@c-po It makes sense
Need to try.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed Search
Aug 14 2021
Aug 14 2021
Aug 13 2021
Aug 13 2021
Well test it tomorrow once it becomes available :)
They are all intermixed ;) - maybe I also missinterpreted the issue. Maybe you can retest the latest rolling which will be available by tomorrow? Image is currently build: https://ci.vyos.net/job/vyos-build/job/current/2195
Nvm I just noticed that the task number was mentioned in a commit, I have a feeling this won't solve the issue as this is related to the router bgp 123 vrf something rather than vrf something statements.
Very cool this has apparently been fixed already, I was reading through the vyos-1x commints and didn't see anything that looked related. What was the implemented change for this?
Viacheslav moved T3738: openvpn fails if server and authentication are configured from Open to Backport Candidates on the VyOS 1.4 Sagitta board.
PR for current https://github.com/vyos/vyos-1x/pull/967
Aug 12 2021
Aug 12 2021
c-po changed the status of T3746: Inform users logging into the system about a pending reboot from Open to In progress.
c-po added a parent task for T3734: Move EVPN VRF up in FRR config: T3728: FRR not respect configured RD and RT for L3VNI.
c-po added a parent task for T3318: Update Linux Kernel to v5.4.208 / 5.10.142: T3710: Upgrade the kernel in 1.3 to 5.10.
c-po added a subtask for T3710: Upgrade the kernel in 1.3 to 5.10: T3318: Update Linux Kernel to v5.4.208 / 5.10.142.
c-po renamed T3318: Update Linux Kernel to v5.4.208 / 5.10.142 from Update Linux Kernel to v5.4.139 / 5.10.57 to Update Linux Kernel to v5.4.140 / 5.10.58.
jestabro changed the status of T3732: override-default helper should support adding defaultValues to default less nodes from Unknown Status to Resolved.
jestabro changed the status of T3574: Add constraintGroup for combining validators with logical AND from Unknown Status to Resolved.
jestabro removed a project from T3574: Add constraintGroup for combining validators with logical AND: test.
Unknown Object (User) changed the status of T2432: dhcpd: Can't create new lease file: Permission denied from Unknown Status to Resolved.
Another bug.
From time to time I get errors in debug mode ("touch /tmp/vyos.frr.debug" and "sudo systemctl stop vyos-configd") when changing lsp-mtu size
vyos@r1-roll# set protocols isis lsp-mtu 1308 [edit] vyos@r1-roll# commit [ protocols isis ]
erkin changed the status of T521: Network services may fail if vyatta-router.service startup takes longer than a few seconds from Open to In progress.
c-po added a comment to T3737: openvpn-option needs to be able to support quotes as since openvpn 2.4..
We have this problem in more then one case. The solution so gar is to use " as quote which we later on render in Jinja2
Sounds like a missing validator. Wo should prevent users from doing such things ;)
@Viacheslav, when we use a migrator we should enable the ipv4 afi for each and every ipv4 neighbor if its not configured explicitly. What do you think? If a peer group is configured for that neighbour, too - that will be no issue.
Aug 11 2021
Aug 11 2021
jestabro moved T3732: override-default helper should support adding defaultValues to default less nodes from Open to Finished on the VyOS 1.4 Sagitta board.
jestabro closed T3732: override-default helper should support adding defaultValues to default less nodes as Unknown Status.
Thanks for you comment ! it's good consider that options
Similar task T2315, also there is bug related T1976, etc.
It should be a migration script that determines ip/ipv6 neighbor and set neighbor to properly afi.
So there is one question, how to determine which afi we should to use if we see "peer-group" in configuration?
I don't think that we can implement it in 1.3 as it uses an old codebase.
nyamada added a comment to T3735: Configuration with multiple network addresses of firewall network-group via colud-init fails.
Thank you for the quick fix!
