| Age | Commit message (Collapse) | Author |
|---|
|
<enable|disable> commands; log and state moved to new syntax.
|
|
Replace regex-based URL validator with native validator from vyos-utils.
Also, move `include/url.xml.i` to `include/url-http-https.xml.i` to
reflect the fact that it is used only for HTTP(S) URLs.
|
|
change.
|
|
T5559: Add static neighbor-proxy feature
|
|
T5702: SNMP add interface-mib max-interfaces-number and prefix
|
|
- Allow to configure only required interface prefixes
set service snmp mib interface 'eth'
set service snmp mib interface 'bond'
include_ifmib_iface_prefix eth bond
Sets the interface name prefixes to include in the IF-MIB data collection.
For servers with a large number of interfaces (ppp, dummy, bridge, etc)
the IF-MIB processing will take a large chunk of CPU for ioctl calls.
A set of space separated interface name prefixes will reduce the CPU
load for IF-MIB processing. For example, configuring
"include_ifmib_iface_prefix eth dummy lo" will include only interfaces
with these prefixes and ignore all others for IF-MIB processing.
- Allow to configure maximum interface number
set service snmp mib interface-max '100'
ifmib_max_num_ifaces NUM
Sets the maximum number of interfaces included in IF-MIB data collection.
For servers with a large number of interfaces (ppp, dummy, bridge, etc)
the IF-MIB processing will take a large chunk of CPU for ioctl calls
(on Linux). Setting a reasonable maximum for the CPU used will
reduce the CPU load for IF-MIB processing. For example, configuring
"ifmib_max_num_ifaces 500" will include only the first 500 interfaces
based on ifindex and ignore all others for IF-MIB processing.
|
|
Time interval in seconds to wait between DNS updates would be a bit
more intuitive as `interval` than `timeout`.
|
|
T5698 EVPN ESI Multihoming
|
|
T5704: PPPoE L2TP SSTP IPoE add option max-concurrent-sessions
|
|
Add `max-starting` option:
[common]
max-starting=N
Specifies maximum concurrent session attempts which server may processed
set service pppoe-server max-concurrent-sessions '30'
Useful to prevent high CPU utilization and compat execution
scripts per time.
|
|
The vendor name could contain Uppercase or lowercase symbols and
not rely on the dictionary name but on dictionary value
/ # cat /usr/share/freeradius/dictionary.cisco | grep -i vendor
VENDOR Cisco 9
Another example
VENDOR Alcatel-IPD 6527
This way if we use `vendor=cisco` instead of `vendor=Cisco` it
will not work at all
Delete vendor validators
|
|
Ability to set ip neigbhor proxy
set protocols static neighbor-proxy arp 192.0.2.1 interface 'eth0'
set protocols static neighbor-proxy arp 192.0.2.2 interface 'eth0'
set protocols static neighbor-proxy nd 2001:db8::1 interface 'eth1'
|
|
T1797: Delete VPP from vyos-1x as it is implemented in addon
|
|
Fix commit 51abbc0f1b2 ("T5681: Firewall,Nat and Nat66: simplified and
standarize interface matcher (valid for interfaces and groups) in firewal, nat
and nat66") that added a migrator but did not bump the version number.
|
|
vxlan: T5668: add CLI knob to enable ARP/ND suppression
|
|
As we have a bunch of options under "paramteres" already and "external" is
clearly one of them it should be migrated under that node as well.
|
|
In order to minimize the flooding of ARP and ND messages in the VXLAN network,
EVPN includes provisions [1] that allow participating VTEPs to suppress such
messages in case they know the MAC-IP binding and can reply on behalf of the
remote host. In Linux, the above is implemented in the bridge driver using a
per-port option called "neigh_suppress" that was added in kernel version 4.15.
