- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed Search
Jun 7 2021
Jun 7 2021
In the crux.
set system conntrack timeout custom rule 10 destination address '203.0.113.74' set system conntrack timeout custom rule 10 destination port '80' set system conntrack timeout custom rule 10 protocol tcp established '300' set system conntrack timeout custom rule 10 source address '192.0.2.168'
commit
vyos@r2-lts# commit [ system conntrack hash-size 32768 ] Updated conntrack hash size. This change will take affect when the system is rebooted.
Jun 2 2021
Jun 2 2021
It seems after that commit
but it is not a root case
Viacheslav added a parent task for T3595: Cannot create new VTI interface: T2816: Rewrite IPsec scripts with the new XML/Python approach.
Viacheslav edited projects for T3595: Cannot create new VTI interface, added: VyOS 1.4 Sagitta; removed VyOS 1.3 Equuleus.
Jun 1 2021
Jun 1 2021
Viacheslav renamed T3594: Disable by default service strongswan-starter from Disable by defaul service strongswan-starter to Disable by default service strongswan-starter.
Viacheslav changed the subtype of T3594: Disable by default service strongswan-starter from "Task" to "Bug".
Viacheslav added a comment to T842: Adopt VyOS CLI to latest StrongSwan options and deprecated Keywords.
Note
ipsec-interface not deprecated. This option needed.
set vpn ipsec ipsec-interfaces interface 'eth1'
Viacheslav closed T406: VPN configuration error: IPv6 over IPv4 IPsec is not supported when using IPv6 ONLY tunnel. as Resolved.
set vpn ipsec esp-group ESP-GRP compression 'disable' set vpn ipsec esp-group ESP-GRP lifetime '1800' set vpn ipsec esp-group ESP-GRP mode 'tunnel' set vpn ipsec esp-group ESP-GRP pfs 'enable' set vpn ipsec esp-group ESP-GRP proposal 1 encryption 'aes256' set vpn ipsec esp-group ESP-GRP proposal 1 hash 'sha1' set vpn ipsec ike-group IKE-GRP ikev2-reauth 'no' set vpn ipsec ike-group IKE-GRP key-exchange 'ikev1' set vpn ipsec ike-group IKE-GRP lifetime '3600' set vpn ipsec ike-group IKE-GRP proposal 1 encryption 'aes256' set vpn ipsec ike-group IKE-GRP proposal 1 hash 'sha1' set vpn ipsec ipsec-interfaces interface 'eth1' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 authentication pre-shared-secret 'SeCrEt' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 connection-type 'respond' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 ike-group 'IKE-GRP' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 local-address 'c01d:c01a:cafe::2' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 allow-nat-networks 'disable' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 allow-public-networks 'disable' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 esp-group 'ESP-GRP' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 local prefix '2001:db7::/64' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 0 remote prefix '2001:db8::/64' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 allow-nat-networks 'disable' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 allow-public-networks 'disable' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 esp-group 'ESP-GRP' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 local prefix '10.2.3.0/24' set vpn ipsec site-to-site peer c01d:c01a:cafe::1 tunnel 1 remote prefix '10.1.0.0/24'
Viacheslav renamed T3588: IPSec: migrate no longer available options from CLI which are now hardcoded/enabled in strongSwan from IPSec: migrate no longer available options from CLI which are now hardcoded/enabled in stringSwan to IPSec: migrate no longer available options from CLI which are now hardcoded/enabled in strongSwan.
May 31 2021
May 31 2021
@mTx87 Do you have a working example in Linux?
Maybe it also needs OpenVPN >= 2.5.0
https://blog.sdn.clinic/2018/12/openvpn-and-vrfs/
May 29 2021
May 29 2021
root@r2-lts:/home/vyos# snmpget -v 2c -c public 192.168.122.11 IF-MIB::ifAdminStatus.1 IF-MIB::ifAdminStatus.1 = INTEGER: up(1)
May 27 2021
May 27 2021
Viacheslav changed the status of T1976: deleting address-family under neighbor will disable neighbor from Needs testing to Confirmed.
The reason it such script https://github.com/vyos/vyatta-cfg-quagga/blob/d962ef0f2c15333411e719f7d1b02dd7575ebdee/scripts/bgp/vyatta-bgp.pl#L385
That do
router bgp xxx address-family ipv4 unicast no neighbor x.x.x.x activate
Viacheslav closed T2512: vyatta-op-quagga [show ip] to XML format, a subtask of T2511: Migrate vyatta-op-quagga to new XML format, as Resolved.
Viacheslav closed T2617: Rewrite vyatta-op-quagga "show" to XML, a subtask of T2546: The root task for rewriting [op-mode] to XML, as Resolved.
May 26 2021
May 26 2021
FRR doing normalization for ipv6
Possible was fixed in that task T3502
Unfortunately, I can't reproduce it.
Also, all smoke test for static routes looks good.
Viacheslav closed T3558: autocomplete options for dhcp-interface is not showing for the static route command as Resolved.
vyos@r4-1.3# set protocols static route 192.0.2.0/24 dhcp-interface Possible completions: <text> DHCP interface name eth0 eth1 lo
@olofl Add please a separate task for JSON.
Viacheslav added a comment to T3546: Add support for running scripts on PPPoE server session events.
