@a.kudientsov thanks for the detailed report and the reproducer. You wrote that you have local patches for both parts (skipping the drain in lcp_nl_pair_add_cb when
there is no socket, and the state sync during the resync window) that remove the stuck state in your tests.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
All Stories
Mon, Oct 19
I checked this against current rolling and the description matches what I see in the sources:
Because of that the fix belongs in FRR: batch a hard clear (BGP_CLEAR_SOFT_NONE) also when a family is given. Then clearing a group with a family filter is fast as well.
FRR issue: https://github.com/FRRouting/frr/issues/23771. I also opened a patch with a topotest: https://github.com/FRRouting/frr/pull/23779.
I looked at this in the FRR source (stable/10.5 and master, same code), and the cause is a bit wider than the ip token.
Sun, Oct 18
Implementation superseeded by https://github.com/vyos/vyos-1x/pull/5579
Removing bgpq3 from data/live-build-config/package-lists/vyos-utils.list.chroot resolves the error. I must have had dragged it with me in my own version of that file.
Sat, Oct 17
@najieb_haswell VyOS 1.5.2 will run at least Kernel 6.6.159 and ICE 2.6.7, IAVF 4.13.35, I40E 2.30.18 - or even newer
vyos-build was recently updated with FRR 10.7.1. This is now unblocked, PR#5570 submitted.
Fri, Oct 16
I can confirm "set system option disable-usb-autosuspend" fixes the issue on Supermicro X11SCM-F with current BIOS 2.9 / BMC 1.74.21.
The virtual keyboard can be made to work for a while by clicking Options -> Keyboard Mouse Hotplug in the iKVM window.
Then quickly type this (the keyboard freezes again after a few seconds of inactivity):
With no traffic-selector configured, the template falls back to 0.0.0.0/0,::/0 for both local and remote. That is the same proposal as listing both families explicitly, so the result is identical: the responder narrows the CHILD_SA to IPv4 and IPv6 stays down. The default does not help, because both families are always sent in one CHILD_SA.
The only way to get both families up against this peer is one CHILD_SA per family. That is what the PR does: https://github.com/vyos/vyos-1x/pull/5565. I tested it against a real Sophos Firewall by configuring the two children by hand: both were installed and IPv6 worked, with no change on the Sophos side.
@rherold, what will happen if you remove the traffic-selector option altogether?
Thanks for the capture, that settles it.
Options on a client class (and possibly a list of classes per subnet) would be a new feature. I can open a separate task for that if you want it.
Thanks for testing, @DuxOv8.
The default server in the yealink phone is normal and this is the default URL after a factory reset (https://updateyealink.lydis.com ....
Hi Team,
Thu, Oct 15
Great @Viacheslav ! I'll wait for the next rolling release to test this new feature. Thank you both (you and @rherold) and VyOS Team