[1] https://www.rfc-editor.org/rfc/rfc7432#section-10
|
|
|
|
set interfaces bonding bond10 evpn es-df-pref '50'
set interfaces bonding bond10 evpn es-id '10'
set interfaces bonding bond10 evpn es-sys-mac '01:23:45:67:89:ab'
set interfaces bonding bond10 member interface 'eth3'
set interfaces bonding bond10 mode '802.3ad'
|
|
(valid for interfaces and groups) in firewal, nat and nat66.
|
|
T5643: nat: add interface-groups to nat. Use same cli structure for i…
|
|
vxlan: T5671: change port to IANA assigned default port
|
|
Currently VyOS VXLAN implementation uses the Linux assigned port 8472 that
predates the IANA assignment. As Most other vendors use the IANA assigned port,
follow this guideline and use the new default port 4789.
Existing configuration not defining an explicit port number will be migrated
to the old default port number of 8472, keeping existing configurations work!
|
|
|
|
bridge: T5670: add missing constraint on "member interface" node
|
|
T5541: firewall zone: re add firewall zone-base firewall
|
|
cluster: T2897: add a migration script for converting cluster to VRRP
|
|
T5637: add new rule at the end of base chains for default-actions and log capabilities
|
|
One could specify a bridge member of VXLAN1 interface, but it is not possible
to create a VXLAN interface with the name of VXLAN1 - prohibited by VXLAN
interface name validator.
Add missing interface-name validator code
|
|
|
|
|
|
|
|
bonding: T5254: Fixed changing ethernet when it is a bond member
|
|
|
|
openvpn: T5634: Remove support for insecure DES and Blowfish ciphers
|
|
|
|
interface-name|interface-group as in firewall.
|
|
T5165: Implement policy local-route source and destination port
|
|
T5530: isis: Adding loop free alternate feature
|
|
enables log capabilities for default-action in base chains. And of course, add option for enabling log for default-action
|
|
Add `policy local-route` source and destination port
set policy local-route rule 23 destination port '222'
set policy local-route rule 23 protocol 'tcp'
set policy local-route rule 23 set table '123'
set policy local-route rule 23 source port '8888'
% ip rule show prio 23
23: from all ipproto tcp sport 8888 dport 222 lookup 123
|
|
|
|
Set the MRU (Maximum Receive Unit) value to n. PPPd will ask the peer to send
packets of no more than n bytes. The value of n must be between 128 and 16384,
the default was always 1492 to match PPPoE MTU.
A value of 296 works well on very slow links (40 bytes for TCP/IP header + 256
bytes of data). Note that for the IPv6 protocol, the MRU must be at least 1280.
CLI:
set interfaces pppoe pppoe0 mru 1280
|
|
If ethernet interface is a bond memeber:
1. Allow for changing only specific parameters which are specified
in EthernetIf.get_bond_member_allowed_options function.
2. Added inheritable parameters from bond interface to ethernet
interface which are scpecified
in BondIf.get_inherit_bond_options.
Users can change inheritable options under ethernet interface
but in commit it will be copied from bond interface.
3. All other parameters are denied for changing.
Added migration script. It deletes all denied parameters under
ethernet interface if it is a bond member.
|
|
A network namespace can have VRFs assigned, thus we need to get the priorities
right. This lowers both priorities in general as a VRF or NETNS needs to be
available very early as services can run on top of them.
|
|
ddclient: T5574: Support per-service cache management for providers
|
|
T5600: firewall: change constraints for inbound|outbound interface-name
|
|
Add support for per-service cache management for ddclient providers
via `wait-time` and `expiry-time` options. This allows for finer-grained
control over how often a service is updated and how long the hostname
will be cached before being marked expired in ddclient's cache.
More specifically, `wait-time` controls how often ddclient will attempt
to check for a change in the hostname's IP address, and `expiry-time`
controls how often ddclient to a forced update of the hostname's IP
address.
These options intentionally don't have any default values because they
are provider-specific. They get treated similar to the other provider-
specific options in that they are only used if defined.
|
|
T5165: Migrate policy local-route rule x destination to address
|
|
ddclient: T5612: Miscellaneous improvements and fixes for dynamic DNS
|
