From b8b3044d3c3515d91de0f44785bfd965174867df Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 6 May 2026 21:50:08 +0300 Subject: feat: flip swap mechanism on sagitta — MD as primary, RST as override MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirror of #1899 (current) and #1900 (circinus) for sagitta. Same logic, same scripts, per-branch file set. Changes: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 210 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 210 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty - conf.py exclude_patterns flipped: rst-*.rst excluded by default - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt - scripts/swap_sources.py imported from current (post-#1899 rewrite, with inverted rename direction) - scripts/import_myst.py and tests/test_import_myst.py deleted (obsolete) - tests/test_swap_sources.py imported from current (post-#1899 rewrite) Side-effect: fixes the same 404 on /en/1.4/ View page source links that #1899 fixed for /en/rolling/ and #1900 fixed for /en/1.5/. Per-branch differences vs #1899: - sagitta has 210 stems vs current's 254 (sagitta has no vpp pages and fewer current-only features; cli + installation/cloud/aws are still RST-only on sagitta pending the title-level fix follow-up) - otherwise the script/conf.py/test changes are byte-identical with current Generated by robots https://vyos.io --- docs/404.md | 13 + docs/404.rst | 12 - docs/_rst_overrides.txt | 7 + docs/_swap.txt | 214 - docs/automation/cloud-init.md | 387 ++ docs/automation/cloud-init.rst | 441 -- docs/automation/command-scripting.md | 207 + docs/automation/command-scripting.rst | 214 - docs/automation/index.md | 15 + docs/automation/index.rst | 16 - docs/automation/md-cloud-init.md | 387 -- docs/automation/md-command-scripting.md | 207 - docs/automation/md-index.md | 15 - docs/automation/md-vyos-ansible.md | 89 - docs/automation/md-vyos-api.md | 383 -- docs/automation/md-vyos-napalm.md | 142 - docs/automation/md-vyos-netmiko.md | 72 - docs/automation/md-vyos-salt.md | 209 - docs/automation/rst-cloud-init.rst | 441 ++ docs/automation/rst-command-scripting.rst | 214 + docs/automation/rst-index.rst | 16 + docs/automation/rst-vyos-ansible.rst | 93 + docs/automation/rst-vyos-api.rst | 406 ++ docs/automation/rst-vyos-napalm.rst | 144 + docs/automation/rst-vyos-netmiko.rst | 72 + docs/automation/rst-vyos-salt.rst | 216 + docs/automation/terraform/index.md | 13 + docs/automation/terraform/index.rst | 14 - docs/automation/terraform/md-index.md | 13 - docs/automation/terraform/md-terraformAWS.md | 519 -- docs/automation/terraform/md-terraformAZ.md | 470 -- docs/automation/terraform/md-terraformGoogle.md | 0 docs/automation/terraform/md-terraformvSphere.md | 377 -- docs/automation/terraform/md-terraformvyos.md | 37 - docs/automation/terraform/rst-index.rst | 14 + docs/automation/terraform/rst-terraformAWS.rst | 547 ++ docs/automation/terraform/rst-terraformAZ.rst | 488 ++ docs/automation/terraform/rst-terraformGoogle.rst | 0 docs/automation/terraform/rst-terraformvSphere.rst | 400 ++ docs/automation/terraform/rst-terraformvyos.rst | 39 + docs/automation/terraform/terraformAWS.md | 519 ++ docs/automation/terraform/terraformAWS.rst | 547 -- docs/automation/terraform/terraformAZ.md | 470 ++ docs/automation/terraform/terraformAZ.rst | 488 -- docs/automation/terraform/terraformGoogle.md | 0 docs/automation/terraform/terraformGoogle.rst | 0 docs/automation/terraform/terraformvSphere.md | 377 ++ docs/automation/terraform/terraformvSphere.rst | 400 -- docs/automation/terraform/terraformvyos.md | 37 + docs/automation/terraform/terraformvyos.rst | 39 - docs/automation/vyos-ansible.md | 89 + docs/automation/vyos-ansible.rst | 93 - docs/automation/vyos-api.md | 383 ++ docs/automation/vyos-api.rst | 406 -- docs/automation/vyos-napalm.md | 142 + docs/automation/vyos-napalm.rst | 144 - docs/automation/vyos-netmiko.md | 72 + docs/automation/vyos-netmiko.rst | 72 - docs/automation/vyos-salt.md | 209 + docs/automation/vyos-salt.rst | 216 - docs/changelog/1.2.1.md | 50 + docs/changelog/1.2.1.rst | 52 - docs/changelog/1.2.2.md | 43 + docs/changelog/1.2.2.rst | 46 - docs/changelog/1.2.3.md | 58 + docs/changelog/1.2.3.rst | 62 - docs/changelog/1.2.4.md | 75 + docs/changelog/1.2.4.rst | 77 - docs/changelog/1.2.5.md | 68 + docs/changelog/1.2.5.rst | 70 - docs/changelog/1.2.6.md | 104 + docs/changelog/1.2.6.rst | 108 - docs/changelog/1.3.md | 4317 ++++++++++++++ docs/changelog/1.3.rst | 5978 ------------------- docs/changelog/1.4.md | 4457 +++++++++++++++ docs/changelog/1.4.rst | 6044 -------------------- docs/changelog/1.5.md | 32 + docs/changelog/1.5.rst | 47 - docs/changelog/index.md | 19 + docs/changelog/index.rst | 21 - docs/changelog/md-1.2.1.md | 50 - docs/changelog/md-1.2.2.md | 43 - docs/changelog/md-1.2.3.md | 58 - docs/changelog/md-1.2.4.md | 75 - docs/changelog/md-1.2.5.md | 68 - docs/changelog/md-1.2.6.md | 104 - docs/changelog/md-1.3.md | 4317 -------------- docs/changelog/md-1.4.md | 4457 --------------- docs/changelog/md-1.5.md | 32 - docs/changelog/md-index.md | 19 - docs/changelog/rst-1.2.1.rst | 52 + docs/changelog/rst-1.2.2.rst | 46 + docs/changelog/rst-1.2.3.rst | 62 + docs/changelog/rst-1.2.4.rst | 77 + docs/changelog/rst-1.2.5.rst | 70 + docs/changelog/rst-1.2.6.rst | 108 + docs/changelog/rst-1.3.rst | 5978 +++++++++++++++++++ docs/changelog/rst-1.4.rst | 6044 ++++++++++++++++++++ docs/changelog/rst-1.5.rst | 47 + docs/changelog/rst-index.rst | 21 + docs/conf.py | 6 +- .../DHCPRelay_through_GRE/DHCPRelay_through_GRE.md | 96 + .../DHCPRelay_through_GRE.rst | 98 - .../md-DHCPRelay_through_GRE.md | 96 - .../rst-DHCPRelay_through_GRE.rst | 98 + .../autotest/L3VPN_EVPN/L3VPN_EVPN.md | 250 + .../autotest/L3VPN_EVPN/L3VPN_EVPN.rst | 251 - .../autotest/L3VPN_EVPN/md-L3VPN_EVPN.md | 250 - .../autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst | 251 + .../OpenVPN_with_LDAP/OpenVPN_with_LDAP.md | 284 + .../OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst | 281 - .../OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md | 284 - .../OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst | 281 + .../configexamples/autotest/Wireguard/Wireguard.md | 113 + .../autotest/Wireguard/Wireguard.rst | 112 - .../autotest/Wireguard/md-Wireguard.md | 113 - .../autotest/Wireguard/rst-Wireguard.rst | 112 + .../autotest/tunnelbroker/md-tunnelbroker.md | 199 - .../autotest/tunnelbroker/rst-tunnelbroker.rst | 207 + .../autotest/tunnelbroker/tunnelbroker.md | 199 + .../autotest/tunnelbroker/tunnelbroker.rst | 207 - docs/configexamples/azure-vpn-bgp.md | 134 + docs/configexamples/azure-vpn-bgp.rst | 137 - docs/configexamples/azure-vpn-dual-bgp.md | 160 + docs/configexamples/azure-vpn-dual-bgp.rst | 162 - docs/configexamples/bgp-ipv6-unnumbered.md | 174 + docs/configexamples/bgp-ipv6-unnumbered.rst | 176 - docs/configexamples/firewall.md | 15 + docs/configexamples/firewall.rst | 12 - docs/configexamples/fwall-and-vrf.md | 119 + docs/configexamples/fwall-and-vrf.rst | 121 - docs/configexamples/ha.md | 545 ++ docs/configexamples/ha.rst | 584 -- docs/configexamples/index.md | 59 + docs/configexamples/index.rst | 58 - docs/configexamples/inter-vrf-routing-vrf-lite.md | 798 +++ docs/configexamples/inter-vrf-routing-vrf-lite.rst | 855 --- docs/configexamples/ipsec-cisco-policy-based.md | 357 ++ docs/configexamples/ipsec-cisco-policy-based.rst | 355 -- docs/configexamples/ipsec-cisco-route-based.md | 402 ++ docs/configexamples/ipsec-cisco-route-based.rst | 405 -- docs/configexamples/ipsec-pa-route-based.md | 420 ++ docs/configexamples/ipsec-pa-route-based.rst | 420 -- docs/configexamples/l3vpn-hub-and-spoke.md | 1094 ++++ docs/configexamples/l3vpn-hub-and-spoke.rst | 1123 ---- docs/configexamples/lac-lns.md | 174 + docs/configexamples/lac-lns.rst | 177 - docs/configexamples/md-azure-vpn-bgp.md | 134 - docs/configexamples/md-azure-vpn-dual-bgp.md | 160 - docs/configexamples/md-bgp-ipv6-unnumbered.md | 174 - docs/configexamples/md-firewall.md | 15 - docs/configexamples/md-fwall-and-vrf.md | 119 - docs/configexamples/md-ha.md | 545 -- docs/configexamples/md-index.md | 59 - .../md-inter-vrf-routing-vrf-lite.md | 798 --- docs/configexamples/md-ipsec-cisco-policy-based.md | 357 -- docs/configexamples/md-ipsec-cisco-route-based.md | 402 -- docs/configexamples/md-ipsec-pa-route-based.md | 420 -- docs/configexamples/md-l3vpn-hub-and-spoke.md | 1094 ---- docs/configexamples/md-lac-lns.md | 174 - docs/configexamples/md-nmp.md | 69 - docs/configexamples/md-ospf-unnumbered.md | 118 - docs/configexamples/md-pppoe-ipv6-basic.md | 111 - docs/configexamples/md-qos.md | 187 - docs/configexamples/md-segment-routing-isis.md | 277 - docs/configexamples/md-wan-load-balancing.md | 175 - docs/configexamples/md-zone-policy.md | 415 -- docs/configexamples/nmp.md | 69 + docs/configexamples/nmp.rst | 66 - docs/configexamples/ospf-unnumbered.md | 118 + docs/configexamples/ospf-unnumbered.rst | 120 - docs/configexamples/pppoe-ipv6-basic.md | 111 + docs/configexamples/pppoe-ipv6-basic.rst | 116 - docs/configexamples/qos.md | 187 + docs/configexamples/qos.rst | 182 - docs/configexamples/rst-azure-vpn-bgp.rst | 137 + docs/configexamples/rst-azure-vpn-dual-bgp.rst | 162 + docs/configexamples/rst-bgp-ipv6-unnumbered.rst | 176 + docs/configexamples/rst-firewall.rst | 12 + docs/configexamples/rst-fwall-and-vrf.rst | 121 + docs/configexamples/rst-ha.rst | 584 ++ docs/configexamples/rst-index.rst | 58 + .../rst-inter-vrf-routing-vrf-lite.rst | 855 +++ .../rst-ipsec-cisco-policy-based.rst | 355 ++ .../configexamples/rst-ipsec-cisco-route-based.rst | 405 ++ docs/configexamples/rst-ipsec-pa-route-based.rst | 420 ++ docs/configexamples/rst-l3vpn-hub-and-spoke.rst | 1123 ++++ docs/configexamples/rst-lac-lns.rst | 177 + docs/configexamples/rst-nmp.rst | 66 + docs/configexamples/rst-ospf-unnumbered.rst | 120 + docs/configexamples/rst-pppoe-ipv6-basic.rst | 116 + docs/configexamples/rst-qos.rst | 182 + docs/configexamples/rst-segment-routing-isis.rst | 279 + docs/configexamples/rst-wan-load-balancing.rst | 183 + docs/configexamples/rst-zone-policy.rst | 420 ++ docs/configexamples/segment-routing-isis.md | 277 + docs/configexamples/segment-routing-isis.rst | 279 - docs/configexamples/wan-load-balancing.md | 175 + docs/configexamples/wan-load-balancing.rst | 183 - docs/configexamples/zone-policy.md | 415 ++ docs/configexamples/zone-policy.rst | 420 -- docs/configuration/container/index.md | 406 ++ docs/configuration/container/index.rst | 322 -- docs/configuration/container/md-index.md | 406 -- docs/configuration/container/rst-index.rst | 322 ++ docs/configuration/firewall/bridge.md | 543 ++ docs/configuration/firewall/bridge.rst | 401 -- docs/configuration/firewall/flowtables.md | 195 + docs/configuration/firewall/flowtables.rst | 189 - docs/configuration/firewall/global-options.md | 187 + docs/configuration/firewall/global-options.rst | 147 - docs/configuration/firewall/groups.md | 495 ++ docs/configuration/firewall/groups.rst | 429 -- docs/configuration/firewall/index.md | 181 + docs/configuration/firewall/index.rst | 180 - docs/configuration/firewall/ipv4.md | 2037 +++++++ docs/configuration/firewall/ipv4.rst | 1237 ---- docs/configuration/firewall/ipv6.md | 2026 +++++++ docs/configuration/firewall/ipv6.rst | 1233 ---- docs/configuration/firewall/md-bridge.md | 543 -- docs/configuration/firewall/md-flowtables.md | 195 - docs/configuration/firewall/md-global-options.md | 187 - docs/configuration/firewall/md-groups.md | 495 -- docs/configuration/firewall/md-index.md | 181 - docs/configuration/firewall/md-ipv4.md | 2037 ------- docs/configuration/firewall/md-ipv6.md | 2026 ------- docs/configuration/firewall/md-zone.md | 177 - docs/configuration/firewall/rst-bridge.rst | 401 ++ docs/configuration/firewall/rst-flowtables.rst | 189 + docs/configuration/firewall/rst-global-options.rst | 147 + docs/configuration/firewall/rst-groups.rst | 429 ++ docs/configuration/firewall/rst-index.rst | 180 + docs/configuration/firewall/rst-ipv4.rst | 1237 ++++ docs/configuration/firewall/rst-ipv6.rst | 1233 ++++ docs/configuration/firewall/rst-zone.rst | 163 + docs/configuration/firewall/zone.md | 177 + docs/configuration/firewall/zone.rst | 163 - docs/configuration/highavailability/index.md | 491 ++ docs/configuration/highavailability/index.rst | 481 -- docs/configuration/highavailability/md-index.md | 491 -- docs/configuration/highavailability/rst-index.rst | 481 ++ docs/configuration/index.md | 24 + docs/configuration/index.rst | 24 - docs/configuration/interfaces/bonding.md | 671 +++ docs/configuration/interfaces/bonding.rst | 645 --- docs/configuration/interfaces/bridge.md | 367 ++ docs/configuration/interfaces/bridge.rst | 339 -- docs/configuration/interfaces/dummy.md | 94 + docs/configuration/interfaces/dummy.rst | 84 - docs/configuration/interfaces/ethernet.md | 324 ++ docs/configuration/interfaces/ethernet.rst | 305 - docs/configuration/interfaces/geneve.md | 101 + docs/configuration/interfaces/geneve.rst | 87 - docs/configuration/interfaces/index.md | 28 + docs/configuration/interfaces/index.rst | 30 - docs/configuration/interfaces/l2tpv3.md | 198 + docs/configuration/interfaces/l2tpv3.rst | 191 - docs/configuration/interfaces/loopback.md | 80 + docs/configuration/interfaces/loopback.rst | 73 - docs/configuration/interfaces/macsec.md | 305 + docs/configuration/interfaces/macsec.rst | 285 - docs/configuration/interfaces/md-bonding.md | 671 --- docs/configuration/interfaces/md-bridge.md | 367 -- docs/configuration/interfaces/md-dummy.md | 94 - docs/configuration/interfaces/md-ethernet.md | 324 -- docs/configuration/interfaces/md-geneve.md | 101 - docs/configuration/interfaces/md-index.md | 28 - docs/configuration/interfaces/md-l2tpv3.md | 198 - docs/configuration/interfaces/md-loopback.md | 80 - docs/configuration/interfaces/md-macsec.md | 305 - docs/configuration/interfaces/md-openvpn.md | 867 --- docs/configuration/interfaces/md-pppoe.md | 443 -- .../configuration/interfaces/md-pseudo-ethernet.md | 68 - docs/configuration/interfaces/md-sstp-client.md | 173 - docs/configuration/interfaces/md-tunnel.md | 281 - .../interfaces/md-virtual-ethernet.md | 118 - docs/configuration/interfaces/md-vti.md | 40 - docs/configuration/interfaces/md-vxlan.md | 366 -- docs/configuration/interfaces/md-wireguard.md | 434 -- docs/configuration/interfaces/md-wireless.md | 698 --- docs/configuration/interfaces/md-wwan.md | 372 -- docs/configuration/interfaces/openvpn.md | 867 +++ docs/configuration/interfaces/openvpn.rst | 867 --- docs/configuration/interfaces/pppoe.md | 443 ++ docs/configuration/interfaces/pppoe.rst | 403 -- docs/configuration/interfaces/pseudo-ethernet.md | 68 + docs/configuration/interfaces/pseudo-ethernet.rst | 67 - docs/configuration/interfaces/rst-bonding.rst | 645 +++ docs/configuration/interfaces/rst-bridge.rst | 339 ++ docs/configuration/interfaces/rst-dummy.rst | 84 + docs/configuration/interfaces/rst-ethernet.rst | 305 + docs/configuration/interfaces/rst-geneve.rst | 87 + docs/configuration/interfaces/rst-index.rst | 30 + docs/configuration/interfaces/rst-l2tpv3.rst | 191 + docs/configuration/interfaces/rst-loopback.rst | 73 + docs/configuration/interfaces/rst-macsec.rst | 285 + docs/configuration/interfaces/rst-openvpn.rst | 867 +++ docs/configuration/interfaces/rst-pppoe.rst | 403 ++ .../interfaces/rst-pseudo-ethernet.rst | 67 + docs/configuration/interfaces/rst-sstp-client.rst | 150 + docs/configuration/interfaces/rst-tunnel.rst | 286 + .../interfaces/rst-virtual-ethernet.rst | 110 + docs/configuration/interfaces/rst-vti.rst | 40 + docs/configuration/interfaces/rst-vxlan.rst | 349 ++ docs/configuration/interfaces/rst-wireguard.rst | 428 ++ docs/configuration/interfaces/rst-wireless.rst | 618 ++ docs/configuration/interfaces/rst-wwan.rst | 338 ++ docs/configuration/interfaces/sstp-client.md | 173 + docs/configuration/interfaces/sstp-client.rst | 150 - docs/configuration/interfaces/tunnel.md | 281 + docs/configuration/interfaces/tunnel.rst | 286 - docs/configuration/interfaces/virtual-ethernet.md | 118 + docs/configuration/interfaces/virtual-ethernet.rst | 110 - docs/configuration/interfaces/vti.md | 40 + docs/configuration/interfaces/vti.rst | 40 - docs/configuration/interfaces/vxlan.md | 366 ++ docs/configuration/interfaces/vxlan.rst | 349 -- docs/configuration/interfaces/wireguard.md | 434 ++ docs/configuration/interfaces/wireguard.rst | 428 -- docs/configuration/interfaces/wireless.md | 698 +++ docs/configuration/interfaces/wireless.rst | 618 -- docs/configuration/interfaces/wwan.md | 372 ++ docs/configuration/interfaces/wwan.rst | 338 -- docs/configuration/loadbalancing/index.md | 12 + docs/configuration/loadbalancing/index.rst | 12 - docs/configuration/loadbalancing/md-index.md | 12 - .../loadbalancing/md-reverse-proxy.md | 485 -- docs/configuration/loadbalancing/md-wan.md | 300 - docs/configuration/loadbalancing/reverse-proxy.md | 485 ++ docs/configuration/loadbalancing/reverse-proxy.rst | 442 -- docs/configuration/loadbalancing/rst-index.rst | 12 + .../loadbalancing/rst-reverse-proxy.rst | 442 ++ docs/configuration/loadbalancing/rst-wan.rst | 313 + docs/configuration/loadbalancing/wan.md | 300 + docs/configuration/loadbalancing/wan.rst | 313 - docs/configuration/md-index.md | 24 - docs/configuration/nat/index.md | 13 + docs/configuration/nat/index.rst | 13 - docs/configuration/nat/md-index.md | 13 - docs/configuration/nat/md-nat44.md | 802 --- docs/configuration/nat/md-nat64.md | 72 - docs/configuration/nat/md-nat66.md | 227 - docs/configuration/nat/nat44.md | 802 +++ docs/configuration/nat/nat44.rst | 826 --- docs/configuration/nat/nat64.md | 72 + docs/configuration/nat/nat64.rst | 81 - docs/configuration/nat/nat66.md | 227 + docs/configuration/nat/nat66.rst | 236 - docs/configuration/nat/rst-index.rst | 13 + docs/configuration/nat/rst-nat44.rst | 826 +++ docs/configuration/nat/rst-nat64.rst | 81 + docs/configuration/nat/rst-nat66.rst | 236 + docs/configuration/pki/index.md | 408 ++ docs/configuration/pki/index.rst | 340 -- docs/configuration/pki/md-index.md | 408 -- docs/configuration/pki/rst-index.rst | 340 ++ docs/configuration/policy/access-list.md | 70 + docs/configuration/policy/access-list.rst | 70 - docs/configuration/policy/as-path-list.md | 29 + docs/configuration/policy/as-path-list.rst | 33 - docs/configuration/policy/community-list.md | 40 + docs/configuration/policy/community-list.rst | 35 - docs/configuration/policy/examples.md | 203 + docs/configuration/policy/examples.rst | 213 - docs/configuration/policy/extcommunity-list.md | 33 + docs/configuration/policy/extcommunity-list.rst | 40 - docs/configuration/policy/index.md | 53 + docs/configuration/policy/index.rst | 54 - docs/configuration/policy/large-community-list.md | 29 + docs/configuration/policy/large-community-list.rst | 36 - docs/configuration/policy/local-route.md | 57 + docs/configuration/policy/local-route.rst | 47 - docs/configuration/policy/md-access-list.md | 70 - docs/configuration/policy/md-as-path-list.md | 29 - docs/configuration/policy/md-community-list.md | 40 - docs/configuration/policy/md-examples.md | 203 - docs/configuration/policy/md-extcommunity-list.md | 33 - docs/configuration/policy/md-index.md | 53 - .../policy/md-large-community-list.md | 29 - docs/configuration/policy/md-local-route.md | 57 - docs/configuration/policy/md-prefix-list.md | 143 - docs/configuration/policy/md-route-map.md | 515 -- docs/configuration/policy/md-route.md | 483 -- docs/configuration/policy/prefix-list.md | 143 + docs/configuration/policy/prefix-list.rst | 96 - docs/configuration/policy/route-map.md | 515 ++ docs/configuration/policy/route-map.rst | 384 -- docs/configuration/policy/route.md | 483 ++ docs/configuration/policy/route.rst | 274 - docs/configuration/policy/rst-access-list.rst | 70 + docs/configuration/policy/rst-as-path-list.rst | 33 + docs/configuration/policy/rst-community-list.rst | 35 + docs/configuration/policy/rst-examples.rst | 213 + .../configuration/policy/rst-extcommunity-list.rst | 40 + docs/configuration/policy/rst-index.rst | 54 + .../policy/rst-large-community-list.rst | 36 + docs/configuration/policy/rst-local-route.rst | 47 + docs/configuration/policy/rst-prefix-list.rst | 96 + docs/configuration/policy/rst-route-map.rst | 384 ++ docs/configuration/policy/rst-route.rst | 274 + docs/configuration/protocols/babel.md | 245 + docs/configuration/protocols/babel.rst | 210 - docs/configuration/protocols/bfd.md | 205 + docs/configuration/protocols/bfd.rst | 199 - docs/configuration/protocols/bgp.md | 1435 +++++ docs/configuration/protocols/bgp.rst | 1274 ----- docs/configuration/protocols/failover.md | 120 + docs/configuration/protocols/failover.rst | 114 - docs/configuration/protocols/igmp-proxy.md | 79 + docs/configuration/protocols/igmp-proxy.rst | 77 - docs/configuration/protocols/index.md | 22 + docs/configuration/protocols/index.rst | 22 - docs/configuration/protocols/isis.md | 596 ++ docs/configuration/protocols/isis.rst | 547 -- docs/configuration/protocols/md-babel.md | 245 - docs/configuration/protocols/md-bfd.md | 205 - docs/configuration/protocols/md-bgp.md | 1435 ----- docs/configuration/protocols/md-failover.md | 120 - docs/configuration/protocols/md-igmp-proxy.md | 79 - docs/configuration/protocols/md-index.md | 22 - docs/configuration/protocols/md-isis.md | 596 -- docs/configuration/protocols/md-mpls.md | 285 - docs/configuration/protocols/md-ospf.md | 1560 ----- docs/configuration/protocols/md-pim.md | 304 - docs/configuration/protocols/md-pim6.md | 100 - docs/configuration/protocols/md-rip.md | 294 - docs/configuration/protocols/md-rpki.md | 210 - docs/configuration/protocols/md-segment-routing.md | 359 -- docs/configuration/protocols/md-static.md | 268 - docs/configuration/protocols/mpls.md | 285 + docs/configuration/protocols/mpls.rst | 259 - docs/configuration/protocols/ospf.md | 1560 +++++ docs/configuration/protocols/ospf.rst | 1391 ----- docs/configuration/protocols/pim.md | 304 + docs/configuration/protocols/pim.rst | 266 - docs/configuration/protocols/pim6.md | 100 + docs/configuration/protocols/pim6.rst | 94 - docs/configuration/protocols/rip.md | 294 + docs/configuration/protocols/rip.rst | 257 - docs/configuration/protocols/rpki.md | 210 + docs/configuration/protocols/rpki.rst | 211 - docs/configuration/protocols/rst-babel.rst | 210 + docs/configuration/protocols/rst-bfd.rst | 199 + docs/configuration/protocols/rst-bgp.rst | 1274 +++++ docs/configuration/protocols/rst-failover.rst | 114 + docs/configuration/protocols/rst-igmp-proxy.rst | 77 + docs/configuration/protocols/rst-index.rst | 22 + docs/configuration/protocols/rst-isis.rst | 547 ++ docs/configuration/protocols/rst-mpls.rst | 259 + docs/configuration/protocols/rst-ospf.rst | 1391 +++++ docs/configuration/protocols/rst-pim.rst | 266 + docs/configuration/protocols/rst-pim6.rst | 94 + docs/configuration/protocols/rst-rip.rst | 257 + docs/configuration/protocols/rst-rpki.rst | 211 + .../protocols/rst-segment-routing.rst | 357 ++ docs/configuration/protocols/rst-static.rst | 242 + docs/configuration/protocols/segment-routing.md | 359 ++ docs/configuration/protocols/segment-routing.rst | 357 -- docs/configuration/protocols/static.md | 268 + docs/configuration/protocols/static.rst | 242 - docs/configuration/rst-index.rst | 24 + docs/configuration/service/broadcast-relay.md | 76 + docs/configuration/service/broadcast-relay.rst | 66 - docs/configuration/service/config-sync.md | 117 + docs/configuration/service/config-sync.rst | 114 - docs/configuration/service/conntrack-sync.md | 329 ++ docs/configuration/service/conntrack-sync.rst | 296 - docs/configuration/service/console-server.md | 139 + docs/configuration/service/console-server.rst | 120 - docs/configuration/service/dhcp-relay.md | 225 + docs/configuration/service/dhcp-relay.rst | 205 - docs/configuration/service/dhcp-server.md | 919 +++ docs/configuration/service/dhcp-server.rst | 831 --- docs/configuration/service/dns.md | 476 ++ docs/configuration/service/dns.rst | 417 -- docs/configuration/service/eventhandler.md | 122 + docs/configuration/service/eventhandler.rst | 127 - docs/configuration/service/https.md | 100 + docs/configuration/service/https.rst | 83 - docs/configuration/service/ids.md | 200 + docs/configuration/service/ids.rst | 179 - docs/configuration/service/index.md | 30 + docs/configuration/service/index.rst | 32 - docs/configuration/service/ipoe-server.md | 531 ++ docs/configuration/service/ipoe-server.rst | 450 -- docs/configuration/service/lldp.md | 158 + docs/configuration/service/lldp.rst | 142 - docs/configuration/service/md-broadcast-relay.md | 76 - docs/configuration/service/md-config-sync.md | 117 - docs/configuration/service/md-conntrack-sync.md | 329 -- docs/configuration/service/md-console-server.md | 139 - docs/configuration/service/md-dhcp-relay.md | 225 - docs/configuration/service/md-dhcp-server.md | 919 --- docs/configuration/service/md-dns.md | 476 -- docs/configuration/service/md-eventhandler.md | 122 - docs/configuration/service/md-https.md | 100 - docs/configuration/service/md-ids.md | 200 - docs/configuration/service/md-index.md | 30 - docs/configuration/service/md-ipoe-server.md | 531 -- docs/configuration/service/md-lldp.md | 158 - docs/configuration/service/md-mdns.md | 138 - docs/configuration/service/md-monitoring.md | 191 - docs/configuration/service/md-ntp.md | 124 - docs/configuration/service/md-pppoe-server.md | 789 --- docs/configuration/service/md-router-advert.md | 125 - docs/configuration/service/md-salt-minion.md | 53 - docs/configuration/service/md-snmp.md | 259 - docs/configuration/service/md-ssh.md | 304 - docs/configuration/service/md-tftp-server.md | 78 - docs/configuration/service/md-webproxy.md | 459 -- docs/configuration/service/mdns.md | 138 + docs/configuration/service/mdns.rst | 123 - docs/configuration/service/monitoring.md | 191 + docs/configuration/service/monitoring.rst | 149 - docs/configuration/service/ntp.md | 124 + docs/configuration/service/ntp.rst | 114 - docs/configuration/service/pppoe-server.md | 789 +++ docs/configuration/service/pppoe-server.rst | 684 --- docs/configuration/service/router-advert.md | 125 + docs/configuration/service/router-advert.rst | 128 - docs/configuration/service/rst-broadcast-relay.rst | 66 + docs/configuration/service/rst-config-sync.rst | 114 + docs/configuration/service/rst-conntrack-sync.rst | 296 + docs/configuration/service/rst-console-server.rst | 120 + docs/configuration/service/rst-dhcp-relay.rst | 205 + docs/configuration/service/rst-dhcp-server.rst | 831 +++ docs/configuration/service/rst-dns.rst | 417 ++ docs/configuration/service/rst-eventhandler.rst | 127 + docs/configuration/service/rst-https.rst | 83 + docs/configuration/service/rst-ids.rst | 179 + docs/configuration/service/rst-index.rst | 32 + docs/configuration/service/rst-ipoe-server.rst | 450 ++ docs/configuration/service/rst-lldp.rst | 142 + docs/configuration/service/rst-mdns.rst | 123 + docs/configuration/service/rst-monitoring.rst | 149 + docs/configuration/service/rst-ntp.rst | 114 + docs/configuration/service/rst-pppoe-server.rst | 684 +++ docs/configuration/service/rst-router-advert.rst | 128 + docs/configuration/service/rst-salt-minion.rst | 53 + docs/configuration/service/rst-snmp.rst | 276 + docs/configuration/service/rst-ssh.rst | 250 + docs/configuration/service/rst-tftp-server.rst | 80 + docs/configuration/service/rst-webproxy.rst | 445 ++ docs/configuration/service/salt-minion.md | 53 + docs/configuration/service/salt-minion.rst | 53 - docs/configuration/service/snmp.md | 259 + docs/configuration/service/snmp.rst | 276 - docs/configuration/service/ssh.md | 304 + docs/configuration/service/ssh.rst | 250 - docs/configuration/service/tftp-server.md | 78 + docs/configuration/service/tftp-server.rst | 80 - docs/configuration/service/webproxy.md | 459 ++ docs/configuration/service/webproxy.rst | 445 -- docs/configuration/system/acceleration.md | 158 + docs/configuration/system/acceleration.rst | 157 - docs/configuration/system/conntrack.md | 365 ++ docs/configuration/system/conntrack.rst | 187 - docs/configuration/system/console.md | 47 + docs/configuration/system/console.rst | 46 - docs/configuration/system/default-route.md | 40 + docs/configuration/system/default-route.rst | 40 - docs/configuration/system/flow-accounting.md | 248 + docs/configuration/system/flow-accounting.rst | 216 - docs/configuration/system/frr.md | 44 + docs/configuration/system/frr.rst | 38 - docs/configuration/system/host-name.md | 70 + docs/configuration/system/host-name.rst | 68 - docs/configuration/system/index.md | 36 + docs/configuration/system/index.rst | 35 - docs/configuration/system/ip.md | 110 + docs/configuration/system/ip.rst | 107 - docs/configuration/system/ipv6.md | 235 + docs/configuration/system/ipv6.rst | 205 - docs/configuration/system/lcd.md | 46 + docs/configuration/system/lcd.rst | 45 - docs/configuration/system/login.md | 474 ++ docs/configuration/system/login.rst | 425 -- docs/configuration/system/md-acceleration.md | 158 - docs/configuration/system/md-conntrack.md | 365 -- docs/configuration/system/md-console.md | 47 - docs/configuration/system/md-default-route.md | 40 - docs/configuration/system/md-flow-accounting.md | 248 - docs/configuration/system/md-frr.md | 44 - docs/configuration/system/md-host-name.md | 70 - docs/configuration/system/md-index.md | 36 - docs/configuration/system/md-ip.md | 110 - docs/configuration/system/md-ipv6.md | 235 - docs/configuration/system/md-lcd.md | 46 - docs/configuration/system/md-login.md | 474 -- docs/configuration/system/md-name-server.md | 65 - docs/configuration/system/md-option.md | 186 - docs/configuration/system/md-proxy.md | 27 - docs/configuration/system/md-sflow.md | 71 - docs/configuration/system/md-sysctl.md | 12 - docs/configuration/system/md-syslog.md | 365 -- docs/configuration/system/md-task-scheduler.md | 48 - docs/configuration/system/md-time-zone.md | 17 - docs/configuration/system/md-updates.md | 37 - docs/configuration/system/name-server.md | 65 + docs/configuration/system/name-server.rst | 74 - docs/configuration/system/option.md | 186 + docs/configuration/system/option.rst | 169 - docs/configuration/system/proxy.md | 27 + docs/configuration/system/proxy.rst | 28 - docs/configuration/system/rst-acceleration.rst | 157 + docs/configuration/system/rst-conntrack.rst | 187 + docs/configuration/system/rst-console.rst | 46 + docs/configuration/system/rst-default-route.rst | 40 + docs/configuration/system/rst-flow-accounting.rst | 216 + docs/configuration/system/rst-frr.rst | 38 + docs/configuration/system/rst-host-name.rst | 68 + docs/configuration/system/rst-index.rst | 35 + docs/configuration/system/rst-ip.rst | 107 + docs/configuration/system/rst-ipv6.rst | 205 + docs/configuration/system/rst-lcd.rst | 45 + docs/configuration/system/rst-login.rst | 425 ++ docs/configuration/system/rst-name-server.rst | 74 + docs/configuration/system/rst-option.rst | 169 + docs/configuration/system/rst-proxy.rst | 28 + docs/configuration/system/rst-sflow.rst | 61 + docs/configuration/system/rst-sysctl.rst | 12 + docs/configuration/system/rst-syslog.rst | 389 ++ docs/configuration/system/rst-task-scheduler.rst | 40 + docs/configuration/system/rst-time-zone.rst | 18 + docs/configuration/system/rst-updates.rst | 37 + docs/configuration/system/sflow.md | 71 + docs/configuration/system/sflow.rst | 61 - docs/configuration/system/sysctl.md | 12 + docs/configuration/system/sysctl.rst | 12 - docs/configuration/system/syslog.md | 365 ++ docs/configuration/system/syslog.rst | 389 -- docs/configuration/system/task-scheduler.md | 48 + docs/configuration/system/task-scheduler.rst | 40 - docs/configuration/system/time-zone.md | 17 + docs/configuration/system/time-zone.rst | 18 - docs/configuration/system/updates.md | 37 + docs/configuration/system/updates.rst | 37 - docs/configuration/trafficpolicy/index.md | 1391 +++++ docs/configuration/trafficpolicy/index.rst | 1341 ----- docs/configuration/trafficpolicy/md-index.md | 1391 ----- docs/configuration/trafficpolicy/rst-index.rst | 1341 +++++ docs/configuration/vpn/dmvpn.md | 351 ++ docs/configuration/vpn/dmvpn.rst | 335 -- docs/configuration/vpn/index.md | 25 + docs/configuration/vpn/index.rst | 25 - docs/configuration/vpn/ipsec/index.md | 20 + docs/configuration/vpn/ipsec/index.rst | 20 - docs/configuration/vpn/ipsec/ipsec_general.md | 347 ++ docs/configuration/vpn/ipsec/ipsec_general.rst | 308 - docs/configuration/vpn/ipsec/md-index.md | 20 - docs/configuration/vpn/ipsec/md-ipsec_general.md | 347 -- .../vpn/ipsec/md-remoteaccess_ipsec.md | 179 - docs/configuration/vpn/ipsec/md-site2site_ipsec.md | 811 --- .../vpn/ipsec/md-troubleshooting_ipsec.md | 305 - docs/configuration/vpn/ipsec/remoteaccess_ipsec.md | 179 + .../configuration/vpn/ipsec/remoteaccess_ipsec.rst | 183 - docs/configuration/vpn/ipsec/rst-index.rst | 20 + docs/configuration/vpn/ipsec/rst-ipsec_general.rst | 308 + .../vpn/ipsec/rst-remoteaccess_ipsec.rst | 183 + .../vpn/ipsec/rst-site2site_ipsec.rst | 729 +++ .../vpn/ipsec/rst-troubleshooting_ipsec.rst | 323 ++ docs/configuration/vpn/ipsec/site2site_ipsec.md | 811 +++ docs/configuration/vpn/ipsec/site2site_ipsec.rst | 729 --- .../vpn/ipsec/troubleshooting_ipsec.md | 305 + .../vpn/ipsec/troubleshooting_ipsec.rst | 323 -- docs/configuration/vpn/l2tp.md | 685 +++ docs/configuration/vpn/l2tp.rst | 578 -- docs/configuration/vpn/md-dmvpn.md | 351 -- docs/configuration/vpn/md-index.md | 25 - docs/configuration/vpn/md-l2tp.md | 685 --- docs/configuration/vpn/md-openconnect.md | 291 - docs/configuration/vpn/md-pptp.md | 656 --- docs/configuration/vpn/md-rsa-keys.md | 105 - docs/configuration/vpn/md-sstp.md | 765 --- docs/configuration/vpn/openconnect.md | 291 + docs/configuration/vpn/openconnect.rst | 300 - docs/configuration/vpn/pptp.md | 656 +++ docs/configuration/vpn/pptp.rst | 552 -- docs/configuration/vpn/rsa-keys.md | 105 + docs/configuration/vpn/rsa-keys.rst | 107 - docs/configuration/vpn/rst-dmvpn.rst | 335 ++ docs/configuration/vpn/rst-index.rst | 25 + docs/configuration/vpn/rst-l2tp.rst | 578 ++ docs/configuration/vpn/rst-openconnect.rst | 300 + docs/configuration/vpn/rst-pptp.rst | 552 ++ docs/configuration/vpn/rst-rsa-keys.rst | 107 + docs/configuration/vpn/rst-sstp.rst | 657 +++ docs/configuration/vpn/sstp.md | 765 +++ docs/configuration/vpn/sstp.rst | 657 --- docs/configuration/vrf/index.md | 601 ++ docs/configuration/vrf/index.rst | 568 -- docs/configuration/vrf/md-index.md | 601 -- docs/configuration/vrf/rst-index.rst | 568 ++ docs/contributing/build-vyos.md | 838 +++ docs/contributing/build-vyos.rst | 865 --- docs/contributing/debugging.md | 191 + docs/contributing/debugging.rst | 206 - docs/contributing/development.md | 694 +++ docs/contributing/development.rst | 738 --- docs/contributing/issues-features.md | 73 + docs/contributing/issues-features.rst | 80 - docs/contributing/md-build-vyos.md | 838 --- docs/contributing/md-debugging.md | 191 - docs/contributing/md-development.md | 694 --- docs/contributing/md-issues-features.md | 73 - docs/contributing/md-testing.md | 214 - docs/contributing/md-upstream-packages.md | 79 - docs/contributing/rst-build-vyos.rst | 865 +++ docs/contributing/rst-debugging.rst | 206 + docs/contributing/rst-development.rst | 738 +++ docs/contributing/rst-issues-features.rst | 80 + docs/contributing/rst-testing.rst | 208 + docs/contributing/rst-upstream-packages.rst | 86 + docs/contributing/testing.md | 214 + docs/contributing/testing.rst | 208 - docs/contributing/upstream-packages.md | 79 + docs/contributing/upstream-packages.rst | 86 - docs/coverage.md | 55 + docs/coverage.rst | 56 - docs/documentation.md | 430 ++ docs/documentation.rst | 452 -- docs/index.md | 113 + docs/index.rst | 103 - docs/installation/cloud/aws-ha.md | 135 + docs/installation/cloud/aws-ha.rst | 154 - docs/installation/cloud/aws-to-azure.md | 175 + docs/installation/cloud/aws-to-azure.rst | 189 - docs/installation/cloud/azure-ha.md | 128 + docs/installation/cloud/azure-ha.rst | 152 - docs/installation/cloud/azure.md | 378 ++ docs/installation/cloud/azure.rst | 433 -- docs/installation/cloud/gcp.md | 260 + docs/installation/cloud/gcp.rst | 277 - docs/installation/cloud/index.md | 14 + docs/installation/cloud/index.rst | 16 - docs/installation/cloud/md-aws-ha.md | 135 - docs/installation/cloud/md-aws-to-azure.md | 175 - docs/installation/cloud/md-azure-ha.md | 128 - docs/installation/cloud/md-azure.md | 378 -- docs/installation/cloud/md-gcp.md | 260 - docs/installation/cloud/md-index.md | 14 - docs/installation/cloud/md-oracel.md | 5 - docs/installation/cloud/oracel.md | 5 + docs/installation/cloud/oracel.rst | 8 - docs/installation/cloud/rst-aws-ha.rst | 154 + docs/installation/cloud/rst-aws-to-azure.rst | 189 + docs/installation/cloud/rst-azure-ha.rst | 152 + docs/installation/cloud/rst-azure.rst | 433 ++ docs/installation/cloud/rst-gcp.rst | 277 + docs/installation/cloud/rst-index.rst | 16 + docs/installation/cloud/rst-oracel.rst | 8 + docs/installation/image.md | 122 + docs/installation/image.rst | 115 - docs/installation/index.md | 28 + docs/installation/index.rst | 26 - docs/installation/install.md | 396 ++ docs/installation/install.rst | 417 -- docs/installation/md-image.md | 122 - docs/installation/md-index.md | 28 - docs/installation/md-install.md | 396 -- docs/installation/md-update.md | 86 - docs/installation/md-vyos-on-baremetal.md | 626 -- docs/installation/rst-image.rst | 115 + docs/installation/rst-index.rst | 26 + docs/installation/rst-install.rst | 417 ++ docs/installation/rst-update.rst | 82 + docs/installation/rst-vyos-on-baremetal.rst | 632 ++ docs/installation/update.md | 86 + docs/installation/update.rst | 82 - docs/installation/virtual/docker.md | 67 + docs/installation/virtual/docker.rst | 74 - docs/installation/virtual/eve-ng.md | 5 + docs/installation/virtual/eve-ng.rst | 8 - docs/installation/virtual/gns3.md | 187 + docs/installation/virtual/gns3.rst | 175 - docs/installation/virtual/index.md | 13 + docs/installation/virtual/index.rst | 13 - docs/installation/virtual/libvirt.md | 171 + docs/installation/virtual/libvirt.rst | 172 - docs/installation/virtual/md-docker.md | 67 - docs/installation/virtual/md-eve-ng.md | 5 - docs/installation/virtual/md-gns3.md | 187 - docs/installation/virtual/md-index.md | 13 - docs/installation/virtual/md-libvirt.md | 171 - docs/installation/virtual/md-proxmox.md | 45 - docs/installation/virtual/md-vmware.md | 39 - docs/installation/virtual/proxmox.md | 45 + docs/installation/virtual/proxmox.rst | 56 - docs/installation/virtual/rst-docker.rst | 74 + docs/installation/virtual/rst-eve-ng.rst | 8 + docs/installation/virtual/rst-gns3.rst | 175 + docs/installation/virtual/rst-index.rst | 13 + docs/installation/virtual/rst-libvirt.rst | 172 + docs/installation/virtual/rst-proxmox.rst | 56 + docs/installation/virtual/rst-vmware.rst | 46 + docs/installation/virtual/vmware.md | 39 + docs/installation/virtual/vmware.rst | 46 - docs/installation/vyos-on-baremetal.md | 626 ++ docs/installation/vyos-on-baremetal.rst | 632 -- docs/introducing/about.md | 25 + docs/introducing/about.rst | 27 - docs/introducing/history.md | 124 + docs/introducing/history.rst | 136 - docs/introducing/md-about.md | 25 - docs/introducing/md-history.md | 124 - docs/introducing/rst-about.rst | 27 + docs/introducing/rst-history.rst | 136 + docs/md-404.md | 13 - docs/md-coverage.md | 55 - docs/md-documentation.md | 430 -- docs/md-index.md | 113 - docs/md-quick-start.md | 368 -- docs/operation/boot-options.md | 53 + docs/operation/boot-options.rst | 58 - docs/operation/index.md | 12 + docs/operation/index.rst | 12 - docs/operation/information.md | 159 + docs/operation/information.rst | 155 - docs/operation/md-boot-options.md | 53 - docs/operation/md-index.md | 12 - docs/operation/md-information.md | 159 - docs/operation/md-password-recovery.md | 24 - docs/operation/md-raid.md | 249 - docs/operation/password-recovery.md | 24 + docs/operation/password-recovery.rst | 25 - docs/operation/raid.md | 249 + docs/operation/raid.rst | 245 - docs/operation/rst-boot-options.rst | 58 + docs/operation/rst-index.rst | 12 + docs/operation/rst-information.rst | 155 + docs/operation/rst-password-recovery.rst | 25 + docs/operation/rst-raid.rst | 245 + docs/quick-start.md | 368 ++ docs/quick-start.rst | 389 -- docs/rst-404.rst | 12 + docs/rst-coverage.rst | 56 + docs/rst-documentation.rst | 452 ++ docs/rst-index.rst | 103 + docs/rst-quick-start.rst | 389 ++ docs/troubleshooting/index.md | 438 ++ docs/troubleshooting/index.rst | 460 -- docs/troubleshooting/md-index.md | 438 -- docs/troubleshooting/rst-index.rst | 460 ++ 843 files changed, 127157 insertions(+), 127364 deletions(-) create mode 100644 docs/404.md delete mode 100644 docs/404.rst create mode 100644 docs/_rst_overrides.txt delete mode 100644 docs/_swap.txt create mode 100644 docs/automation/cloud-init.md delete mode 100644 docs/automation/cloud-init.rst create mode 100644 docs/automation/command-scripting.md delete mode 100644 docs/automation/command-scripting.rst create mode 100644 docs/automation/index.md delete mode 100644 docs/automation/index.rst delete mode 100644 docs/automation/md-cloud-init.md delete mode 100644 docs/automation/md-command-scripting.md delete mode 100644 docs/automation/md-index.md delete mode 100644 docs/automation/md-vyos-ansible.md delete mode 100644 docs/automation/md-vyos-api.md delete mode 100644 docs/automation/md-vyos-napalm.md delete mode 100644 docs/automation/md-vyos-netmiko.md delete mode 100644 docs/automation/md-vyos-salt.md create mode 100644 docs/automation/rst-cloud-init.rst create mode 100644 docs/automation/rst-command-scripting.rst create mode 100644 docs/automation/rst-index.rst create mode 100644 docs/automation/rst-vyos-ansible.rst create mode 100644 docs/automation/rst-vyos-api.rst create mode 100644 docs/automation/rst-vyos-napalm.rst create mode 100644 docs/automation/rst-vyos-netmiko.rst create mode 100644 docs/automation/rst-vyos-salt.rst create mode 100644 docs/automation/terraform/index.md delete mode 100644 docs/automation/terraform/index.rst delete mode 100644 docs/automation/terraform/md-index.md delete mode 100644 docs/automation/terraform/md-terraformAWS.md delete mode 100644 docs/automation/terraform/md-terraformAZ.md delete mode 100644 docs/automation/terraform/md-terraformGoogle.md delete mode 100644 docs/automation/terraform/md-terraformvSphere.md delete mode 100644 docs/automation/terraform/md-terraformvyos.md create mode 100644 docs/automation/terraform/rst-index.rst create mode 100644 docs/automation/terraform/rst-terraformAWS.rst create mode 100644 docs/automation/terraform/rst-terraformAZ.rst create mode 100644 docs/automation/terraform/rst-terraformGoogle.rst create mode 100644 docs/automation/terraform/rst-terraformvSphere.rst create mode 100644 docs/automation/terraform/rst-terraformvyos.rst create mode 100644 docs/automation/terraform/terraformAWS.md delete mode 100644 docs/automation/terraform/terraformAWS.rst create mode 100644 docs/automation/terraform/terraformAZ.md delete mode 100644 docs/automation/terraform/terraformAZ.rst create mode 100644 docs/automation/terraform/terraformGoogle.md delete mode 100644 docs/automation/terraform/terraformGoogle.rst create mode 100644 docs/automation/terraform/terraformvSphere.md delete mode 100644 docs/automation/terraform/terraformvSphere.rst create mode 100644 docs/automation/terraform/terraformvyos.md delete mode 100644 docs/automation/terraform/terraformvyos.rst create mode 100644 docs/automation/vyos-ansible.md delete mode 100644 docs/automation/vyos-ansible.rst create mode 100644 docs/automation/vyos-api.md delete mode 100644 docs/automation/vyos-api.rst create mode 100644 docs/automation/vyos-napalm.md delete mode 100644 docs/automation/vyos-napalm.rst create mode 100644 docs/automation/vyos-netmiko.md delete mode 100644 docs/automation/vyos-netmiko.rst create mode 100644 docs/automation/vyos-salt.md delete mode 100644 docs/automation/vyos-salt.rst create mode 100644 docs/changelog/1.2.1.md delete mode 100644 docs/changelog/1.2.1.rst create mode 100644 docs/changelog/1.2.2.md delete mode 100644 docs/changelog/1.2.2.rst create mode 100644 docs/changelog/1.2.3.md delete mode 100644 docs/changelog/1.2.3.rst create mode 100644 docs/changelog/1.2.4.md delete mode 100644 docs/changelog/1.2.4.rst create mode 100644 docs/changelog/1.2.5.md delete mode 100644 docs/changelog/1.2.5.rst create mode 100644 docs/changelog/1.2.6.md delete mode 100644 docs/changelog/1.2.6.rst create mode 100644 docs/changelog/1.3.md delete mode 100644 docs/changelog/1.3.rst create mode 100644 docs/changelog/1.4.md delete mode 100644 docs/changelog/1.4.rst create mode 100644 docs/changelog/1.5.md delete mode 100644 docs/changelog/1.5.rst create mode 100644 docs/changelog/index.md delete mode 100644 docs/changelog/index.rst delete mode 100644 docs/changelog/md-1.2.1.md delete mode 100644 docs/changelog/md-1.2.2.md delete mode 100644 docs/changelog/md-1.2.3.md delete mode 100644 docs/changelog/md-1.2.4.md delete mode 100644 docs/changelog/md-1.2.5.md delete mode 100644 docs/changelog/md-1.2.6.md delete mode 100644 docs/changelog/md-1.3.md delete mode 100644 docs/changelog/md-1.4.md delete mode 100644 docs/changelog/md-1.5.md delete mode 100644 docs/changelog/md-index.md create mode 100644 docs/changelog/rst-1.2.1.rst create mode 100644 docs/changelog/rst-1.2.2.rst create mode 100644 docs/changelog/rst-1.2.3.rst create mode 100644 docs/changelog/rst-1.2.4.rst create mode 100644 docs/changelog/rst-1.2.5.rst create mode 100644 docs/changelog/rst-1.2.6.rst create mode 100644 docs/changelog/rst-1.3.rst create mode 100644 docs/changelog/rst-1.4.rst create mode 100644 docs/changelog/rst-1.5.rst create mode 100644 docs/changelog/rst-index.rst create mode 100644 docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md delete mode 100644 docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst delete mode 100644 docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md create mode 100644 docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst create mode 100644 docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md delete mode 100644 docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst delete mode 100644 docs/configexamples/autotest/L3VPN_EVPN/md-L3VPN_EVPN.md create mode 100644 docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst create mode 100644 docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md delete mode 100644 docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst delete mode 100644 docs/configexamples/autotest/OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md create mode 100644 docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst create mode 100644 docs/configexamples/autotest/Wireguard/Wireguard.md delete mode 100644 docs/configexamples/autotest/Wireguard/Wireguard.rst delete mode 100644 docs/configexamples/autotest/Wireguard/md-Wireguard.md create mode 100644 docs/configexamples/autotest/Wireguard/rst-Wireguard.rst delete mode 100644 docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md create mode 100644 docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst create mode 100644 docs/configexamples/autotest/tunnelbroker/tunnelbroker.md delete mode 100644 docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst create mode 100644 docs/configexamples/azure-vpn-bgp.md delete mode 100644 docs/configexamples/azure-vpn-bgp.rst create mode 100644 docs/configexamples/azure-vpn-dual-bgp.md delete mode 100644 docs/configexamples/azure-vpn-dual-bgp.rst create mode 100644 docs/configexamples/bgp-ipv6-unnumbered.md delete mode 100644 docs/configexamples/bgp-ipv6-unnumbered.rst create mode 100644 docs/configexamples/firewall.md delete mode 100644 docs/configexamples/firewall.rst create mode 100644 docs/configexamples/fwall-and-vrf.md delete mode 100644 docs/configexamples/fwall-and-vrf.rst create mode 100644 docs/configexamples/ha.md delete mode 100644 docs/configexamples/ha.rst create mode 100644 docs/configexamples/index.md delete mode 100644 docs/configexamples/index.rst create mode 100644 docs/configexamples/inter-vrf-routing-vrf-lite.md delete mode 100644 docs/configexamples/inter-vrf-routing-vrf-lite.rst create mode 100644 docs/configexamples/ipsec-cisco-policy-based.md delete mode 100644 docs/configexamples/ipsec-cisco-policy-based.rst create mode 100644 docs/configexamples/ipsec-cisco-route-based.md delete mode 100644 docs/configexamples/ipsec-cisco-route-based.rst create mode 100644 docs/configexamples/ipsec-pa-route-based.md delete mode 100644 docs/configexamples/ipsec-pa-route-based.rst create mode 100644 docs/configexamples/l3vpn-hub-and-spoke.md delete mode 100644 docs/configexamples/l3vpn-hub-and-spoke.rst create mode 100644 docs/configexamples/lac-lns.md delete mode 100644 docs/configexamples/lac-lns.rst delete mode 100644 docs/configexamples/md-azure-vpn-bgp.md delete mode 100644 docs/configexamples/md-azure-vpn-dual-bgp.md delete mode 100644 docs/configexamples/md-bgp-ipv6-unnumbered.md delete mode 100644 docs/configexamples/md-firewall.md delete mode 100644 docs/configexamples/md-fwall-and-vrf.md delete mode 100644 docs/configexamples/md-ha.md delete mode 100644 docs/configexamples/md-index.md delete mode 100644 docs/configexamples/md-inter-vrf-routing-vrf-lite.md delete mode 100644 docs/configexamples/md-ipsec-cisco-policy-based.md delete mode 100644 docs/configexamples/md-ipsec-cisco-route-based.md delete mode 100644 docs/configexamples/md-ipsec-pa-route-based.md delete mode 100644 docs/configexamples/md-l3vpn-hub-and-spoke.md delete mode 100644 docs/configexamples/md-lac-lns.md delete mode 100644 docs/configexamples/md-nmp.md delete mode 100644 docs/configexamples/md-ospf-unnumbered.md delete mode 100644 docs/configexamples/md-pppoe-ipv6-basic.md delete mode 100644 docs/configexamples/md-qos.md delete mode 100644 docs/configexamples/md-segment-routing-isis.md delete mode 100644 docs/configexamples/md-wan-load-balancing.md delete mode 100644 docs/configexamples/md-zone-policy.md create mode 100644 docs/configexamples/nmp.md delete mode 100644 docs/configexamples/nmp.rst create mode 100644 docs/configexamples/ospf-unnumbered.md delete mode 100644 docs/configexamples/ospf-unnumbered.rst create mode 100644 docs/configexamples/pppoe-ipv6-basic.md delete mode 100644 docs/configexamples/pppoe-ipv6-basic.rst create mode 100644 docs/configexamples/qos.md delete mode 100644 docs/configexamples/qos.rst create mode 100644 docs/configexamples/rst-azure-vpn-bgp.rst create mode 100644 docs/configexamples/rst-azure-vpn-dual-bgp.rst create mode 100644 docs/configexamples/rst-bgp-ipv6-unnumbered.rst create mode 100644 docs/configexamples/rst-firewall.rst create mode 100644 docs/configexamples/rst-fwall-and-vrf.rst create mode 100644 docs/configexamples/rst-ha.rst create mode 100644 docs/configexamples/rst-index.rst create mode 100644 docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst create mode 100644 docs/configexamples/rst-ipsec-cisco-policy-based.rst create mode 100644 docs/configexamples/rst-ipsec-cisco-route-based.rst create mode 100644 docs/configexamples/rst-ipsec-pa-route-based.rst create mode 100644 docs/configexamples/rst-l3vpn-hub-and-spoke.rst create mode 100644 docs/configexamples/rst-lac-lns.rst create mode 100644 docs/configexamples/rst-nmp.rst create mode 100644 docs/configexamples/rst-ospf-unnumbered.rst create mode 100644 docs/configexamples/rst-pppoe-ipv6-basic.rst create mode 100644 docs/configexamples/rst-qos.rst create mode 100644 docs/configexamples/rst-segment-routing-isis.rst create mode 100644 docs/configexamples/rst-wan-load-balancing.rst create mode 100644 docs/configexamples/rst-zone-policy.rst create mode 100644 docs/configexamples/segment-routing-isis.md delete mode 100644 docs/configexamples/segment-routing-isis.rst create mode 100644 docs/configexamples/wan-load-balancing.md delete mode 100644 docs/configexamples/wan-load-balancing.rst create mode 100644 docs/configexamples/zone-policy.md delete mode 100644 docs/configexamples/zone-policy.rst create mode 100644 docs/configuration/container/index.md delete mode 100644 docs/configuration/container/index.rst delete mode 100644 docs/configuration/container/md-index.md create mode 100644 docs/configuration/container/rst-index.rst create mode 100644 docs/configuration/firewall/bridge.md delete mode 100644 docs/configuration/firewall/bridge.rst create mode 100644 docs/configuration/firewall/flowtables.md delete mode 100644 docs/configuration/firewall/flowtables.rst create mode 100644 docs/configuration/firewall/global-options.md delete mode 100644 docs/configuration/firewall/global-options.rst create mode 100644 docs/configuration/firewall/groups.md delete mode 100644 docs/configuration/firewall/groups.rst create mode 100644 docs/configuration/firewall/index.md delete mode 100644 docs/configuration/firewall/index.rst create mode 100644 docs/configuration/firewall/ipv4.md delete mode 100644 docs/configuration/firewall/ipv4.rst create mode 100644 docs/configuration/firewall/ipv6.md delete mode 100644 docs/configuration/firewall/ipv6.rst delete mode 100644 docs/configuration/firewall/md-bridge.md delete mode 100644 docs/configuration/firewall/md-flowtables.md delete mode 100644 docs/configuration/firewall/md-global-options.md delete mode 100644 docs/configuration/firewall/md-groups.md delete mode 100644 docs/configuration/firewall/md-index.md delete mode 100644 docs/configuration/firewall/md-ipv4.md delete mode 100644 docs/configuration/firewall/md-ipv6.md delete mode 100644 docs/configuration/firewall/md-zone.md create mode 100644 docs/configuration/firewall/rst-bridge.rst create mode 100644 docs/configuration/firewall/rst-flowtables.rst create mode 100644 docs/configuration/firewall/rst-global-options.rst create mode 100644 docs/configuration/firewall/rst-groups.rst create mode 100644 docs/configuration/firewall/rst-index.rst create mode 100644 docs/configuration/firewall/rst-ipv4.rst create mode 100644 docs/configuration/firewall/rst-ipv6.rst create mode 100644 docs/configuration/firewall/rst-zone.rst create mode 100644 docs/configuration/firewall/zone.md delete mode 100644 docs/configuration/firewall/zone.rst create mode 100644 docs/configuration/highavailability/index.md delete mode 100644 docs/configuration/highavailability/index.rst delete mode 100644 docs/configuration/highavailability/md-index.md create mode 100644 docs/configuration/highavailability/rst-index.rst create mode 100644 docs/configuration/index.md delete mode 100644 docs/configuration/index.rst create mode 100644 docs/configuration/interfaces/bonding.md delete mode 100644 docs/configuration/interfaces/bonding.rst create mode 100644 docs/configuration/interfaces/bridge.md delete mode 100644 docs/configuration/interfaces/bridge.rst create mode 100644 docs/configuration/interfaces/dummy.md delete mode 100644 docs/configuration/interfaces/dummy.rst create mode 100644 docs/configuration/interfaces/ethernet.md delete mode 100644 docs/configuration/interfaces/ethernet.rst create mode 100644 docs/configuration/interfaces/geneve.md delete mode 100644 docs/configuration/interfaces/geneve.rst create mode 100644 docs/configuration/interfaces/index.md delete mode 100644 docs/configuration/interfaces/index.rst create mode 100644 docs/configuration/interfaces/l2tpv3.md delete mode 100644 docs/configuration/interfaces/l2tpv3.rst create mode 100644 docs/configuration/interfaces/loopback.md delete mode 100644 docs/configuration/interfaces/loopback.rst create mode 100644 docs/configuration/interfaces/macsec.md delete mode 100644 docs/configuration/interfaces/macsec.rst delete mode 100644 docs/configuration/interfaces/md-bonding.md delete mode 100644 docs/configuration/interfaces/md-bridge.md delete mode 100644 docs/configuration/interfaces/md-dummy.md delete mode 100644 docs/configuration/interfaces/md-ethernet.md delete mode 100644 docs/configuration/interfaces/md-geneve.md delete mode 100644 docs/configuration/interfaces/md-index.md delete mode 100644 docs/configuration/interfaces/md-l2tpv3.md delete mode 100644 docs/configuration/interfaces/md-loopback.md delete mode 100644 docs/configuration/interfaces/md-macsec.md delete mode 100644 docs/configuration/interfaces/md-openvpn.md delete mode 100644 docs/configuration/interfaces/md-pppoe.md delete mode 100644 docs/configuration/interfaces/md-pseudo-ethernet.md delete mode 100644 docs/configuration/interfaces/md-sstp-client.md delete mode 100644 docs/configuration/interfaces/md-tunnel.md delete mode 100644 docs/configuration/interfaces/md-virtual-ethernet.md delete mode 100644 docs/configuration/interfaces/md-vti.md delete mode 100644 docs/configuration/interfaces/md-vxlan.md delete mode 100644 docs/configuration/interfaces/md-wireguard.md delete mode 100644 docs/configuration/interfaces/md-wireless.md delete mode 100644 docs/configuration/interfaces/md-wwan.md create mode 100644 docs/configuration/interfaces/openvpn.md delete mode 100644 docs/configuration/interfaces/openvpn.rst create mode 100644 docs/configuration/interfaces/pppoe.md delete mode 100644 docs/configuration/interfaces/pppoe.rst create mode 100644 docs/configuration/interfaces/pseudo-ethernet.md delete mode 100644 docs/configuration/interfaces/pseudo-ethernet.rst create mode 100644 docs/configuration/interfaces/rst-bonding.rst create mode 100644 docs/configuration/interfaces/rst-bridge.rst create mode 100644 docs/configuration/interfaces/rst-dummy.rst create mode 100644 docs/configuration/interfaces/rst-ethernet.rst create mode 100644 docs/configuration/interfaces/rst-geneve.rst create mode 100644 docs/configuration/interfaces/rst-index.rst create mode 100644 docs/configuration/interfaces/rst-l2tpv3.rst create mode 100644 docs/configuration/interfaces/rst-loopback.rst create mode 100644 docs/configuration/interfaces/rst-macsec.rst create mode 100644 docs/configuration/interfaces/rst-openvpn.rst create mode 100644 docs/configuration/interfaces/rst-pppoe.rst create mode 100644 docs/configuration/interfaces/rst-pseudo-ethernet.rst create mode 100644 docs/configuration/interfaces/rst-sstp-client.rst create mode 100644 docs/configuration/interfaces/rst-tunnel.rst create mode 100644 docs/configuration/interfaces/rst-virtual-ethernet.rst create mode 100644 docs/configuration/interfaces/rst-vti.rst create mode 100644 docs/configuration/interfaces/rst-vxlan.rst create mode 100644 docs/configuration/interfaces/rst-wireguard.rst create mode 100644 docs/configuration/interfaces/rst-wireless.rst create mode 100644 docs/configuration/interfaces/rst-wwan.rst create mode 100644 docs/configuration/interfaces/sstp-client.md delete mode 100644 docs/configuration/interfaces/sstp-client.rst create mode 100644 docs/configuration/interfaces/tunnel.md delete mode 100644 docs/configuration/interfaces/tunnel.rst create mode 100644 docs/configuration/interfaces/virtual-ethernet.md delete mode 100644 docs/configuration/interfaces/virtual-ethernet.rst create mode 100644 docs/configuration/interfaces/vti.md delete mode 100644 docs/configuration/interfaces/vti.rst create mode 100644 docs/configuration/interfaces/vxlan.md delete mode 100644 docs/configuration/interfaces/vxlan.rst create mode 100644 docs/configuration/interfaces/wireguard.md delete mode 100644 docs/configuration/interfaces/wireguard.rst create mode 100644 docs/configuration/interfaces/wireless.md delete mode 100644 docs/configuration/interfaces/wireless.rst create mode 100644 docs/configuration/interfaces/wwan.md delete mode 100644 docs/configuration/interfaces/wwan.rst create mode 100644 docs/configuration/loadbalancing/index.md delete mode 100644 docs/configuration/loadbalancing/index.rst delete mode 100644 docs/configuration/loadbalancing/md-index.md delete mode 100644 docs/configuration/loadbalancing/md-reverse-proxy.md delete mode 100644 docs/configuration/loadbalancing/md-wan.md create mode 100644 docs/configuration/loadbalancing/reverse-proxy.md delete mode 100644 docs/configuration/loadbalancing/reverse-proxy.rst create mode 100644 docs/configuration/loadbalancing/rst-index.rst create mode 100644 docs/configuration/loadbalancing/rst-reverse-proxy.rst create mode 100644 docs/configuration/loadbalancing/rst-wan.rst create mode 100644 docs/configuration/loadbalancing/wan.md delete mode 100644 docs/configuration/loadbalancing/wan.rst delete mode 100644 docs/configuration/md-index.md create mode 100644 docs/configuration/nat/index.md delete mode 100644 docs/configuration/nat/index.rst delete mode 100644 docs/configuration/nat/md-index.md delete mode 100644 docs/configuration/nat/md-nat44.md delete mode 100644 docs/configuration/nat/md-nat64.md delete mode 100644 docs/configuration/nat/md-nat66.md create mode 100644 docs/configuration/nat/nat44.md delete mode 100644 docs/configuration/nat/nat44.rst create mode 100644 docs/configuration/nat/nat64.md delete mode 100644 docs/configuration/nat/nat64.rst create mode 100644 docs/configuration/nat/nat66.md delete mode 100644 docs/configuration/nat/nat66.rst create mode 100644 docs/configuration/nat/rst-index.rst create mode 100644 docs/configuration/nat/rst-nat44.rst create mode 100644 docs/configuration/nat/rst-nat64.rst create mode 100644 docs/configuration/nat/rst-nat66.rst create mode 100644 docs/configuration/pki/index.md delete mode 100644 docs/configuration/pki/index.rst delete mode 100644 docs/configuration/pki/md-index.md create mode 100644 docs/configuration/pki/rst-index.rst create mode 100644 docs/configuration/policy/access-list.md delete mode 100644 docs/configuration/policy/access-list.rst create mode 100644 docs/configuration/policy/as-path-list.md delete mode 100644 docs/configuration/policy/as-path-list.rst create mode 100644 docs/configuration/policy/community-list.md delete mode 100644 docs/configuration/policy/community-list.rst create mode 100644 docs/configuration/policy/examples.md delete mode 100644 docs/configuration/policy/examples.rst create mode 100644 docs/configuration/policy/extcommunity-list.md delete mode 100644 docs/configuration/policy/extcommunity-list.rst create mode 100644 docs/configuration/policy/index.md delete mode 100644 docs/configuration/policy/index.rst create mode 100644 docs/configuration/policy/large-community-list.md delete mode 100644 docs/configuration/policy/large-community-list.rst create mode 100644 docs/configuration/policy/local-route.md delete mode 100644 docs/configuration/policy/local-route.rst delete mode 100644 docs/configuration/policy/md-access-list.md delete mode 100644 docs/configuration/policy/md-as-path-list.md delete mode 100644 docs/configuration/policy/md-community-list.md delete mode 100644 docs/configuration/policy/md-examples.md delete mode 100644 docs/configuration/policy/md-extcommunity-list.md delete mode 100644 docs/configuration/policy/md-index.md delete mode 100644 docs/configuration/policy/md-large-community-list.md delete mode 100644 docs/configuration/policy/md-local-route.md delete mode 100644 docs/configuration/policy/md-prefix-list.md delete mode 100644 docs/configuration/policy/md-route-map.md delete mode 100644 docs/configuration/policy/md-route.md create mode 100644 docs/configuration/policy/prefix-list.md delete mode 100644 docs/configuration/policy/prefix-list.rst create mode 100644 docs/configuration/policy/route-map.md delete mode 100644 docs/configuration/policy/route-map.rst create mode 100644 docs/configuration/policy/route.md delete mode 100644 docs/configuration/policy/route.rst create mode 100644 docs/configuration/policy/rst-access-list.rst create mode 100644 docs/configuration/policy/rst-as-path-list.rst create mode 100644 docs/configuration/policy/rst-community-list.rst create mode 100644 docs/configuration/policy/rst-examples.rst create mode 100644 docs/configuration/policy/rst-extcommunity-list.rst create mode 100644 docs/configuration/policy/rst-index.rst create mode 100644 docs/configuration/policy/rst-large-community-list.rst create mode 100644 docs/configuration/policy/rst-local-route.rst create mode 100644 docs/configuration/policy/rst-prefix-list.rst create mode 100644 docs/configuration/policy/rst-route-map.rst create mode 100644 docs/configuration/policy/rst-route.rst create mode 100644 docs/configuration/protocols/babel.md delete mode 100644 docs/configuration/protocols/babel.rst create mode 100644 docs/configuration/protocols/bfd.md delete mode 100644 docs/configuration/protocols/bfd.rst create mode 100644 docs/configuration/protocols/bgp.md delete mode 100644 docs/configuration/protocols/bgp.rst create mode 100644 docs/configuration/protocols/failover.md delete mode 100644 docs/configuration/protocols/failover.rst create mode 100644 docs/configuration/protocols/igmp-proxy.md delete mode 100644 docs/configuration/protocols/igmp-proxy.rst create mode 100644 docs/configuration/protocols/index.md delete mode 100644 docs/configuration/protocols/index.rst create mode 100644 docs/configuration/protocols/isis.md delete mode 100644 docs/configuration/protocols/isis.rst delete mode 100644 docs/configuration/protocols/md-babel.md delete mode 