vyos-1x.git/interface-definitions, branch fix/T8859-dh-keysize-validation

Merge pull request #5453 from m-songer/T9274-add-telegraf-config

2026-09-25T14:03:20+00:00

T9274: Add more telegraf configuration

Merge pull request #5484 from haakonnore/feat/T9319-vxlan-gbp

2026-09-24T17:06:31+00:00

vxlan: T9319: add VXLAN-GBP support

T9274: Add more telegraf configuration- #5453

2026-09-24T16:00:38+00:00

Added the ability to make several agent values configurable instead of hardcoded.

vxlan: T9319: add VXLAN-GBP support

2026-09-22T23:13:09+00:00

Expose the Group Policy extension as a valueless gbp CLI node and pass it to iproute2 when creating VXLAN links. Recreate links when GBP changes and reject configurations combining GBP with GPE. Reject conflicting GBP settings on a shared UDP port, accounting for address families and underlay VRF socket bindings. Warn that external mode carries GBP in tunnel metadata instead of the packet mark. Add smoketest coverage for GBP creation, removal and re-enabling, retained interface settings, rejection without changing the running tunnel, shared ports, separate address families, and external mode.

ipsec: T8952: Allow per-peer strongSwan `unique` override for site-to-site peers

2026-09-16T08:22:40+00:00

VyOS does not expose the strongSwan `connections..unique` parameter for site-to-site peers. The swanctl default is `unique = no`, which only replaces existing SAs if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`, charon initiates new IKE_SAs without `INITIAL_CONTACT`, so duplicates accumulate on every DPD timeout. Previously the strongSwan `unique` connection policy could only be driven by the global "disable-uniqreqids" option, which set it to "never" for every connection. Site-to-site peers had no way to opt into stricter enforcement on their own.

openvpn: T8264: mention the offload in the raw option help

2026-09-13T19:06:12+00:00

Not every option that turns the offload off can be recognised, so say so where the option is entered.

openvpn: T8264: migrate away DCO the Kernel module cannot serve

2026-09-13T19:06:12+00:00

"offload dco" was accepted next to tap, static keys, compression, CBC ciphers and raw options OpenVPN refuses to offload, because 2.6 ignored the module altogether. Those combinations now fail verify(), which would break config load on upgrade, so drop the request instead. The migration has to mirror verify_dco() exactly: anything it keeps that verify() turns away leaves a router unable to commit its own configuration.

Merge pull request #5440 from sever-sever/T9260-se

2026-09-11T16:47:27+00:00

monitoring: T9260: relay local frr_exporter metrics via Telegraf

Merge pull request #5372 from ruben-herold/T9157-fib-type-match

2026-09-11T14:28:09+00:00

firewall: T9157: add fib-type match for destination/source

monitoring: T9260: relay local frr_exporter metrics via Telegraf

2026-09-11T10:36:29+00:00

FRR routing state was only available through the Prometheus frr-exporter, a pull target. Operators who push everything else out via Telegraf had to run an external Prometheus server and open inbound access to the router just to scrape routing state. Add a dedicated "service monitoring telegraf frr-metrics" node. When set, Telegraf uses inputs.prometheus to scrape the already-running local frr-exporter and re-emits the metrics through whatever Telegraf outputs are already configured (InfluxDB, ADX, Loki, Splunk, etc.).