@runar The sudo wrapper is mostly due to the fact that the op mode convertor is largely a clone of the conf mode convertor. This also interfers with operator level users' ability to run anything at all, so this is a good point.
We likely need to switch to adding sudo where needed instead, but we need to test which commands break from it when run by non-admin users.

Seems to work fine now, reopen if necessary.

@syncer @higebu Yes, stock quagga is missing many things that ours has. We have no choice other than to integrate the patches by hand.

It was just an error in the help. Someone probably copied it from somewhere else (e.g. the address option of firewall rules) and forgot to edit.

Interesting. Perhaps the config format has changed in newer versions? What do the docs say?

After installing pppd from T677, it seems to work again.

Found the issue. First, renaming is hadled in a pre-up script that was in the ppp package rather than vyatta-ravpn, so it is not included in 1.2.0.

State files are updated properly after keepalived upgrade, no need for this workaround anymore.

When we get to it, we should also get rid of built-in support for a handful of north american wireless providers (which is likely very out of date by now) and add support for custom connection strings etc.

The root cause was here:

Completely dead:

Just verified that install_routes = no has no adverse effect on L2TP/IPsec.

Downgraded packages are in the latest nightly build.

Correction: 5.5, not 5.2.

No amount of messing up with the config in 5.6 fixed this, but when I downgraded strongswan to 5.2 (from stretch-security), it just worked. I'm downgrading it in the repositories.