I would like to contribute with a PR about this. At the same, time I would need some guidance on identifying the conditions requiring the onlink option to be added.

https://github.com/vyos/vyos-1x/pull/2495

As I undestand it is possible now to create multiple auth ID's

vyos@r4# set vpn ipsec authentication psk FOO id 
Possible completions:
   <text>               ID used for authentication

Not sure about other options.

Tested in VyOS 1.4-rolling-202311100309 (AES)

Tested in VyOS 1.4-rolling-202311100309 (3DES)

In VyOS 1.3.4
Configs:

I have a similar setup where I have two VyOS VMs used as VPN routers with some firewalling enabled. Since I use OSPF for dynamic routing I am not able to synchronize the sessions between both routers so in case one VPN router fails the other one can't take over flawlessly. Having conntrack-sync configuration separated from VRRP would be a great benefit.

I tested in VyOS 1.4-rolling-202311100309

https://github.com/vyos/vyos-1x/pull/2492
for equuleus

Tested in VyOS 1.4-rolling-202311100309
Tried with single quotes: ''

looks great from my perspective (I've just updated our nodes. Tested on Community Edition client on windows and Connect V3 client on windows and Tunnelblick on Mac all working as expected. (I tested with; 1.5-rolling-202311150738).
nice work!

Created a related feature request but for VRRP here
https://vyos.dev/T5745

to keep track of this request on git
https://github.com/vyos/vyos-1x/pull/1960

I had entered the command as you have suggested and I think it's working somehow.

This is still an issue in 1.5. I tried importing a cert signed by my own CA and got the same error.

PR for 1.5
https://github.com/vyos/vyos-1x/pull/2483

Tested VyOS 1.4-rolling-202311100309

PR for 1.5: https://github.com/vyos/vyatta-cfg-system/pull/213

New patch for migration scripts in 1.5: https://github.com/vyos/vyos-1x/pull/2480

Changing this https://github.com/vyos/vyos-1x/blob/2e587c8329a1d32fc1ec601c7753211d0fedbf2c/python/vyos/remote.py#L356
to

download(local_path, urlstring, False, True, source_host, source_port)

Fixes the issue for API

https://github.com/vyos/vyos-1x/pull/2479

Contact me via Slack for testing

The fear of having the HTTP-API part of nginx compromised by another virtualhost config (as in they are sharing the same process) should be overcome by having a dedicated config file and start a 2nd nginx process.

I have created a draft pull request for FRR, but I can still see a bunch of odd bugs.
I'm going to activate it after additional testing by the team.
Most issues involve Wireshark's inability to parse packets correctly and display an exception, although the demons seem to run fine.
https://github.com/FRRouting/frr/pull/14788

I`m back after a long break and will follow up on this feature.
Here is a summary of things that have happened since the last update:

1. In my absence, the feature testing got broken as a result of migrating from the `mininet` to the `munet` framework
From debugging, I have identified a root cause to be - bpf fs was not inherited by the `munet` router.
The solution is to hop into the router mount namespace for the test run.

Because there is a long-running development for operation data retrieval, we can postpone this ticket until an effort is finished.
Then, I can open a feature request or visit the yang meeting and start a discussion about the data pagination functionality.
Currently, my idea is to simulate pagination at the fs level by having a split of requested JSON.
This solution involves:

• Fetching an operation data from the demon

vtysh -c "show yang operational-data /frr-vrf:lib/vrf[name='default']/frr-zebra:zebra/ribs zebra" > big.json

• Fetching flat data stream and formating it 1 item (prefix) per line with jq -c option

jq -c '."frr-vrf:lib" .vrf[0] ."frr-zebra:zebra" .ribs .rib[0] .route[]' big.json | split -l 100 -d

• Splitting result by the number of lines (objects), saving into files on the filesystem

Now, UI can display 1 of the resulting files at a time. These files may be regenerated on page refresh.
Such a solution will utilize extra disk space, although it can be avoided by using pipes and other
streaming utilities like awk/sed

PR for Sagitta: https://github.com/vyos/vyos-1x/pull/2478

Will be tracked via PR https://github.com/vyos/vyos-1x/pull/2476 as it's realted to the ongoing PIM/PIM6 CLI extension

In T5167#164447, @JeffWDH wrote:

What about using nginx which seems to be already leveraged by the web API?

I would vote for that (using nginx as backend since it already exists).

What about using nginx which seems to be already leveraged by the web API?

PR for VyOS 1.5 https://github.com/vyos/vyos-1x/pull/2476

Instead of "file-server" I think "http-server" would be a better name or even "web-server" in this context.