100644 docs/configuration/protocols/md-bfd.md delete mode 100644 docs/configuration/protocols/md-bgp.md delete mode 100644 docs/configuration/protocols/md-failover.md delete mode 100644 docs/configuration/protocols/md-igmp-proxy.md delete mode 100644 docs/configuration/protocols/md-index.md delete mode 100644 docs/configuration/protocols/md-isis.md delete mode 100644 docs/configuration/protocols/md-mpls.md delete mode 100644 docs/configuration/protocols/md-ospf.md delete mode 100644 docs/configuration/protocols/md-pim.md delete mode 100644 docs/configuration/protocols/md-pim6.md delete mode 100644 docs/configuration/protocols/md-rip.md delete mode 100644 docs/configuration/protocols/md-rpki.md delete mode 100644 docs/configuration/protocols/md-segment-routing.md delete mode 100644 docs/configuration/protocols/md-static.md create mode 100644 docs/configuration/protocols/mpls.md delete mode 100644 docs/configuration/protocols/mpls.rst create mode 100644 docs/configuration/protocols/ospf.md delete mode 100644 docs/configuration/protocols/ospf.rst create mode 100644 docs/configuration/protocols/pim.md delete mode 100644 docs/configuration/protocols/pim.rst create mode 100644 docs/configuration/protocols/pim6.md delete mode 100644 docs/configuration/protocols/pim6.rst create mode 100644 docs/configuration/protocols/rip.md delete mode 100644 docs/configuration/protocols/rip.rst create mode 100644 docs/configuration/protocols/rpki.md delete mode 100644 docs/configuration/protocols/rpki.rst create mode 100644 docs/configuration/protocols/rst-babel.rst create mode 100644 docs/configuration/protocols/rst-bfd.rst create mode 100644 docs/configuration/protocols/rst-bgp.rst create mode 100644 docs/configuration/protocols/rst-failover.rst create mode 100644 docs/configuration/protocols/rst-igmp-proxy.rst create mode 100644 docs/configuration/protocols/rst-index.rst create mode 100644 docs/configuration/protocols/rst-isis.rst create mode 100644 docs/configuration/protocols/rst-mpls.rst create mode 100644 docs/configuration/protocols/rst-ospf.rst create mode 100644 docs/configuration/protocols/rst-pim.rst create mode 100644 docs/configuration/protocols/rst-pim6.rst create mode 100644 docs/configuration/protocols/rst-rip.rst create mode 100644 docs/configuration/protocols/rst-rpki.rst create mode 100644 docs/configuration/protocols/rst-segment-routing.rst create mode 100644 docs/configuration/protocols/rst-static.rst create mode 100644 docs/configuration/protocols/segment-routing.md delete mode 100644 docs/configuration/protocols/segment-routing.rst create mode 100644 docs/configuration/protocols/static.md delete mode 100644 docs/configuration/protocols/static.rst create mode 100644 docs/configuration/rst-index.rst create mode 100644 docs/configuration/service/broadcast-relay.md delete mode 100644 docs/configuration/service/broadcast-relay.rst create mode 100644 docs/configuration/service/config-sync.md delete mode 100644 docs/configuration/service/config-sync.rst create mode 100644 docs/configuration/service/conntrack-sync.md delete mode 100644 docs/configuration/service/conntrack-sync.rst create mode 100644 docs/configuration/service/console-server.md delete mode 100644 docs/configuration/service/console-server.rst create mode 100644 docs/configuration/service/dhcp-relay.md delete mode 100644 docs/configuration/service/dhcp-relay.rst create mode 100644 docs/configuration/service/dhcp-server.md delete mode 100644 docs/configuration/service/dhcp-server.rst create mode 100644 docs/configuration/service/dns.md delete mode 100644 docs/configuration/service/dns.rst create mode 100644 docs/configuration/service/eventhandler.md delete mode 100644 docs/configuration/service/eventhandler.rst create mode 100644 docs/configuration/service/https.md delete mode 100644 docs/configuration/service/https.rst create mode 100644 docs/configuration/service/ids.md delete mode 100644 docs/configuration/service/ids.rst create mode 100644 docs/configuration/service/index.md delete mode 100644 docs/configuration/service/index.rst create mode 100644 docs/configuration/service/ipoe-server.md delete mode 100644 docs/configuration/service/ipoe-server.rst create mode 100644 docs/configuration/service/lldp.md delete mode 100644 docs/configuration/service/lldp.rst delete mode 100644 docs/configuration/service/md-broadcast-relay.md delete mode 100644 docs/configuration/service/md-config-sync.md delete mode 100644 docs/configuration/service/md-conntrack-sync.md delete mode 100644 docs/configuration/service/md-console-server.md delete mode 100644 docs/configuration/service/md-dhcp-relay.md delete mode 100644 docs/configuration/service/md-dhcp-server.md delete mode 100644 docs/configuration/service/md-dns.md delete mode 100644 docs/configuration/service/md-eventhandler.md delete mode 100644 docs/configuration/service/md-https.md delete mode 100644 docs/configuration/service/md-ids.md delete mode 100644 docs/configuration/service/md-index.md delete mode 100644 docs/configuration/service/md-ipoe-server.md delete mode 100644 docs/configuration/service/md-lldp.md delete mode 100644 docs/configuration/service/md-mdns.md delete mode 100644 docs/configuration/service/md-monitoring.md delete mode 100644 docs/configuration/service/md-ntp.md delete mode 100644 docs/configuration/service/md-pppoe-server.md delete mode 100644 docs/configuration/service/md-router-advert.md delete mode 100644 docs/configuration/service/md-salt-minion.md delete mode 100644 docs/configuration/service/md-snmp.md delete mode 100644 docs/configuration/service/md-ssh.md delete mode 100644 docs/configuration/service/md-tftp-server.md delete mode 100644 docs/configuration/service/md-webproxy.md create mode 100644 docs/configuration/service/mdns.md delete mode 100644 docs/configuration/service/mdns.rst create mode 100644 docs/configuration/service/monitoring.md delete mode 100644 docs/configuration/service/monitoring.rst create mode 100644 docs/configuration/service/ntp.md delete mode 100644 docs/configuration/service/ntp.rst create mode 100644 docs/configuration/service/pppoe-server.md delete mode 100644 docs/configuration/service/pppoe-server.rst create mode 100644 docs/configuration/service/router-advert.md delete mode 100644 docs/configuration/service/router-advert.rst create mode 100644 docs/configuration/service/rst-broadcast-relay.rst create mode 100644 docs/configuration/service/rst-config-sync.rst create mode 100644 docs/configuration/service/rst-conntrack-sync.rst create mode 100644 docs/configuration/service/rst-console-server.rst create mode 100644 docs/configuration/service/rst-dhcp-relay.rst create mode 100644 docs/configuration/service/rst-dhcp-server.rst create mode 100644 docs/configuration/service/rst-dns.rst create mode 100644 docs/configuration/service/rst-eventhandler.rst create mode 100644 docs/configuration/service/rst-https.rst create mode 100644 docs/configuration/service/rst-ids.rst create mode 100644 docs/configuration/service/rst-index.rst create mode 100644 docs/configuration/service/rst-ipoe-server.rst create mode 100644 docs/configuration/service/rst-lldp.rst create mode 100644 docs/configuration/service/rst-mdns.rst create mode 100644 docs/configuration/service/rst-monitoring.rst create mode 100644 docs/configuration/service/rst-ntp.rst create mode 100644 docs/configuration/service/rst-pppoe-server.rst create mode 100644 docs/configuration/service/rst-router-advert.rst create mode 100644 docs/configuration/service/rst-salt-minion.rst create mode 100644 docs/configuration/service/rst-snmp.rst create mode 100644 docs/configuration/service/rst-ssh.rst create mode 100644 docs/configuration/service/rst-tftp-server.rst create mode 100644 docs/configuration/service/rst-webproxy.rst create mode 100644 docs/configuration/service/salt-minion.md delete mode 100644 docs/configuration/service/salt-minion.rst create mode 100644 docs/configuration/service/snmp.md delete mode 100644 docs/configuration/service/snmp.rst create mode 100644 docs/configuration/service/ssh.md delete mode 100644 docs/configuration/service/ssh.rst create mode 100644 docs/configuration/service/tftp-server.md delete mode 100644 docs/configuration/service/tftp-server.rst create mode 100644 docs/configuration/service/webproxy.md delete mode 100644 docs/configuration/service/webproxy.rst create mode 100644 docs/configuration/system/acceleration.md delete mode 100644 docs/configuration/system/acceleration.rst create mode 100644 docs/configuration/system/conntrack.md delete mode 100644 docs/configuration/system/conntrack.rst create mode 100644 docs/configuration/system/console.md delete mode 100644 docs/configuration/system/console.rst create mode 100644 docs/configuration/system/default-route.md delete mode 100644 docs/configuration/system/default-route.rst create mode 100644 docs/configuration/system/flow-accounting.md delete mode 100644 docs/configuration/system/flow-accounting.rst create mode 100644 docs/configuration/system/frr.md delete mode 100644 docs/configuration/system/frr.rst create mode 100644 docs/configuration/system/host-name.md delete mode 100644 docs/configuration/system/host-name.rst create mode 100644 docs/configuration/system/index.md delete mode 100644 docs/configuration/system/index.rst create mode 100644 docs/configuration/system/ip.md delete mode 100644 docs/configuration/system/ip.rst create mode 100644 docs/configuration/system/ipv6.md delete mode 100644 docs/configuration/system/ipv6.rst create mode 100644 docs/configuration/system/lcd.md delete mode 100644 docs/configuration/system/lcd.rst create mode 100644 docs/configuration/system/login.md delete mode 100644 docs/configuration/system/login.rst delete mode 100644 docs/configuration/system/md-acceleration.md delete mode 100644 docs/configuration/system/md-conntrack.md delete mode 100644 docs/configuration/system/md-console.md delete mode 100644 docs/configuration/system/md-default-route.md delete mode 100644 docs/configuration/system/md-flow-accounting.md delete mode 100644 docs/configuration/system/md-frr.md delete mode 100644 docs/configuration/system/md-host-name.md delete mode 100644 docs/configuration/system/md-index.md delete mode 100644 docs/configuration/system/md-ip.md delete mode 100644 docs/configuration/system/md-ipv6.md delete mode 100644 docs/configuration/system/md-lcd.md delete mode 100644 docs/configuration/system/md-login.md delete mode 100644 docs/configuration/system/md-name-server.md delete mode 100644 docs/configuration/system/md-option.md delete mode 100644 docs/configuration/system/md-proxy.md delete mode 100644 docs/configuration/system/md-sflow.md delete mode 100644 docs/configuration/system/md-sysctl.md delete mode 100644 docs/configuration/system/md-syslog.md delete mode 100644 docs/configuration/system/md-task-scheduler.md delete mode 100644 docs/configuration/system/md-time-zone.md delete mode 100644 docs/configuration/system/md-updates.md create mode 100644 docs/configuration/system/name-server.md delete mode 100644 docs/configuration/system/name-server.rst create mode 100644 docs/configuration/system/option.md delete mode 100644 docs/configuration/system/option.rst create mode 100644 docs/configuration/system/proxy.md delete mode 100644 docs/configuration/system/proxy.rst create mode 100644 docs/configuration/system/rst-acceleration.rst create mode 100644 docs/configuration/system/rst-conntrack.rst create mode 100644 docs/configuration/system/rst-console.rst create mode 100644 docs/configuration/system/rst-default-route.rst create mode 100644 docs/configuration/system/rst-flow-accounting.rst create mode 100644 docs/configuration/system/rst-frr.rst create mode 100644 docs/configuration/system/rst-host-name.rst create mode 100644 docs/configuration/system/rst-index.rst create mode 100644 docs/configuration/system/rst-ip.rst create mode 100644 docs/configuration/system/rst-ipv6.rst create mode 100644 docs/configuration/system/rst-lcd.rst create mode 100644 docs/configuration/system/rst-login.rst create mode 100644 docs/configuration/system/rst-name-server.rst create mode 100644 docs/configuration/system/rst-option.rst create mode 100644 docs/configuration/system/rst-proxy.rst create mode 100644 docs/configuration/system/rst-sflow.rst create mode 100644 docs/configuration/system/rst-sysctl.rst create mode 100644 docs/configuration/system/rst-syslog.rst create mode 100644 docs/configuration/system/rst-task-scheduler.rst create mode 100644 docs/configuration/system/rst-time-zone.rst create mode 100644 docs/configuration/system/rst-updates.rst create mode 100644 docs/configuration/system/sflow.md delete mode 100644 docs/configuration/system/sflow.rst create mode 100644 docs/configuration/system/sysctl.md delete mode 100644 docs/configuration/system/sysctl.rst create mode 100644 docs/configuration/system/syslog.md delete mode 100644 docs/configuration/system/syslog.rst create mode 100644 docs/configuration/system/task-scheduler.md delete mode 100644 docs/configuration/system/task-scheduler.rst create mode 100644 docs/configuration/system/time-zone.md delete mode 100644 docs/configuration/system/time-zone.rst create mode 100644 docs/configuration/system/updates.md delete mode 100644 docs/configuration/system/updates.rst create mode 100644 docs/configuration/trafficpolicy/index.md delete mode 100644 docs/configuration/trafficpolicy/index.rst delete mode 100644 docs/configuration/trafficpolicy/md-index.md create mode 100644 docs/configuration/trafficpolicy/rst-index.rst create mode 100644 docs/configuration/vpn/dmvpn.md delete mode 100644 docs/configuration/vpn/dmvpn.rst create mode 100644 docs/configuration/vpn/index.md delete mode 100644 docs/configuration/vpn/index.rst create mode 100644 docs/configuration/vpn/ipsec/index.md delete mode 100644 docs/configuration/vpn/ipsec/index.rst create mode 100644 docs/configuration/vpn/ipsec/ipsec_general.md delete mode 100644 docs/configuration/vpn/ipsec/ipsec_general.rst delete mode 100644 docs/configuration/vpn/ipsec/md-index.md delete mode 100644 docs/configuration/vpn/ipsec/md-ipsec_general.md delete mode 100644 docs/configuration/vpn/ipsec/md-remoteaccess_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/md-site2site_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/md-troubleshooting_ipsec.md create mode 100644 docs/configuration/vpn/ipsec/remoteaccess_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/rst-index.rst create mode 100644 docs/configuration/vpn/ipsec/rst-ipsec_general.rst create mode 100644 docs/configuration/vpn/ipsec/rst-remoteaccess_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/rst-site2site_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/rst-troubleshooting_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/site2site_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/site2site_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/troubleshooting_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst create mode 100644 docs/configuration/vpn/l2tp.md delete mode 100644 docs/configuration/vpn/l2tp.rst delete mode 100644 docs/configuration/vpn/md-dmvpn.md delete mode 100644 docs/configuration/vpn/md-index.md delete mode 100644 docs/configuration/vpn/md-l2tp.md delete mode 100644 docs/configuration/vpn/md-openconnect.md delete mode 100644 docs/configuration/vpn/md-pptp.md delete mode 100644 docs/configuration/vpn/md-rsa-keys.md delete mode 100644 docs/configuration/vpn/md-sstp.md create mode 100644 docs/configuration/vpn/openconnect.md delete mode 100644 docs/configuration/vpn/openconnect.rst create mode 100644 docs/configuration/vpn/pptp.md delete mode 100644 docs/configuration/vpn/pptp.rst create mode 100644 docs/configuration/vpn/rsa-keys.md delete mode 100644 docs/configuration/vpn/rsa-keys.rst create mode 100644 docs/configuration/vpn/rst-dmvpn.rst create mode 100644 docs/configuration/vpn/rst-index.rst create mode 100644 docs/configuration/vpn/rst-l2tp.rst create mode 100644 docs/configuration/vpn/rst-openconnect.rst create mode 100644 docs/configuration/vpn/rst-pptp.rst create mode 100644 docs/configuration/vpn/rst-rsa-keys.rst create mode 100644 docs/configuration/vpn/rst-sstp.rst create mode 100644 docs/configuration/vpn/sstp.md delete mode 100644 docs/configuration/vpn/sstp.rst create mode 100644 docs/configuration/vrf/index.md delete mode 100644 docs/configuration/vrf/index.rst delete mode 100644 docs/configuration/vrf/md-index.md create mode 100644 docs/configuration/vrf/rst-index.rst create mode 100644 docs/contributing/build-vyos.md delete mode 100644 docs/contributing/build-vyos.rst create mode 100644 docs/contributing/debugging.md delete mode 100644 docs/contributing/debugging.rst create mode 100644 docs/contributing/development.md delete mode 100644 docs/contributing/development.rst create mode 100644 docs/contributing/issues-features.md delete mode 100644 docs/contributing/issues-features.rst delete mode 100644 docs/contributing/md-build-vyos.md delete mode 100644 docs/contributing/md-debugging.md delete mode 100644 docs/contributing/md-development.md delete mode 100644 docs/contributing/md-issues-features.md delete mode 100644 docs/contributing/md-testing.md delete mode 100644 docs/contributing/md-upstream-packages.md create mode 100644 docs/contributing/rst-build-vyos.rst create mode 100644 docs/contributing/rst-debugging.rst create mode 100644 docs/contributing/rst-development.rst create mode 100644 docs/contributing/rst-issues-features.rst create mode 100644 docs/contributing/rst-testing.rst create mode 100644 docs/contributing/rst-upstream-packages.rst create mode 100644 docs/contributing/testing.md delete mode 100644 docs/contributing/testing.rst create mode 100644 docs/contributing/upstream-packages.md delete mode 100644 docs/contributing/upstream-packages.rst create mode 100644 docs/coverage.md delete mode 100644 docs/coverage.rst create mode 100644 docs/documentation.md delete mode 100644 docs/documentation.rst create mode 100644 docs/index.md delete mode 100644 docs/index.rst create mode 100644 docs/installation/cloud/aws-ha.md delete mode 100755 docs/installation/cloud/aws-ha.rst create mode 100644 docs/installation/cloud/aws-to-azure.md delete mode 100755 docs/installation/cloud/aws-to-azure.rst create mode 100644 docs/installation/cloud/azure-ha.md delete mode 100755 docs/installation/cloud/azure-ha.rst create mode 100644 docs/installation/cloud/azure.md delete mode 100644 docs/installation/cloud/azure.rst create mode 100644 docs/installation/cloud/gcp.md delete mode 100644 docs/installation/cloud/gcp.rst create mode 100644 docs/installation/cloud/index.md delete mode 100644 docs/installation/cloud/index.rst delete mode 100644 docs/installation/cloud/md-aws-ha.md delete mode 100644 docs/installation/cloud/md-aws-to-azure.md delete mode 100644 docs/installation/cloud/md-azure-ha.md delete mode 100644 docs/installation/cloud/md-azure.md delete mode 100644 docs/installation/cloud/md-gcp.md delete mode 100644 docs/installation/cloud/md-index.md delete mode 100644 docs/installation/cloud/md-oracel.md create mode 100644 docs/installation/cloud/oracel.md delete mode 100644 docs/installation/cloud/oracel.rst create mode 100755 docs/installation/cloud/rst-aws-ha.rst create mode 100755 docs/installation/cloud/rst-aws-to-azure.rst create mode 100755 docs/installation/cloud/rst-azure-ha.rst create mode 100644 docs/installation/cloud/rst-azure.rst create mode 100644 docs/installation/cloud/rst-gcp.rst create mode 100644 docs/installation/cloud/rst-index.rst create mode 100644 docs/installation/cloud/rst-oracel.rst create mode 100644 docs/installation/image.md delete mode 100644 docs/installation/image.rst create mode 100644 docs/installation/index.md delete mode 100644 docs/installation/index.rst create mode 100644 docs/installation/install.md delete mode 100644 docs/installation/install.rst delete mode 100644 docs/installation/md-image.md delete mode 100644 docs/installation/md-index.md delete mode 100644 docs/installation/md-install.md delete mode 100644 docs/installation/md-update.md delete mode 100644 docs/installation/md-vyos-on-baremetal.md create mode 100644 docs/installation/rst-image.rst create mode 100644 docs/installation/rst-index.rst create mode 100644 docs/installation/rst-install.rst create mode 100644 docs/installation/rst-update.rst create mode 100644 docs/installation/rst-vyos-on-baremetal.rst create mode 100644 docs/installation/update.md delete mode 100644 docs/installation/update.rst create mode 100644 docs/installation/virtual/docker.md delete mode 100644 docs/installation/virtual/docker.rst create mode 100644 docs/installation/virtual/eve-ng.md delete mode 100644 docs/installation/virtual/eve-ng.rst create mode 100644 docs/installation/virtual/gns3.md delete mode 100644 docs/installation/virtual/gns3.rst create mode 100644 docs/installation/virtual/index.md delete mode 100644 docs/installation/virtual/index.rst create mode 100644 docs/installation/virtual/libvirt.md delete mode 100644 docs/installation/virtual/libvirt.rst delete mode 100644 docs/installation/virtual/md-docker.md delete mode 100644 docs/installation/virtual/md-eve-ng.md delete mode 100644 docs/installation/virtual/md-gns3.md delete mode 100644 docs/installation/virtual/md-index.md delete mode 100644 docs/installation/virtual/md-libvirt.md delete mode 100644 docs/installation/virtual/md-proxmox.md delete mode 100644 docs/installation/virtual/md-vmware.md create mode 100644 docs/installation/virtual/proxmox.md delete mode 100644 docs/installation/virtual/proxmox.rst create mode 100644 docs/installation/virtual/rst-docker.rst create mode 100644 docs/installation/virtual/rst-eve-ng.rst create mode 100644 docs/installation/virtual/rst-gns3.rst create mode 100644 docs/installation/virtual/rst-index.rst create mode 100644 docs/installation/virtual/rst-libvirt.rst create mode 100644 docs/installation/virtual/rst-proxmox.rst create mode 100644 docs/installation/virtual/rst-vmware.rst create mode 100644 docs/installation/virtual/vmware.md delete mode 100644 docs/installation/virtual/vmware.rst create mode 100644 docs/installation/vyos-on-baremetal.md delete mode 100644 docs/installation/vyos-on-baremetal.rst create mode 100644 docs/introducing/about.md delete mode 100644 docs/introducing/about.rst create mode 100644 docs/introducing/history.md delete mode 100644 docs/introducing/history.rst delete mode 100644 docs/introducing/md-about.md delete mode 100644 docs/introducing/md-history.md create mode 100644 docs/introducing/rst-about.rst create mode 100644 docs/introducing/rst-history.rst delete mode 100644 docs/md-404.md delete mode 100644 docs/md-coverage.md delete mode 100644 docs/md-documentation.md delete mode 100644 docs/md-index.md delete mode 100644 docs/md-quick-start.md create mode 100644 docs/operation/boot-options.md delete mode 100644 docs/operation/boot-options.rst create mode 100644 docs/operation/index.md delete mode 100644 docs/operation/index.rst create mode 100644 docs/operation/information.md delete mode 100644 docs/operation/information.rst delete mode 100644 docs/operation/md-boot-options.md delete mode 100644 docs/operation/md-index.md delete mode 100644 docs/operation/md-information.md delete mode 100644 docs/operation/md-password-recovery.md delete mode 100644 docs/operation/md-raid.md create mode 100644 docs/operation/password-recovery.md delete mode 100755 docs/operation/password-recovery.rst create mode 100644 docs/operation/raid.md delete mode 100644 docs/operation/raid.rst create mode 100644 docs/operation/rst-boot-options.rst create mode 100644 docs/operation/rst-index.rst create mode 100644 docs/operation/rst-information.rst create mode 100755 docs/operation/rst-password-recovery.rst create mode 100644 docs/operation/rst-raid.rst create mode 100644 docs/quick-start.md delete mode 100644 docs/quick-start.rst create mode 100644 docs/rst-404.rst create mode 100644 docs/rst-coverage.rst create mode 100644 docs/rst-documentation.rst create mode 100644 docs/rst-index.rst create mode 100644 docs/rst-quick-start.rst create mode 100644 docs/troubleshooting/index.md delete mode 100644 docs/troubleshooting/index.rst delete mode 100644 docs/troubleshooting/md-index.md create mode 100644 docs/troubleshooting/rst-index.rst (limited to 'docs') diff --git a/docs/404.md b/docs/404.md new file mode 100644 index 00000000..f5530747 --- /dev/null +++ b/docs/404.md @@ -0,0 +1,13 @@ +--- +orphan: true +--- + +# Page Not Found + +Sorry, we could not find a page. +Try using the search box or go to the release homepage: + +- [1.2.x (crux)](https://docs.vyos.io/en/crux/) +- [1.3.x (equuleus)](https://docs.vyos.io/en/equuleus/) +- [1.4.x (sagitta)](https://docs.vyos.io/en/sagitta/) +- [rolling release (circinus)](https://docs.vyos.io/en/latest/) diff --git a/docs/404.rst b/docs/404.rst deleted file mode 100644 index 2ae79f2e..00000000 --- a/docs/404.rst +++ /dev/null @@ -1,12 +0,0 @@ -:orphan: - -Page Not Found -============== - -Sorry, We could not find a page. -Try using the search box or go to the release homepage: - - * `1.2.x (crux) `_ - * `1.3.x (equuleus) `_ - * `1.4.x (sagitta) `_ - * `rolling release (circinus) `_ diff --git a/docs/_rst_overrides.txt b/docs/_rst_overrides.txt new file mode 100644 index 00000000..82df65b0 --- /dev/null +++ b/docs/_rst_overrides.txt @@ -0,0 +1,7 @@ +# RST override list +# One page stem per line (relative to docs/, no extension) +# Pages listed here will render from rst-.rst INSTEAD of .md at build time. +# +# Default behaviour: every page builds from its .md primary. Add a stem here +# only if you specifically want the legacy RST version to render for that page. +# Initially empty — MD is canonical for all migrated pages. diff --git a/docs/_swap.txt b/docs/_swap.txt deleted file mode 100644 index 274d072f..00000000 --- a/docs/_swap.txt +++ /dev/null @@ -1,214 +0,0 @@ -# Incremental MyST swap list -# One page stem per line (relative to docs/, no extension) -# Pages listed here will render from MD instead of RST at build time. - -404 -automation/cloud-init -automation/command-scripting -automation/index -automation/terraform/index -automation/terraform/terraformAWS -automation/terraform/terraformAZ -automation/terraform/terraformGoogle -automation/terraform/terraformvSphere -automation/terraform/terraformvyos -automation/vyos-ansible -automation/vyos-api -automation/vyos-napalm -automation/vyos-netmiko -automation/vyos-salt -changelog/1.2.1 -changelog/1.2.2 -changelog/1.2.3 -changelog/1.2.4 -changelog/1.2.5 -changelog/1.2.6 -changelog/1.3 -changelog/1.4 -changelog/1.5 -changelog/index -configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE -configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN -configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP -configexamples/autotest/Wireguard/Wireguard -configexamples/autotest/tunnelbroker/tunnelbroker -configexamples/azure-vpn-bgp -configexamples/azure-vpn-dual-bgp -configexamples/bgp-ipv6-unnumbered -configexamples/firewall -configexamples/fwall-and-vrf -configexamples/ha -configexamples/index -configexamples/inter-vrf-routing-vrf-lite -configexamples/ipsec-cisco-policy-based -configexamples/ipsec-cisco-route-based -configexamples/ipsec-pa-route-based -configexamples/l3vpn-hub-and-spoke -configexamples/lac-lns -configexamples/nmp -configexamples/ospf-unnumbered -configexamples/pppoe-ipv6-basic -configexamples/qos -configexamples/segment-routing-isis -configexamples/wan-load-balancing -configexamples/zone-policy -configuration/container/index -configuration/firewall/bridge -configuration/firewall/flowtables -configuration/firewall/global-options -configuration/firewall/groups -configuration/firewall/index -configuration/firewall/ipv4 -configuration/firewall/ipv6 -configuration/firewall/zone -configuration/highavailability/index -configuration/index -configuration/interfaces/bonding -configuration/interfaces/bridge -configuration/interfaces/dummy -configuration/interfaces/ethernet -configuration/interfaces/geneve -configuration/interfaces/index -configuration/interfaces/l2tpv3 -configuration/interfaces/loopback -configuration/interfaces/macsec -configuration/interfaces/openvpn -configuration/interfaces/pppoe -configuration/interfaces/pseudo-ethernet -configuration/interfaces/sstp-client -configuration/interfaces/tunnel -configuration/interfaces/virtual-ethernet -configuration/interfaces/vti -configuration/interfaces/vxlan -configuration/interfaces/wireguard -configuration/interfaces/wireless -configuration/interfaces/wwan -configuration/loadbalancing/index -configuration/loadbalancing/reverse-proxy -configuration/loadbalancing/wan -configuration/nat/index -configuration/nat/nat44 -configuration/nat/nat64 -configuration/nat/nat66 -configuration/pki/index -configuration/policy/access-list -configuration/policy/as-path-list -configuration/policy/community-list -configuration/policy/examples -configuration/policy/extcommunity-list -configuration/policy/index -configuration/policy/large-community-list -configuration/policy/local-route -configuration/policy/prefix-list -configuration/policy/route -configuration/policy/route-map -configuration/protocols/babel -configuration/protocols/bfd -configuration/protocols/bgp -configuration/protocols/failover -configuration/protocols/igmp-proxy -configuration/protocols/index -configuration/protocols/isis -configuration/protocols/mpls -configuration/protocols/ospf -configuration/protocols/pim -configuration/protocols/pim6 -configuration/protocols/rip -configuration/protocols/rpki -configuration/protocols/segment-routing -configuration/protocols/static -configuration/service/broadcast-relay -configuration/service/config-sync -configuration/service/conntrack-sync -configuration/service/console-server -configuration/service/dhcp-relay -configuration/service/dhcp-server -configuration/service/dns -configuration/service/eventhandler -configuration/service/https -configuration/service/ids -configuration/service/index -configuration/service/ipoe-server -configuration/service/lldp -configuration/service/mdns -configuration/service/monitoring -configuration/service/ntp -configuration/service/pppoe-server -configuration/service/router-advert -configuration/service/salt-minion -configuration/service/snmp -configuration/service/ssh -configuration/service/tftp-server -configuration/service/webproxy -configuration/system/acceleration -configuration/system/conntrack -configuration/system/console -configuration/system/default-route -configuration/system/flow-accounting -configuration/system/frr -configuration/system/host-name -configuration/system/index -configuration/system/ip -configuration/system/ipv6 -configuration/system/lcd -configuration/system/login -configuration/system/name-server -configuration/system/option -configuration/system/proxy -configuration/system/sflow -configuration/system/sysctl -configuration/system/syslog -configuration/system/task-scheduler -configuration/system/time-zone -configuration/system/updates -configuration/trafficpolicy/index -configuration/vpn/dmvpn -configuration/vpn/index -configuration/vpn/ipsec/index -configuration/vpn/ipsec/ipsec_general -configuration/vpn/ipsec/remoteaccess_ipsec -configuration/vpn/ipsec/site2site_ipsec -configuration/vpn/ipsec/troubleshooting_ipsec -configuration/vpn/l2tp -configuration/vpn/openconnect -configuration/vpn/pptp -configuration/vpn/rsa-keys -configuration/vpn/sstp -configuration/vrf/index -contributing/build-vyos -contributing/debugging -contributing/development -contributing/issues-features -contributing/testing -contributing/upstream-packages -coverage -documentation -index -installation/cloud/aws-ha -installation/cloud/aws-to-azure -installation/cloud/azure -installation/cloud/azure-ha -installation/cloud/gcp -installation/cloud/index -installation/cloud/oracel -installation/image -installation/index -installation/install -installation/update -installation/virtual/docker -installation/virtual/eve-ng -installation/virtual/gns3 -installation/virtual/index -installation/virtual/libvirt -installation/virtual/proxmox -installation/virtual/vmware -installation/vyos-on-baremetal -introducing/about -introducing/history -operation/boot-options -operation/index -operation/information -operation/password-recovery -operation/raid -quick-start -troubleshooting/index diff --git a/docs/automation/cloud-init.md b/docs/automation/cloud-init.md new file mode 100644 index 00000000..1b796c04 --- /dev/null +++ b/docs/automation/cloud-init.md @@ -0,0 +1,387 @@ +--- +lastproofread: '2021-07-12' +--- + +(cloud-init)= + +# VyOS