https://github.com/vyos/vyos-1x/pull/4528

Tested. It works

The file "new_config" did not contain a footer for proper migration.

I have tested the lab without IPSec for 3.5 hours - PIMD is alive

If I use 1M in the command, everything works well for 3 hours

I reproduced this issue in my lab.
Network MAP
HOST1(debian)---VyOS1----(GREoverIPSEC)-----VyOS-2-- HOST2(debian)

I built a lab and generated traffic as the customer did. However, I could not reproduce this issue. Maybe it is a problem with the packets generated by the switch (192.168.10.10).
There are periodic messages in the log file

After deep investigation with @zsdc, we found that the issue can be here https://github.com/FRRouting/frr/blob/f3a7077df01176164c0bb5775ecb886cf233089e/ldpd/neighbor.c#L629

@sarthurdev I think, conntract should be transferred from input or forward to the global section or used in prerouting. Because now it looks like conntrack is used only in these rules, not for all traffic.

I did more tests. If I create any rule called conntrack (in input, forward, with different conditions), Conntrack affects all traffic that passes through or to the router.

The problem still exists. I tried to redirect ipv6 multicast to nflog group via nft. After that, I see multicast traffic but it is encapsulated in gre ip, not in gre ipv6. Maybe this is the issue.

I have created bug report in Accel-ppp github https://github.com/accel-ppp/accel-ppp/issues/233

I created bug report in accel-ppp github https://github.com/accel-ppp/accel-ppp/issues/232

https://github.com/vyos/vyos-1x/pull/4217

@talmakion tested. everything works.