We have a physical router (Lannerinc) running VyOS 1.5-Q2.
The device is relying on BGP for routing purposes (not in config, not relevant for the problem)
and therefore using a separate VRF for management purposes.
We are using zone-based firewall approach on the device.
So far in version 1.5-Q2 it is working great.
Today I tried to upgrade the device but was not able to connect to ssh after the reboot.
The connections via management card to the machine did not bring up any problems.
I was able to capture incoming SSH attempts via tcpdump from a neighbor device within the same management network.
Unfortunately, I was not able to see any answers on any interface (even the non-vrf interfaces).
An outgoing arping was working, so network in general seems to work.
The routing table for the default instance and the vrf instance was also looking good.
During troubleshooting I checked the release notes (blog article) for Version 2025.11 and I saw that there was a change: T7452.
The simplified configuration looks like the following:
firewall {
global-options {
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
ipv4 {
name ALLOW_ALL_4 {
default-action drop
rule 10 {
action accept
}
}
}
zone Firewall {
default-action drop
from MGMT {
firewall {
name ALLOW_ALL_4
}
}
local-zone
}
zone MGMT {
default-action drop
description "Management Access"
from Firewall {
firewall {
name ALLOW_ALL_4
}
}
member {
interface MGMT
vrf MGMT
}
}
}
interfaces {
ethernet eth12 {
address 100.68.1.9/24
vrf MGMT
}
loopback lo {
}
}
service {
lldp {
interface all {
}
legacy-protocols {
cdp
}
}
ssh {
port 22
vrf MGMT
}
}
system {
host-name cr-gw-09
option {
reboot-on-upgrade-failure 5
}
sysctl {
parameter net.ipv4.fib_multipath_hash_policy {
value 1
}
parameter net.ipv4.tcp_wmem {
value "4096 87380 67108864"
}
}
syslog {
local {
facility all {
level info
}
facility local7 {
level debug
}
}
}
time-zone Europe/Berlin
}
vrf {
name MGMT {
protocols {
static {
route 0.0.0.0/0 {
next-hop 100.68.1.254 {
}
}
}
}
table 100
}
}