Thanks! This is definitely a non-issue then, closing.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Aug 6 2021
Aug 6 2021
Since we cannot update the kernel in 1.3 due to the QAT issues, we likely need to backport netmap support. It seems to have been introduced by this commit: https://github.com/torvalds/linux/commit/3ff7ddb1353da
@maznu
Add these lines:
Thank you for pointing that out - updated defaults.json and it seems to have made that issue go away.
For some reason its now breaking on using our internal repo (no TLS there, inside the datacenter), but i suspect its got something to do with the repo itself or some change in Debian since we started using it.
dmbaturin changed the status of T1083: Implement persistent/random address and port mapping options for NAT rules, a subtask of T2198: Rewrite NAT in new XML/Python style, from Open to Needs testing.
dmbaturin changed the status of T1083: Implement persistent/random address and port mapping options for NAT rules, a subtask of T3710: Upgrade the kernel in 1.3 to 5.10, from Open to Needs testing.
dmbaturin changed the status of T1083: Implement persistent/random address and port mapping options for NAT rules from Open to Needs testing.
I've tested it on 1.3 with kernel 5.4.138, and for me the persistent option works as expected. I think it's a non-issue for equuleus already and the task can be closed, though I'd like other people to test that first.
Not having much luck with the build environment — and it doesn't seem to be something I've caused, because I get the same error building vyos-1x from mainline:
@stepler interesting - this bahavior changes when running from frr-reload vs. vtysh.
GitHub <noreply@github.com> committed rVYOSONEX9aff90d36f15: Merge pull request #954 from sever-sever/T548 (authored by c-po).
GitHub <noreply@github.com> committed rVYOSONEX022cb9ead22a: Merge pull request #955 from sever-sever/T548-curr (authored by c-po).
I think all that is required is in: https://github.com/maznu/vyos-1x/commit/68d7897622ddaa4b2e5a98d79154500b33959567
Hello, @Dmitry, I agree. I'll prepare patches for 1.3 and 1.4.
Unhelpfully it looks like Salt has changed repo: https://repo.saltproject.io/#debian
GitHub <noreply@github.com> committed rVYOSONEXf9f97c17bca9: Merge pull request #953 from runborg/T3721 (authored by c-po).
Unknown Object (User) added a comment to T3724: Allow setting host-name in l2tp section of accel-ppp.
Hello @maznu , I also prefer the first variant set vpn l2tp remote-access lns host-name example.com I'm sure that we no need to overload l2tp remote-access root noded
Aug 5 2021
Aug 5 2021
Cheeze_It added a comment to T3634: Add op command option for ping for do not fragment bit to be set.
Made the change to "do" and I noticed that.....DF is used even if there is no DF bit explicitly set...:
Cheeze_It added a comment to T3634: Add op command option for ping for do not fragment bit to be set.
It seems the man page that I looked at I either didn't read carefully enough, or I completely messed it up. You're right @Viacheslav.
Cheeze_It added a comment to T3634: Add op command option for ping for do not fragment bit to be set.
Did a quick test...
Already rewritten in 1.4 and 1.3 T3535
https://phabricator.vyos.net/rVYOSONEX21527ef4551613fe9b7eed9e4b2ce33ad46fe540
Cheeze_It added a comment to T3634: Add op command option for ping for do not fragment bit to be set.
Hmmmm....it worked last time. I'll give it another run.
Viacheslav reopened T3634: Add op command option for ping for do not fragment bit to be set as "Open".
Reopen
It doesn't work properly
Viacheslav added a project to T681: Shaper QoS policy does not recognize 'lowdelay' DSCP value: VyOS 1.4 Sagitta.
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
ipsec start error ..
jestabro added a project to T3574: Add constraintGroup for combining validators with logical AND: test.
c-po closed T3719: Restart vpn shows some missed files, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, as Resolved.
jestabro closed T3574: Add constraintGroup for combining validators with logical AND as Unknown Status.
Unknown Object (User) added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
It is not critical, please test without this package "libstrongswan-standard-plugins"
All necessary data is already installed.
