In T4460#124345, @Viacheslav wrote:

From provided log syntax error in config string 6
‘holding-time 300’

But yes “ cisco-authentication” shouldn’t be without values

From provided log syntax error in config string 6
‘holding-time 300’

Added more options. PR https://github.com/vyos/vyos-1x/pull/1350

I already merged your XML definition ;)

I once made XML, it might come in handy

PR: https://github.com/vyos/vyos-1x/pull/1348

Ultimately I moved my physical connection from port eth0 to eth4, and configured eth4 with the same config as was on eth0. Once I did that everything was stable and has been stable for days (nearly a week now). I'm not sure what could be causing an interface to work for an amount of time, then as if on-cue stop forwarding packets.

Should I make improvements to the remaining revisions in the PR?

Sorry I just saw it now, I'll test it. But because of limited conditions, I may test in the future, please forgive me

In T3435#115394, @n.fort wrote:

Error still present on VyOS 1.4-rolling-202201020317

vyos@vyos:~$ show nat source rules 
Traceback (most recent call last):
  File "/usr/libexec/vyos/op_mode/show_nat_rules.py", line 114, in <module>
    print(format_nat_rule.format(rule, srcdests[0], tran_addr, interface))
IndexError: list index out of range
Rule       Source                                             Translation                                        Outbound Interface
----       ------                                             -----------                                        ------------------
vyos@vyos:~$ show ver

Version:          VyOS 1.4-rolling-202201020317
Release train:    sagitta

Nat config in this example:

vyos@vyos:~$ show config comm | grep nat
set nat source rule 10 description 'Masquerade to NAT'
set nat source rule 10 outbound-interface 'eth0'
set nat source rule 10 translation address 'masquerade'

@m.korobeinikov I believe that I already posted this some time ago, but just in case...
Not all combinations of DPD and close-action are safe. Actually, most of them sooner or later will lead to issues with IPSec. So, I created the next scheme. It is from 2020, so I will not say that nothing was changed from that time, however, it shows well how careful you should be while configuring IPSec. On the scheme, you can see the only safe configuration of the close-action option, depending on how the peer is configured, but the same logic can be applied to DPD.

PR https://github.com/vyos/vyos-build/pull/240
disable owamp|twamp.service by default

@SrividyaA will be present in the next rolling release

PR for the current https://github.com/vyos/vyos-1x/pull/1346

For Debian11 requires pkg "libpam-tacplus" that is not available https://github.com/kravietz/pam_tacplus/issues/180

PR https://github.com/vyos/vyos-1x/pull/1345

Yes on this version it is available the requested options for ipv6:

yes, it was added on this version vyos-1.4-rolling-202205311706, please check again

I just check and on version: vyos-1.4-rolling-202205310217 is still missing :(

We've added this feature in our latest nightly building release, could you check it ?

PR for op-mode importing existing PKI files into config: https://github.com/vyos/vyos-1x/pull/1343

PR: https://github.com/vyos/vyos-1x/pull/1342

PR: https://github.com/vyos/vyos-1x/pull/1339

Currently dealing with some minor FRR issues:

@fernando Could you try to set sysctl mark?

sysctl -w net.ipv4.conf.eth0.src_valid_mark=1
sysctl -w net.ipv4.conf.eth1.src_valid_mark=1

PR https://github.com/vyos/vyos-1x/pull/1340

set service event-handler event first filter pattern '.*ssh2.*'
set service event-handler event first script arguments '192.0.2.5'
set service event-handler event first script environment interface value 'eth0'
set service event-handler event first script path '/config/scripts/hello.sh'

PR https://github.com/vyos/vyos-1x/pull/1338

PR for 1.4 Sagitta branch https://github.com/vyos/vyos-1x/pull/1337

PR for 1.3 equuleus branch https://github.com/vyos/vyos-1x/pull/1336

Some debug info:

PR for 1.3 https://github.com/vyos/vyos-1x/pull/1335

PR:
https://github.com/vyos/vyos-1x/pull/1334

PR https://github.com/vyos/vyos-1x/pull/1333

PR fixing exposed errors:
https://github.com/vyos/vyos-1x/pull/1331

I removed my comment as my issue was not a bug AFAIK, but rather a miss-configuration and operation.

Yeah I discovered the same in forums:

I was not aware that the nft implementation changes the kind of how groups are used.
We have implemented a blacklisting approach which heavily relates on using ipset because no one wants to have hundred thousand of addresses in the config file.
So I think this is essential, at least for us.