Thanks for the info. I think (indeed) that *might* work for wireguard. But never the less, it would be cool to have the possibility to route by fwmark.

We only have source routing now:

I think we need to reopen this task. Sometimes (one per hour) some users and I got similar messages on version 1.3-rc4/rc5

Have tried as you suggested, and confirmed it works.

No issue on 1.4-rolling-202107191536 and later.

I think it is already fixed in T3674

@ramaxlo You can try to set this workaround:

Have tried, but no luck.

Want to test latest rolling iso, but equuleus seems to be stuck at vyos-1.3-beta-202107121144-amd64.iso which doesn't have this fix yet.

PR https://github.com/vyos/vyos-1x/pull/933

Will be available in the next 1.3 beta release.

PR https://github.com/vyos/vyatta-cfg-quagga/pull/85

set protocols static table 1 route6 ::/0 next-hop fe80::11 interface eth0
commit

To reproduce, without the "interface" option

set protocols static table 1 route6 ::/0 next-hop fe80::11
commit

Also, the bug still present, fix for which I sent above in diff

[email protected]# compare 
[edit interfaces]
+vxlan vxlan0 {
+    mtu 1430
+    remote fe80::2
+    source-address fe80::3
+    source-interface eth0
+    vni 0
+}
[edit]
[email protected]# commit
WARNING: RFC7348 recommends VXLAN tunnels preserve a 1500 byte MTU

@c-po It seems doesn't work

This is already available in VyOS 1.4

@Scoopta, thank you. That's good. I *think* know how the logic should go. Shouldn't be difficult but I'll consult with @Viacheslav and @c-po on how we should tackle it. It shouldn't be hard, but I want to make sure I properly do it :)

@Viacheslav, @c-po, the ISIS FRR Jinja2 template is significantly different between 1.3 and 1.4. Should I try to make the change on 1.3 and then merge? Or should I make it on 1.4 and we'll find a way to merge it back into 1.3?

@Cheeze_It Yes, I actually patched my version of vyos already. Just have to add

ipv6 router isis {{ process }}

to the frr isis template file

@Viacheslav, @Scoopta, I take it for default originate on IPv6 there's a requirement to have "ipv6 router isis" added on the interface? I'm thinking yes. If it's a yes (which I'm thinking it is) then I believe this should be fairly easy to add. I'll give it a check guys.

@Scoopta Provide please example of configuration with every task.
If it a possible example of frr, for what you get and what you expected.

thanks for your comment , we are testing first with @rherold , I understand that your case is similar but it's not the same (you have an explicit route-leaking between default vrf and vrf X ). So we also need to test it and try to sure the version solved it .

PR for 1.3 https://github.com/vyos/vyatta-cfg-quagga/pull/84

@zsdc
please take a look on this
it might be some similar issue in this patch?
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=0fb4d21956f4a9af225594a46857ccf29bd747bc

I have made a second attempt of the PR: https://github.com/vyos/vyos-1x/pull/928
The original tls configuration checks are back, but it's only checked if no alternative authentication methods are configured.

As I suspected, it check if the ConfigSession properly errors if "tls cert-file" and "tls key-file" are NOT defined (for server):

something like this in 1.4 nft
https://www.spinics.net/lists/netfilter/msg58240.html