- 1) When specifying a network-group which contains a generic network, for example /24, then adding a more specific network returns an error, but configuration is saved:
vyos@edgecore-per-test# set firewall group network-group NG network 198.51.100.0/24 [edit] vyos@edgecore-per-test# commit [edit] vyos@edgecore-per-test# set firewall group network-group NG network 198.51.100.99/32 [edit] vyos@edgecore-per-test# commit [ firewall group network-group NG ] Error: member [198.51.100.99/32] already exists in [NG] [edit] vyos@edgecore-per-test# run show config comm | grep group set firewall group network-group NG network '198.51.100.0/24' set firewall group network-group NG network '198.51.100.99/32' [edit] vyos@edgecore-per-test# sudo ipset -L Name: NG Type: hash:net Revision: 6 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 512 References: 0 Number of entries: 1 Members: 198.51.100.0/24 [edit] vyos@edgecore-per-test#
- 2a) Then removing element /32 from vyos config, returns ipset error message:
vyos@edgecore-per-test# del firewall group network-group NG network 198.51.100.99/32 [edit] vyos@edgecore-per-test# commit [ firewall group network-group NG ] ipset v6.38: Kernel support protocol versions 6-7 while userspace supports protocol versions 6-6 Element cannot be deleted from the set: it's not added Error: call to ipset failed [256]
- 2b) If while removing the /32 entry (which exists on firewall cli, but doesn't exist on ipset) we also add another valid entry, is even worst:
- vyos cli removes the /32 and adds new entry.
- ipset error while deleting /32 (which it does not exists in ipset configuration) and new configuration is not loaded into ipset.
vyos@edgecore-per-test# run show config comm | grep group set firewall group network-group NG network '198.51.100.0/24' set firewall group network-group NG network '198.51.100.99/32' [edit] vyos@edgecore-per-test# sudo ipset -L Name: NG Type: hash:net Revision: 6 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 512 References: 0 Number of entries: 1 Members: 198.51.100.0/24 [edit] vyos@edgecore-per-test# set firewall group network-group NG network 203.0.113.0/24 [edit] vyos@edgecore-per-test# del firewall group network-group NG network 198.51.100.99/32 [edit] vyos@edgecore-per-test# commit [ firewall group network-group NG ] ipset v6.38: Kernel support protocol versions 6-7 while userspace supports protocol versions 6-6 Element cannot be deleted from the set: it's not added Error: call to ipset failed [256] [edit] vyos@edgecore-per-test# run show config comm | grep group set firewall group network-group NG network '198.51.100.0/24' set firewall group network-group NG network '203.0.113.0/24' [edit] vyos@edgecore-per-test# sudo ipset -L Name: NG Type: hash:net Revision: 6 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 512 References: 0 Number of entries: 1 Members: 198.51.100.0/24 [edit] vyos@edgecore-per-test#