cloud-init + +Cloud and virtualized instances of VyOS are initialized using the +industry-standard cloud-init. Via cloud-init, the system performs tasks such as +injecting SSH keys and configuring the network. In addition, the user can supply +a custom configuration at the time of instance launch. + +## Config Sources + +VyOS support three types of config sources. + +- Metadata - Metadata is sourced by the cloud platform or hypervisor. + In some clouds, there is implemented as an HTTP endpoint at + `http://169.254.169.254`. +- Network configuration - This config source informs the system about the + network settings like IP addresses, routes, DNS. Available only in several + cloud and virtualization platforms. +- User-data - User-data is specified by the user. This config source offers the + ability to insert any CLI configuration commands into the configuration before + the first boot. + +## User-data + +Major cloud providers offer a means of providing user-data at the time of +instance launch. It can be provided as plain text or as base64-encoded text, +depending on cloud provider. Also, it can be compressed using gzip, which makes +sense with a long configuration commands list, because of the hard limit to +\~16384 bytes for the whole user-data. + +The easiest way to configure the system via user-data is the Cloud-config syntax +described below. + +## Cloud-config modules + +In VyOS, by default, enables only two modules: + +- `write_files` - this module allows to insert any files into the filesystem + before the first boot, for example, pre-generated encryption keys, + certificates, or even a whole `config.boot` file. The format is described in the cloudinit documentation [Cloud-init-write_files]. +- `vyos_userdata` - the module accepts a list of CLI configuration commands in + a `vyos_config_commands` section, which gives an easy way to configure the + system during deployment. + +## cloud-config file format + +A cloud-config document is written in YAML. The file must begin +with `#cloud-config` line. The only supported top-level keys are +`vyos_config_commands` and `write_files`. The use of these keys is described +in the following two sections. + +## Initial Configuration + +The key used to designate a VyOS configuration is `vyos_config_commands`. +What follows is VyOS configuration using the "set-style" syntax. Both "set" +and "delete" commands are supported. + +Commands requirements: + +- One command per line. +- If command ends in a value, it must be inside single quotes. +- A single-quote symbol is not allowed inside command or value. + +The commands list produced by the `show configuration commands` command on a +VyOS router should comply with all the requirements, so it is easy to get a +proper commands list by copying it from another router. + +The configuration specified in the cloud-config document overwrites default +configuration values and values configured via Metadata. + +Here is an example cloud-config that appends configuration at the time of +first boot. + +```yaml +#cloud-config +vyos_config_commands: + - set system host-name 'vyos-prod-ashburn' + - set service ntp server 1.pool.ntp.org + - set service ntp server 2.pool.ntp.org + - delete interfaces ethernet eth1 address 'dhcp' + - set interfaces ethernet eth1 address '192.0.2.247/24' + - set protocols static route 198.51.100.0/24 next-hop '192.0.2.1' +``` + +### System Defaults/Fallbacks + +These are the VyOS defaults and fallbacks. + +- SSH is configured on port 22. +- `vyos`/`vyos` credentials if no others specified by data source. +- DHCP on first Ethernet interface if no network configuration is provided. + +All of these can be overridden using the configuration in user-data. + +## Command Execution at Initial Boot + +VyOS supports the execution of operational commands and linux commands at +initial boot. This is accomplished using `write_files` to certain +files in the /opt/vyatta/etc/config/scripts directory. Commands specified +in opt/vyatta/etc/config/scripts/vyos-preconfig-bootup.script are executed +prior to configuration. The +/opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script file contains +commands to be executed after configuration. In both cases, commands are +executed as the root user. + +Note that the /opt/vyatta/etc/config is used instead of the /config/scripts +directory referenced in the {ref}`command-scripting` section of the +documentation because the /config/script directory isn't mounted when the +`write_files` module executes. + +The following example shows how to execute commands after the initial +configuration. + +```yaml +#cloud-config +write_files: + - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script + owner: root:vyattacfg + permissions: '0775' + content: | + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + filename=/tmp/bgp_status_`date +"%Y_%m_%d_%I_%M_%p"`.log + run show ip bgp summary >> $filename +``` + +If you need to gather information from linux commands to configure VyOS, you +can execute commands and then configure VyOS in the same script. + +The following example sets the hostname based on the instance identifier +obtained from the EC2 metadata service. + +Please observe that the same configuration pitfall described in {ref}`command-scripting` +exists here when running `configure` in any context as without user group +'vyattacfg' will cause the error message `Set failed` to appear. +We therefore need to wrap it and have the script re-execute itself with the correct +group permissions. + +```yaml +#cloud-config +write_files: + - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script + owner: root:vyattacfg + permissions: '0775' + content: | + #!/bin/vbash + if [ "$(id -g -n)" != 'vyattacfg' ] ; then + exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@" + fi + source /opt/vyatta/etc/functions/script-template + hostname=`curl -s http://169.254.169.254/latest/meta-data/instance-id` + configure + set system host-name $hostname + commit + exit +``` + +## NoCloud + +Injecting configuration data is not limited to cloud platforms. Users can +employ the NoCloud data source to inject user-data and meta-data on +virtualization platforms such as VMware, Hyper-V and KVM. + +While other methods exist, the most straightforward method for using the +NoCloud data source is creating a seed ISO and attaching it to the virtual +machine as a CD drive. The volume must be formatted as a vfat or ISO 9660 +file system with the label "cidata" or "CIDATA". + +Create text files named user-data and meta-data. On linux-based systems, +the mkisofs utility can be used to create the seed ISO. The following +syntax will add these files to the ISO 9660 file system. + +```none +mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data user-data +``` + +The seed.iso file can be attached to the virtual machine. As an example, +the method with KVM to attach the ISO as a CD drive follows. + +```none +$ virt-install -n vyos_r1 \ + --ram 4096 \ + --vcpus 2 \ + --cdrom seed.iso \ + --os-type linux \ + --os-variant debian10 \ + --network network=default \ + --graphics vnc \ + --hvm \ + --virt-type kvm \ + --disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \ + --import \ + --noautoconsole +``` + +For more information on the NoCloud data source, visit its [page](https://cloudinit.readthedocs.io/en/latest/reference/datasources/nocloud.html) +in the cloud-init documentation. + +## Troubleshooting + +If you encounter problems, verify that the cloud-config document contains +valid YAML. Online resources such as provide +a simple tool for validating YAML. + +cloud-init logs to /var/log/cloud-init.log. This file can be helpful in +determining why the configuration varies from what you expect. You can fetch the +most important data filtering output for `vyos` keyword: + +```none +sudo grep vyos /var/log/cloud-init.log +``` + +## Cloud-init on Proxmox + +Before starting, please refer to cloud-init [network-config-docs] in order to +know how to import user and network configurations. + +Most important keys that needs to be considered: + +- VyOS configuration commands are defined in user-data file. + +- Networking configurations shouldn't be passed in user-data file. + +- If no networking configuration is provided, then dhcp client is going to be + enabled on first interface. Bare in mind that this configuration will be + inyected at an OS level, so don't expect to find dhcp client configuration + on vyos cli. Because of this behavior, in next example lab we will disable + dhcp-client configuration on eth0. + + Also, this lab considers: + +- Proxmox IP address: **192.168.0.253/24** + +- Storaged used: volume local, which is mounted on directory **/var/lib/vz**, + and contains all type of content, including snippets. + +- Remove default dhcp client on first interface, and load other + configuration during first boot, using cloud-init. + +### Generate qcow image + +A VyOS qcow image with cloud-init options is needed. This can be obtained +using [vyos-vm-images] repo. After cloning the repo, edit the file +**qemu.yml** and comment the **download-iso** role. + +In this lab, we are using 1.3.0 VyOS version and setting a disk of 10G. +Download VyOS .iso file and save it as `/tmp/vyos.iso`. Command used for +generating qcow image: + +```sh +sudo ansible-playbook qemu.yml -e disk_size=10 \ + -e iso_local=/tmp/vyos.iso -e grub_console=serial -e vyos_version=1.3.0 \ + -e cloud_init=true -e cloud_init_ds=NoCloud +``` + +File generated with previous command: +`/tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2` + +Now, that file needs to be copied to proxmox server: + +```sh +sudo scp /tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2 root@192.168.0.253:/tmp/ +``` + +### Prepare cloud-init files + +In Proxmox server three files are going to be used for this setup: + +- **network-config**: file that will indicate to avoid dhcp client on first + interface. +- **user-data**: includes vyos-commands. +- **meta-data**: empty file (required). + +In this lab, all files are located in `/tmp/`. So, before going on, lets +move to that directory: + +```sh +cd /tmp/ +``` + +**user-data** file must start with `#cloud-config` and contains +vyos-commands. For example: + +```none +#cloud-config +vyos_config_commands: + - set system host-name 'vyos-BRAS' + - set service ntp server 1.pool.ntp.org + - set service ntp server 2.pool.ntp.org + - delete interfaces ethernet eth0 address 'dhcp' + - set interfaces ethernet eth0 address '198.51.100.2/30' + - set interfaces ethernet eth0 description 'WAN - ISP01' + - set interfaces ethernet eth1 address '192.168.25.1/24' + - set interfaces ethernet eth1 description 'Comming through VLAN 25' + - set interfaces ethernet eth2 address '192.168.26.1/24' + - set interfaces ethernet eth2 description 'Comming through VLAN 26' + - set protocols static route 0.0.0.0/0 next-hop '198.51.100.1' +``` + +**network-config** file only has configuration that disables the automatic +dhcp client on first interface. + +Content of network-config file: + +```none +version: 2 +ethernets: + eth0: + dhcp4: false + dhcp6: false +``` + +Finally, file **meta-data** has no content, but it's required. + +### Create seed.iso + +Once the three files were created, it's time to generate the `seed.iso` +image, which needs to be mounted to the new VM as a cd. + +Command for generating `seed.iso` + +```sh +mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data \ +user-data network-config +``` + +**NOTE**: be careful while copying and pasting previous commands. Double +quotes may need to be corrected. + +### Creating the VM + +Notes for this particular example, that may need to be modified in other +setups: + +- VM ID: in this example, VM ID used is 555. +- VM Storage: `local` volume is used. +- ISO files storage: `local` volume is used for `.iso` file storage. In + this scenario `local` volume type is set to **directory**, abd attached to + `/var/lib/vz`. +- VM Resources: these parameters can be modified as needed. + +`seed.iso` was previously created in directory `/tmp/`. It's necessary to +move it to `/var/lib/vz/template/iso` + +```sh +mv /tmp/seed.iso /var/lib/vz/template/iso/ +``` + +On proxmox server: + +```none +## Create VM, import disk and define boot order +qm create 555 --name vyos-1.3.0-cloudinit --memory 1024 --net0 virtio,bridge=vmbr0 +qm importdisk 555 vyos-1.3.0-cloud-init-10G-qemu.qcow2 local +qm set 555 --virtio0 local:555/vm-555-disk-0.raw +qm set 555 --boot order=virtio0 + +## Import seed.iso for cloud init +qm set 555 --ide2 media=cdrom,file=local:iso/seed.iso + +## Since this server has 1 nic, lets add network intefaces (vlan 25 and 26) +qm set 555 --net1 virtio,bridge=vmbr0,firewall=1,tag=25 +qm set 555 --net2 virtio,bridge=vmbr0,firewall=1,tag=26 +``` + +### Power on VM and verifications + +From cli or GUI, power on VM, and after it boots, verify configuration + +### References + +- VyOS [cloud-init-docs]. +- Cloud-init [network-config-docs]. +- Proxmox [Cloud-init-Support]. + + + +[cloud-init-docs]: https://docs.vyos.io/en/equuleus/automation/cloud-init.html?highlight=cloud-init#vyos-cloud-init +[cloud-init-support]: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_cloud_init +[cloud-init-write_files]: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files +[network-config-docs]: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html +[vyos-vm-images]: https://github.com/vyos/vyos-vm-images diff --git a/docs/automation/cloud-init.rst b/docs/automation/cloud-init.rst deleted file mode 100644 index 20b6dc49..00000000 --- a/docs/automation/cloud-init.rst +++ /dev/null @@ -1,441 +0,0 @@ -:lastproofread: 2021-07-12 - -.. _cloud-init: - -############### -VyOS cloud-init -############### - -Cloud and virtualized instances of VyOS are initialized using the -industry-standard cloud-init. Via cloud-init, the system performs tasks such as -injecting SSH keys and configuring the network. In addition, the user can supply -a custom configuration at the time of instance launch. - -************** -Config Sources -************** - -VyOS support three types of config sources. - -* Metadata - Metadata is sourced by the cloud platform or hypervisor. - In some clouds, there is implemented as an HTTP endpoint at - ``http://169.254.169.254``. - -* Network configuration - This config source informs the system about the - network settings like IP addresses, routes, DNS. Available only in several - cloud and virtualization platforms. - -* User-data - User-data is specified by the user. This config source offers the - ability to insert any CLI configuration commands into the configuration before - the first boot. - -********* -User-data -********* - -Major cloud providers offer a means of providing user-data at the time of -instance launch. It can be provided as plain text or as base64-encoded text, -depending on cloud provider. Also, it can be compressed using gzip, which makes -sense with a long configuration commands list, because of the hard limit to -~16384 bytes for the whole user-data. - -The easiest way to configure the system via user-data is the Cloud-config syntax -described below. - -******************** -Cloud-config modules -******************** - -In VyOS, by default, enables only two modules: - -* ``write_files`` - this module allows to insert any files into the filesystem - before the first boot, for example, pre-generated encryption keys, - certificates, or even a whole ``config.boot`` file. The format is described in the cloudinit documentation `Cloud-init-write_files`_. - -* ``vyos_userdata`` - the module accepts a list of CLI configuration commands in - a ``vyos_config_commands`` section, which gives an easy way to configure the - system during deployment. - -************************ -cloud-config file format -************************ - -A cloud-config document is written in YAML. The file must begin -with ``#cloud-config`` line. The only supported top-level keys are -``vyos_config_commands`` and ``write_files``. The use of these keys is described -in the following two sections. - - -************************ -Initial Configuration -************************ - - -The key used to designate a VyOS configuration is ``vyos_config_commands``. -What follows is VyOS configuration using the "set-style" syntax. Both "set" -and "delete" commands are supported. - -Commands requirements: - -* One command per line. -* If command ends in a value, it must be inside single quotes. -* A single-quote symbol is not allowed inside command or value. - -The commands list produced by the ``show configuration commands`` command on a -VyOS router should comply with all the requirements, so it is easy to get a -proper commands list by copying it from another router. - -The configuration specified in the cloud-config document overwrites default -configuration values and values configured via Metadata. - -Here is an example cloud-config that appends configuration at the time of -first boot. - -.. code-block:: yaml - - #cloud-config - vyos_config_commands: - - set system host-name 'vyos-prod-ashburn' - - set service ntp server 1.pool.ntp.org - - set service ntp server 2.pool.ntp.org - - delete interfaces ethernet eth1 address 'dhcp' - - set interfaces ethernet eth1 address '192.0.2.247/24' - - set protocols static route 198.51.100.0/24 next-hop '192.0.2.1' - -------------------------- -System Defaults/Fallbacks -------------------------- - -These are the VyOS defaults and fallbacks. - -* SSH is configured on port 22. -* ``vyos``/``vyos`` credentials if no others specified by data source. -* DHCP on first Ethernet interface if no network configuration is provided. - -All of these can be overridden using the configuration in user-data. - - -********************************* -Command Execution at Initial Boot -********************************* - -VyOS supports the execution of operational commands and linux commands at -initial boot. This is accomplished using ``write_files`` to certain -files in the /opt/vyatta/etc/config/scripts directory. Commands specified -in opt/vyatta/etc/config/scripts/vyos-preconfig-bootup.script are executed -prior to configuration. The -/opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script file contains -commands to be executed after configuration. In both cases, commands are -executed as the root user. - -Note that the /opt/vyatta/etc/config is used instead of the /config/scripts -directory referenced in the :ref:`command-scripting` section of the -documentation because the /config/script directory isn't mounted when the -``write_files`` module executes. - -The following example shows how to execute commands after the initial -configuration. - -.. code-block:: yaml - - #cloud-config - write_files: - - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script - owner: root:vyattacfg - permissions: '0775' - content: | - #!/bin/vbash - source /opt/vyatta/etc/functions/script-template - filename=/tmp/bgp_status_`date +"%Y_%m_%d_%I_%M_%p"`.log - run show ip bgp summary >> $filename - - -If you need to gather information from linux commands to configure VyOS, you -can execute commands and then configure VyOS in the same script. - -The following example sets the hostname based on the instance identifier -obtained from the EC2 metadata service. - -Please observe that the same configuration pitfall described in :ref:`command-scripting` -exists here when running ``configure`` in any context as without user group -'vyattacfg' will cause the error message ``Set failed`` to appear. -We therefore need to wrap it and have the script re-execute itself with the correct -group permissions. - -.. code-block:: yaml - - - #cloud-config - write_files: - - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script - owner: root:vyattacfg - permissions: '0775' - content: | - #!/bin/vbash - if [ "$(id -g -n)" != 'vyattacfg' ] ; then - exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@" - fi - source /opt/vyatta/etc/functions/script-template - hostname=`curl -s http://169.254.169.254/latest/meta-data/instance-id` - configure - set system host-name $hostname - commit - exit - -******* -NoCloud -******* - -Injecting configuration data is not limited to cloud platforms. Users can -employ the NoCloud data source to inject user-data and meta-data on -virtualization platforms such as VMware, Hyper-V and KVM. - -While other methods exist, the most straightforward method for using the -NoCloud data source is creating a seed ISO and attaching it to the virtual -machine as a CD drive. The volume must be formatted as a vfat or ISO 9660 -file system with the label "cidata" or "CIDATA". - -Create text files named user-data and meta-data. On linux-based systems, -the mkisofs utility can be used to create the seed ISO. The following -syntax will add these files to the ISO 9660 file system. - -.. code-block:: none - - mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data user-data - -The seed.iso file can be attached to the virtual machine. As an example, -the method with KVM to attach the ISO as a CD drive follows. - -.. code-block:: none - - $ virt-install -n vyos_r1 \ - --ram 4096 \ - --vcpus 2 \ - --cdrom seed.iso \ - --os-type linux \ - --os-variant debian10 \ - --network network=default \ - --graphics vnc \ - --hvm \ - --virt-type kvm \ - --disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \ - --import \ - --noautoconsole - - -For more information on the NoCloud data source, visit its `page -`_ -in the cloud-init documentation. - -*************** -Troubleshooting -*************** - -If you encounter problems, verify that the cloud-config document contains -valid YAML. Online resources such as https://www.yamllint.com/ provide -a simple tool for validating YAML. - -cloud-init logs to /var/log/cloud-init.log. This file can be helpful in -determining why the configuration varies from what you expect. You can fetch the -most important data filtering output for ``vyos`` keyword: - -.. code-block:: none - - sudo grep vyos /var/log/cloud-init.log - -********************* -Cloud-init on Proxmox -********************* - -Before starting, please refer to cloud-init `network-config-docs`_ in order to -know how to import user and network configurations. - -Most important keys that needs to be considered: - -* VyOS configuration commands are defined in user-data file. - -* Networking configurations shouldn't be passed in user-data file. - -* If no networking configuration is provided, then dhcp client is going to be - enabled on first interface. Bare in mind that this configuration will be - inyected at an OS level, so don't expect to find dhcp client configuration - on vyos cli. Because of this behavior, in next example lab we will disable - dhcp-client configuration on eth0. - - Also, this lab considers: - -* Proxmox IP address: **192.168.0.253/24** - -* Storaged used: volume local, which is mounted on directory **/var/lib/vz**, - and contains all type of content, including snippets. - -* Remove default dhcp client on first interface, and load other - configuration during first boot, using cloud-init. - -------------------- -Generate qcow image -------------------- - -A VyOS qcow image with cloud-init options is needed. This can be obtained -using `vyos-vm-images`_ repo. After cloning the repo, edit the file -**qemu.yml** and comment the **download-iso** role. - -In this lab, we are using 1.3.0 VyOS version and setting a disk of 10G. -Download VyOS .iso file and save it as ``/tmp/vyos.iso``. Command used for -generating qcow image: - -.. code-block:: sh - - sudo ansible-playbook qemu.yml -e disk_size=10 \ - -e iso_local=/tmp/vyos.iso -e grub_console=serial -e vyos_version=1.3.0 \ - -e cloud_init=true -e cloud_init_ds=NoCloud - -File generated with previous command: -``/tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2`` - -Now, that file needs to be copied to proxmox server: - -.. code-block:: sh - - sudo scp /tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2 root@192.168.0.253:/tmp/ - - ------------------------- -Prepare cloud-init files ------------------------- - -In Proxmox server three files are going to be used for this setup: - -* **network-config**: file that will indicate to avoid dhcp client on first - interface. - -* **user-data**: includes vyos-commands. - -* **meta-data**: empty file (required). - -In this lab, all files are located in ``/tmp/``. So, before going on, lets -move to that directory: - -.. code-block:: sh - - cd /tmp/ - -**user-data** file must start with ``#cloud-config`` and contains -vyos-commands. For example: - -.. code-block:: none - - #cloud-config - vyos_config_commands: - - set system host-name 'vyos-BRAS' - - set service ntp server 1.pool.ntp.org - - set service ntp server 2.pool.ntp.org - - delete interfaces ethernet eth0 address 'dhcp' - - set interfaces ethernet eth0 address '198.51.100.2/30' - - set interfaces ethernet eth0 description 'WAN - ISP01' - - set interfaces ethernet eth1 address '192.168.25.1/24' - - set interfaces ethernet eth1 description 'Comming through VLAN 25' - - set interfaces ethernet eth2 address '192.168.26.1/24' - - set interfaces ethernet eth2 description 'Comming through VLAN 26' - - set protocols static route 0.0.0.0/0 next-hop '198.51.100.1' - -**network-config** file only has configuration that disables the automatic -dhcp client on first interface. - - -Content of network-config file: - -.. code-block:: none - - version: 2 - ethernets: - eth0: - dhcp4: false - dhcp6: false - -Finally, file **meta-data** has no content, but it's required. - ---------------- -Create seed.iso ---------------- - -Once the three files were created, it's time to generate the ``seed.iso`` -image, which needs to be mounted to the new VM as a cd. - -Command for generating ``seed.iso`` - -.. code-block:: sh - - mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data \ - user-data network-config - -**NOTE**: be careful while copying and pasting previous commands. Double -quotes may need to be corrected. - ---------------- -Creating the VM ---------------- - -Notes for this particular example, that may need to be modified in other -setups: - -* VM ID: in this example, VM ID used is 555. - -* VM Storage: ``local`` volume is used. - -* ISO files storage: ``local`` volume is used for ``.iso`` file storage. In - this scenario ``local`` volume type is set to **directory**, abd attached to - ``/var/lib/vz``. - -* VM Resources: these parameters can be modified as needed. - -``seed.iso`` was previously created in directory ``/tmp/``. It's necessary to -move it to ``/var/lib/vz/template/iso`` - -.. code-block:: sh - - mv /tmp/seed.iso /var/lib/vz/template/iso/ - -On proxmox server: - -.. code-block:: none - - ## Create VM, import disk and define boot order - qm create 555 --name vyos-1.3.0-cloudinit --memory 1024 --net0 virtio,bridge=vmbr0 - qm importdisk 555 vyos-1.3.0-cloud-init-10G-qemu.qcow2 local - qm set 555 --virtio0 local:555/vm-555-disk-0.raw - qm set 555 --boot order=virtio0 - - ## Import seed.iso for cloud init - qm set 555 --ide2 media=cdrom,file=local:iso/seed.iso - - ## Since this server has 1 nic, lets add network intefaces (vlan 25 and 26) - qm set 555 --net1 virtio,bridge=vmbr0,firewall=1,tag=25 - qm set 555 --net2 virtio,bridge=vmbr0,firewall=1,tag=26 - ------------------------------ -Power on VM and verifications ------------------------------ - -From cli or GUI, power on VM, and after it boots, verify configuration - - ----------- -References ----------- - -* VyOS `cloud-init-docs`_. - -* Cloud-init `network-config-docs`_. - -* Proxmox `Cloud-init-Support`_. - -.. stop_vyoslinter - -.. _network-config-docs: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html -.. _vyos-vm-images: https://github.com/vyos/vyos-vm-images -.. _cloud-init-docs: https://docs.vyos.io/en/equuleus/automation/cloud-init.html?highlight=cloud-init#vyos-cloud-init -.. _Cloud-init-Support: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_cloud_init -.. _Cloud-init-write_files: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files - -.. start_vyoslinter diff --git a/docs/automation/command-scripting.md b/docs/automation/command-scripting.md new file mode 100644 index 00000000..941ba744 --- /dev/null +++ b/docs/automation/command-scripting.md @@ -0,0 +1,207 @@ +--- +lastproofread: '2023-01-16' +--- + +(command-scripting)= + +# Command Scripting + +VyOS supports executing configuration and operational commands non-interactively +from shell scripts. + +To include VyOS specific functions and aliases you need to `source +/opt/vyatta/etc/functions/script-template` files at the top of your script. + +```none +#!/bin/vbash +source /opt/vyatta/etc/functions/script-template +exit +``` + +## Run configuration commands + +Configuration commands are executed just like from a normal config session. For +example, if you want to disable a BGP peer on VRRP transition to backup: + +```none +#!/bin/vbash +source /opt/vyatta/etc/functions/script-template +configure +set protocols bgp system-as 65536 +set protocols bgp neighbor 192.168.2.1 shutdown +commit +exit +``` + +## Run operational commands + +Unlike a normal configuration session, all operational commands must be +prepended with `run`, even if you haven't created a session with configure. + +```none +#!/bin/vbash +source /opt/vyatta/etc/functions/script-template +run show interfaces +exit +``` + +## Run commands remotely + +Sometimes you simply want to execute a bunch of op-mode commands via SSH on +a remote VyOS system. + +```none +ssh 192.0.2.1 'vbash -s' <> $filename -``` - -If you need to gather information from linux commands to configure VyOS, you -can execute commands and then configure VyOS in the same script. - -The following example sets the hostname based on the instance identifier -obtained from the EC2 metadata service. - -Please observe that the same configuration pitfall described in {ref}`command-scripting` -exists here when running `configure` in any context as without user group -'vyattacfg' will cause the error message `Set failed` to appear. -We therefore need to wrap it and have the script re-execute itself with the correct -group permissions. - -```yaml -#cloud-config -write_files: - - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script - owner: root:vyattacfg - permissions: '0775' - content: | - #!