Example vyos config:

@daniil Any idea for CLI and what it should generate to strongswan.conf?
Which plugin should it use?
https://docs.strongswan.org/docs/5.9/plugins/plugins.html

eap-dynamic Plugin
eap-gtc Plugin
eap-radius Plugin
eap-simaka-sql Plugin
eap-tls Plugin

I’d expect the behavior is correct now. There shouldn't be empty nodes. As some of them uses “default values” and system can see it as partly configured,
In any case the check is here https://github.com/vyos/vyos-1x/blob/ec18cc393591052fd1f021c4a62220ab2e537a2e/src/conf_mode/service_ntp.py#L68

https://github.com/vyos/vyos-1x/pull/4207

This is resolved for rolling, and not applicable to Circinus until backport of T6326.

So yes, that's the idea, and the tools are there for a simple implementation (done in May, rebased now for comparison):
https://github.com/vyos/vyos-1x/compare/current...jestabro:example-property-secret

@sarthurdev i think it can be good idea to those case , what do you think ? @dmbaturin @jestabro

Could nodes be flagged as sensitive in XML properties and that flag exposed to op-mode show scripts?

This is mentioned in https://github.com/vyos/vyos-documentation/blob/current/docs/changelog/1.3.rst as a fix in upcoming 1.3.9 - but the backport https://github.com/vyos/vyos-1x/pull/3015 had conflicts and was closed.
So, just a question - what is really the status of this in equuleus?

@sarthurdev and need to be in 1.4?

PR:
https://github.com/vyos/vyos-1x/pull/4202

This will be squashed with https://vyos.dev/T6326 for backport to Circinus, after confirmation.

This will need the fix in https://vyos.dev/T6899 for backport to Circinus.

PR:
https://github.com/vyos/vyos-1x/pull/4197

Yes, I linked the article for background why the MTU setting is helpful, this applies to Podman as well as Docker.

We use podman for containers.
Eq command for the podman:

vyos@r14:~$ sudo podman network create pod-net2 --opt mtu=1200
pod-net2
vyos@r14:~$

Check:

vyos@r14:~$ sudo podman network inspect pod-net2
[
     {
          "name": "pod-net2",
          "id": "f1ec367ee95ee0f5b644b7fb96faffa6cf499490e3ff5e8f3915182639302cc7",
          "driver": "bridge",
          "network_interface": "podman1",
          "created": "2024-11-18T10:08:28.26831792Z",
          "subnets": [
               {
                    "subnet": "10.89.0.0/24",
                    "gateway": "10.89.0.1"
               }
          ],
          "ipv6_enabled": false,
          "internal": false,
          "dns_enabled": true,
          "options": {
               "mtu": "1200"
          },
          "ipam_options": {
               "driver": "host-local"
          }
     }
]
vyos@r14:~$

When trying to make a non-working peer via the command reset vpn ipsec site-to-site peer RIGHT
Gives an error

PR https://github.com/vyos/vyos-build/pull/839

As covered in last comment, all matters have been addressed, but for (then) open question re firewall migration. If that recurs, or still present, we will open a specific task.

The only piece remaining here is a backport for Equuleus.