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
Setting up libstrongswan (5.7.2-1) ... Setting up libstrongswan-extra-plugins (5.7.2-1) ... dpkg: dependency problems prevent configuration of libstrongswan-standard-plugins: libstrongswan-standard-plugins depends on libssl1.0.0 (>= 1.0.2~beta3); however: Version of libssl1.0.0:amd64 on system is 1.0.1t-1+deb8u14.
Unknown Object (User) added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
strongswan.tar2 MBDownload
I have patched packages for 1.2.8. It works on my routers in the virtual environment.
Instruction:
- Upload package to the router
- Unarchiv it
sudo tar -xvf strongswan.tar
- Install packages
sudo dpkg -i *.deb
- Reboot router or reconfigure IPSec
As I understand there are 2 bugs:
- It expected --iroute-ipv6, i.e
iroute-ipv6 2001:470:1f14:af1:: ffff:ffff:ffff:ffff::
- Something wrong with such format (ipv6 address/ ipv4 mask)
ifconfig-push 2001:470:1f14:af1::2 255.255.240.0
Aug 4 2021
Aug 4 2021
c-po closed T3718: VPN IPsec IKE group by default not use DH-group 2, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, as Resolved.
@SrividyaA does this configuration work or not?
set interfaces openvpn vtun10 encryption cipher 'aes256' set interfaces openvpn vtun10 hash 'sha512' set interfaces openvpn vtun10 local-host '10.2.0.15' set interfaces openvpn vtun10 local-port '1194' set interfaces openvpn vtun10 mode 'server' set interfaces openvpn vtun10 persistent-tunnel set interfaces openvpn vtun10 protocol 'udp' set interfaces openvpn vtun10 server client client1 ip '2001:470:1f14:af1::2' set interfaces openvpn vtun10 server client client1 subnet '2001:470:1f14:af1::/64' set interfaces openvpn vtun10 server push-route '2001:db8:0:abc::/64' set interfaces openvpn vtun10 server subnet '10.140.0.0/20' set interfaces openvpn vtun10 server topology 'subnet' set interfaces openvpn vtun10 tls ca-cert-file '/config/auth/ea1/ca.crt' set interfaces openvpn vtun10 tls cert-file '/config/auth/ea1/central.crt' set interfaces openvpn vtun10 tls dh-file '/config/auth/ea1/dh.pem' set interfaces openvpn vtun10 tls key-file '/config/auth/ea1/central.key'
jestabro changed the status of T3474: Revisit storing syntax version of interface definitions in XML file, a subtask of T1962: Add syntax version to schema, from Open to In progress.
jestabro changed the status of T3474: Revisit storing syntax version of interface definitions in XML file, a subtask of T3475: XML dictionary cache unable to process syntaxVersion elements, from Open to In progress.
jestabro changed the status of T3474: Revisit storing syntax version of interface definitions in XML file from Open to In progress.
Viacheslav closed T320: OSPF does not redistribute connected routes associated with virtual tunnel interfaces as Resolved.
I don't see this bug in 1.3.0-rc5,
Aug 3 2021
Aug 3 2021
@stepler I created https://github.com/FRRouting/frr/pull/9281 for "easier" debugging
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
OK , Thank you!
GitHub <noreply@github.com> committed rVYOSONEXbc9936e5bebd: Merge pull request #950 from sever-sever/T1594 (authored by c-po).
c-po changed the status of T3718: VPN IPsec IKE group by default not use DH-group 2, a subtask of T2816: Rewrite IPsec scripts with the new XML/Python approach, from Open to Confirmed.
c-po changed the status of T3718: VPN IPsec IKE group by default not use DH-group 2 from Open to Confirmed.
I tried this locally and you can do no router bgp 100 vrf blue before no vni 2000, my vtysh instance does not scream for an error - it more feels like a programming issue on our side.
Viacheslav added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
In T2851#99364, @lawrencepan wrote:
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
sudo ip rule add prio 219 from 192.0.2.48/30 to 192.0.2.48/30 lookup main }
Viacheslav added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
As a workaround it can help in such cases:
lawrencepan added a comment to T2851: Invalid passthrough routes installing by strongSwan into table 220.
I get the same issue in 1.2.8.
Viacheslav updated the task description for T3720: IPSec set vti secondary address cause interface disable.