As I understand the needed section
[pppd-compat] verbose=1 #ip-pre-up=/etc/ppp/ip-pre-up ip-up=/etc/ppp/ip-up ip-down=/etc/ppp/ip-down #ip-change=/etc/ppp/ip-change radattr-prefix=/var/run/radattr #fork-limit=16
Viacheslav added a parent task for T3560: Ability to create groups of MAC addresses: T2199: Rewrite firewall in new XML/Python style.
@masimo Can you check/test it?
Viacheslav changed the status of T3581: Incomplete command `show ipv6 ospfv3 linkstate` from Open to Confirmed.
The word "detail" is cut off for some reason.
https://github.com/vyos/vyos-1x/blob/32bc1e5babd1bd31909a93ca1818998bf46db003/op-mode-definitions/include/ospfv3-detail.xml.i#L7
Viacheslav added a comment to T3553: OSPFv3 redistribute configuration remains in frr running config after removal.
I can't reproduce it in 1.3-rc4
vyos@r4-1.3# run show conf com | match ospf set protocols ospfv3 area 0 interface 'lo' set protocols ospfv3 area 0 interface 'eth0' set protocols ospfv3 area 0 interface 'eth1' set protocols ospfv3 parameters router-id '1.2.3.4' set protocols ospfv3 redistribute static route-map 'FOO' [edit] vyos@r4-1.3#
May 25 2021
May 25 2021
Viacheslav changed the subtype of T3580: Refactoring firewall ipv6 rule icmpv6 from "Task" to "Feature Request".
Viacheslav changed the status of T3568: Add XML for firewall conf-mode, a subtask of T2199: Rewrite firewall in new XML/Python style, from Open to Needs testing.
May 24 2021
May 24 2021
PR https://github.com/vyos/vyos-1x/pull/854
Add XML for the firewall. For future rewriting to Python style.
May 22 2021
May 22 2021
Viacheslav added a parent task for T3569: Firewall wrong completion help values: T2199: Rewrite firewall in new XML/Python style.
May 21 2021
May 21 2021
Viacheslav changed the status of T2807: IPv6 Link-Local Address - Automatically generation/configuration on GRE Interfaces from Open to Needs testing.
Viacheslav added a subtask for T2199: Rewrite firewall in new XML/Python style: T3568: Add XML for firewall conf-mode.
Viacheslav added a parent task for T3568: Add XML for firewall conf-mode: T2199: Rewrite firewall in new XML/Python style.
Viacheslav added a comment to T3567: Building Crux from Docker Image failing to download repo index.
Viacheslav changed the status of T3567: Building Crux from Docker Image failing to download repo index from Open to Confirmed.
Viacheslav triaged T3567: Building Crux from Docker Image failing to download repo index as High priority.
Viacheslav added a project to T3567: Building Crux from Docker Image failing to download repo index: VyOS 1.2 Crux.
May 20 2021
May 20 2021
Function get_interface_config itself not added. Needs to add it for 1.3.
vyos@r4-1.3:~$ show int
Traceback (most recent call last):
File "/usr/libexec/vyos/op_mode/show_interfaces.py", line 26, in <module>
from vyos.ifconfig import Section
File "/usr/lib/python3/dist-packages/vyos/ifconfig/__init__.py", line 18, in <module>
from vyos.ifconfig.interface import Interface
File "/usr/lib/python3/dist-packages/vyos/ifconfig/interface.py", line 39, in <module>
from vyos.util import get_interface_config
ImportError: cannot import name 'get_interface_config' from 'vyos.util' (/usr/lib/python3/dist-packages/vyos/util.py)
vyos@r4-1.3:~$Fixed VyOS 1.4-rolling-202105192127
set protocols ospfv3 area 23 area-type stub set protocols ospfv3 area 25 area-type stub no-summary
Viacheslav moved T1995: "show vpn ike sa" command always show child-sas as down from Open to Backport Candidates on the VyOS 1.4 Sagitta board.
@olofl Can you re-check it? Or can we close it?
Viacheslav edited parent tasks for T3378: commit-archive source-address broken for IPv6 addresses, added: T3356: Script for remote file transfers; removed: T2651: Generate CLI abstraction for options passed to CURL and SSH client.
Viacheslav added a parent task for T1506: commit-archive scp/sftp public key authentication: T3356: Script for remote file transfers.
Viacheslav added a parent task for T3518: Warning messages when using SCP commit-archive: T3356: Script for remote file transfers.
Viacheslav added a parent task for T3563: commit-archive breaks with IPv6 source addresses: T3356: Script for remote file transfers.
May 19 2021
May 19 2021
As I understand it a part of zebra, not specified to any protocol.
Maybe I'm wrong and we don't need it.
Viacheslav edited projects for T3394: Error on removing dhcpv6 address from interface, added: VyOS 1.2 Crux (VyOS 1.2.8); removed VyOS 1.2 Crux.
A similar problem, only for ipv4 https://phabricator.vyos.net/T1053
As we can see ipv6 address before normalization without prefix
DEBUG: 2001:db8::191 before normalize
https://github.com/vyos/vyatta-cfg-system/blob/165e56e88763c40f13e6ef77f5df1c888fdfb899/scripts/vyatta-address#L38
@c-po Nope,
vyos@r6-roll:~$ sudo ip -d link show | grep vtun -A 5
5: vtun1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT group default qlen 100
link/none promiscuity 0 minmtu 68 maxmtu 65535
tun type tun pi off vnet_hdr off persist off addrgenmode none numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535