@DuxOv8 feel free to test/check it. It will be available in the next rolling release (after the 15th of October)

There's now a fix for this in https://github.com/vyos/vyos-1x/pull/5519
It would be great if a maintainer could take a look when there's time.

Another instance, VyOS Stream 2026.03 (vyos-1x 1.5dev0-3990-g9a296ec12), site-to-site to an Azure VPN Gateway (IKEv2, no reauth, DPD restart). On 2026-10-12 the vti was left admin-down while its CHILD_SA stayed INSTALLED: IKE and child SA reported up, BGP over the vti sat in Active, bytes out 0 for two days. /tmp/ipsec_vti_interfaces had lost the entry; reset vpn ipsec site-to-site peer re-ran up-client and recovered it. Confirms the DB key needs the SA identity (PLUTO_UNIQUEID), as proposed. Workaround in place: a cron job that re-raises any xfrm interface whose if_id matches an INSTALLED CHILD_SA (via vici) by re-running the updown hook's up path.

This behaviour was observed on our current production version from January 2026.
I have tried it on the rolling version from the 7th October but i cannot get this version to work because it is affected by the interface renaming bug (T9291), so the WWAN interface will not come up at all.
I guess we have to wait until the bug is fixed before we can test if the bug we discovered is still applicable.

Which version?

PR created: https://github.com/vyos/vyos-1x/pull/5559

PRs:
https://github.com/vyos/vyos-1x/pull/5558
https://github.com/vyos/vyatta-cfg/pull/157

PR created: https://github.com/vyos/vyos-1x/pull/5557

Will be available in the next rolling release.

PR: https://github.com/vyos/vyos-1x/pull/5556

@c-po @zsdc can we consider this task as done or not yet?

configure
set interface eth0 address '192.0.2.1/24'
for vid in $(seq 1 1000); do set interfaces ethernet eth0 vif $vid address 10.$((vid/256)).$((vid%256)).1/24; done
time commit

PR https://github.com/vyos/vyos-1x/pull/5534

In T9197#281816, @c-po wrote:

https://github.com/vyos/vyos-build/pull/1323