NFT rate-limiting is effectively a policer instead of a shaper, so I don't think it'd be a good way to accomplish this. All drops would be aggressive and not tail-drops.

Also the config section could perhaps be name "custom" (with subsections) so that section will survive an upgrade aswell - otherwise config lines will vanish during boot/commit.

Duplicate

On testing, it looks like vyos.utils.network.get_vxlan_vni_filter() doesn't know how to handle when there are no vni filters installed.

I've created a quick PR to give sane feedback from the validator: https://github.com/vyos/vyos-1x/pull/3572

PR : https://github.com/vyos/vyos-1x/pull/3571

Tested as working in: VyOS 1.5-rolling-202405310019

I've created a PR for this that fixed a mistake with my original patch: https://github.com/vyos/vyos-1x/pull/3570

In https://github.com/vyos/vyos-rolling-nightly-builds/releases/tag/1.5-rolling-202405301617 wrote

We do not need add tasks for the documentation. There are a lot of things that are not documented or require improvements.
Just create a PR to the documentation repo.

This is a new feature that was added after EPA-3 release
It was added 3 days ago https://github.com/vyos/vyos-1x/pull/3535

Provide the full (minimal) set of commands to reproduce.

PR opened here: https://github.com/vyos/vyos-1x/pull/3563/

set resource-group username-group <my-users> username user01 password '09078081'
set resource-group username-group <my-users> username user02 password 'fmndskl82'

set service pppoe-server authentication local-users username-group 'my-users'
set vpn l2tp remote-access authentication local-users username-group 'my-users'
set vpn sstp authentication local-users username-group 'my-users'
set vpn openconnect authentication local-users username-group 'my-users'

Looks like what I was talking about

Need a general place to store accounts for VPN; whether it is a local radius server or chap-secrets file(this option seems simpler and more correct) is not so important.
A separate radius server is another point of failure and a separate infrastructure object. Wants to have a boxed solution where everything is available at once

https://github.com/vyos/vyos-1x/pull/3552

Apple IOS now recognizes multiple CAs inside the profile

With this change all CAs in the list are rendered into the template.

In T6417#190336, @Viacheslav wrote:

It is not clear why it should be ignored? If they should be ignored they must not be in the CLI at all.
Why not use RADIUS authentication for it?

Do I get it wrong? Local RADIUS server seems like overhead here. Are we talking about the local “chap-secrets” file that can be reused by other daemons or RADIUS?
Clarify please the feature request.

Need a general place to store accounts for VPN; whether it is a local radius server or chap-secrets file(this option seems simpler and more correct) is not so important.
A separate radius server is another point of failure and a separate infrastructure object. Wants to have a boxed solution where everything is available at once

ok, sure

The similar task T6409

no it's not
hold on with his task for now