 offload lro [edit] vyos@r1-roll# commit [edit] vyos@r1-roll# sudo ethtool -k eth1 | match large-receive-offload large-receive-offload: on [edit] vyos@r1-roll#
Jun 17 2021
Jun 17 2021
Viacheslav added a comment to T3633: Add LRO offload for interface ethernet.
Viacheslav renamed T3633: Add LRO offload for interface ethernet from Add LRO offload to Add LRO offload for interface ethernet.
Jun 15 2021
Jun 15 2021
Viacheslav added a comment to T3619: Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage.
Flame graph for 1.3-rc4, proxmox/virtio
Viacheslav changed the status of T3567: Building Crux from Docker Image failing to download repo index from Confirmed to Needs testing.
Jun 11 2021
Jun 11 2021
Viacheslav added a comment to T3614: Container network name with hyphen fail.
Jun 10 2021
Jun 10 2021
Viacheslav added a comment to T3613: Selectors for route-based IPsec tunnel (vti).
@krox2 How should looks like a configuration for many local/remote traffic selectors per one vti interface?
Viacheslav awarded T3613: Selectors for route-based IPsec tunnel (vti) a Like token.
Viacheslav closed T2620: Add ipsec peer-name to log to simplifies grepping and troubleshooting, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, as Resolved.
Viacheslav added a comment to T3567: Building Crux from Docker Image failing to download repo index.
Should be fixed with commit https://github.com/vyos/vyos-build/commit/7905f0d5715bb8da158d09734ba78dc28b2fd4e1
Viacheslav added a comment to T2645: Editing route-map action requires adding a new rule.
I can't reproduce it, VyOS 1.3-beta-202106081558
set policy prefix-list FOO rule 10 action 'permit' set policy prefix-list FOO rule 10 prefix '0.0.0.0/0' set policy route-map FOO rule 10 action 'permit' set policy route-map FOO rule 10 match ip address prefix-list 'FOO' set policy route-map FOO rule 10 set distance '220' set policy route-map FOO rule 1000 action 'permit'
Viacheslav added a comment to T3609: BGP Peer Group Changes Slow.
Commit with such policies:
[email protected]# time commit
Jun 9 2021
Jun 9 2021
Viacheslav added a comment to T3610: DHCP-Server creation for not primary IP address fails.
@n.fort You can try to replace True with False there (1.3 and 1.4). But it needs more tests. In some cases, it was some bugs with the DHCP server and not the primary address.
https://github.com/vyos/vyos-1x/blob/5d068442cf7b1863724c83168176ce2940a023fe/src/conf_mode/dhcp_server.py#L237
Viacheslav added a comment to T3609: BGP Peer Group Changes Slow.
It may be problem with large prefix-lists T2425
Viacheslav added a comment to T3609: BGP Peer Group Changes Slow.
Try to check the same directly in the FRR.
Viacheslav added a comment to T2620: Add ipsec peer-name to log to simplifies grepping and troubleshooting.
VyOS 1.3-beta-202106081558
Works as expected.
Jun 9 19:57:38 r4-1 charon: 13[CFG] no IKE_SA named 'peer-192.0.2.2-tunnel-0' found
Jun 9 19:57:38 r4-1 charon: 14[CFG] received stroke: initiate 'peer-192.0.2.2-tunnel-0'
Jun 9 19:57:38 r4-1 charon: 06[IKE] <peer-192.0.2.2-tunnel-0|4> initiating Main Mode IKE_SA peer-192.0.2.2-tunnel-0[4] to 192.0.2.2
Jun 9 19:57:38 r4-1 charon: 06[ENC] <peer-192.0.2.2-tunnel-0|4> generating ID_PROT request 0 [ SA V V V V V ]
Jun 9 19:57:38 r4-1 charon: 06[NET] <peer-192.0.2.2-tunnel-0|4> sending packet: from 192.0.2.1[500] to 192.0.2.2[500] (180 bytes)
Jun 9 19:57:38 r4-1 charon: 07[NET] <peer-192.0.2.2-tunnel-0|4> received packet: from 192.0.2.2[500] to 192.0.2.1[500] (160 bytes)
Jun 9 19:57:38 r4-1 charon: 07[ENC] <peer-192.0.2.2-tunnel-0|4> parsed ID_PROT response 0 [ SA V V V V ]
Jun 9 19:57:38 r4-1 charon: 07[IKE] <peer-192.0.2.2-tunnel-0|4> received XAuth vendor ID
Jun 9 19:57:38 r4-1 charon: 07[IKE] <peer-192.0.2.2-tunnel-0|4> received DPD vendor ID
Jun 9 19:57:38 r4-1 charon: 07[IKE] <peer-192.0.2.2-tunnel-0|4> received FRAGMENTATION vendor ID