/bin/vbash - if [ "$(id -g -n)" != 'vyattacfg' ] ; then - exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@" - fi - source /opt/vyatta/etc/functions/script-template - hostname=`curl -s http://169.254.169.254/latest/meta-data/instance-id` - configure - set system host-name $hostname - commit - exit -``` - -## NoCloud - -Injecting configuration data is not limited to cloud platforms. Users can -employ the NoCloud data source to inject user-data and meta-data on -virtualization platforms such as VMware, Hyper-V and KVM. - -While other methods exist, the most straightforward method for using the -NoCloud data source is creating a seed ISO and attaching it to the virtual -machine as a CD drive. The volume must be formatted as a vfat or ISO 9660 -file system with the label "cidata" or "CIDATA". - -Create text files named user-data and meta-data. On linux-based systems, -the mkisofs utility can be used to create the seed ISO. The following -syntax will add these files to the ISO 9660 file system. - -```none -mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data user-data -``` - -The seed.iso file can be attached to the virtual machine. As an example, -the method with KVM to attach the ISO as a CD drive follows. - -```none -$ virt-install -n vyos_r1 \ - --ram 4096 \ - --vcpus 2 \ - --cdrom seed.iso \ - --os-type linux \ - --os-variant debian10 \ - --network network=default \ - --graphics vnc \ - --hvm \ - --virt-type kvm \ - --disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \ - --import \ - --noautoconsole -``` - -For more information on the NoCloud data source, visit its [page](https://cloudinit.readthedocs.io/en/latest/reference/datasources/nocloud.html) -in the cloud-init documentation. - -## Troubleshooting - -If you encounter problems, verify that the cloud-config document contains -valid YAML. Online resources such as provide -a simple tool for validating YAML. - -cloud-init logs to /var/log/cloud-init.log. This file can be helpful in -determining why the configuration varies from what you expect. You can fetch the -most important data filtering output for `vyos` keyword: - -```none -sudo grep vyos /var/log/cloud-init.log -``` - -## Cloud-init on Proxmox - -Before starting, please refer to cloud-init [network-config-docs] in order to -know how to import user and network configurations. - -Most important keys that needs to be considered: - -- VyOS configuration commands are defined in user-data file. - -- Networking configurations shouldn't be passed in user-data file. - -- If no networking configuration is provided, then dhcp client is going to be - enabled on first interface. Bare in mind that this configuration will be - inyected at an OS level, so don't expect to find dhcp client configuration - on vyos cli. Because of this behavior, in next example lab we will disable - dhcp-client configuration on eth0. - - Also, this lab considers: - -- Proxmox IP address: **192.168.0.253/24** - -- Storaged used: volume local, which is mounted on directory **/var/lib/vz**, - and contains all type of content, including snippets. - -- Remove default dhcp client on first interface, and load other - configuration during first boot, using cloud-init. - -### Generate qcow image - -A VyOS qcow image with cloud-init options is needed. This can be obtained -using [vyos-vm-images] repo. After cloning the repo, edit the file -**qemu.yml** and comment the **download-iso** role. - -In this lab, we are using 1.3.0 VyOS version and setting a disk of 10G. -Download VyOS .iso file and save it as `/tmp/vyos.iso`. Command used for -generating qcow image: - -```sh -sudo ansible-playbook qemu.yml -e disk_size=10 \ - -e iso_local=/tmp/vyos.iso -e grub_console=serial -e vyos_version=1.3.0 \ - -e cloud_init=true -e cloud_init_ds=NoCloud -``` - -File generated with previous command: -`/tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2` - -Now, that file needs to be copied to proxmox server: - -```sh -sudo scp /tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2 root@192.168.0.253:/tmp/ -``` - -### Prepare cloud-init files - -In Proxmox server three files are going to be used for this setup: - -- **network-config**: file that will indicate to avoid dhcp client on first - interface. -- **user-data**: includes vyos-commands. -- **meta-data**: empty file (required). - -In this lab, all files are located in `/tmp/`. So, before going on, lets -move to that directory: - -```sh -cd /tmp/ -``` - -**user-data** file must start with `#cloud-config` and contains -vyos-commands. For example: - -```none -#cloud-config -vyos_config_commands: - - set system host-name 'vyos-BRAS' - - set service ntp server 1.pool.ntp.org - - set service ntp server 2.pool.ntp.org - - delete interfaces ethernet eth0 address 'dhcp' - - set interfaces ethernet eth0 address '198.51.100.2/30' - - set interfaces ethernet eth0 description 'WAN - ISP01' - - set interfaces ethernet eth1 address '192.168.25.1/24' - - set interfaces ethernet eth1 description 'Comming through VLAN 25' - - set interfaces ethernet eth2 address '192.168.26.1/24' - - set interfaces ethernet eth2 description 'Comming through VLAN 26' - - set protocols static route 0.0.0.0/0 next-hop '198.51.100.1' -``` - -**network-config** file only has configuration that disables the automatic -dhcp client on first interface. - -Content of network-config file: - -```none -version: 2 -ethernets: - eth0: - dhcp4: false - dhcp6: false -``` - -Finally, file **meta-data** has no content, but it's required. - -### Create seed.iso - -Once the three files were created, it's time to generate the `seed.iso` -image, which needs to be mounted to the new VM as a cd. - -Command for generating `seed.iso` - -```sh -mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data \ -user-data network-config -``` - -**NOTE**: be careful while copying and pasting previous commands. Double -quotes may need to be corrected. - -### Creating the VM - -Notes for this particular example, that may need to be modified in other -setups: - -- VM ID: in this example, VM ID used is 555. -- VM Storage: `local` volume is used. -- ISO files storage: `local` volume is used for `.iso` file storage. In - this scenario `local` volume type is set to **directory**, abd attached to - `/var/lib/vz`. -- VM Resources: these parameters can be modified as needed. - -`seed.iso` was previously created in directory `/tmp/`. It's necessary to -move it to `/var/lib/vz/template/iso` - -```sh -mv /tmp/seed.iso /var/lib/vz/template/iso/ -``` - -On proxmox server: - -```none -## Create VM, import disk and define boot order -qm create 555 --name vyos-1.3.0-cloudinit --memory 1024 --net0 virtio,bridge=vmbr0 -qm importdisk 555 vyos-1.3.0-cloud-init-10G-qemu.qcow2 local -qm set 555 --virtio0 local:555/vm-555-disk-0.raw -qm set 555 --boot order=virtio0 - -## Import seed.iso for cloud init -qm set 555 --ide2 media=cdrom,file=local:iso/seed.iso - -## Since this server has 1 nic, lets add network intefaces (vlan 25 and 26) -qm set 555 --net1 virtio,bridge=vmbr0,firewall=1,tag=25 -qm set 555 --net2 virtio,bridge=vmbr0,firewall=1,tag=26 -``` - -### Power on VM and verifications - -From cli or GUI, power on VM, and after it boots, verify configuration - -### References - -- VyOS [cloud-init-docs]. -- Cloud-init [network-config-docs]. -- Proxmox [Cloud-init-Support]. - - - -[cloud-init-docs]: https://docs.vyos.io/en/equuleus/automation/cloud-init.html?highlight=cloud-init#vyos-cloud-init -[cloud-init-support]: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_cloud_init -[cloud-init-write_files]: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files -[network-config-docs]: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html -[vyos-vm-images]: https://github.com/vyos/vyos-vm-images diff --git a/docs/automation/md-command-scripting.md b/docs/automation/md-command-scripting.md deleted file mode 100644 index 941ba744..00000000 --- a/docs/automation/md-command-scripting.md +++ /dev/null @@ -1,207 +0,0 @@ ---- -lastproofread: '2023-01-16' ---- - -(command-scripting)= - -# Command Scripting - -VyOS supports executing configuration and operational commands non-interactively -from shell scripts. - -To include VyOS specific functions and aliases you need to `source -/opt/vyatta/etc/functions/script-template` files at the top of your script. - -```none -#!/bin/vbash -source /opt/vyatta/etc/functions/script-template -exit -``` - -## Run configuration commands - -Configuration commands are executed just like from a normal config session. For -example, if you want to disable a BGP peer on VRRP transition to backup: - -```none -#!/bin/vbash -source /opt/vyatta/etc/functions/script-template -configure -set protocols bgp system-as 65536 -set protocols bgp neighbor 192.168.2.1 shutdown -commit -exit -``` - -## Run operational commands - -Unlike a normal configuration session, all operational commands must be -prepended with `run`, even if you haven't created a session with configure. - -```none -#!/bin/vbash -source /opt/vyatta/etc/functions/script-template -run show interfaces -exit -``` - -## Run commands remotely - -Sometimes you simply want to execute a bunch of op-mode commands via SSH on -a remote VyOS system. - -```none -ssh 192.0.2.1 'vbash -s' <> $filename + + +If you need to gather information from linux commands to configure VyOS, you +can execute commands and then configure VyOS in the same script. + +The following example sets the hostname based on the instance identifier +obtained from the EC2 metadata service. + +Please observe that the same configuration pitfall described in :ref:`command-scripting` +exists here when running ``configure`` in any context as without user group +'vyattacfg' will cause the error message ``Set failed`` to appear. +We therefore need to wrap it and have the script re-execute itself with the correct +group permissions. + +.. code-block:: yaml + + + #cloud-config + write_files: + - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script + owner: root:vyattacfg + permissions: '0775' + content: | + #!/bin/vbash + if [ "$(id -g -n)" != 'vyattacfg' ] ; then + exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@" + fi + source /opt/vyatta/etc/functions/script-template + hostname=`curl -s http://169.254.169.254/latest/meta-data/instance-id` + configure + set system host-name $hostname + commit + exit + +******* +NoCloud +******* + +Injecting configuration data is not limited to cloud platforms. Users can +employ the NoCloud data source to inject user-data and meta-data on +virtualization platforms such as VMware, Hyper-V and KVM. + +While other methods exist, the most straightforward method for using the +NoCloud data source is creating a seed ISO and attaching it to the virtual +machine as a CD drive. The volume must be formatted as a vfat or ISO 9660 +file system with the label "cidata" or "CIDATA". + +Create text files named user-data and meta-data. On linux-based systems, +the mkisofs utility can be used to create the seed ISO. The following +syntax will add these files to the ISO 9660 file system. + +.. code-block:: none + + mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data user-data + +The seed.iso file can be attached to the virtual machine. As an example, +the method with KVM to attach the ISO as a CD drive follows. + +.. code-block:: none + + $ virt-install -n vyos_r1 \ + --ram 4096 \ + --vcpus 2 \ + --cdrom seed.iso \ + --os-type linux \ + --os-variant debian10 \ + --network network=default \ + --graphics vnc \ + --hvm \ + --virt-type kvm \ + --disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \ + --import \ + --noautoconsole + + +For more information on the NoCloud data source, visit its `page +`_ +in the cloud-init documentation. + +*************** +Troubleshooting +*************** + +If you encounter problems, verify that the cloud-config document contains +valid YAML. Online resources such as https://www.yamllint.com/ provide +a simple tool for validating YAML. + +cloud-init logs to /var/log/cloud-init.log. This file can be helpful in +determining why the configuration varies from what you expect. You can fetch the +most important data filtering output for ``vyos`` keyword: + +.. code-block:: none + + sudo grep vyos /var/log/cloud-init.log + +********************* +Cloud-init on Proxmox +********************* + +Before starting, please refer to cloud-init `network-config-docs`_ in order to +know how to import user and network configurations. + +Most important keys that needs to be considered: + +* VyOS configuration commands are defined in user-data file. + +* Networking configurations shouldn't be passed in user-data file. + +* If no networking configuration is provided, then dhcp client is going to be + enabled on first interface. Bare in mind that this configuration will be + inyected at an OS level, so don't expect to find dhcp client configuration + on vyos cli. Because of this behavior, in next example lab we will disable + dhcp-client configuration on eth0. + + Also, this lab considers: + +* Proxmox IP address: **192.168.0.253/24** + +* Storaged used: volume local, which is mounted on directory **/var/lib/vz**, + and contains all type of content, including snippets. + +* Remove default dhcp client on first interface, and load other + configuration during first boot, using cloud-init. + +------------------- +Generate qcow image +------------------- + +A VyOS qcow image with cloud-init options is needed. This can be obtained +using `vyos-vm-images`_ repo. After cloning the repo, edit the file +**qemu.yml** and comment the **download-iso** role. + +In this lab, we are using 1.3.0 VyOS version and setting a disk of 10G. +Download VyOS .iso file and save it as ``/tmp/vyos.iso``. Command used for +generating qcow image: + +.. code-block:: sh + + sudo ansible-playbook qemu.yml -e disk_size=10 \ + -e iso_local=/tmp/vyos.iso -e grub_console=serial -e vyos_version=1.3.0 \ + -e cloud_init=true -e cloud_init_ds=NoCloud + +File generated with previous command: +``/tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2`` + +Now, that file needs to be copied to proxmox server: + +.. code-block:: sh + + sudo scp /tmp/vyos-1.3.0-cloud-init-10G-qemu.qcow2 root@192.168.0.253:/tmp/ + + +------------------------ +Prepare cloud-init files +------------------------ + +In Proxmox server three files are going to be used for this setup: + +* **network-config**: file that will indicate to avoid dhcp client on first + interface. + +* **user-data**: includes vyos-commands. + +* **meta-data**: empty file (required). + +In this lab, all files are located in ``/tmp/``. So, before going on, lets +move to that directory: + +.. code-block:: sh + + cd /tmp/ + +**user-data** file must start with ``#cloud-config`` and contains +vyos-commands. For example: + +.. code-block:: none + + #cloud-config + vyos_config_commands: + - set system host-name 'vyos-BRAS' + - set service ntp server 1.pool.ntp.org + - set service ntp server 2.pool.ntp.org + - delete interfaces ethernet eth0 address 'dhcp' + - set interfaces ethernet eth0 address '198.51.100.2/30' + - set interfaces ethernet eth0 description 'WAN - ISP01' + - set interfaces ethernet eth1 address '192.168.25.1/24' + - set interfaces ethernet eth1 description 'Comming through VLAN 25' + - set interfaces ethernet eth2 address '192.168.26.1/24' + - set interfaces ethernet eth2 description 'Comming through VLAN 26' + - set protocols static route 0.0.0.0/0 next-hop '198.51.100.1' + +**network-config** file only has configuration that disables the automatic +dhcp client on first interface. + + +Content of network-config file: + +.. code-block:: none + + version: 2 + ethernets: + eth0: + dhcp4: false + dhcp6: false + +Finally, file **meta-data** has no content, but it's required. + +--------------- +Create seed.iso +--------------- + +Once the three files were created, it's time to generate the ``seed.iso`` +image, which needs to be mounted to the new VM as a cd. + +Command for generating ``seed.iso`` + +.. code-block:: sh + + mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data \ + user-data network-config + +**NOTE**: be careful while copying and pasting previous commands. Double +quotes may need to be corrected. + +--------------- +Creating the VM +--------------- + +Notes for this particular example, that may need to be modified in other +setups: + +* VM ID: in this example, VM ID used is 555. + +* VM Storage: ``local`` volume is used. + +* ISO files storage: ``local`` volume is used for ``.iso`` file storage. In + this scenario ``local`` volume type is set to **directory**, abd attached to + ``/var/lib/vz``. + +* VM Resources: these parameters can be modified as needed. + +``seed.iso`` was previously created in directory ``/tmp/``. It's necessary to +move it to ``/var/lib/vz/template/iso`` + +.. code-block:: sh + + mv /tmp/seed.iso /var/lib/vz/template/iso/ + +On proxmox server: + +.. code-block:: none + + ## Create VM, import disk and define boot order + qm create 555 --name vyos-1.3.0-cloudinit --memory 1024 --net0 virtio,bridge=vmbr0 + qm importdisk 555 vyos-1.3.0-cloud-init-10G-qemu.qcow2 local + qm set 555 --virtio0 local:555/vm-555-disk-0.raw + qm set 555 --boot order=virtio0 + + ## Import seed.iso for cloud init + qm set 555 --ide2 media=cdrom,file=local:iso/seed.iso + + ## Since this server has 1 nic, lets add network intefaces (vlan 25 and 26) + qm set 555 --net1 virtio,bridge=vmbr0,firewall=1,tag=25 + qm set 555 --net2 virtio,bridge=vmbr0,firewall=1,tag=26 + +----------------------------- +Power on VM and verifications +----------------------------- + +From cli or GUI, power on VM, and after it boots, verify configuration + + +---------- +References +---------- + +* VyOS `cloud-init-docs`_. + +* Cloud-init `network-config-docs`_. + +* Proxmox `Cloud-init-Support`_. + +.. stop_vyoslinter + +.. _network-config-docs: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html +.. _vyos-vm-images: https://github.com/vyos/vyos-vm-images +.. _cloud-init-docs: https://docs.vyos.io/en/equuleus/automation/cloud-init.html?highlight=cloud-init#vyos-cloud-init +.. _Cloud-init-Support: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_cloud_init +.. _Cloud-init-write_files: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files + +.. start_vyoslinter diff --git a/docs/automation/rst-command-scripting.rst b/docs/automation/rst-command-scripting.rst new file mode 100644 index 00000000..aaa60957 --- /dev/null +++ b/docs/automation/rst-command-scripting.rst @@ -0,0 +1,214 @@ +:lastproofread: 2023-01-16 + +.. _command-scripting: + +Command Scripting +================= + +VyOS supports executing configuration and operational commands non-interactively +from shell scripts. + +To include VyOS specific functions and aliases you need to ``source +/opt/vyatta/etc/functions/script-template`` files at the top of your script. + +.. code-block:: none + + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + exit + +Run configuration commands +-------------------------- + +Configuration commands are executed just like from a normal config session. For +example, if you want to disable a BGP peer on VRRP transition to backup: + +.. code-block:: none + + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + configure + set protocols bgp system-as 65536 + set protocols bgp neighbor 192.168.2.1 shutdown + commit + exit + +Run operational commands +------------------------ + +Unlike a normal configuration session, all operational commands must be +prepended with ``run``, even if you haven't created a session with configure. + +.. code-block:: none + + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + run show interfaces + exit + +Run commands remotely +--------------------- + +Sometimes you simply want to execute a bunch of op-mode commands via SSH on +a remote VyOS system. + +.. code-block:: none + + ssh 192.0.2.1 'vbash -s' < 1 Create an UNIX or Windows instance -> -> 2 Download and install Terraform -> -> 3 Create the folder for example /root/awsterraform - -```none -mkdir /root/awsterraform - - 4 Copy all files into your Terraform project "/root/awsterraform" (vyos.tf, var.tf, terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for AWS`_ - - 5 Type the commands : -``` - -```none -cd / -terraform init -``` - -Ansible - -> 1 Create an UNIX instance whenever you want (local, cloud, and so on) -> -> 2 Download and install Ansible -> -> 3 Create the folder for example /root/aws/ -> -> 4 Copy all files into your Ansible project "/root/aws/" (ansible.cfg, instance.yml, mykey.pem and "all"), more detailed see [Structure of files Ansible for AWS] - -mykey.pem you have to get using step 1.2 - -Start - -Type the commands on your Terrafom instance: - -```none -cd / -terraform plan -terraform apply -yes -``` - -## Start creating an AWS instance and check the result - -```none -root@localhost:~/awsterraform# terraform apply - -Terraform used the selected providers to generate the following execution plan. -Resource actions are indicated with the following symbols: - + create - -Terraform will perform the following actions: - - # aws_instance.myVyOSec2 will be created - + resource "aws_instance" "myVyOSec2" { - + ami = "ami-************62c2d" - + arn = (known after apply) - + associate_public_ip_address = (known after apply) - + availability_zone = (known after apply) - + cpu_core_count = (known after apply) - + cpu_threads_per_core = (known after apply) - + disable_api_stop = (known after apply) - + disable_api_termination = (known after apply) - + ebs_optimized = (known after apply) - + get_password_data = false - + host_id = (known after apply) - + host_resource_group_arn = (known after apply) - + iam_instance_profile = (known after apply) - + id = (known after apply) - + instance_initiated_shutdown_behavior = (known after apply) - + instance_lifecycle = (known after apply) - + instance_state = (known after apply) - + instance_type = "t2.micro" - + ipv6_address_count = (known after apply) - + ipv6_addresses = (known after apply) - + key_name = "awsterraform" - + monitoring = (known after apply) - + outpost_arn = (known after apply) - + password_data = (known after apply) - + placement_group = (known after apply) - + placement_partition_number = (known after apply) - + primary_network_interface_id = (known after apply) - + private_dns = (known after apply) - + private_ip = (known after apply) - + public_dns = (known after apply) - + public_ip = (known after apply) - + secondary_private_ips = (known after apply) - + security_groups = [ - + "awsterraformsg", - ] - + source_dest_check = true - + spot_instance_request_id = (known after apply) - + subnet_id = (known after apply) - + tags = { - + "name" = "VyOS System" - } - + tags_all = { - + "name" = "VyOS System" - } - + tenancy = (known after apply) - + user_data = (known after apply) - + user_data_base64 = (known after apply) - + user_data_replace_on_change = false - + vpc_security_group_ids = (known after apply) - } - - # local_file.ip will be created - + resource "local_file" "ip" { - + content = (known after apply) - + content_base64sha256 = (known after apply) - + content_base64sha512 = (known after apply) - + content_md5 = (known after apply) - + content_sha1 = (known after apply) - + content_sha256 = (known after apply) - + content_sha512 = (known after apply) - + directory_permission = "0777" - + file_permission = "0777" - + filename = "ip.txt" - + id = (known after apply) - } - - # null_resource.SSHconnection1 will be created - + resource "null_resource" "SSHconnection1" { - + id = (known after apply) - } - - # null_resource.SSHconnection2 will be created - + resource "null_resource" "SSHconnection2" { - + id = (known after apply) - } - -Plan: 4 to add, 0 to change, 0 to destroy. - -Changes to Outputs: - + my_IP = (known after apply) - -Do you want to perform these actions? - Terraform will perform the actions described above. - Only 'yes' will be accepted to approve. - - Enter a value: yes - -aws_instance.myVyOSec2: Creating... -aws_instance.myVyOSec2: Still creating... [10s elapsed] -aws_instance.myVyOSec2: Still creating... [20s elapsed] -aws_instance.myVyOSec2: Still creating... [30s elapsed] -aws_instance.myVyOSec2: Still creating... [40s elapsed] -aws_instance.myVyOSec2: Creation complete after 44s [id=i-09edfca15aac2fe0a] -null_resource.SSHconnection1: Creating... -null_resource.SSHconnection2: Creating... -null_resource.SSHconnection1: Provisioning with 'file'... -null_resource.SSHconnection2: Provisioning with 'remote-exec'... -null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... -null_resource.SSHconnection2 (remote-exec): Host: 10.217.80.104 -null_resource.SSHconnection2 (remote-exec): User: root -null_resource.SSHconnection2 (remote-exec): Password: true -null_resource.SSHconnection2 (remote-exec): Private key: false -null_resource.SSHconnection2 (remote-exec): Certificate: false -null_resource.SSHconnection2 (remote-exec): SSH Agent: false -null_resource.SSHconnection2 (remote-exec): Checking Host Key: false -null_resource.SSHconnection2 (remote-exec): Target Platform: unix -local_file.ip: Creating... -local_file.ip: Creation complete after 0s [id=e8e91f2e24579cd28b92e2d152c0c24c3bf4b52c] -null_resource.SSHconnection2 (remote-exec): Connected! -null_resource.SSHconnection1: Creation complete after 0s [id=7070868940858935600] - -null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ - -null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** -null_resource.SSHconnection2: Still creating... [10s elapsed] -null_resource.SSHconnection2: Still creating... [20s elapsed] -null_resource.SSHconnection2: Still creating... [30s elapsed] -null_resource.SSHconnection2: Still creating... [40s elapsed] -null_resource.SSHconnection2: Still creating... [50s elapsed] -null_resource.SSHconnection2: Still creating... [1m0s elapsed] -null_resource.SSHconnection2 (remote-exec): ok: [54.xxx.xxx.xxx] - -null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* -null_resource.SSHconnection2: Still creating... [1m10s elapsed] -null_resource.SSHconnection2 (remote-exec): changed: [54.xxx.xxx.xxx] - -null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* -null_resource.SSHconnection2 (remote-exec): 54.xxx.xxx.xxx : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - -null_resource.SSHconnection2: Creation complete after 1m16s [id=4902256962410024771] - -Apply complete! Resources: 4 added, 0 changed, 0 destroyed. - -Outputs: - -my_IP = "54.xxx.xxx.xxx" -``` - -After executing all the commands you will have your VyOS instance on the AWS cloud with your configuration, it's a very convenient desition. -If you need to delete the instance please type the command: - -```none -terraform destroy -``` - -## Troubleshooting - -1 Ansible doesn't connect via SSH to your AWS instance: you have to check that your SSH key has copied into the path /root/aws/. -Also, increase the time in the file instance.yml from 300 sec to 500 sec or more. (It depends on your location). -Make sure that you have opened access to the instance in the security group. - -> 2 Terraform doesn't connect via SSH to your Ansible instance: you have to check the correct login and password in the part of the file VyOS. tf - -```none -connection { - type = "ssh" - user = "root" # open root access using login and password on your Ansible - password = var.password # check password in the file terraform.tfvars isn't empty - host = var.host # check the correct IP address of your Ansible host -} -``` - -Make sure that Ansible is pinging from Terrafom. - -## Structure of files Terrafom for AWS - -```none -. -├── vyos.tf # The main script -├── var.tf # The file of all variables in "vyos.tf" -├── versions.tf # File for the changing version of Terraform. -└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) -``` - -## File contents of Terrafom for AWS - -vyos.tf - -```none -############################################################################## -# Build an VyOS VM from the Marketplace -# To finde nessesery AMI image_ in AWS -# -# In the script vyos.tf we'll use default values (you can chang it as you need) -# AWS Region = "us-east-1" -# AMI = "standard AMI of VyOS from AWS Marketplace" -# Size of VM = "t2.micro" -# AWS Region = "us-east-1" -# After deploying the AWS instance and getting an IP address, the IP address is copied into the file -#"ip.txt" and copied to the Ansible node for provisioning. -############################################################################## - -provider "aws" { - access_key = var.access - secret_key = var.secret - region = var.region -} - -variable "region" { - default = "us-east-1" - description = "AWS Region" -} - -variable "ami" { - default = "ami-**************3b3" # ami image please enter your details - description = "Amazon Machine Image ID for VyOS" -} - -variable "type" { - default = "t2.micro" - description = "Size of VM" -} - -# my resource for VyOS - -resource "aws_instance" "myVyOSec2" { - ami = var.ami - key_name = "awsterraform" # Please enter your details from 1.2 of Preparation steps for deploying VyOS on AWS - security_groups = ["awsterraformsg"] # Please enter your details from 1.3 of Preparation steps for deploying VyOS on AWS - instance_type = var.type - tags = { - name = "VyOS System" - } -} - -############################################################################## -# specific variable (to getting type "terraform plan"): -# aws_instance.myVyOSec2.public_ip - the information about public IP address -# of our instance, needs for provisioning and ssh connection from Ansible -############################################################################## - -output "my_IP"{ -value = aws_instance.myVyOSec2.public_ip -} - -############################################################################## -# -# IP of aws instance copied to a file ip.txt in local system Terraform -# ip.txt looks like: -# cat ./ip.txt -# ххх.ххх.ххх.