In the crux.
set system conntrack timeout custom rule 10 destination address '203.0.113.74' set system conntrack timeout custom rule 10 destination port '80' set system conntrack timeout custom rule 10 protocol tcp established '300' set system conntrack timeout custom rule 10 source address '192.0.2.168'
commit
vyos@r2-lts# commit [ system conntrack hash-size 32768 ] Updated conntrack hash size. This change will take affect when the system is rebooted.
It seems after that commit
but it is not a root case
Note
ipsec-interface not deprecated. This option needed.
set vpn ipsec ipsec-interfaces interface 'eth1'
set vpn ipsec esp-group ESP-GRP compression 'disable' set vpn ipsec esp-group ESP-GRP lifetime '1800' set vpn ipsec esp-group ESP-GRP mode 'tunnel' set vpn ipsec esp-group ESP-GRP pfs 'enable' set vpn ipsec esp-group ESP-GRP proposal 1 encryption 'aes256' set vpn ipsec esp-group ESP-GRP proposal 1 hash 'sha1' set vpn ipsec ike-group IKE-GRP ikev2-reauth 'no' set vpn ipsec ike-group IKE-GRP key-exchange 'ikev1' set vpn ipsec ike-group IKE-GRP lifetime '3600' set vpn ipsec ike-group IKE-GRP proposal 1 encryption 'aes256' set vpn ipsec ike-group IKE-GRP proposal 1 hash 'sha1' set vpn ipsec ipsec-interfaces interface 'eth1' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 authentication pre-shared-secret 'SeCrEt' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 connection-type 'respond' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 ike-group 'IKE-GRP' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 local-address 'c01d:c01a:cafe::2' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 allow-nat-networks 'disable' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 allow-public-networks 'disable' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 esp-group 'ESP-GRP' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 local prefix '2001:db7::/64' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 remote prefix '2001:db8::/64' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 allow-nat-networks 'disable' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 allow-public-networks 'disable' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 esp-group 'ESP-GRP' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 local prefix '10.2.3.0/24' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 remote prefix '10.1.0.0/24'
@mTx87 Do you have a working example in Linux?
Maybe it also needs OpenVPN >= 2.5.0
https://blog.sdn.clinic/2018/12/openvpn-and-vrfs/
root@r2-lts:/home/vyos# snmpget -v 2c -c public 192.168.122.11 IF-MIB::ifAdminStatus.1 IF-MIB::ifAdminStatus.1 = INTEGER: up(1)
The reason it such script https://github.com/vyos/vyatta-cfg-quagga/blob/d962ef0f2c15333411e719f7d1b02dd7575ebdee/scripts/bgp/vyatta-bgp.pl#L385
That do
router bgp xxx address-family ipv4 unicast no neighbor x.x.x.x activate
FRR doing normalization for ipv6
Possible was fixed in that task T3502
Unfortunately, I can't reproduce it.
Also, all smoke test for static routes looks good.
vyos@r4-1.3# set protocols static route 192.0.2.0/24 dhcp-interface Possible completions: <text> DHCP interface name eth0 eth1 lo
@olofl Add please a separate task for JSON.
As I understand the needed section
[pppd-compat] verbose=1 #ip-pre-up=/etc/ppp/ip-pre-up ip-up=/etc/ppp/ip-up ip-down=/etc/ppp/ip-down #ip-change=/etc/ppp/ip-change radattr-prefix=/var/run/radattr #fork-limit=16
@masimo Can you check/test it?
The word "detail" is cut off for some reason.
https://github.com/vyos/vyos-1x/blob/32bc1e5babd1bd31909a93ca1818998bf46db003/op-mode-definitions/include/ospfv3-detail.xml.i#L7
I can't reproduce it in 1.3-rc4
vyos@r4-1.3# run show conf com | match ospf set protocols ospfv3 area 0 interface 'lo' set protocols ospfv3 area 0 interface 'eth0' set protocols ospfv3 area 0 interface 'eth1' set protocols ospfv3 parameters router-id '1.2.3.4' set protocols ospfv3 redistribute static route-map 'FOO' [edit] vyos@r4-1.3#
PR https://github.com/vyos/vyos-1x/pull/854
Add XML for the firewall. For future rewriting to Python style.
Function get_interface_config itself not added. Needs to add it for 1.3.
vyos@r4-1.3:~$ show int
Traceback (most recent call last):
File "/usr/libexec/vyos/op_mode/show_interfaces.py", line 26, in <module>
from vyos.ifconfig import Section
File "/usr/lib/python3/dist-packages/vyos/ifconfig/__init__.py", line 18, in <module>
from vyos.ifconfig.interface import Interface
File "/usr/lib/python3/dist-packages/vyos/ifconfig/interface.py", line 39, in <module>
from vyos.util import get_interface_config
ImportError: cannot import name 'get_interface_config' from 'vyos.util' (/usr/lib/python3/dist-packages/vyos/util.py)
vyos@r4-1.3:~$Fixed VyOS 1.4-rolling-202105192127
set protocols ospfv3 area 23 area-type stub set protocols ospfv3 area 25 area-type stub no-summary
@olofl Can you re-check it? Or can we close it?
As I understand it a part of zebra, not specified to any protocol.
Maybe I'm wrong and we don't need it.
A similar problem, only for ipv4 https://phabricator.vyos.net/T1053
As we can see ipv6 address before normalization without prefix
DEBUG: 2001:db8::191 before normalize
https://github.com/vyos/vyatta-cfg-system/blob/165e56e88763c40f13e6ef77f5df1c888fdfb899/scripts/vyatta-address#L38
@c-po Nope,
vyos@r6-roll:~$ sudo ip -d link show | grep vtun -A 5
5: vtun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT group default qlen 100
link/none promiscuity 0 minmtu 68 maxmtu 65535
tun type tun pi off vnet_hdr off persist off addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535@c-po
I propose to add "set routing-options x.x.x.x"
And also migrate protocols xxx route-map
set protocols bgp 65001 route-map RMAP set protocols bgp|ospf|isis route-map RMAP
@wsapplegate I create a PR for it https://github.com/vyos/vyos-1x/pull/847
Can you describe how to test/check it? I'm not familiar with that dns format. I tried zone with dot and without. Not sure how to check/test it.
@rizkidtn I don't understand exactly what wrong with the community?
Customers sent you routes, with blackhole community, on the router you mark match this community and set next hop "blackhole" IP address.