Page MenuHomeVyOS Platform

ipsec: remote-access commit fails when local port is configured
Closed, ResolvedPublicBUG

Description

config:

set vpn ipsec ike-group IKE key-exchange ikev2
set vpn ipsec ike-group IKE lifetime 3600
set vpn ipsec ike-group IKE proposal 1 encryption aes256
set vpn ipsec ike-group IKE proposal 1 hash sha256
set vpn ipsec ike-group IKE proposal 1 dh-group 14
set vpn ipsec esp-group ESP lifetime 3600
set vpn ipsec esp-group ESP proposal 1 encryption aes256
set vpn ipsec esp-group ESP proposal 1 hash sha256
set vpn ipsec remote-access pool POOL prefix 10.99.0.0/24
set vpn ipsec remote-access connection RA authentication local-users username vpnuser password secret123
set vpn ipsec remote-access connection RA authentication server-mode pre-shared-secret
set vpn ipsec remote-access connection RA authentication pre-shared-secret mysecretkey123
set vpn ipsec remote-access connection RA esp-group ESP
set vpn ipsec remote-access connection RA ike-group IKE
set vpn ipsec remote-access connection RA local-address 192.168.1.1
set vpn ipsec remote-access connection RA pool POOL

set vpn ipsec remote-access connection RA local port 4500

Error when trying to commit config:

vyos@vyos# commit
[ vpn ipsec ]
Traceback (most recent call last):
  File "/usr/libexec/vyos/services/vyos-configd", line 156, in run_script
    script.generate(c)
  File "/usr/libexec/vyos/conf_mode/vpn_ipsec.py", line 870, in generate
    render(swanctl_conf, 'ipsec/swanctl.conf.j2', ipsec)
  File "/usr/lib/python3/dist-packages/vyos/template.py", line 174, in render
    rendered = render_to_string(template, content, formater, location)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/vyos/template.py", line 143, in render_to_string
    rendered = template.render(content)
               ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/jinja2/environment.py", line 1301, in render
    self.environment.handle_exception()
  File "/usr/lib/python3/dist-packages/jinja2/environment.py", line 936, in handle_exception
    raise rewrite_traceback_stack(source=source)
  File "/usr/share/vyos/templates/ipsec/swanctl.conf.j2", line 22, in top-level template code
    {{ remote_access_tmpl.conn(rw, rw_conf, ike_group, esp_group) }}
    ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/jinja2/runtime.py", line 777, in _invoke
    rv = self._func(*arguments)
         ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/share/vyos/templates/ipsec/swanctl/remote_access.j2", line 78, in template
    {% set local_suffix = '[%any/{1}]'.format(local_port) if local_port else '' %}
    ^^^^^^^^^^^^^^^^^^^^^^^^^
IndexError: Replacement index 1 out of range for positional args tuple

In '[%any/{1}]'.format(local_port), {1} selects the second argument but only local_port is passed (index 0)

Details

Version
2026.03.14-0024-rolling
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)