| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
firewall: T4134: Fix completion help for protocols
|
|
keepalived: T4109: Add high-availability virtual-server
|
|
|
|
Add new feature, high-availability virtual-server
Change XML, python and templates
Move vrrp to root node 'high-availability' as all logic are
handler by root node 'high-availability'
|
|
monitoring: T3872: Add a new feature service monitoring
|
|
|
|
listen-address: T4110: Ability to set IPv6 link-local addresses
|
|
Some services allows to set link-local IPv6 addresses as
listen-address. Allow it and add a validator 'ipv6-link-local'
and extend listen-address.xml.i to this validator
|
|
* 'firewall' of https://github.com/sarthurdev/vyos-1x:
zone_policy: T3873: Implement intra-zone-filtering
policy: T2199: Migrate policy route op-mode to XML/Python
policy: T2199: Migrate policy route to XML/Python
zone-policy: T2199: Migrate zone-policy op-mode to XML/Python
zone-policy: T2199: Migrate zone-policy to XML/Python
firewall: T2199: Migrate firewall op-mode to XML/Python
firewall: T2199: Migrate firewall to XML/Python
|
|
Add priority for policy based IPSec VPN tunnels
If 2 tunnels have the same pair of local and remote traffic
selectors (prefixes) it allows to set more preforable install
policy from required peer
The lowest priority is more preforable
|
|
|
|
|
|
|
|
|
|
|
|
Add XML for required 'virtual-server' configuration commands
|
|
|
|
|
|
|
|
|
|
The implementation of the "auto" option to specify the sflow/netflow
agent-address is very error prone. The current implementation will determine
the IP address used for the "auto" value as follow:
Get BGP router-id
1) If not found use OSPF router-id
2) If not found use OSPFv3 router-id
3) If not found use "the first IP address found on the system
Well, what is the "first IP address found"? Also this changes if DHCP is in use.
Also another disadvantage is when the BGP/OSPF/OSPFv3 router-id is changed,
the agent-address is not updated upon the next reboot of the system.
This task is about removing the "auto" keyword from the CLI at all and make it
either entirely configurable by the user and hardcode the value in CLI, or not
use this at all.
If "auto" is specified we will query the system in the above order and set the
proper router-id in the CLI. If none can be found the CLI node is removed.
|
|
sFlow uses the source-address CLI node and netflow uses source-ip this is just
confusing and should be synced to the common source-address CLI node.
|
|
|
|
|
|
|
|
There is typo in the completion help when this command "set sys login banner"
executed, Changed the completion help to a proper one.
|
|
T4070: natv4: Add "any" for inbound-interface list
|
|
"any" was missing from the interface list which will be useful to indicate any
interface.
|
|
|
|
logs: T3774: Added CLI options to control atop logs rotation
|
|
* Added proper handling of default values from CLI.
* Replaced rsyslog restart postrotate action to native `rsyslog-rotate`
script.
* Removed unnecessary checks for `None` instead `dict` - with
default values the situation becomes impossible.
* Fixed default value from 10 to 1 in the rsyslog CLI.
|
|
|
|
Added the ability to control the `/var/log/messages` rotation.
Renamed the option `maxsize` to `max-size`.
|
|
|
|
The BGP conditional advertisement feature uses the non-exist-map or the
exist-map and the advertise-map keywords of the neighbor advertise-map command
in order to track routes by the route prefix.
non-exist-map
=============
* If a route prefix is not present in the output of non-exist-map command, then
advertise the route specified by the advertise-map command.
* If a route prefix is present in the output of non-exist-map command, then do
not advertise the route specified by the addvertise-map command.
exist-map
=========
* If a route prefix is present in the output of exist-map command, then
advertise the route specified by the advertise-map command.
* If a route prefix is not present in the output of exist-map command, then do
not advertise the route specified by the advertise-map command.
This feature is useful when some prefixes are advertised to one of its peers
only if the information from the other peer is not present (due to failure in
peering session or partial reachability etc).
The conditional BGP announcements are sent in addition to the normal
announcements that a BGP router sends to its peer.
CLI nodes can be found under:
* set protocols bgp neighbor <ip> address-family <afi> conditional-advertisement
* set protocols bgp peer-group <p> address-family <afi> conditional-advertisement
|
|
|
|
This command is applicable at the global level and at an individual bgp level.
If applied at the global level all bgp instances will wait for fib installation
before announcing routes and there is no way to turn it off for a particular
BGP vrf.
|
|
Administrative shutdown of all peers of a bgp instance. Drop all BGP peers,
but preserve their configurations. The peers are notified in accordance with
RFC 8203 by sending a NOTIFICATION message with error code Cease and subcode
Administrative Shutdown prior to terminating connections.
This global shutdown is independent of the neighbor shutdown, meaning that
individually shut down peers will not be affected by lifting it.
|
|
This command enables rejection of incoming and outgoing routes having AS_SET
or AS_CONFED_SET type.
|
|
This command allows user to prevent session establishment with BGP peers with
lower holdtime less than configured minimum holdtime.
When this command is not set, minimum holdtime does not work.
|
|
Whenever BGP peer address becomes unreachable we must bring down the BGP
session immediately. Currently only single-hop EBGP sessions are brought down
immediately. IBGP and multi-hop EBGP sessions wait for hold-timer expiry to
bring down the sessions.
This new configuration option helps user to teardown BGP sessions immediately
whenever peer becomes unreachable.
This configuration is available at the bgp level. When enabled, configuration
is applied to all the neighbors configured in that bgp instance.
|
|
Set the period to rerun the conditional advertisement scanner process.
The default is 60 seconds.
|
|
|
|
Background information [1]. Specifies whether an external control plane
(e.g. ip route encap/EVPN) or the internal FDB should be used.
[1]: https://legacy.netdevconf.info/2.2/slides/prabhu-linuxbridge-tutorial.pdf
|
|
|
|
|
|
|
|
T562: Config syntax for defining DNS forward authoritative zones
|
