Sorry, typo in the title, but I have no rights to change it.

I'll have to think about how to test this now, we migrated the last Sophos UTM over the weekend, after which we migrated all tunnels from IPSec to wireguard.

I think it should check the state of net.ipv4.ip_nonlocal_bind / net.ipv6.ip_nonlocal_bind, and if set to 1, skip the check.

load-balancing haproxy has exactly the same problem, see https://forum.vyos.io/t/haproxy-load-balancing-vip-address/17495

To add, sudo systemctl stop strongswan followed by a sudo systemctl start strongswan doesn't release the memory claimed.

There is a second reason for the upgrade: there is a memory leak in Strongswan, at least in the case I'm using it in (IKEv1 over PPPoE).

That may be your opinion, which is fine, as you clearly don't have a need for it. I do, and VyOS' python validation rule is the only thing stopping me.

Obviously, I meant DHCPv6-PD, not SLAAC.

Just bumped into the fact appearently this wasn't implemented for all groups, getting an "include is not valid" for a domain-group.