Jun 9 19:57:38 r4-1 charon: 07[IKE] <peer-192.0.2.2-tunnel-0|4> received NAT-T (RFC 3947) vendor ID
Jun 9 19:57:38 r4-1 charon: 07[CFG] <peer-192.0.2.2-tunnel-0|4> selected proposal: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024
Jun 9 19:57:38 r4-1 charon: 07[ENC] <peer-192.0.2.2-tunnel-0|4> generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
Jun 9 19:57:38 r4-1 charon: 07[NET] <peer-192.0.2.2-tunnel-0|4> sending packet: from 192.0.2.1[500] to 192.0.2.2[500] (244 bytes)
Jun 9 19:57:38 r4-1 charon: 05[NET] <peer-192.0.2.2-tunnel-0|4> received packet: from 192.0.2.2[500] to 192.0.2.1[500] (244 bytes)
Jun 9 19:57:38 r4-1 charon: 05[ENC] <peer-192.0.2.2-tunnel-0|4> parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
Jun 9 19:57:38 r4-1 charon: 05[ENC] <peer-192.0.2.2-tunnel-0|4> generating ID_PROT request 0 [ ID HASH N(INITIAL_CONTACT) ]
Jun 9 19:57:38 r4-1 charon: 05[NET] <peer-192.0.2.2-tunnel-0|4> sending packet: from 192.0.2.1[500] to 192.0.2.2[500] (108 bytes)
Jun 9 19:57:38 r4-1 charon: 08[NET] <peer-192.0.2.2-tunnel-0|4> received packet: from 192.0.2.2[500] to 192.0.2.1[500] (76 bytes)
Jun 9 19:57:38 r4-1 charon: 08[ENC] <peer-192.0.2.2-tunnel-0|4> parsed ID_PROT response 0 [ ID HASH ]
Jun 9 19:57:38 r4-1 charon: 08[IKE] <peer-192.0.2.2-tunnel-0|4> IKE_SA peer-192.0.2.2-tunnel-0[4] established between 192.0.2.1[192.0.2.1]...192.0.2.2[192.0.2.2]
Jun 9 19:57:38 r4-1 charon: 08[IKE] <peer-192.0.2.2-tunnel-0|4> scheduling reauthentication in 2524s
Jun 9 19:57:38 r4-1 charon: 08[IKE] <peer-192.0.2.2-tunnel-0|4> maximum IKE_SA lifetime 3064s
Jun 9 19:57:38 r4-1 charon: 08[ENC] <peer-192.0.2.2-tunnel-0|4> generating QUICK_MODE request 364019988 [ HASH SA No KE ID ID ]
Jun 9 19:57:38 r4-1 charon: 08[NET] <peer-192.0.2.2-tunnel-0|4> sending packet: from 192.0.2.1[500] to 192.0.2.2[500] (316 bytes)
Jun 9 19:57:38 r4-1 charon: 09[NET] <peer-192.0.2.2-tunnel-0|4> received packet: from 192.0.2.2[500] to 192.0.2.1[500] (316 bytes)
Jun 9 19:57:38 r4-1 charon: 09[ENC] <peer-192.0.2.2-tunnel-0|4> parsed QUICK_MODE response 364019988 [ HASH SA No KE ID ID ]
Jun 9 19:57:38 r4-1 charon: 09[CFG] <peer-192.0.2.2-tunnel-0|4> selected proposal: ESP:AES_CBC_256/HMAC_SHA1_96/MODP_1024/NO_EXT_SEQ
Jun 9 19:57:38 r4-1 charon: 09[IKE] <peer-192.0.2.2-tunnel-0|4> CHILD_SA peer-192.0.2.2-tunnel-0{1} established with SPIs cb0aa83a_i c728156c_o and TS 10.1.0.0/24 === 10.2.3.0/24
Jun 9 19:57:38 r4-1 charon: 09[ENC] <peer-192.0.2.2-tunnel-0|4> generating QUICK_MODE request 364019988 [ HASH ]
Jun 9 19:57:38 r4-1 charon: 09[NET] <peer-192.0.2.2-tunnel-0|4> sending packet: from 192.0.2.1[500] to 192.0.2.2[500] (60 bytes)
[email protected]:~$Viacheslav added a comment to T2855: disabled vti interfaces still working.
Ok it already fixed in 1.3 T2916 and can be migrated to crux
Viacheslav closed T3602: Renaming BGP Peer Groups Leaves Router Broken, a subtask of T3182: Main blocker Task for FRR 7.4/7.5 series update, as Resolved.
Jun 8 2021
Jun 8 2021
Viacheslav added a comment to T1492: Not able to delete the configured arp-monitor target and interval attribute on VyOS 1.2.0.
It seems Arp monitor not supported in 802.3ad mode
Viacheslav added a comment to T3567: Building Crux from Docker Image failing to download repo index.
It is redirected from
http://archive.repo.saltstack.com/apt/debian/8/amd64/2017.7
to
https://archive.repo.saltproject.io/apt/debian/8/amd64/2017.7
Viacheslav moved T2620: Add ipsec peer-name to log to simplifies grepping and troubleshooting from Open to Backport Candidates on the VyOS 1.4 Sagitta board.
Viacheslav changed the status of T2620: Add ipsec peer-name to log to simplifies grepping and troubleshooting, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, from Open to Needs testing.
Viacheslav changed the status of T2620: Add ipsec peer-name to log to simplifies grepping and troubleshooting from Open to Needs testing.