ххх -############################################################################## - -resource "local_file" "ip" { - content = aws_instance.myVyOSec2.public_ip - filename = "ip.txt" -} - -#connecting to the Ansible control node using SSH connection - -############################################################################## -# Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform node and start remotely the playbook of Ansible. -############################################################################## - -resource "null_resource" "SSHconnection1" { -depends_on = [aws_instance.myVyOSec2] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} - -#copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/aws/ip.txt" # The folder of your Ansible project - } -} - -resource "null_resource" "SSHconnection2" { -depends_on = [aws_instance.myVyOSec2] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} -#command to run Ansible playbook on remote Linux OS -provisioner "remote-exec" { - inline = [ - "cd /root/aws/", - "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for AWS" -] -} -} -``` - -var.tf - -```none -variable "password" { - description = "pass for Ansible" - type = string - sensitive = true -} -variable "host"{ - description = "The IP of my Ansible" - type = string -} -variable "access" { - description = "my access_key for AWS" - type = string - sensitive = true -} -variable "secret" { - description = "my secret_key for AWS" - type = string - sensitive = true -} -``` - -versions.tf - -```none - terraform { - required_providers { - aws = { - source = "hashicorp/aws" - version = "~> 5.0" - } - } -} -``` - -terraform.tfvars - -```none -password = "" # password for Ansible SSH -host = "" # IP of my Ansible -access = "" # access_key for AWS -secret = "" # secret_key for AWS -``` - -## Structure of files Ansible for AWS - -```none -. -├── group_vars - └── all -├── ansible.cfg -├── mykey.pem -└── instance.yml -``` - -## File contents of Ansible for AWS - -ansible.cfg - -```none -[defaults] -inventory = /root/aws/ip.txt -host_key_checking= False -private_key_file = /root/aws/awsterraform.pem # check the name -remote_user=vyos -``` - -mykey.pem - -```none -Copy your key.pem from AWS -``` - -instance.yml - -```none -############################################################################## -# About tasks: -# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds -# "Configure general settings for the VyOS hosts group" - make provisioning into AWS VyOS node -# You have to add all necessary cammans of VyOS under the block "lines:" -############################################################################## - - -- name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true -``` - -group_vars/all - -```none -ansible_connection: ansible.netcommon.network_cli -ansible_network_os: vyos.vyos.vyos -ansible_user: vyos -``` - -## Sourse files for AWS from GIT - -All files about the article can be found [here] - -[group]: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html -[here]: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/AWS_terraform_ansible_single_vyos_instance-main -[image]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html -[install]: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli -[link]: https://developer.hashicorp.com/terraform/intro -[pair]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html diff --git a/docs/automation/terraform/md-terraformAZ.md b/docs/automation/terraform/md-terraformAZ.md deleted file mode 100644 index 0e195be9..00000000 --- a/docs/automation/terraform/md-terraformAZ.md +++ /dev/null @@ -1,470 +0,0 @@ ---- -lastproofread: '2024-03-03' ---- - -(terraformaz)= - -# Deploying VyOS in the Azure cloud - -With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the Azure cloud. If necessary, the infrastructure can be removed using terraform. -Also we will make provisioning using Ansible. - -In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the Azure cloud and make provisioning using Ansible. - -## Preparation steps for deploying VyOS on Azure - -How to create a single instance and install your configuration using Terraform+Ansible+Azure -Step by step: - -Azure - -> 1 Create an account with Azure - -Terraform - -> 1 Create an UNIX or Windows instance -> -> 2 Download and install Terraform -> -> 3 Create the folder for example /root/azvyos/ - -```none -mkdir /root/azvyos - - 4 Copy all files into your Terraform project "/root/azvyos" (vyos.tf, var.tf, terraform.tfvars), more detailed see `Structure of files Terrafom for Azure`_ - - 5 Login with Azure using the command -``` - -```none -az login -``` - -2.6 Type the commands : - -```none -cd / -terraform init -``` - -Ansible - -> 1 Create an UNIX instance whenever you want (local, cloud, and so on) -> -> 2 Download and install Ansible -> -> 3 Create the folder for example /root/az/ -> -> 4 Copy all files into your Ansible project "/root/az/" (ansible.cfg, instance.yml,"all"), more detailed see [Structure of files Ansible for Azure] - -Start - -Type the commands on your Terrafom instance: - -```none -cd / -terraform plan -terraform apply -yes -``` - -After executing all the commands you will have your VyOS instance on the Azure cloud with your configuration, it's a very convenient desition. -If you need to delete the instance please type the command: - -```none -terraform destroy -``` - -## Structure of files Terrafom for Azure - -```none -. -├── vyos.tf # The main script -├── var.tf # File for the changing version of Terraform. -└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) -``` - -## File contents of Terrafom for Azure - -vyos.tf - -```none -############################################################################## -# HashiCorp Guide to Using Terraform on Azure -# This Terraform configuration will create the following: -# Resource group with a virtual network and subnet -# An VyOS server without ssh key (only login+password) -############################################################################## - -# Chouse a provider - -provider "azurerm" { - features {} -} - -# Create a resource group. In Azure every resource belongs to a -# resource group. - -resource "azurerm_resource_group" "azure_vyos" { - name = "${var.resource_group}" - location = "${var.location}" -} - -# The next resource is a Virtual Network. - -resource "azurerm_virtual_network" "vnet" { - name = "${var.virtual_network_name}" - location = "${var.location}" - address_space = ["${var.address_space}"] - resource_group_name = "${var.resource_group}" -} - -# Build a subnet to run our VMs in. - -resource "azurerm_subnet" "subnet" { - name = "${var.prefix}subnet" - virtual_network_name = "${azurerm_virtual_network.vnet.name}" - resource_group_name = "${var.resource_group}" - address_prefixes = ["${var.subnet_prefix}"] -} - -############################################################################## -# Build an VyOS VM from the Marketplace -# To finde nessesery image use the command: -# -# az vm image list --offer vyos --all -# -# Now that we have a network, we'll deploy an VyOS server. -# An Azure Virtual Machine has several components. In this example we'll build -# a security group, a network interface, a public ip address, a storage -# account and finally the VM itself. Terraform handles all the dependencies -# automatically, and each resource is named with user-defined variables. -############################################################################## - - -# Security group to allow inbound access on port 22 (ssh) - -resource "azurerm_network_security_group" "vyos-sg" { - name = "${var.prefix}-sg" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - - security_rule { - name = "SSH" - priority = 100 - direction = "Inbound" - access = "Allow" - protocol = "Tcp" - source_port_range = "*" - destination_port_range = "22" - source_address_prefix = "${var.source_network}" - destination_address_prefix = "*" - } -} - -# A network interface. - -resource "azurerm_network_interface" "vyos-nic" { - name = "${var.prefix}vyos-nic" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - - ip_configuration { - name = "${var.prefix}ipconfig" - subnet_id = "${azurerm_subnet.subnet.id}" - private_ip_address_allocation = "Dynamic" - public_ip_address_id = "${azurerm_public_ip.vyos-pip.id}" - } -} - -# Add a public IP address. - -resource "azurerm_public_ip" "vyos-pip" { - name = "${var.prefix}-ip" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - allocation_method = "Dynamic" -} - -# Build a virtual machine. This is a standard VyOS instance from Marketplace. - -resource "azurerm_virtual_machine" "vyos" { - name = "${var.hostname}-vyos" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - vm_size = "${var.vm_size}" - - network_interface_ids = ["${azurerm_network_interface.vyos-nic.id}"] - delete_os_disk_on_termination = "true" - -# To finde an information about the plan use the command: -# az vm image list --offer vyos --all - - plan { - publisher = "sentriumsl" - name = "vyos-1-3" - product = "vyos-1-2-lts-on-azure" - } - - storage_image_reference { - publisher = "${var.image_publisher}" - offer = "${var.image_offer}" - sku = "${var.image_sku}" - version = "${var.image_version}" - } - - storage_os_disk { - name = "${var.hostname}-osdisk" - managed_disk_type = "Standard_LRS" - caching = "ReadWrite" - create_option = "FromImage" - } - - os_profile { - computer_name = "${var.hostname}" - admin_username = "${var.admin_username}" - admin_password = "${var.admin_password}" - } - - os_profile_linux_config { - disable_password_authentication = false - } -} - -data "azurerm_public_ip" "example" { - depends_on = ["azurerm_virtual_machine.vyos"] - name = "vyos-ip" - resource_group_name = "${var.resource_group}" -} -output "public_ip_address" { - value = data.azurerm_public_ip.example.ip_address -} - -# IP of AZ instance copied to a file ip.txt in local system - -resource "local_file" "ip" { - content = data.azurerm_public_ip.example.ip_address - filename = "ip.txt" -} - -#Connecting to the Ansible control node using SSH connection - -resource "null_resource" "nullremote1" { -depends_on = ["azurerm_virtual_machine.vyos"] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} - -# Copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/az/ip.txt" - } -} - -resource "null_resource" "nullremote2" { -depends_on = ["azurerm_virtual_machine.vyos"] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} - -# Command to run ansible playbook on remote Linux OS - -provisioner "remote-exec" { - - inline = [ - "cd /root/az/", - "ansible-playbook instance.yml" -] -} -} -``` - -var.tf - -```none -############################################################################## -# Variables File -# -# Here is where we store the default values for all the variables used in our -# Terraform code. -############################################################################## - -variable "resource_group" { - description = "The name of your Azure Resource Group." - default = "my_resource_group" -} - -variable "prefix" { - description = "This prefix will be included in the name of some resources." - default = "vyos" -} - -variable "hostname" { - description = "Virtual machine hostname. Used for local hostname, DNS, and storage-related names." - default = "vyos_terraform" -} - -variable "location" { - description = "The region where the virtual network is created." - default = "centralus" -} - -variable "virtual_network_name" { - description = "The name for your virtual network." - default = "vnet" -} - -variable "address_space" { - description = "The address space that is used by the virtual network. You can supply more than one address space. Changing this forces a new resource to be created." - default = "10.0.0.0/16" -} - -variable "subnet_prefix" { - description = "The address prefix to use for the subnet." - default = "10.0.10.0/24" -} - -variable "storage_account_tier" { - description = "Defines the storage tier. Valid options are Standard and Premium." - default = "Standard" -} - -variable "storage_replication_type" { - description = "Defines the replication type to use for this storage account. Valid options include LRS, GRS etc." - default = "LRS" -} - -# The most chippers size - -variable "vm_size" { - description = "Specifies the size of the virtual machine." - default = "Standard_B1s" -} - -variable "image_publisher" { - description = "Name of the publisher of the image (az vm image list)" - default = "sentriumsl" -} - -variable "image_offer" { - description = "Name of the offer (az vm image list)" - default = "vyos-1-2-lts-on-azure" -} - -variable "image_sku" { - description = "Image SKU to apply (az vm image list)" - default = "vyos-1-3" -} - -variable "image_version" { - description = "Version of the image to apply (az vm image list)" - default = "1.3.3" -} - -variable "admin_username" { - description = "Administrator user name" - default = "vyos" -} - -variable "admin_password" { - description = "Administrator password" - default = "Vyos0!" -} - -variable "source_network" { - description = "Allow access from this network prefix. Defaults to '*'." - default = "*" -} - -variable "password" { - description = "pass for Ansible" - type = string - sensitive = true -} -variable "host"{ - description = "IP of my Ansible" -} -``` - -terraform.tfvars - -```none -password = "" # password for Ansible SSH -host = "" # IP of my Ansible -``` - -## Structure of files Ansible for Azure - -```none -. -├── group_vars - └── all -├── ansible.cfg -└── instance.yml -``` - -## File contents of Ansible for Azure - -ansible.cfg - -```none -[defaults] -inventory = /root/az/ip.txt -host_key_checking= False -remote_user=vyos -``` - -instance.yml - -```none -############################################################################## -# About tasks: -# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds -# "Configure general settings for the VyOS hosts group" - make provisioning into Azure VyOS node -# You have to add all necessary cammans of VyOS under the block "lines:" -############################################################################## - - -- name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true -``` - -group_vars/all - -```none -ansible_connection: ansible.netcommon.network_cli -ansible_network_os: vyos.vyos.vyos - -# user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf -ansible_user: vyos -ansible_ssh_pass: Vyos0! -``` - -## Sourse files for Azure from GIT - -All files about the article can be found [here] - -[here]: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Azure_terraform_ansible_single_vyos_instance-main diff --git a/docs/automation/terraform/md-terraformGoogle.md b/docs/automation/terraform/md-terraformGoogle.md deleted file mode 100644 index e69de29b..00000000 diff --git a/docs/automation/terraform/md-terraformvSphere.md b/docs/automation/terraform/md-terraformvSphere.md deleted file mode 100644 index 55b9860b..00000000 --- a/docs/automation/terraform/md-terraformvSphere.md +++ /dev/null @@ -1,377 +0,0 @@ ---- -lastproofread: '2024-03-03' ---- - -(terraformvsphere)= - -# Deploying VyOS in the vSphere infrastructure - -With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the vSphere. -Also we will make provisioning using Ansible. - -In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the vSphere cloud and make provisioning using Ansible. - -## Preparation steps for deploying VyOS on vSphere - -How to create a single instance and install your configuration using Terraform+Ansible+vSphere -Step by step: - -vSphere - -> 1 Collect all data in to file "terraform.tfvars" and create resources for example "terraform" - -Terraform - -> 1 Create an UNIX or Windows instance -> -> 2 Download and install Terraform -> -> 3 Create the folder for example /root/vsphereterraform - -```none -mkdir /root/vsphereterraform - - - 4 Copy all files into your Terraform project "/root/vsphereterraform" (vyos.tf, var.tf, terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for vSphere`_ - - 5 Type the commands : -``` - -```none -cd / -terraform init -``` - -Ansible - -> 1 Create an UNIX instance whenever you want (local, cloud, and so on) -> -> 2 Download and install Ansible -> -> 3 Create the folder for example /root/vsphereterraform/ -> -> 4 Copy all files into your Ansible project "/root/vsphereterraform/" (ansible.cfg, instance.yml,"all"), more detailed see [Structure of files Ansible for vSphere] - -Start - -Type the commands on your Terrafom instance: - -```none -cd / -terraform plan -terraform apply -yes -``` - -After executing all the commands you will have your VyOS instance on the vSphere with your configuration, it's a very convenient desition. -If you need to delete the instance please type the command: - -```none -terraform destroy -``` - -## Structure of files Terrafom for vSphere - -```none -. -├── vyos.tf # The main script -├── versions.tf # File for the changing version of Terraform. -├── var.tf # File for the changing version of Terraform. -└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) -``` - -## File contents of Terrafom for vSphere - -vyos.tf - -```none -provider "vsphere" { - user = var.vsphere_user - password = var.vsphere_password - vsphere_server = var.vsphere_server - allow_unverified_ssl = true -} - -data "vsphere_datacenter" "datacenter" { - name = var.datacenter -} - -data "vsphere_datastore" "datastore" { - name = var.datastore - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -data "vsphere_compute_cluster" "cluster" { - name = var.cluster - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -data "vsphere_resource_pool" "default" { - name = format("%s%s", data.vsphere_compute_cluster.cluster.name, "/Resources/terraform") # set as you need - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -data "vsphere_host" "host" { - name = var.host - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -data "vsphere_network" "network" { - name = var.network_name - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -# Deployment of VM from Remote OVF -resource "vsphere_virtual_machine" "vmFromRemoteOvf" { - name = var.remotename - datacenter_id = data.vsphere_datacenter.datacenter.id - datastore_id = data.vsphere_datastore.datastore.id - host_system_id = data.vsphere_host.host.id - resource_pool_id = data.vsphere_resource_pool.default.id - network_interface { - network_id = data.vsphere_network.network.id - } - wait_for_guest_net_timeout = 2 - wait_for_guest_ip_timeout = 2 - - ovf_deploy { - allow_unverified_ssl_cert = true - remote_ovf_url = var.url_ova - disk_provisioning = "thin" - ip_protocol = "IPv4" - ip_allocation_policy = "dhcpPolicy" - ovf_network_map = { - "Network 1" = data.vsphere_network.network.id - "Network 2" = data.vsphere_network.network.id - } - } - vapp { - properties = { - "password" = "12345678", - "local-hostname" = "terraform_vyos" - } - } -} - -output "ip" { - description = "default ip address of the deployed VM" - value = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address -} - -# IP of vSphere instance copied to a file ip.txt in local system - -resource "local_file" "ip" { - content = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address - filename = "ip.txt" -} - -#Connecting to the Ansible control node using SSH connection - -resource "null_resource" "nullremote1" { -depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] -connection { - type = "ssh" - user = "root" - password = var.ansiblepassword - host = var.ansiblehost - -} - -# Copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/vsphere/ip.txt" - } -} - -resource "null_resource" "nullremote2" { -depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] -connection { - type = "ssh" - user = "root" - password = var.ansiblepassword - host = var.ansiblehost -} - -# Command to run ansible playbook on remote Linux OS - -provisioner "remote-exec" { - - inline = [ - "cd /root/vsphere/", - "ansible-playbook instance.yml" -] -} -} -``` - -versions.tf - -```none -# Copyright (c) HashiCorp, Inc. -# SPDX-License-Identifier: MPL-2.0 - -terraform { - required_providers { - vsphere = { - source = "hashicorp/vsphere" - version = "2.4.0" - } - } -} -``` - -var.tf - -```none -# Copyright (c) HashiCorp, Inc. -# SPDX-License-Identifier: MPL-2.0 - -variable "vsphere_server" { - description = "vSphere server" - type = string -} - -variable "vsphere_user" { - description = "vSphere username" - type = string -} - -variable "vsphere_password" { - description = "vSphere password" - type = string - sensitive = true -} - -variable "datacenter" { - description = "vSphere data center" - type = string -} - -variable "cluster" { - description = "vSphere cluster" - type = string -} - -variable "datastore" { - description = "vSphere datastore" - type = string -} - -variable "network_name" { - description = "vSphere network name" - type = string -} - -variable "host" { - description = "name if yor host" - type = string -} - -variable "remotename" { - description = "the name of you VM" - type = string -} - -variable "url_ova" { - description = "the URL to .OVA file or cloude store" - type = string -} - -variable "ansiblepassword" { - description = "Ansible password" - type = string -} - -variable "ansiblehost" { - description = "Ansible host name or IP" - type = string -} -``` - -terraform.tfvars - -```none -vsphere_user = "" -vsphere_password = "" -vsphere_server = "" -datacenter = "" -datastore = "" -cluster = "" -network_name = "" -host = "" -url_ova = "" -ansiblepassword = "" -ansiblehost = "" -remotename = "" -``` - -## Structure of files Ansible for vSphere - -```none -. -├── group_vars - └── all -├── ansible.cfg -└── instance.yml -``` - -## File contents of Ansible for vSphere - -ansible.cfg - -```none -[defaults] -inventory = /root/vsphere/ip.txt -host_key_checking= False -remote_user=vyos -``` - -instance.yml - -```none -############################################################################## -# About tasks: -# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds -# "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node -# You have to add all necessary cammans of VyOS under the block "lines:" -############################################################################## - - -- name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server 8.8.8.8 - save: - true -``` - -group_vars/all - -```none -ansible_connection: ansible.netcommon.network_cli -ansible_network_os: vyos.vyos.vyos - -# user and password gets from terraform variables "admin_username" and "admin_password" -ansible_user: vyos -# get from vyos.tf "vapp" -ansible_ssh_pass: 12345678 -``` - -## Sourse files for vSphere from GIT - -All files about the article can be found [here] - -[here]: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Vsphere_terraform_ansible_single_vyos_instance-main diff --git a/docs/automation/terraform/md-terraformvyos.md b/docs/automation/terraform/md-terraformvyos.md deleted file mode 100644 index cb1ca1ee..00000000 --- a/docs/automation/terraform/md-terraformvyos.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -lastproofread: '2024-03-03' ---- - -(terraformvyos)= - -# Terraform for VyOS - -VyOS supports development infrastructure via Terraform and provisioning via Ansible. -Terraform allows you to automate the process of deploying instances on many cloud and virtual platforms. -In this article, we will look at using terraforms to deploy VyOS on platforms - AWS, Azure, and vSphere. -For more details about Terraform please have a look here [link]. - -Need to [install] Terraform - -Structure of files in the standard Terraform project: - -```none -. -├── main.tf # The main script -├── version.tf # File for the changing version of Terraform. -├── variables.tf # The file of all variables in "main.tf" -└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) -``` - -General commands that we will use for running Terraform scripts - -```none -cd / # go to the Terrafom project -terraform init # install all addons and provider (aws az and so on) -terraform plan # show what is changing -terraform apply # run script -yes # apply running -``` - -[install]: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli -[link]: https://developer.hashicorp.com/terraform/intro diff --git a/docs/automation/terraform/rst-index.rst b/docs/automation/terraform/rst-index.rst new file mode 100644 index 00000000..42af58bd --- /dev/null +++ b/docs/automation/terraform/rst-index.rst @@ -0,0 +1,14 @@ +############## +VyOS Terraform +############## + +.. toctree:: + :maxdepth: 1 + :caption: Content + + terraformvyos + terraformAWS + terraformAZ + terraformvSphere + terraformGoogle + diff --git a/docs/automation/terraform/rst-terraformAWS.rst b/docs/automation/terraform/rst-terraformAWS.rst new file mode 100644 index 00000000..e068377d --- /dev/null +++ b/docs/automation/terraform/rst-terraformAWS.rst @@ -0,0 +1,547 @@ +:lastproofread: 2024-01-11 + +.. _terraformAWS: + +Deploying VyOS in the AWS cloud +=============================== + +With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the AWS cloud. If necessary, the infrastructure can be removed using terraform. +Also we will make provisioning using Ansible. + + +.. image:: /_static/images/aws.png + :width: 50% + :align: center + :alt: Network Topology Diagram + +In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the AWS cloud and make provisioning using Ansible. + + +Preparation steps for deploying VyOS on AWS +------------------------------------------- + +How to create a single instance and install your configuration using Terraform+Ansible+AWS +Step by step: + +AWS + + +1 Create an account with AWS and get your "access_key", "secret key" + +2 Create a key pair_ and download your .pem key + +.. image:: /_static/images/keypairs.png + :width: 50% + :align: center + :alt: Network Topology Diagram + +3 Create a security group_ for the new VyOS instance and open all traffic + +.. image:: /_static/images/sg.png + :width: 50% + :align: center + :alt: Network Topology Diagram + + +.. image:: /_static/images/traffic.png + :width: 50% + :align: center + :alt: Network Topology Diagram + +Terraform + + + 1 Create an UNIX or Windows instance + + 2 Download and install Terraform + + 3 Create the folder for example /root/awsterraform + +.. code-block:: none + + mkdir /root/awsterraform + + 4 Copy all files into your Terraform project "/root/awsterraform" (vyos.tf, var.tf, terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for AWS`_ + + 5 Type the commands : + +.. code-block:: none + + cd / + terraform init + + +Ansible + + + 1 Create an UNIX instance whenever you want (local, cloud, and so on) + + 2 Download and install Ansible + + 3 Create the folder for example /root/aws/ + + 4 Copy all files into your Ansible project "/root/aws/" (ansible.cfg, instance.yml, mykey.pem and "all"), more detailed see `Structure of files Ansible for AWS`_ + +mykey.pem you have to get using step 1.2 + + +Start + + +Type the commands on your Terrafom instance: + +.. code-block:: none + + cd / + terraform plan + terraform apply + yes + + +Start creating an AWS instance and check the result +--------------------------------------------------- + +.. code-block:: none + + root@localhost:~/awsterraform# terraform apply + + Terraform used the selected providers to generate the following execution plan. + Resource actions are indicated with the following symbols: + + create + + Terraform will perform the following actions: + + # aws_instance.myVyOSec2 will be created + + resource "aws_instance" "myVyOSec2" { + + ami = "ami-************62c2d" + + arn = (known after apply) + + associate_public_ip_address = (known after apply) + + availability_zone = (known after apply) + + cpu_core_count = (known after apply) + + cpu_threads_per_core = (known after apply) + + disable_api_stop = (known after apply) + + disable_api_termination = (known after apply) + + ebs_optimized = (known after apply) + + get_password_data = false + + host_id = (known after apply) + + host_resource_group_arn = (known after apply) + + iam_instance_profile = (known after apply) + + id = (known after apply) + + instance_initiated_shutdown_behavior = (known after apply) + + instance_lifecycle = (known after apply) + + instance_state = (known after apply) + + instance_type = "t2.micro" + + ipv6_address_count = (known after apply) + + ipv6_addresses = (known after apply) + + key_name = "awsterraform" + + monitoring = (known after apply) + + outpost_arn = (known after apply) + + password_data = (known after apply) + + placement_group = (known after apply) + + placement_partition_number = (known after apply) + + primary_network_interface_id = (known after apply) + + private_dns = (known after apply) + + private_ip = (known after apply) + + public_dns = (known after apply) + + public_ip = (known after apply) + + secondary_private_ips = (known after apply) + + security_groups = [ + + "awsterraformsg", + ] + + source_dest_check = true + + spot_instance_request_id = (known after apply) + + subnet_id = (known after apply) + + tags = { + + "name" = "VyOS System" + } + + tags_all = { + + "name" = "VyOS System" + } + + tenancy = (known after apply) + + user_data = (known after apply) + + user_data_base64 = (known after apply) + + user_data_replace_on_change = false + + vpc_security_group_ids = (known after apply) + } + + # local_file.ip will be created + + resource "local_file" "ip" { + + content = (known after apply) + + content_base64sha256 = (known after apply) + + content_base64sha512 = (known after apply) + + content_md5 = (known after apply) + + content_sha1 = (known after apply) + + content_sha256 = (known after apply) + + content_sha512 = (known after apply) + + directory_permission = "0777" + + file_permission = "0777" + + filename = "ip.txt" + + id = (known after apply) + } + + # null_resource.SSHconnection1 will be created + + resource "null_resource" "SSHconnection1" { + + id = (known after apply) + } + + # null_resource.SSHconnection2 will be created + + resource "null_resource" "SSHconnection2" { + + id = (known after apply) + } + + Plan: 4 to add, 0 to change, 0 to destroy. + + Changes to Outputs: + + my_IP = (known after apply) + + Do you want to perform these actions? + Terraform will perform the actions described above. + Only 'yes' will be accepted to approve. + + Enter a value: yes + + aws_instance.myVyOSec2: Creating... + aws_instance.myVyOSec2: Still creating... [10s elapsed] + aws_instance.myVyOSec2: Still creating... [20s elapsed] + aws_instance.myVyOSec2: Still creating... [30s elapsed] + aws_instance.myVyOSec2: Still creating... [40s elapsed] + aws_instance.myVyOSec2: Creation complete after 44s [id=i-09edfca15aac2fe0a] + null_resource.SSHconnection1: Creating... + null_resource.SSHconnection2: Creating... + null_resource.SSHconnection1: Provisioning with 'file'... + null_resource.SSHconnection2: Provisioning with 'remote-exec'... + null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... + null_resource.SSHconnection2 (remote-exec): Host: 10.217.80.104 + null_resource.SSHconnection2 (remote-exec): User: root + null_resource.SSHconnection2 (remote-exec): Password: true + null_resource.SSHconnection2 (remote-exec): Private key: false + null_resource.SSHconnection2 (remote-exec): Certificate: false + null_resource.SSHconnection2 (remote-exec): SSH Agent: false + null_resource.SSHconnection2 (remote-exec): Checking Host Key: false + null_resource.SSHconnection2 (remote-exec): Target Platform: unix + local_file.ip: Creating... + local_file.ip: Creation complete after 0s [id=e8e91f2e24579cd28b92e2d152c0c24c3bf4b52c] + null_resource.SSHconnection2 (remote-exec): Connected! + null_resource.SSHconnection1: Creation complete after 0s [id=7070868940858935600] + + null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ + + null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** + null_resource.SSHconnection2: Still creating... [10s elapsed] + null_resource.SSHconnection2: Still creating... [20s elapsed] + null_resource.SSHconnection2: Still creating... [30s elapsed] + null_resource.SSHconnection2: Still creating... [40s elapsed] + null_resource.SSHconnection2: Still creating... [50s elapsed] + null_resource.SSHconnection2: Still creating... [1m0s elapsed] + null_resource.SSHconnection2 (remote-exec): ok: [54.xxx.xxx.xxx] + + null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* + null_resource.SSHconnection2: Still creating... [1m10s elapsed] + null_resource.SSHconnection2 (remote-exec): changed: [54.xxx.xxx.xxx] + + null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* + null_resource.SSHconnection2 (remote-exec): 54.xxx.xxx.xxx : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + + null_resource.SSHconnection2: Creation complete after 1m16s [id=4902256962410024771] + + Apply complete! Resources: 4 added, 0 changed, 0 destroyed. + + Outputs: + + my_IP = "54.xxx.xxx.xxx" + + + +After executing all the commands you will have your VyOS instance on the AWS cloud with your configuration, it's a very convenient desition. +If you need to delete the instance please type the command: + +.. code-block:: none + + terraform destroy + + +Troubleshooting +--------------- + +1 Ansible doesn't connect via SSH to your AWS instance: you have to check that your SSH key has copied into the path /root/aws/. +Also, increase the time in the file instance.yml from 300 sec to 500 sec or more. (It depends on your location). +Make sure that you have opened access to the instance in the security group. + + 2 Terraform doesn't connect via SSH to your Ansible instance: you have to check the correct login and password in the part of the file VyOS. tf + +.. code-block:: none + + connection { + type = "ssh" + user = "root" # open root access using login and password on your Ansible + password = var.password # check password in the file terraform.tfvars isn't empty + host = var.host # check the correct IP address of your Ansible host + } + + +Make sure that Ansible is pinging from Terrafom. + +Structure of files Terrafom for AWS +----------------------------------- + +.. code-block:: none + + . + ├── vyos.tf # The main script + ├── var.tf # The file of all variables in "vyos.tf" + ├── versions.tf # File for the changing version of Terraform. + └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) + + + +File contents of Terrafom for AWS +--------------------------------- + +vyos.tf + +.. code-block:: none + + + ############################################################################## + # Build an VyOS VM from the Marketplace + # To finde nessesery AMI image_ in AWS + # + # In the script vyos.tf we'll use default values (you can chang it as you need) + # AWS Region = "us-east-1" + # AMI = "standard AMI of VyOS from AWS Marketplace" + # Size of VM = "t2.micro" + # AWS Region = "us-east-1" + # After deploying the AWS instance and getting an IP address, the IP address is copied into the file + #"ip.txt" and copied to the Ansible node for provisioning. + ############################################################################## + + provider "aws" { + access_key = var.access + secret_key = var.secret + region = var.region + } + + variable "region" { + default = "us-east-1" + description = "AWS Region" + } + + variable "ami" { + default = "ami-**************3b3" # ami image please enter your details + description = "Amazon Machine Image ID for VyOS" + } + + variable "type" { + default = "t2.micro" + description = "Size of VM" + } + + # my resource for VyOS + + resource "aws_instance" "myVyOSec2" { + ami = var.ami + key_name = "awsterraform" # Please enter your details from 1.2 of Preparation steps for deploying VyOS on AWS + security_groups = ["awsterraformsg"] # Please enter your details from 1.3 of Preparation steps for deploying VyOS on AWS + instance_type = var.type + tags = { + name = "VyOS System" + } + } + + ############################################################################## + # specific variable (to getting type "terraform plan"): + # aws_instance.myVyOSec2.public_ip - the information about public IP address + # of our instance, needs for provisioning and ssh connection from Ansible + ############################################################################## + + output "my_IP"{ + value = aws_instance.myVyOSec2.public_ip + } + + ############################################################################## + # + # IP of aws instance copied to a file ip.txt in local system Terraform + # ip.txt looks like: + # cat ./ip.txt + # ххх.ххх.ххх.