I added a new neighbor belonging to the sub-AS 65031 to the existing bgp configuration:
c-po moved T1817: BGP next-hop-self not working. from Needs Triage to Finished on the VyOS 1.2 Crux (VyOS 1.2.9) board.
zsdc changed the status of T3735: Configuration with multiple network addresses of firewall network-group via colud-init fails from Open to Needs testing.
Hello, @nyamada!
Really appreciated for such a detailed problem analysis! The regex is fixed in the 1.4 version now.
Could you test it, so we can backport changes safely to 1.2 and 1.3?
To reproduce in 1.4:
Viacheslav added a comment to T3737: openvpn-option needs to be able to support quotes as since openvpn 2.4..
As Workaround in T3350 set raw option "config /path/to/config/file"
UnicronNL triaged T3738: openvpn fails if server and authentication are configured as Normal priority.
UnicronNL added projects to T3736: openvpn-option keeps and adds double dashes ''--": test, VyOS 1.3 Equuleus.
Viacheslav closed T3709: Snmp: Allow enable MIDs/OIDs ipCidrRouteTable, a subtask of T3706: Add proper priorities for systemd daemons, as Resolved.
Aug 10 2021
Aug 10 2021
Viacheslav changed the status of T3709: Snmp: Allow enable MIDs/OIDs ipCidrRouteTable, a subtask of T3706: Add proper priorities for systemd daemons, from Open to Needs testing.
Aug 9 2021
Aug 9 2021
Unknown Object (User) added a comment to T3731: verify_accel_ppp_base_service return wrong config error for SSP.
PR for Equuleus https://github.com/vyos/vyos-1x/pull/959
Unknown Object (User) changed the status of T3731: verify_accel_ppp_base_service return wrong config error for SSP from Open to In progress.
Unknown Object (User) created T3731: verify_accel_ppp_base_service return wrong config error for SSP.
Viacheslav changed the status of T3730: op-mode conntrack-sync miss some functions from Open to Needs testing.
- Backport configquerry.py [Done]
https://github.com/vyos/vyos-1x/commit/2aa75521a829712256c3c34685e60a9d36b33791
jestabro added a project to T3402: Add VyOS programming library for operational level commands: VyOS 1.3 Equuleus.
https://github.com/vyos/vyatta-cfg-vpn/commit/2cec760601a6e85ca8e0b6a30c173196a97a777a
Back-ported the dhcp ip check loop to 1.3
dmbaturin renamed T3729: Split the image build and config load smoke test into separate jobs from Separate the image build and config load smoke test into separate jobs to Split the image build and config load smoke test into separate jobs.
Viacheslav added a comment to T3537: Unable to override the default OSPFv3 link cost for wireguard interface.
@dtoux Did you test it in 1.3.0-rc5?
@xrobau As I mentioned before, peer-group can't exist without peer-as/remote-as in your case remote-as should be internal. It can exist without remote-as but with "route-reflector-client" it shouldn't
You can check it with vtysh FRR:
Unknown Object (User) closed T2776: QAT acceleration not working for IPSec AES-128 (CBC) / SHA256 tunnel as Invalid.
Unknown Object (User) added a comment to T2776: QAT acceleration not working for IPSec AES-128 (CBC) / SHA256 tunnel .
