Age | Commit message (Collapse) | Author |
|
This changes behaviour from fetching CA chain in PKI, to the user manually setting CA certificates.
Prevents unwanted parent CAs existing in PKI from being auto-included as may not be desired/intended.
(cherry picked from commit 952b1656f5164f6cfc601e040b48384859e7a222)
|
|
(cherry picked from commit 679b78356cbda4de15f96a7f22d4a98037dbeea4)
|
|
(cherry picked from commit f7834324d3d9edd7e161e7f2f3868452997c9c81)
|
|
interface with vrf
|
|
(cherry picked from commit 2ba435fa4bc8a5c9b2285fb9215ebc582bfb5fdf)
|
|
Users can not (FRR fails) commit the same network belonging to different OSPF
areas. Add verify() check to prevent this.
(cherry picked from commit c6d8d9c012da1a7566eec2dff70385457f073e64)
|
|
bgp: T6106: Show complete FRR output on internal errors (backport #3151)
|
|
vti: T6085: bring VTI interfaces up only when the IPsec tunnel is up (backport #3157)
|
|
peer-group
handle vtysh bgp error
(cherry picked from commit 6fa72591972618f02ac1c66c084a99e006ce18f3)
|
|
This is a leftover after commit 0e050cb35 (isis: T3417: drop artificial "domain"
node identifying the IS-IS process name). Drop all references to "process"
variable.
Specifying:
set protocols isis interface eth1
set protocols isis net '49.0001.1921.6825.5255.00'
set protocols isis redistribute ipv4 bgp
Triggered an exception
Traceback (most recent call last):
File "/usr/libexec/vyos/conf_mode/protocols_isis.py", line 309, in <module>
verify(c)
File "/usr/libexec/vyos/conf_mode/protocols_isis.py", line 158, in verify
f'"protocols isis {process} redistribute {afi} {proto}"!')
^^^^^^^
NameError: name 'process' is not defined
(cherry picked from commit 78212414e085d6261a32015553eb3e407f77792f)
|
|
When a VTI interface is just created, it is in ADMIN UP state by default, even
if an IPSec peer is not connected. After the peer is disconnected the interface
goes to DOWN state as expected.
This breaks routing logic - for example, static routes through VTI interfaces
will be active even if a peer is not connected.
This changes to logic so ADMIN UP/DOWN state can only be changed by the
vti-up-down helper script.
Error was introduced during the Perl -> Python migration and move to the generic
vyos.ifconfig abstraction during the 1.4 development cycle.
(cherry picked from commit 9eb018c4935235d292d7c693ac15da5761be064a)
|
|
conntrack: T6147: Enable conntrack when firewall state-policy is defined (backport #3159)
|
|
Linux bridge uses EtherType 0x8100 by default. In some scenarios, an EtherType
value of 0x88A8 is required.
Reusing CLI command from VIF-S (QinQ) interfaces:
set interfaces bridge br0 protocol 802.1ad
(cherry picked from commit 9c9b1febff6863ccd3632a04d9e307909b3efe7a)
|
|
* Move global state-policy smoketest to it's own test, verify conntrack
(cherry picked from commit 62bda3b082a79c2f31483dba5bfeb19464f6dbe2)
|
|
add mtu to default and specified class
update smoke test
(cherry picked from commit 84bbcdf5b7980f701aba6e158a2be4a05e7076d9)
|
|
Remove all AS numbers from the AS_PATH of the BGP path's NLRI.
set policy route-map <name> rule <rule> set as-path exclude all
(cherry picked from commit 16395c902ff79fcb34019a6d499467488ed45849)
|
|
Add support for pref64 option, as defined in RFC8781. The prefix valid lifetime
must not be smaller than the "interface interval max" definition which defaults
to 600.
set service router-advert interface eth1 nat64prefix 64:ff9b::/96
(cherry picked from commit f1ead5c6a16aba00699b8a5b9c18ef6cffe8cc4d)
|
|
Added health-check to sync-group in CLI
Don't use instance health-check when instance in sync group member
Disallow wrong healtch-check configurations
New smoke test
|
|
(cherry picked from commit 259ef4740413b39da9b122db19c549eeec88114c)
|
|
e.g. Linux Kernel only supports 255 and not 256 characters for the ifalias field.
