In 1.5-rolling-202502030007, if the global state-policy for invalid packets is set to reject, a error is produced:
vyos@host# set firewall global-options state-policy invalid action
Possible completions:
accept Action to accept
drop Action to drop
reject Action to reject
[edit]
vyos@host# set firewall global-options state-policy invalid action reject
[edit]
vyos@host# commit
[ firewall ]
Failed to apply firewall: /run/nftables.conf:2234:9-39: Error: Could not
process rule: Operation not supported ct state invalid counter
reject ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/run/nftables.conf:2235:9-39: Error: Could not process rule: Operation
not supported ct state related counter accept
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:2236:9-14: Error:
Could not process rule: Operation not supported return
^^^^^^
[[firewall]] failed
Commit failedThis worked in an older version (for ex. 1.5-rolling-202406060020) and the completion shows it as a valid option.
The actions "drop" and "accept" still work fine.