vyos-documentation.git, branch T9354

T9354: document "reconnect interface" operational command

2026-09-25T19:15:00+00:00

PPPoE, SSTP client and WWAN interfaces can now be restarted with a single command which survives the loss of the CLI session, so it can be issued over the very interface being reconnected. The WWAN page gained the connect and disconnect commands as well - they have always been available there, but were only documented for PPPoE and SSTP. The command is also exposed by the HTTP API through a dedicated endpoint, which replaces the "reset connection" path that was previously used for this.

docs: T9157: document firewall fib-type match (#2186)

2026-09-25T13:37:27+00:00

* docs: T9157: document firewall fib-type match Companion doc entry for vyos/vyos-1x#5372, which adds "fib-type" as a source/destination match option (nftables' fib daddr/saddr type expression) for forward/input/output/name rule sets, ipv4 and ipv6. * docs: T9157: update fib match docs for fib-type -> fib type rename Companion vyos-1x PR #5372 restructured the "fib-type" leaf into a "fib" node with a "type" child (following feedback from l0crian1 and sarthurdev to reserve the "fib" namespace for a possible future lookup/match concatenation feature, tracked separately under T5119). Update the CLI paths and examples here to match, and fix "prohibited" to "prohibit" to match nftables' actual fib_addrtype token. * docs: T9157: add prerouting raw fib type reference, fix backtick style CodeRabbit feedback on #2186: - the prose showed a "prerouting raw" example but the command reference only listed forward/input/output/name filter forms, even though fib.xml.i is also included from common-rule-ipv{4,6}-raw.xml.i for that hook. Add the missing source/destination cfgcmd entries. - MyST pages use single backticks for inline code, not double (that's for embedded RST); fix the fib type prose accordingly. * docs: T9157: update fib docs for rule-level lookup/match split Companion vyos-1x PR #5372 moved "fib" from a leaf nested under destination/source to a rule-level node with separate "lookup" (source-address/destination-address) and "match route-type" children, per l0crian1's review feedback - reserving room for mark/iif/oif lookup keys and oif/oifname match results later (tracked under T5119) without ever renaming what ships now. Update the CLI paths and examples here to match.

docs: vpp: document that kernel prerequisites need their own commit and reboot (#2233)

2026-09-15T10:47:32+00:00

* docs: vpp: document that kernel prerequisites need their own commit and reboot VPP depends on hugepages and, since T8460, on isolated CPUs. Both are configured under "system option kernel", take effect only after a reboot, and are validated by VPP against the running kernel. Because "vpp" is committed at priority 295 and "system option" at 9999, the two can never be applied in the same commit - the VPP part is always rejected with "Not enough free memory to start VPP!" or "Not enough isolated CPU cores available", both of which point back at the very command the user just issued. This is independent of the NIC: the checks that fail take no interface or PCI information and run before the NIC validation. It was reproduced both with an unsupported NIC and with a validated one. Such a commit is also partial: the "system option kernel" part is applied even though the commit is reported as failed, while the "set vpp ..." statements are discarded and have to be re-entered after the reboot. The "Optimal Configuration Example" showed exactly this failing one-shot form, mixing "set system option kernel ..." and "set vpp settings ..." in a single block. Split it into the two stages that actually work and state why, and add hugepages to it so the example covers every prerequisite. Also: * add a short "Kernel Configuration" item to the requirements page, which is what a first-time user reads and which had no pointer to the kernel settings at all * document the isolated-CPU requirement on the cpu-cores page, which did not mention "isolate-cpus" * add the missing 1af4:1041 (virtio modern ID) row to the validated NIC table - it is present in SUPPORTED_PCI_IDS but was absent here * correct the allow-unsupported-nics note, which said the check is bypassed "for the specified devices". There are no specified devices: _is_device_allowed() returns True for every interface as soon as the option is set, including interfaces attached later. That wording is a leftover from the per-PCI-ID form originally proposed in T8315, which was merged as a single boolean. Verified by building the docs; the three changed pages produce no Sphinx warnings. Claude-Session: https://claude.ai/code/session_01EQsKVSw5hhDu7jPq1YzQvj * docs: vpp: correct what a failed VPP commit leaves behind Two corrections to the pages added earlier in this PR. The partial-commit note claimed that the "set vpp ..." statements are "discarded". They are not. Verified on VyOS 2026.03: after the commit fails, "compare" still shows them staged in the configuration session. [vpp settings] + resource-allocation { + memory { + main-heap-size "6G" + } + } What actually happens is worse than the previous wording suggested and worth stating precisely: the statements are neither applied nor written by "save", because "save" writes the running configuration - which "system_option.py" has already updated with the kernel options while the VPP part was rejected. The session does not survive the reboot, so the VPP statements are lost there rather than at commit time. The isolated-CPU requirement was also described as if it only applied once "cpu-cores" is raised. It applies at the default of "cpu-cores 1" as well: verify_vpp_cpu_cores() rejects the commit whenever fewer CPUs are isolated than requested, and VPP takes its main core from the isolated set. The project's own test_01_vpp_basic relies on this - it never sets "cpu-cores" and still expects "main-core" to be taken from /sys/devices/system/cpu/isolated. Without this, a reader doing a minimal setup would conclude that CPU isolation is optional for them. Claude-Session: https://claude.ai/code/session_016gXeKHVBq2N8qRAMQkrdM6

firewall/groups: document include option and remote-group interval (#2241)

2026-09-15T09:59:52+00:00

* firewall/groups: document include option and remote-group interval These CLI nodes existed in the XML definitions but were missing from the docs entirely, per docs.vyos.io/en/1.5/coverage.html: - include: lets one group nest another group of the same type (address-group, ipv6-address-group, network-group, ipv6-network-group, mac-group, port-group, interface-group) - remote-group interval: overrides the global resolver-interval on a per-group basis * firewall/groups: clarify remote-group interval range applies post-conversion CodeRabbit review on #2241 noted the range (60-2419200s) wasn't clearly tied to suffixed values. Confirmed in vyos-1x conf_mode/firewall.py: human_to_seconds() converts the value first, then the range check runs on the converted seconds -- so e.g. "30s" is rejected same as "30".

docs: T8045: document dont-query (#2211)

2026-09-11T14:52:08+00:00

* docs: T8045: document dont-query --------- Co-authored-by: Daniil Baturin

docs: Update sFlow page to VyOS 1.5 standards (#2237)

2026-09-11T13:10:55+00:00

* docs: Update sFlow page to VyOS 1.5 standards

data-ciphers-fallback must required for s2s (#2235)

2026-09-11T12:42:09+00:00

docs: Update Conntrack page to VyOS 1.5 standards (#2232)

2026-09-11T12:38:51+00:00

* docs: Update Conntrack page to VyOS 1.5 standards * Update conntrack.md * Apply suggestion from @dmbaturin * Apply suggestion from @dmbaturin * Apply suggestion from @dmbaturin * Apply suggestion from @dmbaturin --------- Co-authored-by: Daniil Baturin

docs: Update Acceleration page to VyOS 1.5 standards (#2231)

2026-09-11T12:32:17+00:00

* docs: Update Acceleration page to VyOS 1.5 standards * Apply batched suggestions from code review Co-authored-by: Daniil Baturin * Update acceleration.md --------- Co-authored-by: Daniil Baturin

Merge pull request #2210 from cqjjjzr/T9166-ipv6-ha

2026-09-11T12:20:31+00:00

docs: T9166: document IPv6 for HA peer link