https://github.com/vyos/vyos-1x/pull/3777

PR for current: https://github.com/vyos/vyos-1x/pull/3776

A version of this change will be part of T5528, only for Circinus initially.

I've checked this bug , it's still present the vesion 1.4./1.5 and the 1.3.x , this problem is related to the update of the new version (openvpn) where the syntax to create a tunnel tap (layer2) is changed , this command allow to transport frame and it's needed when you want to bridge a vtun :

@Viacheslav found the issue which I've documented below.

No urgency here, so moving out of LTS.

No simple solution, so it should be done and tested in a development release first in any case, not in LTS.

Moving to 1.5 for now. If we are confident about the solution, we can backport it to 1.4 later. New architectures certainly should be introduced in development releases first.

Since it's not really a trivial change, I'm moving this to 1.5 now. If we find a good solution and prove that it's perfectly safe, then we can backport it to 1.4 later.

Removing from Sagitta, since we aren't changing any syntax within an LTS release.

How about having a command on the primary router to trigger a save on the secondary router?

OK, thanks! I will test it.

This will be readied for PR without adding the external package vyos1x-adapter; that version has already been completed and will be linked below.

PR https://github.com/vyos/vyos-1x/pull/3752

@SamLue will be available in the next rolling release, can you check when it will be available?

There are some nuances with it, until we do not have a route from to default VRF to the peer it won't work

set vrf bind-to-all
set vrf name first table '123'

PR https://github.com/vyos/vyos-1x/pull/3748

We are not going to implement it.

So with nftables output apparently the rule is correctly in place.

I've created the FRR bug report :

We do not use iptables, we use nftables.
Check the rules with sudo nft list ruleset
What exactly does not work?