Tested locally and receive sflow with agent IP of the configured ip/interface/vrf.
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
Jul 27 2022
Will it affect also tunnels/openvpn/wireguard/vxlan etc?
If you get rid of the default MTU values you get more pain.
Jul 26 2022
VyOS config:
set nat source rule 10 destination address '192.0.2.0/24' set nat source rule 10 exclude set nat source rule 10 outbound-interface 'any' set nat source rule 10 protocol 'all' set nat source rule 10 source address '0.0.0.0/0' set nat source rule 100 outbound-interface 'eth0' set nat source rule 100 source address '203.0.113.0/24' set nat source rule 100 translation address masquerade
The bug is still here:
vyos@r14# run show nat source rules
Traceback (most recent call last):
File "/usr/libexec/vyos/op_mode/nat.py", line 157, in <module>
res = vyos.opmode.run(sys.modules[__name__])
File "/usr/lib/python3/dist-packages/vyos/opmode.py", line 118, in run
res = func(**args)
File "/usr/libexec/vyos/op_mode/nat.py", line 152, in show_rules
return _get_formatted_output_rules(nat_rules, direction)
File "/usr/libexec/vyos/op_mode/nat.py", line 103, in _get_formatted_output_rules
sport {sport}'''
UnboundLocalError: local variable 'sport' referenced before assignment
[edit]
vyos@r14#PR https://github.com/vyos/vyos-1x/pull/1435
vyos@r14:~$ show bridge Bridge interface br0: Member State MTU Flags Prio -------- ---------- ----- ------------------------------- ------ dum0 forwarding 1500 broadcast,noarp,up,lower_up 32 eth1.30 forwarding 1500 broadcast,multicast,up,lower_up 32 eth1.55 forwarding 1500 broadcast,multicast,up,lower_up 32
Mark as resolved as a i have tested it on 1.4-rolling-202207260217 and has been merged
@n.fort source-address is useful especially when more precision is needed. At the moment its use is cumbersome as it does not provide help hint on the addresses assigned to the router, forcing an operator to first list those addresses.
As of 1.4-rolling-202207250217 this is still not resolved.
I can confirm that at least as of version 1.4-rolling-202207250217the op commands have been merged:
vyos@vyos-lab:~$ reset bgp Possible completions: <x.x.x.x> BGP IPv4/IPv6 neighbor to clear <h:h:h:h:h:h:h:h> 1-4294967295 Reset peers with the AS number all Clear all peers external Reset all external peers ipv4 IPv4 Address Family ipv6 IPv6 Address Family l2vpn Layer 2 Virtual Private Network Address Family peer-group Reset all members of peer-group prefix Clear bestpath and re-advertise vrf Virtual Routing and Forwarding (VRF)
Jul 25 2022
@c-po which one is the new syntax?
Agree that both options are not available in cli.. But, you can use source-address:
Will be fixed with syntax migration in T4118
Jul 24 2022
Jul 23 2022
It will be fixed in T4545
PR https://github.com/vyos/vyos-1x/pull/1426
PR https://github.com/vyos/vyos-1x/pull/1430
vyos@r14:~$ show vrf Name State MAC address Flags Interfaces ------ ------- ----------------- ------------------------ --------------- foo up be:e3:5c:f1:54:99 noarp,master,up,lower_up eth1.50,eth1.55 bar up 1e:7c:94:da:e0:35 noarp,master,up,lower_up n/a vyos@r14:~$
New PR (Notice corrected):
https://github.com/vyos/vyos-1x/pull/1427
I have added a pull request for this:
PR https://github.com/vyos/vyos-1x/pull/1428
vyos@r14:~$ reset vpn ipsec-peer 2001:db8::2
CHILD_SA {21241} closed successfully
CHILD_SA {21243} closed successfully
CHILD_SA {21245} closed successfully
CHILD_SA {21244} closed successfully
CHILD_SA {21247} closed successfully
CHILD_SA {21246} closed successfully
CHILD_SA {21249} closed successfully
CHILD_SA {21248} closed successfully
closing CHILD_SA peer_2001-db8--2_tunnel_0{21250} with SPIs cab47d6b_i (0 bytes) c3cbba13_o (0 bytes) and TS 2001:db8:1111::/64 === 2001:db8:2222::/64
sending DELETE for ESP CHILD_SA with SPI cab47d6b
generating INFORMATIONAL request 14065 [ D ]
sending packet: from 2001:db8::1[500] to 2001:db8::2[500] (69 bytes)
received packet: from 2001:db8::2[500] to 2001:db8::1[500] (69 bytes)
parsed INFORMATIONAL response 14065 [ D ]
received DELETE for ESP CHILD_SA with SPI c3cbba13
CHILD_SA closed
CHILD_SA {21250} closed successfully
establishing CHILD_SA peer_2001-db8--2_tunnel_0{21251}
generating CREATE_CHILD_SA request 14066 [ SA No KE TSi TSr ]
sending packet: from 2001:db8::1[500] to 2001:db8::2[500] (497 bytes)
received packet: from 2001:db8::2[500] to 2001:db8::1[500] (497 bytes)
parsed CREATE_CHILD_SA response 14066 [ SA No KE TSi TSr ]
selected proposal: ESP:AES_GCM_16_256/MODP_2048/NO_EXT_SEQ
CHILD_SA peer_2001-db8--2_tunnel_0{21251} established with SPIs ccaff1e5_i c5a2b674_o and TS 2001:db8:1111::/64 === 2001:db8:2222::/64
connection 'peer_2001-db8--2_tunnel_0' established successfully
Peer reset result: success
vyos@r14:~$Jul 22 2022
Commit fails b/c of frr-reload output: 200 % Local-AS allowed only for EBGP peers - we should add an appropriate verify() stage I guess.
PR https://github.com/vyos/vyos-1x/pull/1426
An example with only one rule 10 raw output
vyos@r14:~$ /usr/libexec/vyos/op_mode/nat.py show_rules --direction source --raw
[
{
"rule": {
"family": "ip",
"table": "nat",
"chain": "POSTROUTING",
"handle": 114,
"comment": "SRC-NAT-10",
"expr": [
{
"match": {
"op": "==",
"left": {
"meta": {
"key": "oifname"
}
},
"right": "eth0"
}
},
{
"counter": {
"packets": 0,
"bytes": 0
}
},
{
"masquerade": null
}
]
}
}
]
vyos@r14:~$PR to new format + IPv6 entries https://github.com/vyos/vyos-1x/pull/1425
@aaliddell I am not too concerned about tayga's maintenance. It have been proved to work well for years, and the package is already a part of the official repository of debian. Actually debian's tayga package includes a few patches: https://salsa.debian.org/debian/tayga/-/tree/debian/master/debian/patches
I just leave it here. We must not return to bug T2189 with this fix.
Jul 21 2022
That's XPN support but GCM-AES-256 was added back in 2018 in https://w1.fi/cgit/hostap/commit/?id=1ff8605775
Put in pull request https://github.com/vyos/vyos-1x/pull/1423
That's what commit rVYOSONEX5e510e45f6f9 did :)