Don't see errors with this configuration:

set interfaces ethernet eth1 vif 11 address '192.0.2.2/24'
set interfaces input ifb0 description 'WAN Ingress'

vhost modules are not included to kernet

I've found the reason why this command fails, it' happens because the logic to match the dscp parameter is missing. So, it tries to apply the basic policy with the tc filter parameters by default :

Wow! Glad to see its moving on!

Thanks!

PR: https://github.com/vyos/vyatta-cfg/pull/65

That did fix the issue. So how do I get that change in the main code?

PR https://github.com/vyos/vyos-1x/pull/2042

set service config-sync mode 'load'
set service config-sync secondary address '192.168.122.11'
set service config-sync secondary key 'foo'
set service config-sync section 'nat'

You can try edit with sudo nano /opt/vyatta/sbin/vyatta-cfg-cmd-wrapper

Nope it hasn't, you skim read the bug report.

Your current version is too old, this function has been changed or removed, try upgrading to the new rolling version.

From my testing, all traffic that originates from an interface attached to a VRF, will show the source interface as the VRF master interface, regardless of the zone attached to that interface. This will make it difficult to segment traffic between interfaces attached to the same VRF. For example:

PR: https://github.com/vyos/vyos-1x/pull/2041

I opened an issue on github:

Hi @jestabro I saw that feature request but I wasn't sure. Thank you!

cf. https://vyos.dev/T5249, currently being assessed.

Thanks, @jestabro
It works in my tests!!

Network vendors always talk about control-plane and data-plane ... forward-plane is not used often

PR:
https://github.com/vyos/vyos-1x/pull/2039

After T5239, (vyatta-cfg, commit 4bbb3829), frr.service start and stop is managed by vyos-router, consequently, one should remove the following, so as not to confuse systemd:
https://github.com/vyos/vyos-1x/blob/current/src/etc/systemd/system/frr.service.d/override.conf#L1-L3

PR https://github.com/vyos/vyos-build/pull/360

In T2251#150145, @ganawaj wrote:

This bug is still present in the latest 1.4 rolling release

This bug is still present in the latest 1.4 rolling release

Tested on VyOS 1.3.3

PR:
https://github.com/vyos/vyos-1x/pull/2037

https://github.com/vyos/vyos-build/pull/359

The similar task https://vyos.dev/T4797
You can add manually nft rules that used for firewall group, but they will overwritten per next firewall change/commit. The whole firewall config will overwritten.
There are 2 ways. Somehow use it in CLI or use native (nft) tables, chains, group-sets and rules which are not overlapping with generated “system” firewall ruleset