Tested on 1.3-rc5, all works properly
set vpn ipsec esp-group ESP_DEFAULT compression 'disable' set vpn ipsec esp-group ESP_DEFAULT lifetime '3600' set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel' set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19' set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes128' set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256' set vpn ipsec ike-group IKEv2_DEFAULT close-action 'none' set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'hold' set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30' set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120' set vpn ipsec ike-group IKEv2_DEFAULT ikev2-reauth 'no' set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2' set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800' set vpn ipsec ike-group IKEv2_DEFAULT mobike 'disable' set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19' set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes128' set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
Flow served QAT
vyos@R2-QAT# run show system acceleration qat device qat_dev0 flows +------------------------------------------------+ | FW Statistics for Qat Device | +------------------------------------------------+ | Firmware Requests [AE 0]: 60046 | | Firmware Responses[AE 0]: 60046 | +------------------------------------------------+ | Firmware Requests [AE 1]: 112720 | | Firmware Responses[AE 1]: 112720 | +------------------------------------------------+ | Firmware Requests [AE 2]: 219657 | | Firmware Responses[AE 2]: 219657 | +------------------------------------------------+ | Firmware Requests [AE 3]: 60046 | | Firmware Responses[AE 3]: 60046 | +------------------------------------------------+ | Firmware Requests [AE 4]: 112722 | | Firmware Responses[AE 4]: 112722 | +------------------------------------------------+ | Firmware Requests [AE 5]: 219657 | | Firmware Responses[AE 5]: 219657 | +------------------------------------------------+
Interrupts
vyos@R2-QAT# run show system acceleration qat interrupts 140: 44039 0 0 0 0 0 0 0 IR-PCI-MSI 524288-edge qat0-bundle0 141: 0 42358 0 0 0 0 0 0 IR-PCI-MSI 524289-edge qat0-bundle1 142: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524290-edge qat0-bundle2 143: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524291-edge qat0-bundle3 144: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524292-edge qat0-bundle4 145: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524293-edge qat0-bundle5 146: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524294-edge qat0-bundle6 147: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524295-edge qat0-bundle7 148: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524296-edge qat0-bundle8 149: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524297-edge qat0-bundle9 150: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524298-edge qat0-bundle10 151: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524299-edge qat0-bundle11 152: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524300-edge qat0-bundle12 153: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524301-edge qat0-bundle13 154: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524302-edge qat0-bundle14 155: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524303-edge qat0-bundle15 156: 0 0 0 0 0 0 0 0 IR-PCI-MSI 524304-edge qat0-ae-cluster
Unknown Object (User) changed the status of T3695: OpenConnect reports commit success when ocserv fails to start due to SSL cert/key file issues from Open to Needs testing.
PR for 1.3 https://github.com/vyos/vyos-1x/pull/957
The same task T1375
Aug 8 2021
Aug 8 2021
c-po renamed T3318: Update Linux Kernel to v5.4.208 / 5.10.142 from Update Linux Kernel to v5.4.135 / 5.10.53 to Update Linux Kernel to v5.4.139 / 5.10.57.
c-po added a comment to T2027: get_config_dict is failing when the configuration section is empty/missing.
>>> from vyos.config import Config
>>> conf = Config()
>>> conf.get_config_dict(['service', 'ssh'])
{'ssh': {'disable-host-validation': {}, 'port': ['22']}}
>>> conf.get_config_dict(['service', 'non-existing'])
{}UnicronNL closed T169: Image install should put correct serial console device in created GRUB menu entry, a subtask of T2452: Serial console related issues, as Resolved.
UnicronNL closed T169: Image install should put correct serial console device in created GRUB menu entry as Resolved.
Checks the grub config rule by rule if ttyS/ttyUSB is used then updates the newly to be included grub template to the same.
dmbaturin changed the status of T169: Image install should put correct serial console device in created GRUB menu entry, a subtask of T2452: Serial console related issues, from Open to Needs testing.
dmbaturin changed the status of T169: Image install should put correct serial console device in created GRUB menu entry from Open to Needs testing.
erkin added a project to T1161: Does Vyos take advantage of linux's improved security features?: VyOS 1.4 Sagitta.
Aug 7 2021
Aug 7 2021
I'm also affected by this. My configuration has about 5k ip prefixes in network group for policy based routing.
Cheeze_It added a comment to T3634: Add op command option for ping for do not fragment bit to be set.
Did more checks.....and noticed it *IS* properly sending the ping command:
I see these error in the openvpn log:
I don't think so the configuration is working, the interface is down. It is not assigning the ipv6 addresses to the tunnel interfaces.