It can't be implemented in 1.3, as it doesn't use swanctl.conf for peers configuration
I didn't find this option for ipsec.conf

PR https://github.com/vyos/vyos-1x/pull/1129

set vpn ipsec site-to-site peer 192.0.2.14 tunnel 0 local prefix '172.16.0.0/24'
set vpn ipsec site-to-site peer 192.0.2.14 tunnel 0 priority '100'
set vpn ipsec site-to-site peer 192.0.2.14 tunnel 0 remote prefix '10.0.0.0/24'

I want to leave a comment , it's also common that customers don't know that PVST is enabled by default (and send bpdu peer VLANS), So it's possible to mitigate it also using nf rules , below leave a example:

How about starting with a simple interface and allowing to set interface for binding address?

set high-availability vrrp group foo address 203.0.113.1 interface ethX      
Possible completions:
 > ethN         Interfcae used to assign virtual address
 > eth0         
 > eth1         
 > eth2

This sounds like a "peer-link" or "heartbeat-link" between two VyOS boxes. I have yet no idea how the CLI could look like, maybe you have one?

Suggested fix: https://github.com/vyos/vyatta-op/pull/52

Problem (2) with multiple IPv6 remotes fixed.

During multiple tests on my testlab I found two (or three) possible bugs:
1.)
vyos-cli does not prevent to mix IPv4 and IPv6 remotes. Mixing them is not possible with vxlan.

PR to fix the problem: https://github.com/vyos/vyos-1x/pull/1128
It is compatible with both 1.3 and 1.4, so can be cherry-picked from sagitta to equuleus.

This is a mutability issue: since under vyos-configd the script is loaded as module, global variables persist, however:

@insignia96 Will be present in the next rolling release.

PR started:
https://github.com/vyos/vyos-1x/pull/1127

To reproduce:

set interfaces ethernet eth2 vif 35
set interfaces pppoe pppoe0 authentication password 'MYPASSWORD'
set interfaces pppoe pppoe0 authentication user 'MYUSER'
set interfaces pppoe pppoe0 default-route 'force'
set interfaces pppoe pppoe0 mtu '1492'
set interfaces pppoe pppoe0 redirect 'ifb0'
set interfaces pppoe pppoe0 source-interface 'eth2.35'
set interfaces pppoe pppoe0 traffic-policy out 'OUT2'
set interfaces input ifb0

Commit:

vyos@r11-roll# commit
[ interfaces pppoe pppoe0 redirect ifb0 ]
Cannot find device "pppoe0"
tc qdisc ingress failed at /opt/vyatta/sbin/vyatta-qos.pl line 334.

Test version:
VyOS 1.4-rolling-202112290317
Result:

Never done this before. I hope that PR is correct:
https://github.com/vyos/vyos-1x/pull/1126

Just fork the repository vyos-1x and create a PR with propper commit format.
https://docs.vyos.io/en/equuleus/contributing/development.html#fork-repository-and-submit-patch
https://github.com/vyos/vyos-1x/blob/current/CONTRIBUTING.md

Related task https://phabricator.vyos.net/T4119

PR https://github.com/vyos/vyos-1x/pull/1125

Maybe "is_addr_assigned" on "python/vyos/validate.py" needs to be patched too.
When I set "listen-address fe80::abc2%eth0" to service tftp-server then "is_addr_assigned" got called and run into an error:

At the moment I am testing the patch with some common services and found a tiny issue inside the auto completion feature.

In T4014#114910, @johannrichard wrote:

@Viacheslav, appreciate your question, and yes, there is:

ntopng/ntopng (https://hub.docker.com/r/ntop/ntopng/) as well as nprobe require that their configuration options and/or an option with the path to a config file are passed as arguments, it won’t just pick up a/any file, and thus won’t run without proper command arguments.

There are certainly others, but these are the ones I’m working towards running on VyOS.*

@Viacheslav, appreciate your question, and yes, there is:

One issue with static + dhcp on one interface at the same time.
After renew, the static address 192.168.122.11 is disappears
To reproduce:

vyos@r11-roll:~$ show conf com | match eth0
set interfaces ethernet eth0 address '192.168.122.11/24'
set interfaces ethernet eth0 address 'dhcp'

Renew dhcp:

vyos@r11-roll:~$ renew dhcp interface eth0

Static address not in the system:

vyos@r11-roll:~$ show int
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface        IP Address                        S/L  Description
---------        ----------                        ---  -----------
eth0             192.168.122.166/24                u/u  WAN
eth1             203.0.113.1/24                    u/u

Fixed in https://github.com/vyos/vyatta-op-vpn/pull/31/commits/1dff71494b3ddea72de3df2d08105fe9d8a90c95

@johannrichard Is there any real example that you want to achieve?

thanks you @Viacheslav

PR https://github.com/vyos/vyos-user-utils/pull/1

PR https://github.com/vyos/vyos-1x/pull/1124

set service ssh disable-host-validation
set service ssh listen-address '192.168.122.11'
set service ssh listen-address 'fe80::5054:ff:fe48:a0c6%eth0'

Chek service and listen-addresses:

vyos@r11-roll# cat /run/sshd/sshd_config | grep List
ListenAddress 192.168.122.11
ListenAddress fe80::5054:ff:fe48:a0c6%eth0

PR https://github.com/vyos/vyatta-op-vpn/pull/31

It still doesn't work for 1.3
This regex not for all IPv6 peers

PR https://github.com/vyos/vyos-1x/pull/1123

Although this works, there’s still some mandatory config statements that are required. You can just lob everything into a file to be included.

There is a task for "loadbalancing" T4109

Some of the options can be included in the config:

set interfaces openvpn vtun10 openvpn-option-include '/config/openvpn/included.conf'

Just configure minimal OpenVPN configuration and include what you want

Issue was a missing verify() step which requires every SNMPv3 user to have a group assigned.