Page MenuHomeVyOS Platform

Commit fails when removing a firewall local zone
Closed, ResolvedPublicBUG

Description

UPD:
Re-tested in 2025.11.18-0020-rolling

Since this commit behaviour is different - no traceback produced but a commit failed message:

vyos@vyos# comp
[firewall zone LOCAL]
- local-zone

[edit]

vyos@vyos# commit
[ firewall ]
Zone "LOCAL" has no interfaces and is not the local zone
[[firewall]] failed
Commit failed
[edit]

vyos@vyos# comp
[firewall zone LOCAL]
- local-zone

[edit]

An attempt to commit the subject changes results in the following error:

Traceback (most recent call last):
  File "/usr/libexec/vyos/services/vyos-configd", line 144, in run_script
    c = script.get_config(config)
        ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/libexec/vyos/conf_mode/firewall.py", line 148, in get_config
    if 'vrf' in local_zone_conf['member']:
                ~~~~~~~~~~~~~~~^^^^^^^^^^
KeyError: 'member'

[[firewall]] failed
Commit failed

Steps to reproduce:

set firewall zone LOCAL local-zone
commit
delete firewall zone LOCAL local-zone
commit

Details

Version
2025.11.18-0020-rolling
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

Unknown Object (User) triaged this task as Normal priority.Sep 4 2025, 6:03 PM
a.kudientsov changed Version from 2025.08.28-0019-rolling to 2025.11.18-0020-rolling.

Re-tested in 2025.11.18-0020-rolling

Since this commit behaviour is different - no traceback produced but a commit failed message:

vyos@vyos# comp
[firewall zone LOCAL]
- local-zone

[edit]

vyos@vyos# commit
[ firewall ]
Zone "LOCAL" has no interfaces and is not the local zone
[[firewall]] failed
Commit failed
[edit]

vyos@vyos# comp
[firewall zone LOCAL]
- local-zone

[edit]

Seems like the initial KeyError issue is resolved recently in https://vyos.dev/T7112

Viacheslav assigned this task to o.kuchmystyi.
Viacheslav subscribed.

Commit failed because you have to set local-zone and you don't have it
Behavior is correct.