ххх + ############################################################################## + + resource "local_file" "ip" { + content = aws_instance.myVyOSec2.public_ip + filename = "ip.txt" + } + + #connecting to the Ansible control node using SSH connection + + ############################################################################## + # Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform node and start remotely the playbook of Ansible. + ############################################################################## + + resource "null_resource" "SSHconnection1" { + depends_on = [aws_instance.myVyOSec2] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + + #copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/aws/ip.txt" # The folder of your Ansible project + } + } + + resource "null_resource" "SSHconnection2" { + depends_on = [aws_instance.myVyOSec2] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + #command to run Ansible playbook on remote Linux OS + provisioner "remote-exec" { + inline = [ + "cd /root/aws/", + "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for AWS" + ] + } + } + + +var.tf + +.. code-block:: none + + variable "password" { + description = "pass for Ansible" + type = string + sensitive = true + } + variable "host"{ + description = "The IP of my Ansible" + type = string + } + variable "access" { + description = "my access_key for AWS" + type = string + sensitive = true + } + variable "secret" { + description = "my secret_key for AWS" + type = string + sensitive = true + } + +versions.tf + +.. code-block:: none + + terraform { + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.0" + } + } + } + +terraform.tfvars + +.. code-block:: none + + password = "" # password for Ansible SSH + host = "" # IP of my Ansible + access = "" # access_key for AWS + secret = "" # secret_key for AWS + + +Structure of files Ansible for AWS +---------------------------------- + +.. code-block:: none + + . + ├── group_vars + └── all + ├── ansible.cfg + ├── mykey.pem + └── instance.yml + + +File contents of Ansible for AWS +-------------------------------- + +ansible.cfg + +.. code-block:: none + + [defaults] + inventory = /root/aws/ip.txt + host_key_checking= False + private_key_file = /root/aws/awsterraform.pem # check the name + remote_user=vyos + +mykey.pem + +.. code-block:: none + + Copy your key.pem from AWS + + +instance.yml + + + +.. code-block:: none + + ############################################################################## + # About tasks: + # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds + # "Configure general settings for the VyOS hosts group" - make provisioning into AWS VyOS node + # You have to add all necessary cammans of VyOS under the block "lines:" + ############################################################################## + + + - name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true + + +group_vars/all + +.. code-block:: none + + ansible_connection: ansible.netcommon.network_cli + ansible_network_os: vyos.vyos.vyos + ansible_user: vyos + +Sourse files for AWS from GIT +----------------------------- + +All files about the article can be found here_ + + +.. _link: https://developer.hashicorp.com/terraform/intro +.. _install: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli +.. _pair: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html +.. _group: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html +.. _image: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html +.. _here: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/AWS_terraform_ansible_single_vyos_instance-main \ No newline at end of file diff --git a/docs/automation/terraform/rst-terraformAZ.rst b/docs/automation/terraform/rst-terraformAZ.rst new file mode 100644 index 00000000..a0fea023 --- /dev/null +++ b/docs/automation/terraform/rst-terraformAZ.rst @@ -0,0 +1,488 @@ +:lastproofread: 2024-03-03 + +.. _terraformAZ: + +Deploying VyOS in the Azure cloud +================================= + +With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the Azure cloud. If necessary, the infrastructure can be removed using terraform. +Also we will make provisioning using Ansible. + +In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the Azure cloud and make provisioning using Ansible. + +Preparation steps for deploying VyOS on Azure +--------------------------------------------- + +How to create a single instance and install your configuration using Terraform+Ansible+Azure +Step by step: + +Azure + + 1 Create an account with Azure + +Terraform + + + 1 Create an UNIX or Windows instance + + 2 Download and install Terraform + + 3 Create the folder for example /root/azvyos/ + +.. code-block:: none + + mkdir /root/azvyos + + 4 Copy all files into your Terraform project "/root/azvyos" (vyos.tf, var.tf, terraform.tfvars), more detailed see `Structure of files Terrafom for Azure`_ + + 5 Login with Azure using the command + +.. code-block:: none + + az login + +2.6 Type the commands : + +.. code-block:: none + + cd / + terraform init + +Ansible + + + 1 Create an UNIX instance whenever you want (local, cloud, and so on) + + 2 Download and install Ansible + + 3 Create the folder for example /root/az/ + + 4 Copy all files into your Ansible project "/root/az/" (ansible.cfg, instance.yml,"all"), more detailed see `Structure of files Ansible for Azure`_ + + +Start + + +Type the commands on your Terrafom instance: + +.. code-block:: none + + cd / + terraform plan + terraform apply + yes + +After executing all the commands you will have your VyOS instance on the Azure cloud with your configuration, it's a very convenient desition. +If you need to delete the instance please type the command: + +.. code-block:: none + + terraform destroy + +Structure of files Terrafom for Azure +------------------------------------- + +.. code-block:: none + + . + ├── vyos.tf # The main script + ├── var.tf # File for the changing version of Terraform. + └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) + +File contents of Terrafom for Azure +----------------------------------- + +vyos.tf + +.. code-block:: none + + + ############################################################################## + # HashiCorp Guide to Using Terraform on Azure + # This Terraform configuration will create the following: + # Resource group with a virtual network and subnet + # An VyOS server without ssh key (only login+password) + ############################################################################## + + # Chouse a provider + + provider "azurerm" { + features {} + } + + # Create a resource group. In Azure every resource belongs to a + # resource group. + + resource "azurerm_resource_group" "azure_vyos" { + name = "${var.resource_group}" + location = "${var.location}" + } + + # The next resource is a Virtual Network. + + resource "azurerm_virtual_network" "vnet" { + name = "${var.virtual_network_name}" + location = "${var.location}" + address_space = ["${var.address_space}"] + resource_group_name = "${var.resource_group}" + } + + # Build a subnet to run our VMs in. + + resource "azurerm_subnet" "subnet" { + name = "${var.prefix}subnet" + virtual_network_name = "${azurerm_virtual_network.vnet.name}" + resource_group_name = "${var.resource_group}" + address_prefixes = ["${var.subnet_prefix}"] + } + + ############################################################################## + # Build an VyOS VM from the Marketplace + # To finde nessesery image use the command: + # + # az vm image list --offer vyos --all + # + # Now that we have a network, we'll deploy an VyOS server. + # An Azure Virtual Machine has several components. In this example we'll build + # a security group, a network interface, a public ip address, a storage + # account and finally the VM itself. Terraform handles all the dependencies + # automatically, and each resource is named with user-defined variables. + ############################################################################## + + + # Security group to allow inbound access on port 22 (ssh) + + resource "azurerm_network_security_group" "vyos-sg" { + name = "${var.prefix}-sg" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + + security_rule { + name = "SSH" + priority = 100 + direction = "Inbound" + access = "Allow" + protocol = "Tcp" + source_port_range = "*" + destination_port_range = "22" + source_address_prefix = "${var.source_network}" + destination_address_prefix = "*" + } + } + + # A network interface. + + resource "azurerm_network_interface" "vyos-nic" { + name = "${var.prefix}vyos-nic" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + + ip_configuration { + name = "${var.prefix}ipconfig" + subnet_id = "${azurerm_subnet.subnet.id}" + private_ip_address_allocation = "Dynamic" + public_ip_address_id = "${azurerm_public_ip.vyos-pip.id}" + } + } + + # Add a public IP address. + + resource "azurerm_public_ip" "vyos-pip" { + name = "${var.prefix}-ip" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + allocation_method = "Dynamic" + } + + # Build a virtual machine. This is a standard VyOS instance from Marketplace. + + resource "azurerm_virtual_machine" "vyos" { + name = "${var.hostname}-vyos" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + vm_size = "${var.vm_size}" + + network_interface_ids = ["${azurerm_network_interface.vyos-nic.id}"] + delete_os_disk_on_termination = "true" + + # To finde an information about the plan use the command: + # az vm image list --offer vyos --all + + plan { + publisher = "sentriumsl" + name = "vyos-1-3" + product = "vyos-1-2-lts-on-azure" + } + + storage_image_reference { + publisher = "${var.image_publisher}" + offer = "${var.image_offer}" + sku = "${var.image_sku}" + version = "${var.image_version}" + } + + storage_os_disk { + name = "${var.hostname}-osdisk" + managed_disk_type = "Standard_LRS" + caching = "ReadWrite" + create_option = "FromImage" + } + + os_profile { + computer_name = "${var.hostname}" + admin_username = "${var.admin_username}" + admin_password = "${var.admin_password}" + } + + os_profile_linux_config { + disable_password_authentication = false + } + } + + data "azurerm_public_ip" "example" { + depends_on = ["azurerm_virtual_machine.vyos"] + name = "vyos-ip" + resource_group_name = "${var.resource_group}" + } + output "public_ip_address" { + value = data.azurerm_public_ip.example.ip_address + } + + # IP of AZ instance copied to a file ip.txt in local system + + resource "local_file" "ip" { + content = data.azurerm_public_ip.example.ip_address + filename = "ip.txt" + } + + #Connecting to the Ansible control node using SSH connection + + resource "null_resource" "nullremote1" { + depends_on = ["azurerm_virtual_machine.vyos"] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + + # Copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/az/ip.txt" + } + } + + resource "null_resource" "nullremote2" { + depends_on = ["azurerm_virtual_machine.vyos"] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + + # Command to run ansible playbook on remote Linux OS + + provisioner "remote-exec" { + + inline = [ + "cd /root/az/", + "ansible-playbook instance.yml" + ] + } + } + + +var.tf + +.. code-block:: none + + ############################################################################## + # Variables File + # + # Here is where we store the default values for all the variables used in our + # Terraform code. + ############################################################################## + + variable "resource_group" { + description = "The name of your Azure Resource Group." + default = "my_resource_group" + } + + variable "prefix" { + description = "This prefix will be included in the name of some resources." + default = "vyos" + } + + variable "hostname" { + description = "Virtual machine hostname. Used for local hostname, DNS, and storage-related names." + default = "vyos_terraform" + } + + variable "location" { + description = "The region where the virtual network is created." + default = "centralus" + } + + variable "virtual_network_name" { + description = "The name for your virtual network." + default = "vnet" + } + + variable "address_space" { + description = "The address space that is used by the virtual network. You can supply more than one address space. Changing this forces a new resource to be created." + default = "10.0.0.0/16" + } + + variable "subnet_prefix" { + description = "The address prefix to use for the subnet." + default = "10.0.10.0/24" + } + + variable "storage_account_tier" { + description = "Defines the storage tier. Valid options are Standard and Premium." + default = "Standard" + } + + variable "storage_replication_type" { + description = "Defines the replication type to use for this storage account. Valid options include LRS, GRS etc." + default = "LRS" + } + + # The most chippers size + + variable "vm_size" { + description = "Specifies the size of the virtual machine." + default = "Standard_B1s" + } + + variable "image_publisher" { + description = "Name of the publisher of the image (az vm image list)" + default = "sentriumsl" + } + + variable "image_offer" { + description = "Name of the offer (az vm image list)" + default = "vyos-1-2-lts-on-azure" + } + + variable "image_sku" { + description = "Image SKU to apply (az vm image list)" + default = "vyos-1-3" + } + + variable "image_version" { + description = "Version of the image to apply (az vm image list)" + default = "1.3.3" + } + + variable "admin_username" { + description = "Administrator user name" + default = "vyos" + } + + variable "admin_password" { + description = "Administrator password" + default = "Vyos0!" + } + + variable "source_network" { + description = "Allow access from this network prefix. Defaults to '*'." + default = "*" + } + + variable "password" { + description = "pass for Ansible" + type = string + sensitive = true + } + variable "host"{ + description = "IP of my Ansible" + } + +terraform.tfvars + +.. code-block:: none + + password = "" # password for Ansible SSH + host = "" # IP of my Ansible + + +Structure of files Ansible for Azure +------------------------------------ + +.. code-block:: none + + . + ├── group_vars + └── all + ├── ansible.cfg + └── instance.yml + + +File contents of Ansible for Azure +---------------------------------- + +ansible.cfg + +.. code-block:: none + + [defaults] + inventory = /root/az/ip.txt + host_key_checking= False + remote_user=vyos + + +instance.yml + + +.. code-block:: none + + ############################################################################## + # About tasks: + # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds + # "Configure general settings for the VyOS hosts group" - make provisioning into Azure VyOS node + # You have to add all necessary cammans of VyOS under the block "lines:" + ############################################################################## + + + - name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true + + +group_vars/all + +.. code-block:: none + + ansible_connection: ansible.netcommon.network_cli + ansible_network_os: vyos.vyos.vyos + + # user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf + ansible_user: vyos + ansible_ssh_pass: Vyos0! + +Sourse files for Azure from GIT +------------------------------- + +All files about the article can be found here_ + +.. _here: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Azure_terraform_ansible_single_vyos_instance-main + + diff --git a/docs/automation/terraform/rst-terraformGoogle.rst b/docs/automation/terraform/rst-terraformGoogle.rst new file mode 100644 index 00000000..e69de29b diff --git a/docs/automation/terraform/rst-terraformvSphere.rst b/docs/automation/terraform/rst-terraformvSphere.rst new file mode 100644 index 00000000..5d39261b --- /dev/null +++ b/docs/automation/terraform/rst-terraformvSphere.rst @@ -0,0 +1,400 @@ +:lastproofread: 2024-03-03 + +.. _terraformvSphere: + +Deploying VyOS in the vSphere infrastructure +============================================ + +With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the vSphere. +Also we will make provisioning using Ansible. + +In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the vSphere cloud and make provisioning using Ansible. + +Preparation steps for deploying VyOS on vSphere +----------------------------------------------- + +How to create a single instance and install your configuration using Terraform+Ansible+vSphere +Step by step: + + +vSphere + + + 1 Collect all data in to file "terraform.tfvars" and create resources for example "terraform" + + +Terraform + + + 1 Create an UNIX or Windows instance + + 2 Download and install Terraform + + 3 Create the folder for example /root/vsphereterraform + +.. code-block:: none + + mkdir /root/vsphereterraform + + + 4 Copy all files into your Terraform project "/root/vsphereterraform" (vyos.tf, var.tf, terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for vSphere`_ + + 5 Type the commands : + +.. code-block:: none + + cd / + terraform init + + +Ansible + + + 1 Create an UNIX instance whenever you want (local, cloud, and so on) + + 2 Download and install Ansible + + 3 Create the folder for example /root/vsphereterraform/ + + 4 Copy all files into your Ansible project "/root/vsphereterraform/" (ansible.cfg, instance.yml,"all"), more detailed see `Structure of files Ansible for vSphere`_ + + +Start + + +Type the commands on your Terrafom instance: + +.. code-block:: none + + cd / + terraform plan + terraform apply + yes + + +After executing all the commands you will have your VyOS instance on the vSphere with your configuration, it's a very convenient desition. +If you need to delete the instance please type the command: + +.. code-block:: none + + terraform destroy + + +Structure of files Terrafom for vSphere +--------------------------------------- + +.. code-block:: none + + . + ├── vyos.tf # The main script + ├── versions.tf # File for the changing version of Terraform. + ├── var.tf # File for the changing version of Terraform. + └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) + + +File contents of Terrafom for vSphere +------------------------------------- + +vyos.tf + +.. code-block:: none + + provider "vsphere" { + user = var.vsphere_user + password = var.vsphere_password + vsphere_server = var.vsphere_server + allow_unverified_ssl = true + } + + data "vsphere_datacenter" "datacenter" { + name = var.datacenter + } + + data "vsphere_datastore" "datastore" { + name = var.datastore + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + data "vsphere_compute_cluster" "cluster" { + name = var.cluster + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + data "vsphere_resource_pool" "default" { + name = format("%s%s", data.vsphere_compute_cluster.cluster.name, "/Resources/terraform") # set as you need + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + data "vsphere_host" "host" { + name = var.host + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + data "vsphere_network" "network" { + name = var.network_name + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + # Deployment of VM from Remote OVF + resource "vsphere_virtual_machine" "vmFromRemoteOvf" { + name = var.remotename + datacenter_id = data.vsphere_datacenter.datacenter.id + datastore_id = data.vsphere_datastore.datastore.id + host_system_id = data.vsphere_host.host.id + resource_pool_id = data.vsphere_resource_pool.default.id + network_interface { + network_id = data.vsphere_network.network.id + } + wait_for_guest_net_timeout = 2 + wait_for_guest_ip_timeout = 2 + + ovf_deploy { + allow_unverified_ssl_cert = true + remote_ovf_url = var.url_ova + disk_provisioning = "thin" + ip_protocol = "IPv4" + ip_allocation_policy = "dhcpPolicy" + ovf_network_map = { + "Network 1" = data.vsphere_network.network.id + "Network 2" = data.vsphere_network.network.id + } + } + vapp { + properties = { + "password" = "12345678", + "local-hostname" = "terraform_vyos" + } + } + } + + output "ip" { + description = "default ip address of the deployed VM" + value = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address + } + + # IP of vSphere instance copied to a file ip.txt in local system + + resource "local_file" "ip" { + content = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address + filename = "ip.txt" + } + + #Connecting to the Ansible control node using SSH connection + + resource "null_resource" "nullremote1" { + depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] + connection { + type = "ssh" + user = "root" + password = var.ansiblepassword + host = var.ansiblehost + + } + + # Copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/vsphere/ip.txt" + } + } + + resource "null_resource" "nullremote2" { + depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] + connection { + type = "ssh" + user = "root" + password = var.ansiblepassword + host = var.ansiblehost + } + + # Command to run ansible playbook on remote Linux OS + + provisioner "remote-exec" { + + inline = [ + "cd /root/vsphere/", + "ansible-playbook instance.yml" + ] + } + } + + +versions.tf + +.. code-block:: none + + # Copyright (c) HashiCorp, Inc. + # SPDX-License-Identifier: MPL-2.0 + + terraform { + required_providers { + vsphere = { + source = "hashicorp/vsphere" + version = "2.4.0" + } + } + } + +var.tf + +.. code-block:: none + + # Copyright (c) HashiCorp, Inc. + # SPDX-License-Identifier: MPL-2.0 + + variable "vsphere_server" { + description = "vSphere server" + type = string + } + + variable "vsphere_user" { + description = "vSphere username" + type = string + } + + variable "vsphere_password" { + description = "vSphere password" + type = string + sensitive = true + } + + variable "datacenter" { + description = "vSphere data center" + type = string + } + + variable "cluster" { + description = "vSphere cluster" + type = string + } + + variable "datastore" { + description = "vSphere datastore" + type = string + } + + variable "network_name" { + description = "vSphere network name" + type = string + } + + variable "host" { + description = "name if yor host" + type = string + } + + variable "remotename" { + description = "the name of you VM" + type = string + } + + variable "url_ova" { + description = "the URL to .OVA file or cloude store" + type = string + } + + variable "ansiblepassword" { + description = "Ansible password" + type = string + } + + variable "ansiblehost" { + description = "Ansible host name or IP" + type = string + } + +terraform.tfvars + +.. code-block:: none + + vsphere_user = "" + vsphere_password = "" + vsphere_server = "" + datacenter = "" + datastore = "" + cluster = "" + network_name = "" + host = "" + url_ova = "" + ansiblepassword = "" + ansiblehost = "" + remotename = "" + + +Structure of files Ansible for vSphere +-------------------------------------- + +.. code-block:: none + + . + ├── group_vars + └── all + ├── ansible.cfg + └── instance.yml + + +File contents of Ansible for vSphere +------------------------------------ + +ansible.cfg + +.. code-block:: none + + [defaults] + inventory = /root/vsphere/ip.txt + host_key_checking= False + remote_user=vyos + + +instance.yml + +.. code-block:: none + + ############################################################################## + # About tasks: + # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds + # "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node + # You have to add all necessary cammans of VyOS under the block "lines:" + ############################################################################## + + + - name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server 8.8.8.8 + save: + true + + +group_vars/all + +.. code-block:: none + + ansible_connection: ansible.netcommon.network_cli + ansible_network_os: vyos.vyos.vyos + + # user and password gets from terraform variables "admin_username" and "admin_password" + ansible_user: vyos + # get from vyos.tf "vapp" + ansible_ssh_pass: 12345678 + + +Sourse files for vSphere from GIT +--------------------------------- + +All files about the article can be found here_ + +.. _here: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Vsphere_terraform_ansible_single_vyos_instance-main + diff --git a/docs/automation/terraform/rst-terraformvyos.rst b/docs/automation/terraform/rst-terraformvyos.rst new file mode 100644 index 00000000..42dc7492 --- /dev/null +++ b/docs/automation/terraform/rst-terraformvyos.rst @@ -0,0 +1,39 @@ +:lastproofread: 2024-03-03 + +.. _terraformvyos: + +Terraform for VyOS +================== + +VyOS supports development infrastructure via Terraform and provisioning via Ansible. +Terraform allows you to automate the process of deploying instances on many cloud and virtual platforms. +In this article, we will look at using terraforms to deploy VyOS on platforms - AWS, Azure, and vSphere. +For more details about Terraform please have a look here link_. + +Need to install_ Terraform + +Structure of files in the standard Terraform project: + +.. code-block:: none + + . + ├── main.tf # The main script + ├── version.tf # File for the changing version of Terraform. + ├── variables.tf # The file of all variables in "main.tf" + └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) + + +General commands that we will use for running Terraform scripts + + +.. code-block:: none + + cd / # go to the Terrafom project + terraform init # install all addons and provider (aws az and so on) + terraform plan # show what is changing + terraform apply # run script + yes # apply running + + +.. _link: https://developer.hashicorp.com/terraform/intro +.. _install: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli \ No newline at end of file diff --git a/docs/automation/terraform/terraformAWS.md b/docs/automation/terraform/terraformAWS.md new file mode 100644 index 00000000..4a29fba3 --- /dev/null +++ b/docs/automation/terraform/terraformAWS.md @@ -0,0 +1,519 @@ +--- +lastproofread: '2024-01-11' +--- + +(terraformaws)= + +# Deploying VyOS in the AWS cloud + +With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the AWS cloud. If necessary, the infrastructure can be removed using terraform. +Also we will make provisioning using Ansible. + +```{image} /_static/images/aws.png +:align: center +:alt: Network Topology Diagram +:width: 50% +``` + +In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the AWS cloud and make provisioning using Ansible. + +## Preparation steps for deploying VyOS on AWS + +How to create a single instance and install your configuration using Terraform+Ansible+AWS +Step by step: + +AWS + +1 Create an account with AWS and get your "access_key", "secret key" + +2 Create a key [pair] and download your .pem key + +```{image} /_static/images/keypairs.png +:align: center +:alt: Network Topology Diagram +:width: 50% +``` + +3 Create a security [group] for the new VyOS instance and open all traffic + +```{image} /_static/images/sg.png +:align: center +:alt: Network Topology Diagram +:width: 50% +``` + +```{image} /_static/images/traffic.png +:align: center +:alt: Network Topology Diagram +:width: 50% +``` + +Terraform + +> 1 Create an UNIX or Windows instance +> +> 2 Download and install Terraform +> +> 3 Create the folder for example /root/awsterraform + +```none +mkdir /root/awsterraform + + 4 Copy all files into your Terraform project "/root/awsterraform" (vyos.tf, var.tf, terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for AWS`_ + + 5 Type the commands : +``` + +```none +cd / +terraform init +``` + +Ansible + +> 1 Create an UNIX instance whenever you want (local, cloud, and so on) +> +> 2 Download and install Ansible +> +> 3 Create the folder for example /root/aws/ +> +> 4 Copy all files into your Ansible project "/root/aws/" (ansible.cfg, instance.yml, mykey.pem and "all"), more detailed see [Structure of files Ansible for AWS] + +mykey.pem you have to get using step 1.2 + +Start + +Type the commands on your Terrafom instance: + +```none +cd / +terraform plan +terraform apply +yes +``` + +## Start creating an AWS instance and check the result + +```none +root@localhost:~/awsterraform# terraform apply + +Terraform used the selected providers to generate the following execution plan. +Resource actions are indicated with the following symbols: + + create + +Terraform will perform the following actions: + + # aws_instance.myVyOSec2 will be created + + resource "aws_instance" "myVyOSec2" { + + ami = "ami-************62c2d" + + arn = (known after apply) + + associate_public_ip_address = (known after apply) + + availability_zone = (known after apply) + + cpu_core_count = (known after apply) + + cpu_threads_per_core = (known after apply) + + disable_api_stop = (known after apply) + + disable_api_termination = (known after apply) + + ebs_optimized = (known after apply) + + get_password_data = false + + host_id = (known after apply) + + host_resource_group_arn = (known after apply) + + iam_instance_profile = (known after apply) + + id = (known after apply) + + instance_initiated_shutdown_behavior = (known after apply) + + instance_lifecycle = (known after apply) + + instance_state = (known after apply) + + instance_type = "t2.micro" + + ipv6_address_count = (known after apply) + + ipv6_addresses = (known after apply) + + key_name = "awsterraform" + + monitoring = (known after apply) + + outpost_arn = (known after apply) + + password_data = (known after apply) + + placement_group = (known after apply) + + placement_partition_number = (known after apply) + + primary_network_interface_id = (known after apply) + + private_dns = (known after apply) + + private_ip = (known after apply) + + public_dns = (known after apply) + + public_ip = (known after apply) + + secondary_private_ips = (known after apply) + + security_groups = [ + + "awsterraformsg", + ] + + source_dest_check = true + + spot_instance_request_id = (known after apply) + + subnet_id = (known after apply) + + tags = { + + "name" = "VyOS System" + } + + tags_all = { + + "name" = "VyOS System" + } + + tenancy = (known after apply) + + user_data = (known after apply) + + user_data_base64 = (known after apply) + + user_data_replace_on_change = false + + vpc_security_group_ids = (known after apply) + } + + # local_file.ip will be created + + resource "local_file" "ip" { + + content = (known after apply) + + content_base64sha256 = (known after apply) + + content_base64sha512 = (known after apply) + + content_md5 = (known after apply) + + content_sha1 = (known after apply) + + content_sha256 = (known after apply) + + content_sha512 = (known after apply) + + directory_permission = "0777" + + file_permission = "0777" + + filename = "ip.txt" + + id = (known after apply) + } + + # null_resource.SSHconnection1 will be created + + resource "null_resource" "SSHconnection1" { + + id = (known after apply) + } + + # null_resource.SSHconnection2 will be created + + resource "null_resource" "SSHconnection2" { + + id = (known after apply) + } + +Plan: 4 to add, 0 to change, 0 to destroy. + +Changes to Outputs: + + my_IP = (known after apply) + +Do you want to perform these actions? + Terraform will perform the actions described above. + Only 'yes' will be accepted to approve. + + Enter a value: yes + +aws_instance.myVyOSec2: Creating... +aws_instance.myVyOSec2: Still creating... [10s elapsed] +aws_instance.myVyOSec2: Still creating... [20s elapsed] +aws_instance.myVyOSec2: Still creating... [30s elapsed] +aws_instance.myVyOSec2: Still creating... [40s elapsed] +aws_instance.myVyOSec2: Creation complete after 44s [id=i-09edfca15aac2fe0a] +null_resource.SSHconnection1: Creating... +null_resource.SSHconnection2: Creating... +null_resource.SSHconnection1: Provisioning with 'file'... +null_resource.SSHconnection2: Provisioning with 'remote-exec'... +null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... +null_resource.SSHconnection2 (remote-exec): Host: 10.217.80.104 +null_resource.SSHconnection2 (remote-exec): User: root +null_resource.SSHconnection2 (remote-exec): Password: true +null_resource.SSHconnection2 (remote-exec): Private key: false +null_resource.SSHconnection2 (remote-exec): Certificate: false +null_resource.SSHconnection2 (remote-exec): SSH Agent: false +null_resource.SSHconnection2 (remote-exec): Checking Host Key: false +null_resource.SSHconnection2 (remote-exec): Target Platform: unix +local_file.ip: Creating... +local_file.ip: Creation complete after 0s [id=e8e91f2e24579cd28b92e2d152c0c24c3bf4b52c] +null_resource.SSHconnection2 (remote-exec): Connected! +null_resource.SSHconnection1: Creation complete after 0s [id=7070868940858935600] + +null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ + +null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** +null_resource.SSHconnection2: Still creating... [10s elapsed] +null_resource.SSHconnection2: Still creating... [20s elapsed] +null_resource.SSHconnection2: Still creating... [30s elapsed] +null_resource.SSHconnection2: Still creating... [40s elapsed] +null_resource.SSHconnection2: Still creating... [50s elapsed] +null_resource.SSHconnection2: Still creating... [1m0s elapsed] +null_resource.SSHconnection2 (remote-exec): ok: [54.xxx.xxx.xxx] + +null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* +null_resource.SSHconnection2: Still creating... [1m10s elapsed] +null_resource.SSHconnection2 (remote-exec): changed: [54.xxx.xxx.xxx] + +null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* +null_resource.SSHconnection2 (remote-exec): 54.xxx.xxx.xxx : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +null_resource.SSHconnection2: Creation complete after 1m16s [id=4902256962410024771] + +Apply complete! Resources: 4 added, 0 changed, 0 destroyed. + +Outputs: + +my_IP = "54.xxx.xxx.xxx" +``` + +After executing all the commands you will have your VyOS instance on the AWS cloud with your configuration, it's a very convenient desition. +If you need to delete the instance please type the command: + +```none +terraform destroy +``` + +## Troubleshooting + +1 Ansible doesn't connect via SSH to your AWS instance: you have to check that your SSH key has copied into the path /root/aws/. +Also, increase the time in the file instance.yml from 300 sec to 500 sec or more. (It depends on your location). +Make sure that you have opened access to the instance in the security group. + +> 2 Terraform doesn't connect via SSH to your Ansible instance: you have to check the correct login and password in the part of the file VyOS. tf + +```none +connection { + type = "ssh" + user = "root" # open root access using login and password on your Ansible + password = var.password # check password in the file terraform.tfvars isn't empty + host = var.host # check the correct IP address of your Ansible host +} +``` + +Make sure that Ansible is pinging from Terrafom. + +## Structure of files Terrafom for AWS + +```none +. +├── vyos.tf # The main script +├── var.tf # The file of all variables in "vyos.tf" +├── versions.tf # File for the changing version of Terraform. +└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) +``` + +## File contents of Terrafom for AWS + +vyos.tf + +```none +############################################################################## +# Build an VyOS VM from the Marketplace +# To finde nessesery AMI image_ in AWS +# +# In the script vyos.tf we'll use default values (you can chang it as you need) +# AWS Region = "us-east-1" +# AMI = "standard AMI of VyOS from AWS Marketplace" +# Size of VM = "t2.micro" +# AWS Region = "us-east-1" +# After deploying the AWS instance and getting an IP address, the IP address is copied into the file +#"ip.txt" and copied to the Ansible node for provisioning. +############################################################################## + +provider "aws" { + access_key = var.access + secret_key = var.secret + region = var.region +} + +variable "region" { + default = "us-east-1" + description = "AWS Region" +} + +variable "ami" { + default = "ami-**************3b3" # ami image please enter your details + description = "Amazon Machine Image ID for VyOS" +} + +variable "type" { + default = "t2.micro" + description = "Size of VM" +} + +# my resource for VyOS + +resource "aws_instance" "myVyOSec2" { + ami = var.ami + key_name = "awsterraform" # Please enter your details from 1.2 of Preparation steps for deploying VyOS on AWS + security_groups = ["awsterraformsg"] # Please enter your details from 1.3 of Preparation steps for deploying VyOS on AWS + instance_type = var.type + tags = { + name = "VyOS System" + } +} + +############################################################################## +# specific variable (to getting type "terraform plan"): +# aws_instance.myVyOSec2.public_ip - the information about public IP address +# of our instance, needs for provisioning and ssh connection from Ansible +############################################################################## + +output "my_IP"{ +value = aws_instance.myVyOSec2.public_ip +} + +############################################################################## +# +# IP of aws instance copied to a file ip.txt in local system Terraform +# ip.txt looks like: +# cat ./ip.txt +# ххх.