(cherry picked from commit a72ededa0b29c25efaab52f2db170c34eba50248)
|
|
(cherry picked from commit 77a25e95da48549f2791b677f4ba187e547b1c6a)
|
|
(cherry picked from commit 8f2534e9654b61b7db45788bb52ac6cf8017b054)
|
|
ospfv3: T6087: add support to redistribute IS-IS routes (backport #3078)
|
|
(cherry picked from commit 6a97fdfa1ba9b4135a51498ea5acabb804256b2c)
|
|
(cherry picked from commit 256e939b2cd308e1e8be9dd72ccec6e87d58504b)
|
|
settings
(cherry picked from commit 5ee89f46096626ca8aac37da9237635e3d17766a)
|
|
is a network.
(cherry picked from commit a7a0c90404d03f7deccb74a46d0fe1f99116907a)
|
|
dhcp-server: T6079: Disable duplicate static-mappings on migration
|
|
Example:
vyos@vyos# set protocols ospfv3 redistribute bgp
Possible completions:
metric OSPF default metric
metric-type OSPF metric type for default routes (default: 2)
route-map Specify route-map name to use
(cherry picked from commit ed2c288c8a9031f91acf76d20b84e2002696981c)
|
|
(cherry picked from commit b984cf8d179cf3d4b16e7f3e5cf94f822055cb04)
|
|
|
|
(cherry picked from commit 36883ebf0f820003ec86e14e7612ce113630def2)
|
|
|
|
required
(cherry picked from commit 6f7d1e15665655e37e8ca830e28d9650445c1217)
|
|
remove obsolete imports
(cherry picked from commit bc9ccaeda54279022b73a806fa8aa77c523fbecc)
|
|
|
|
This extends commit dbe8c613b ("bridge: T6043: do not call vxlan dependency if
interface does not exist (yet)") with a proper cleanup of additional interfaces
created during the testrun.
(cherry picked from commit 4cb80868ab3ab35453d8609392ca470a02764fac)
|
|
In order to keep the proper priority list during system startup and on initial
setup/commit for this feature the dependent VXLAN code should not be called,
if the interface in question does not exist (yet).
(cherry picked from commit dbe8c613bb80bc8b714398825054ade5942ea75b)
|
|
* set system login user <name> disable
(cherry picked from commit 6e0b146ed3b90da577c3ecba38836883fd435e7a)
|
|
context
* set vrf name <name> ip nht no-resolve-via-default
* set vrf name <name> ipv6 nht no-resolve-via-default
(cherry picked from commit 0fafc4bcdb9efc03796ddab0832471b11ba1bbe0)
|
|
* set system ip nht no-resolve-via-default
* set system ipv6 nht no-resolve-via-default
(cherry picked from commit ece0e768f36e52f8964823d891264d7c187204ec)
|
|
EDB should be EGP for exterior gateway protocol
(cherry picked from commit 56654191613113764415d7eddadcbd8c97e126de)
|
|
(cherry picked from commit 354603398b693af06695d5d1a7602f17079f8350)
|
|
Removed dhcp-interface option (l2tp)
Added wins-server (sstp)
Added description (ipoe, pppoe, sstp, pptp)
Added exteded-script (l2tp, sstp, pptp)
Added shaper (ipoe, pptp, sstp, l2tp)
Added limits (ipoe, pptp, sstp, l2tp)
Added snmp ( ipoe, pptp,sstp, l2tp)
Refactoring and reformated code.
(cherry picked from commit ac6a16f6c5ad7700789759e1ec093236c2e182a2)
|
|
rpki: T6034: move file based SSH keys for authentication to PKI subsystem (backport #2988)
|
|
(cherry picked from commit 3bfbbef22954488541abd3cad262b1e196d4c240)
|
|
(cherry picked from commit 4d76e9ef3e7773ed96c037108021c292675b101c)
|
|
(cherry picked from commit 0f8bf6bd0fb29cfd638e9920674e7ad1d1d25350)
|
|
(cherry picked from commit ac2d7dfac6073d0f232191ec494f78a8d12889e4)
|
|
After updateing netfilter in the commit https://github.com/vyos/vyos-build/commit/b31f5fe934bcb37534d49acdb5f7756bf05422e8
The nftables format for conntrack timeouts is different.
Fix this.
(cherry picked from commit 24860e092426bf0bb09c2d164d66330be13bcd77)
|