Duplicate PR:
https://github.com/vyos/vyos-1x/pull/1118
Request revoked

VyOS 1.3.0-epa3 with config below works good:

I personally think the interface part is high-effort, low-gain since you can simply use the address of the interface to the same effect, whereas simply providing an interface will force it to decide which address to use on dual-stack systems. It needs to pick between AF_INET and AF_INET6 when creating the socket before setsockopt()ing SO_BINDTODEVICE; although I think we can get away with doing what socket.create_connection() does. Even then, only the SFTP portion of the code directly uses socket — everything else relies on higher level libraries that only expose address and port options. (Also, using a single parameter for both addresses and interfaces is a bad idea, in my opinion, because it's probably more useful to resolve an FQDN string to an address rather than assume all strings are interfaces. But otherwise, we'd need to find a way to resolve conflict between address and interface parameters.) All in all, I don't think the interface parameter is a good idea at all but we'll see.

All parts completely backported to Equuleus.

I opened a new issue for this: T4090.

@m.korobeinikov Could you re-check it and close if necessary?

@ernstjo Do you have any news regarding this issue or should we close it?

@SrividyaA Could you re-check it?

PR https://github.com/vyos/vyos-1x/pull/1117

@daniil can you edit one file?

sudo nano -c +1308 /usr/lib/python3/dist-packages/vyos/ifconfig/interface.py

And replace string:

if not 'redirect' in self._config:

To string:

if not 'redirect' in self._config and not 'traffic_policy' in self._config:

save and reboot the router or just restart vyos-configd

sudo systemctl restart vyos-configd

I think this is the limitation with the Linux interface name, it should not be higher than 16 characters. In you config I see, as an example (bond0.995.130 = 13 chars and additional part .100 = 4) = 17
I know how we can fix it manually, but I'm not sure that it is a good idea.
Accel-PPP supports name changing for created interface by vlan_mon module

[pppoe]
vlan-name=e0.%P.%N
interface=re:^e0\.\d+\.\d+

you can try to change this manually (edit /run/accel-ppp/pppoe.conf) and restart pppoe-server

PR https://github.com/vyos/vyos-1x/pull/1116

@Boman I don't see such issue:

vyos@r11-roll# set interfaces bridge br0 enable-vlan 
[edit]
vyos@r11-roll# set interfaces bridge br0 member interface eth2 allowed-vlan 1-4094
[edit]
vyos@r11-roll# 
[edit]
vyos@r11-roll# time commit

@daniil Can you share an example of traffic-policy 1G?

PR https://github.com/vyos/vyos-1x/pull/1115

There is still another bug:

set nat destination rule 120 destination address '203.0.113.1'
set nat destination rule 120 inbound-interface 'eth0'
set nat destination rule 120 protocol 'tcp'
set nat destination rule 120 translation address '192.0.2.40'

PR https://github.com/vyos/vyos-1x/pull/1114

vyos@r11-roll:~$ show nat destination rules 
Rule       Destination                                        Translation                                        Inbound Interface
----       -----------                                        -----------                                        -----------------
100        port 3389                                          192.0.2.40 port 80                                 eth0      
vyos@r11-roll:~$

@adestis thank you. This issue isn't critical. It's more for to improve the design and for convenience of our customers.
You can use /32 to add a host, but we have to have the opportunity to add hosts without masks.
For example, if you need to create a group consisting of 1000 (or more random hosts), it's more convenient to use configuration without masks.

@c-po I will check it!

@UnicronNL can you rechecknon todays rolling image? It behaved differently for me

I set the banners via set system login pre-login 'test' and/or set system login post-login 'test'
and then the banners are set. (and the default is overwritten)

Well deleting the login banner results in the "default" behavior as expected.

PR https://github.com/vyos/vyatta-cluster/pull/5

Similar problem:

@m.korobeinikov why not use network group with /32 host addresses ?

The custom banner is removed after the deletion operation. But it shows the default banner:

It gives a different error when the translation port option is configured for both the source and destination nat:

submitted this PR: https://github.com/vyos/vyos-1x/pull/1112

Yes, but sync-groups dont have health-check scripts.
The best solution, in this case, is to implement health-check features for sync-group and do migration script.
We should not use health-check configured for a group if this group belongs to a sync-group

sync-groups habe transition scripts, too

Still broken:

trae@cr01b-vyos:~$ show conf com | grep arch
set service dhcp-server shared-network-name INT subnet 192.168.1.0/24 domain-search 'int.trae32566.org'
set service dhcp-server shared-network-name INT subnet 192.168.1.0/24 domain-search 'ipa.trae32566.org'
set service dhcp-server shared-network-name INT subnet 192.168.1.0/24 domain-search 'trae32566.org'
set system config-management commit-archive location 'sftp://USER:[email protected]:/int/cr01b-vyos'                                                                          
set system config-management commit-archive source-address 'lo'
set system domain-search domain 'int.trae32566.org'
set system domain-search domain 'ipa.trae32566.org'
set system domain-search domain 'trae32566.org'
trae@cr01b-vyos:~$ configure
[edit]
trae@cr01b-vyos# set system host-name temp
[edit]
trae@cr01b-vyos# commit
Using source address lo
Archiving config...
  sftp://stor01z-rh8.int.trae32566.org:/int/cr01b-vyos Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/lib/python3/dist-packages/vyos/remote.py", line 312, in upload
    urlc(urlstring, *args, **kwargs).upload(local_path)
  File "/usr/lib/python3/dist-packages/vyos/remote.py", line 202, in upload
    with self._establish() as ssh, ssh.open_sftp() as sftp:
  File "/usr/lib/python3/dist-packages/vyos/remote.py", line 189, in _establish
    sock = socket.create_connection((self.hostname, self.port), socket.getdefaulttimeout(), self.source)
  File "/usr/lib/python3.9/socket.py", line 843, in create_connection
    raise err
  File "/usr/lib/python3.9/socket.py", line 830, in create_connection
    sock.bind(source_address)
socket.gaierror: [Errno -5] No address associated with hostname
[edit]

This is on 1.4-rolling-202112160318

Didn't notice this message, thanks!
Maybe we should add a corresponding sync_group command to the CLI?

When sync group configure the keepalived report to log, looks like we need to use this script on sync_group

Dec 16 15:22:53 vyos Keepalived_vrrp[4766]: Warning - script healthcheck_XXX is not used

I'm not happy with the current one. Ideally, I'd like to rewrite it in Python using better diagnostic collection tools. I don't see it happening in 1.3.0, however.

I'm going to delete loadkey from 1.4 some time after 1.3 comes out.

I assumed the last element of .history[] is the final URL, so I had it display .history[-1]; but it turns out it overwrites .url with the final destination and only keeps the previous redirects in .history[]. Now it just displays .url if .history[] is not empty.

Assuming it does not (and I can't replicate this), since the responsible code was rewritten in November to properly use low-level sockets. Let me know if it still persists and I'll try to poke around Paramiko for performance bottlenecks.

Going to backport this to 1.3 as well.

@Dmitry there it is: