This is a different maniphestation of the same mistake I made in is_admin — not checking if the effective UID is already zero. User vyos is a red herring because it's the actual user name but what actually matters is the effective UID instead.

PR: https://github.com/vyos/vyos-1x/pull/4888

I'm closing this task as invalid because the user's report combines unrelated problem that need to be tracked as separate tasks.

I split this task into three independent parts:

PR: https://github.com/vyos/ipaddrcheck/pull/19

Cisco and Arista support such addresses as interface addresses, and the anycast bit doesn't preclude unicast usage, so we should allow that.

Cisco and Arista also don't support multiple ports on the same IP address/host.

One way to get around the problem is to point multiple hostnames at the same IP/IPv6 address and use them in the VyOS config with different ports (suggestion from @c-po).

I still couldn't reproduce the issue either in rolling or in 1.4.3, so I'm inclined to think that some unrelated change that I can't find had fixed it.

This comment in ipaddrcheck explains why I disallowed all-zero host part addresses: https://github.com/vyos/ipaddrcheck/blob/current/src/ipaddrcheck_functions.c#L337-L346

This specific case when servers are unavailable is consistent with other vendors' behavior and likely worth fixing. Commit performance issues when TACACS servers are slow to respond or need to be contacted frequently is a different issue and we will eventually improve that.