- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
All Stories
Sat, Oct 17
@najieb_haswell VyOS 1.5.2 will run at least Kernel 6.6.159 and ICE 2.6.7, IAVF 4.13.35, I40E 2.30.18 - or even newer
vyos-build was recently updated with FRR 10.7.1. This is now unblocked, PR#5570 submitted.
Fri, Oct 16
I can confirm "set system option disable-usb-autosuspend" fixes the issue on Supermicro X11SCM-F with current BIOS 2.9 / BMC 1.74.21.
The virtual keyboard can be made to work for a while by clicking Options -> Keyboard Mouse Hotplug in the iKVM window.
Then quickly type this (the keyboard freezes again after a few seconds of inactivity):
With no traffic-selector configured, the template falls back to 0.0.0.0/0,::/0 for both local and remote. That is the same proposal as listing both families explicitly, so the result is identical: the responder narrows the CHILD_SA to IPv4 and IPv6 stays down. The default does not help, because both families are always sent in one CHILD_SA.
The only way to get both families up against this peer is one CHILD_SA per family. That is what the PR does: https://github.com/vyos/vyos-1x/pull/5565. I tested it against a real Sophos Firewall by configuring the two children by hand: both were installed and IPv6 worked, with no change on the Sophos side.
@rherold, what will happen if you remove the traffic-selector option altogether?
Thanks for the capture, that settles it.
Options on a client class (and possibly a list of classes per subnet) would be a new feature. I can open a separate task for that if you want it.
Thanks for testing, @DuxOv8.
The default server in the yealink phone is normal and this is the default URL after a factory reset (https://updateyealink.lydis.com ....
Hi Team,
Thu, Oct 15
Great @Viacheslav ! I'll wait for the next rolling release to test this new feature. Thank you both (you and @rherold) and VyOS Team
@DuxOv8 feel free to test/check it. It will be available in the next rolling release (after the 15th of October)
There's now a fix for this in https://github.com/vyos/vyos-1x/pull/5519
It would be great if a maintainer could take a look when there's time.
Wed, Oct 14
Another instance, VyOS Stream 2026.03 (vyos-1x 1.5dev0-3990-g9a296ec12), site-to-site to an Azure VPN Gateway (IKEv2, no reauth, DPD restart). On 2026-10-12 the vti was left admin-down while its CHILD_SA stayed INSTALLED: IKE and child SA reported up, BGP over the vti sat in Active, bytes out 0 for two days. /tmp/ipsec_vti_interfaces had lost the entry; reset vpn ipsec site-to-site peer re-ran up-client and recovered it. Confirms the DB key needs the SA identity (PLUTO_UNIQUEID), as proposed. Workaround in place: a cron job that re-raises any xfrm interface whose if_id matches an INSTALLED CHILD_SA (via vici) by re-running the updown hook's up path.
This behaviour was observed on our current production version from January 2026.
I have tried it on the rolling version from the 7th October but i cannot get this version to work because it is affected by the interface renaming bug (T9291), so the WWAN interface will not come up at all.
I guess we have to wait until the bug is fixed before we can test if the bug we discovered is still applicable.
Which version?
Can this not be implemented directly with nftables, since it can match VRF members?
PR created: https://github.com/vyos/vyos-1x/pull/5559
PR created: https://github.com/vyos/vyos-1x/pull/5557
Tue, Oct 13
Will be available in the next rolling release.