Need to backport this to 1.2.1

need to backport it into the crux branch

@zsdc it's in http://dev.packages.vyos.net/repositories/current/vyos/pool/main/v/vyatta-cfg-quagga/vyatta-cfg-quagga_0.19.1+vyos2+current8_all.deb, but you better wait until the rolling release is working again, there were some frr dependencies added, which makes the packge not backward compatible. If you need it urgently, I can compile you a working one which works on the older releases (it's really only a dependency issue). So far I have it only implemented for IPv4 routes, let me know if you need it for route6 as well. I planned to start with the backend rewrite for frr asap.

@zsdc would the below help you?

https://vyos.readthedocs.io/en/latest/vpn.html#pptp-server

After more testing, this does look more like an upstream regression wrt this particular hardware:

moving 'set protocols static arp' into it's own python script. - done-

@zsdc How quickly needs that to be resolved? It requires quite some work on the backend for the cli.

Both use cases mentioned above have been solved in a different maner.

@c-po i think we should bump it to 1450
also need a recommendation for 1600 for production use
maybe at time you create vxlan it should check upstream interface

How should we proceed?

thx for testing.

Tested using new rolling vyos-1.2.0-rolling+201903072319-amd64.iso

configure
set system syslog global preserve-fqdn
commit
save

searched these two files:

• /etc/rsyslog.conf
• /etc/rsyslog.d/vyos-rsyslog.conf

this and it's a global rsyslog option only. (https://www.rsyslog.com/doc/v8-stable/configuration/global/index.html)

oh sorry, i was simply curious as to why you suggested adding the "global" node?

Can you clarify please, I can't follow what you mean.

OOC why the term "global"? Do you foresee add'l global directives that you'd like added to that node or simply to keep things tidy under the syslog node?

What about:
set system syslog global preserve-fqdn

Tested this now using snapshot vyos-1.2.0-rolling+201903070337 and my usecase with OSPF via OpenVPN-Site-to-Site tunnels. Built up test setup using two vpn endpoints connected via a router (w/o firewall).

I didn't find any issues so far, aside from the fact that I think no one is using pptp anymore, I'll keep this task still open for a few days just to make sure the replacement was successful.

found in the old documentation that mppe is always set to the highest, will implement it as a config option with the default of mppe require.

available via latest iso (https://downloads.vyos.io/rolling/current/amd64/vyos-1.2.0-rolling%2B201903062146-amd64.iso)

I rather would prefer only one option. The more options you have for things to configure - the more trouble you get.

yes sure:

If you used set service syslog preserve-hostname, would you change the default rsyslog behavior to have $PreserveFQDN off?

I prefere set service syslog preserve-hostname as we use hostname in other configuration nodes, too

Thank you! This was made the situation much more apparent. Provide, please, an output of the next command:

sudo ipset list

All right, ready for the first release. I'll add a few more options for radius tuning which are currently set to static defaults values (like timeouts).

https://github.com/hagbard-01/vyos-1x/tree/T833

No dice sadly. I think we have to close this since i have a feeling it might be more than 1 issue.
I think the problem with the bond vif interface not sending recieving is a critial error but i do not know how to report it correctly.
The other issue i think is related is the static routes not being applied.

@syncer send hostname is automatically set, so not sure if that task is still valid. (see: /var/lib/dhcp/dhclient_eth0.conf).
The value is taken from hostname.
However dhcp has a ton of client options (https://tools.ietf.org/html/rfc2132), implementing all of them or just a portion and make them configurable, means the rewrite of th dhclient scripts, which I think is overdue anyway.

@Maltahl Do you receive the udp packets now?

Just a message to confirm this one. ap_isolate always set to 1, but have to be 0 (or undefined) when isolate-stations is set to false (or not set because it's indicated to be the default)

See

as soon as I did

set interfaces ethernet eth3 pppoe 0 enable-ipv6
set interfaces ethernet eth3 pppoe 0 ipv6 address autoconf

Hmmm. I'll try to help you debug this issue offline (look for my message).

I've turned off the IPv6 firewall, and run tcpdumps on my LAN and WAN interfaces (eth1 and eth0, respectively). I see loads of tcp retransmissions, and all my icmpv6 requests have an error message of 'no response found!' in the Wireshark output.

I've reproduced the hang you described on a test router. It looks like this:

Hmmm. My next guess would be that you could be inadvertently blocking neighbor discovery (which happens on the link-local addresses). Can you try turning off the IPv6 firewall long enough to test whether it's the firewall at all? Another thing to try would be tcpdump on the LAN and WAN interfaces, as well as putting another machine (like a laptop) on the link between the two routers, to see where the packets are appearing and not appearing. You should see lots of link-local traffic between the LAN hosts and the VyOS router, as well as between the two routers.

output of ip6tables commands (with firewall rules applied):

Can you disable this GRE tunnel and make a dump of a moment when a tunnel being established?
Also, send output of:

sudo ip6tables -t raw -L -n -v
sudo ip6tables -t filter -L -n -v
sudo ip6tables -t mangle -L -n -v
sudo ip6tables -t nat -L -n -v

That should be already in there for a few days now.

In T1262#33324, @hagbard wrote:

@fromport does the new pkg solve the issue you are seeing? It did during all my tests.