Page MenuHomeVyOS Platform
Create Task
Maniphest T9565

IPsec remote-id shows incorrect description for default value.
Open, NormalPublicBUG
Actions

Description

There appears to be a cosmetic issue with the auto-completion for remote-id under the IPsec site-to-site peer authentication configuration. The default value is incorrectly displayed as "0x0p+0ny" instead of the expected "%any".

vyos@peer01# set vpn ipsec site-to-site peer to-peer02 authentication
Possible completions:
   local-id             Local ID for peer authentication

   remote-id            ID for remote authentication (default: 0x0p+0ny)

https://github.com/vyos-Networks/vyos-1x/blob/rolling/interface-definitions/vpn_ipsec.xml.in#L1194

Details

Version
1.5.1, 2026.10.16-0024-rolling
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Cosmetic issue (typos etc.)

Event Timeline

SrividyaA created this task.Tue, Nov 3, 8:29 AM
SrividyaA triaged this task as Normal priority.
pasik subscribed.Tue, Nov 3, 8:47 AM
rherold subscribed.Tue, Nov 3, 12:34 PM

The cause is in the generated help, not in the XML. The default of a node is appended to the help line of node.def as (default: ...), and the CLI prints that line with printf. For %any the %a is the hexadecimal float conversion, so it shows as 0x0p+0ny:

$ printf 'ID for remote authentication (default: %any)\n'
ID for remote authentication (default: 0x0p+0ny)

The default itself is right, %any is the strongSwan keyword and the value the configuration uses. It is the only default with a percent sign in all interface definitions.

Reproduced with TAB after set vpn ipsec site-to-site peer X authentication and fixed in the generator, which now doubles the percent signs of the default in the help line: https://github.com/vyos/vyos-1x/pull/5625 (draft).