ххх.ххх.ххх +############################################################################## + +resource "local_file" "ip" { + content = aws_instance.myVyOSec2.public_ip + filename = "ip.txt" +} + +#connecting to the Ansible control node using SSH connection + +############################################################################## +# Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform node and start remotely the playbook of Ansible. +############################################################################## + +resource "null_resource" "SSHconnection1" { +depends_on = [aws_instance.myVyOSec2] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} + +#copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/aws/ip.txt" # The folder of your Ansible project + } +} + +resource "null_resource" "SSHconnection2" { +depends_on = [aws_instance.myVyOSec2] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} +#command to run Ansible playbook on remote Linux OS +provisioner "remote-exec" { + inline = [ + "cd /root/aws/", + "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for AWS" +] +} +} +``` + +var.tf + +```none +variable "password" { + description = "pass for Ansible" + type = string + sensitive = true +} +variable "host"{ + description = "The IP of my Ansible" + type = string +} +variable "access" { + description = "my access_key for AWS" + type = string + sensitive = true +} +variable "secret" { + description = "my secret_key for AWS" + type = string + sensitive = true +} +``` + +versions.tf + +```none + terraform { + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.0" + } + } +} +``` + +terraform.tfvars + +```none +password = "" # password for Ansible SSH +host = "" # IP of my Ansible +access = "" # access_key for AWS +secret = "" # secret_key for AWS +``` + +## Structure of files Ansible for AWS + +```none +. +├── group_vars + └── all +├── ansible.cfg +├── mykey.pem +└── instance.yml +``` + +## File contents of Ansible for AWS + +ansible.cfg + +```none +[defaults] +inventory = /root/aws/ip.txt +host_key_checking= False +private_key_file = /root/aws/awsterraform.pem # check the name +remote_user=vyos +``` + +mykey.pem + +```none +Copy your key.pem from AWS +``` + +instance.yml + +```none +############################################################################## +# About tasks: +# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds +# "Configure general settings for the VyOS hosts group" - make provisioning into AWS VyOS node +# You have to add all necessary cammans of VyOS under the block "lines:" +############################################################################## + + +- name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true +``` + +group_vars/all + +```none +ansible_connection: ansible.netcommon.network_cli +ansible_network_os: vyos.vyos.vyos +ansible_user: vyos +``` + +## Sourse files for AWS from GIT + +All files about the article can be found [here] + +[group]: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html +[here]: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/AWS_terraform_ansible_single_vyos_instance-main +[image]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html +[install]: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli +[link]: https://developer.hashicorp.com/terraform/intro +[pair]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html diff --git a/docs/automation/terraform/terraformAWS.rst b/docs/automation/terraform/terraformAWS.rst deleted file mode 100644 index e068377d..00000000 --- a/docs/automation/terraform/terraformAWS.rst +++ /dev/null @@ -1,547 +0,0 @@ -:lastproofread: 2024-01-11 - -.. _terraformAWS: - -Deploying VyOS in the AWS cloud -=============================== - -With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the AWS cloud. If necessary, the infrastructure can be removed using terraform. -Also we will make provisioning using Ansible. - - -.. image:: /_static/images/aws.png - :width: 50% - :align: center - :alt: Network Topology Diagram - -In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the AWS cloud and make provisioning using Ansible. - - -Preparation steps for deploying VyOS on AWS -------------------------------------------- - -How to create a single instance and install your configuration using Terraform+Ansible+AWS -Step by step: - -AWS - - -1 Create an account with AWS and get your "access_key", "secret key" - -2 Create a key pair_ and download your .pem key - -.. image:: /_static/images/keypairs.png - :width: 50% - :align: center - :alt: Network Topology Diagram - -3 Create a security group_ for the new VyOS instance and open all traffic - -.. image:: /_static/images/sg.png - :width: 50% - :align: center - :alt: Network Topology Diagram - - -.. image:: /_static/images/traffic.png - :width: 50% - :align: center - :alt: Network Topology Diagram - -Terraform - - - 1 Create an UNIX or Windows instance - - 2 Download and install Terraform - - 3 Create the folder for example /root/awsterraform - -.. code-block:: none - - mkdir /root/awsterraform - - 4 Copy all files into your Terraform project "/root/awsterraform" (vyos.tf, var.tf, terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for AWS`_ - - 5 Type the commands : - -.. code-block:: none - - cd / - terraform init - - -Ansible - - - 1 Create an UNIX instance whenever you want (local, cloud, and so on) - - 2 Download and install Ansible - - 3 Create the folder for example /root/aws/ - - 4 Copy all files into your Ansible project "/root/aws/" (ansible.cfg, instance.yml, mykey.pem and "all"), more detailed see `Structure of files Ansible for AWS`_ - -mykey.pem you have to get using step 1.2 - - -Start - - -Type the commands on your Terrafom instance: - -.. code-block:: none - - cd / - terraform plan - terraform apply - yes - - -Start creating an AWS instance and check the result ---------------------------------------------------- - -.. code-block:: none - - root@localhost:~/awsterraform# terraform apply - - Terraform used the selected providers to generate the following execution plan. - Resource actions are indicated with the following symbols: - + create - - Terraform will perform the following actions: - - # aws_instance.myVyOSec2 will be created - + resource "aws_instance" "myVyOSec2" { - + ami = "ami-************62c2d" - + arn = (known after apply) - + associate_public_ip_address = (known after apply) - + availability_zone = (known after apply) - + cpu_core_count = (known after apply) - + cpu_threads_per_core = (known after apply) - + disable_api_stop = (known after apply) - + disable_api_termination = (known after apply) - + ebs_optimized = (known after apply) - + get_password_data = false - + host_id = (known after apply) - + host_resource_group_arn = (known after apply) - + iam_instance_profile = (known after apply) - + id = (known after apply) - + instance_initiated_shutdown_behavior = (known after apply) - + instance_lifecycle = (known after apply) - + instance_state = (known after apply) - + instance_type = "t2.micro" - + ipv6_address_count = (known after apply) - + ipv6_addresses = (known after apply) - + key_name = "awsterraform" - + monitoring = (known after apply) - + outpost_arn = (known after apply) - + password_data = (known after apply) - + placement_group = (known after apply) - + placement_partition_number = (known after apply) - + primary_network_interface_id = (known after apply) - + private_dns = (known after apply) - + private_ip = (known after apply) - + public_dns = (known after apply) - + public_ip = (known after apply) - + secondary_private_ips = (known after apply) - + security_groups = [ - + "awsterraformsg", - ] - + source_dest_check = true - + spot_instance_request_id = (known after apply) - + subnet_id = (known after apply) - + tags = { - + "name" = "VyOS System" - } - + tags_all = { - + "name" = "VyOS System" - } - + tenancy = (known after apply) - + user_data = (known after apply) - + user_data_base64 = (known after apply) - + user_data_replace_on_change = false - + vpc_security_group_ids = (known after apply) - } - - # local_file.ip will be created - + resource "local_file" "ip" { - + content = (known after apply) - + content_base64sha256 = (known after apply) - + content_base64sha512 = (known after apply) - + content_md5 = (known after apply) - + content_sha1 = (known after apply) - + content_sha256 = (known after apply) - + content_sha512 = (known after apply) - + directory_permission = "0777" - + file_permission = "0777" - + filename = "ip.txt" - + id = (known after apply) - } - - # null_resource.SSHconnection1 will be created - + resource "null_resource" "SSHconnection1" { - + id = (known after apply) - } - - # null_resource.SSHconnection2 will be created - + resource "null_resource" "SSHconnection2" { - + id = (known after apply) - } - - Plan: 4 to add, 0 to change, 0 to destroy. - - Changes to Outputs: - + my_IP = (known after apply) - - Do you want to perform these actions? - Terraform will perform the actions described above. - Only 'yes' will be accepted to approve. - - Enter a value: yes - - aws_instance.myVyOSec2: Creating... - aws_instance.myVyOSec2: Still creating... [10s elapsed] - aws_instance.myVyOSec2: Still creating... [20s elapsed] - aws_instance.myVyOSec2: Still creating... [30s elapsed] - aws_instance.myVyOSec2: Still creating... [40s elapsed] - aws_instance.myVyOSec2: Creation complete after 44s [id=i-09edfca15aac2fe0a] - null_resource.SSHconnection1: Creating... - null_resource.SSHconnection2: Creating... - null_resource.SSHconnection1: Provisioning with 'file'... - null_resource.SSHconnection2: Provisioning with 'remote-exec'... - null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... - null_resource.SSHconnection2 (remote-exec): Host: 10.217.80.104 - null_resource.SSHconnection2 (remote-exec): User: root - null_resource.SSHconnection2 (remote-exec): Password: true - null_resource.SSHconnection2 (remote-exec): Private key: false - null_resource.SSHconnection2 (remote-exec): Certificate: false - null_resource.SSHconnection2 (remote-exec): SSH Agent: false - null_resource.SSHconnection2 (remote-exec): Checking Host Key: false - null_resource.SSHconnection2 (remote-exec): Target Platform: unix - local_file.ip: Creating... - local_file.ip: Creation complete after 0s [id=e8e91f2e24579cd28b92e2d152c0c24c3bf4b52c] - null_resource.SSHconnection2 (remote-exec): Connected! - null_resource.SSHconnection1: Creation complete after 0s [id=7070868940858935600] - - null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ - - null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** - null_resource.SSHconnection2: Still creating... [10s elapsed] - null_resource.SSHconnection2: Still creating... [20s elapsed] - null_resource.SSHconnection2: Still creating... [30s elapsed] - null_resource.SSHconnection2: Still creating... [40s elapsed] - null_resource.SSHconnection2: Still creating... [50s elapsed] - null_resource.SSHconnection2: Still creating... [1m0s elapsed] - null_resource.SSHconnection2 (remote-exec): ok: [54.xxx.xxx.xxx] - - null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* - null_resource.SSHconnection2: Still creating... [1m10s elapsed] - null_resource.SSHconnection2 (remote-exec): changed: [54.xxx.xxx.xxx] - - null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* - null_resource.SSHconnection2 (remote-exec): 54.xxx.xxx.xxx : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - - null_resource.SSHconnection2: Creation complete after 1m16s [id=4902256962410024771] - - Apply complete! Resources: 4 added, 0 changed, 0 destroyed. - - Outputs: - - my_IP = "54.xxx.xxx.xxx" - - - -After executing all the commands you will have your VyOS instance on the AWS cloud with your configuration, it's a very convenient desition. -If you need to delete the instance please type the command: - -.. code-block:: none - - terraform destroy - - -Troubleshooting ---------------- - -1 Ansible doesn't connect via SSH to your AWS instance: you have to check that your SSH key has copied into the path /root/aws/. -Also, increase the time in the file instance.yml from 300 sec to 500 sec or more. (It depends on your location). -Make sure that you have opened access to the instance in the security group. - - 2 Terraform doesn't connect via SSH to your Ansible instance: you have to check the correct login and password in the part of the file VyOS. tf - -.. code-block:: none - - connection { - type = "ssh" - user = "root" # open root access using login and password on your Ansible - password = var.password # check password in the file terraform.tfvars isn't empty - host = var.host # check the correct IP address of your Ansible host - } - - -Make sure that Ansible is pinging from Terrafom. - -Structure of files Terrafom for AWS ------------------------------------ - -.. code-block:: none - - . - ├── vyos.tf # The main script - ├── var.tf # The file of all variables in "vyos.tf" - ├── versions.tf # File for the changing version of Terraform. - └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) - - - -File contents of Terrafom for AWS ---------------------------------- - -vyos.tf - -.. code-block:: none - - - ############################################################################## - # Build an VyOS VM from the Marketplace - # To finde nessesery AMI image_ in AWS - # - # In the script vyos.tf we'll use default values (you can chang it as you need) - # AWS Region = "us-east-1" - # AMI = "standard AMI of VyOS from AWS Marketplace" - # Size of VM = "t2.micro" - # AWS Region = "us-east-1" - # After deploying the AWS instance and getting an IP address, the IP address is copied into the file - #"ip.txt" and copied to the Ansible node for provisioning. - ############################################################################## - - provider "aws" { - access_key = var.access - secret_key = var.secret - region = var.region - } - - variable "region" { - default = "us-east-1" - description = "AWS Region" - } - - variable "ami" { - default = "ami-**************3b3" # ami image please enter your details - description = "Amazon Machine Image ID for VyOS" - } - - variable "type" { - default = "t2.micro" - description = "Size of VM" - } - - # my resource for VyOS - - resource "aws_instance" "myVyOSec2" { - ami = var.ami - key_name = "awsterraform" # Please enter your details from 1.2 of Preparation steps for deploying VyOS on AWS - security_groups = ["awsterraformsg"] # Please enter your details from 1.3 of Preparation steps for deploying VyOS on AWS - instance_type = var.type - tags = { - name = "VyOS System" - } - } - - ############################################################################## - # specific variable (to getting type "terraform plan"): - # aws_instance.myVyOSec2.public_ip - the information about public IP address - # of our instance, needs for provisioning and ssh connection from Ansible - ############################################################################## - - output "my_IP"{ - value = aws_instance.myVyOSec2.public_ip - } - - ############################################################################## - # - # IP of aws instance copied to a file ip.txt in local system Terraform - # ip.txt looks like: - # cat ./ip.txt - # ххх.ххх.ххх.ххх - ############################################################################## - - resource "local_file" "ip" { - content = aws_instance.myVyOSec2.public_ip - filename = "ip.txt" - } - - #connecting to the Ansible control node using SSH connection - - ############################################################################## - # Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform node and start remotely the playbook of Ansible. - ############################################################################## - - resource "null_resource" "SSHconnection1" { - depends_on = [aws_instance.myVyOSec2] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - - #copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/aws/ip.txt" # The folder of your Ansible project - } - } - - resource "null_resource" "SSHconnection2" { - depends_on = [aws_instance.myVyOSec2] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - #command to run Ansible playbook on remote Linux OS - provisioner "remote-exec" { - inline = [ - "cd /root/aws/", - "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for AWS" - ] - } - } - - -var.tf - -.. code-block:: none - - variable "password" { - description = "pass for Ansible" - type = string - sensitive = true - } - variable "host"{ - description = "The IP of my Ansible" - type = string - } - variable "access" { - description = "my access_key for AWS" - type = string - sensitive = true - } - variable "secret" { - description = "my secret_key for AWS" - type = string - sensitive = true - } - -versions.tf - -.. code-block:: none - - terraform { - required_providers { - aws = { - source = "hashicorp/aws" - version = "~> 5.0" - } - } - } - -terraform.tfvars - -.. code-block:: none - - password = "" # password for Ansible SSH - host = "" # IP of my Ansible - access = "" # access_key for AWS - secret = "" # secret_key for AWS - - -Structure of files Ansible for AWS ----------------------------------- - -.. code-block:: none - - . - ├── group_vars - └── all - ├── ansible.cfg - ├── mykey.pem - └── instance.yml - - -File contents of Ansible for AWS --------------------------------- - -ansible.cfg - -.. code-block:: none - - [defaults] - inventory = /root/aws/ip.txt - host_key_checking= False - private_key_file = /root/aws/awsterraform.pem # check the name - remote_user=vyos - -mykey.pem - -.. code-block:: none - - Copy your key.pem from AWS - - -instance.yml - - - -.. code-block:: none - - ############################################################################## - # About tasks: - # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds - # "Configure general settings for the VyOS hosts group" - make provisioning into AWS VyOS node - # You have to add all necessary cammans of VyOS under the block "lines:" - ############################################################################## - - - - name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true - - -group_vars/all - -.. code-block:: none - - ansible_connection: ansible.netcommon.network_cli - ansible_network_os: vyos.vyos.vyos - ansible_user: vyos - -Sourse files for AWS from GIT ------------------------------ - -All files about the article can be found here_ - - -.. _link: https://developer.hashicorp.com/terraform/intro -.. _install: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli -.. _pair: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html -.. _group: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html -.. _image: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html -.. _here: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/AWS_terraform_ansible_single_vyos_instance-main \ No newline at end of file diff --git a/docs/automation/terraform/terraformAZ.md b/docs/automation/terraform/terraformAZ.md new file mode 100644 index 00000000..0e195be9 --- /dev/null +++ b/docs/automation/terraform/terraformAZ.md @@ -0,0 +1,470 @@ +--- +lastproofread: '2024-03-03' +--- + +(terraformaz)= + +# Deploying VyOS in the Azure cloud + +With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the Azure cloud. If necessary, the infrastructure can be removed using terraform. +Also we will make provisioning using Ansible. + +In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the Azure cloud and make provisioning using Ansible. + +## Preparation steps for deploying VyOS on Azure + +How to create a single instance and install your configuration using Terraform+Ansible+Azure +Step by step: + +Azure + +> 1 Create an account with Azure + +Terraform + +> 1 Create an UNIX or Windows instance +> +> 2 Download and install Terraform +> +> 3 Create the folder for example /root/azvyos/ + +```none +mkdir /root/azvyos + + 4 Copy all files into your Terraform project "/root/azvyos" (vyos.tf, var.tf, terraform.tfvars), more detailed see `Structure of files Terrafom for Azure`_ + + 5 Login with Azure using the command +``` + +```none +az login +``` + +2.6 Type the commands : + +```none +cd / +terraform init +``` + +Ansible + +> 1 Create an UNIX instance whenever you want (local, cloud, and so on) +> +> 2 Download and install Ansible +> +> 3 Create the folder for example /root/az/ +> +> 4 Copy all files into your Ansible project "/root/az/" (ansible.cfg, instance.yml,"all"), more detailed see [Structure of files Ansible for Azure] + +Start + +Type the commands on your Terrafom instance: + +```none +cd / +terraform plan +terraform apply +yes +``` + +After executing all the commands you will have your VyOS instance on the Azure cloud with your configuration, it's a very convenient desition. +If you need to delete the instance please type the command: + +```none +terraform destroy +``` + +## Structure of files Terrafom for Azure + +```none +. +├── vyos.tf # The main script +├── var.tf # File for the changing version of Terraform. +└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) +``` + +## File contents of Terrafom for Azure + +vyos.tf + +```none +############################################################################## +# HashiCorp Guide to Using Terraform on Azure +# This Terraform configuration will create the following: +# Resource group with a virtual network and subnet +# An VyOS server without ssh key (only login+password) +############################################################################## + +# Chouse a provider + +provider "azurerm" { + features {} +} + +# Create a resource group. In Azure every resource belongs to a +# resource group. + +resource "azurerm_resource_group" "azure_vyos" { + name = "${var.resource_group}" + location = "${var.location}" +} + +# The next resource is a Virtual Network. + +resource "azurerm_virtual_network" "vnet" { + name = "${var.virtual_network_name}" + location = "${var.location}" + address_space = ["${var.address_space}"] + resource_group_name = "${var.resource_group}" +} + +# Build a subnet to run our VMs in. + +resource "azurerm_subnet" "subnet" { + name = "${var.prefix}subnet" + virtual_network_name = "${azurerm_virtual_network.vnet.name}" + resource_group_name = "${var.resource_group}" + address_prefixes = ["${var.subnet_prefix}"] +} + +############################################################################## +# Build an VyOS VM from the Marketplace +# To finde nessesery image use the command: +# +# az vm image list --offer vyos --all +# +# Now that we have a network, we'll deploy an VyOS server. +# An Azure Virtual Machine has several components. In this example we'll build +# a security group, a network interface, a public ip address, a storage +# account and finally the VM itself. Terraform handles all the dependencies +# automatically, and each resource is named with user-defined variables. +############################################################################## + + +# Security group to allow inbound access on port 22 (ssh) + +resource "azurerm_network_security_group" "vyos-sg" { + name = "${var.prefix}-sg" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + + security_rule { + name = "SSH" + priority = 100 + direction = "Inbound" + access = "Allow" + protocol = "Tcp" + source_port_range = "*" + destination_port_range = "22" + source_address_prefix = "${var.source_network}" + destination_address_prefix = "*" + } +} + +# A network interface. + +resource "azurerm_network_interface" "vyos-nic" { + name = "${var.prefix}vyos-nic" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + + ip_configuration { + name = "${var.prefix}ipconfig" + subnet_id = "${azurerm_subnet.subnet.id}" + private_ip_address_allocation = "Dynamic" + public_ip_address_id = "${azurerm_public_ip.vyos-pip.id}" + } +} + +# Add a public IP address. + +resource "azurerm_public_ip" "vyos-pip" { + name = "${var.prefix}-ip" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + allocation_method = "Dynamic" +} + +# Build a virtual machine. This is a standard VyOS instance from Marketplace. + +resource "azurerm_virtual_machine" "vyos" { + name = "${var.hostname}-vyos" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + vm_size = "${var.vm_size}" + + network_interface_ids = ["${azurerm_network_interface.vyos-nic.id}"] + delete_os_disk_on_termination = "true" + +# To finde an information about the plan use the command: +# az vm image list --offer vyos --all + + plan { + publisher = "sentriumsl" + name = "vyos-1-3" + product = "vyos-1-2-lts-on-azure" + } + + storage_image_reference { + publisher = "${var.image_publisher}" + offer = "${var.image_offer}" + sku = "${var.image_sku}" + version = "${var.image_version}" + } + + storage_os_disk { + name = "${var.hostname}-osdisk" + managed_disk_type = "Standard_LRS" + caching = "ReadWrite" + create_option = "FromImage" + } + + os_profile { + computer_name = "${var.hostname}" + admin_username = "${var.admin_username}" + admin_password = "${var.admin_password}" + } + + os_profile_linux_config { + disable_password_authentication = false + } +} + +data "azurerm_public_ip" "example" { + depends_on = ["azurerm_virtual_machine.vyos"] + name = "vyos-ip" + resource_group_name = "${var.resource_group}" +} +output "public_ip_address" { + value = data.azurerm_public_ip.example.ip_address +} + +# IP of AZ instance copied to a file ip.txt in local system + +resource "local_file" "ip" { + content = data.azurerm_public_ip.example.ip_address + filename = "ip.txt" +} + +#Connecting to the Ansible control node using SSH connection + +resource "null_resource" "nullremote1" { +depends_on = ["azurerm_virtual_machine.vyos"] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} + +# Copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/az/ip.txt" + } +} + +resource "null_resource" "nullremote2" { +depends_on = ["azurerm_virtual_machine.vyos"] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} + +# Command to run ansible playbook on remote Linux OS + +provisioner "remote-exec" { + + inline = [ + "cd /root/az/", + "ansible-playbook instance.yml" +] +} +} +``` + +var.tf + +```none +############################################################################## +# Variables File +# +# Here is where we store the default values for all the variables used in our +# Terraform code. +############################################################################## + +variable "resource_group" { + description = "The name of your Azure Resource Group." + default = "my_resource_group" +} + +variable "prefix" { + description = "This prefix will be included in the name of some resources." + default = "vyos" +} + +variable "hostname" { + description = "Virtual machine hostname. Used for local hostname, DNS, and storage-related names." + default = "vyos_terraform" +} + +variable "location" { + description = "The region where the virtual network is created." + default = "centralus" +} + +variable "virtual_network_name" { + description = "The name for your virtual network." + default = "vnet" +} + +variable "address_space" { + description = "The address space that is used by the virtual network. You can supply more than one address space. Changing this forces a new resource to be created." + default = "10.0.0.0/16" +} + +variable "subnet_prefix" { + description = "The address prefix to use for the subnet." + default = "10.0.10.0/24" +} + +variable "storage_account_tier" { + description = "Defines the storage tier. Valid options are Standard and Premium." + default = "Standard" +} + +variable "storage_replication_type" { + description = "Defines the replication type to use for this storage account. Valid options include LRS, GRS etc." + default = "LRS" +} + +# The most chippers size + +variable "vm_size" { + description = "Specifies the size of the virtual machine." + default = "Standard_B1s" +} + +variable "image_publisher" { + description = "Name of the publisher of the image (az vm image list)" + default = "sentriumsl" +} + +variable "image_offer" { + description = "Name of the offer (az vm image list)" + default = "vyos-1-2-lts-on-azure" +} + +variable "image_sku" { + description = "Image SKU to apply (az vm image list)" + default = "vyos-1-3" +} + +variable "image_version" { + description = "Version of the image to apply (az vm image list)" + default = "1.3.3" +} + +variable "admin_username" { + description = "Administrator user name" + default = "vyos" +} + +variable "admin_password" { + description = "Administrator password" + default = "Vyos0!" +} + +variable "source_network" { + description = "Allow access from this network prefix. Defaults to '*'." + default = "*" +} + +variable "password" { + description = "pass for Ansible" + type = string + sensitive = true +} +variable "host"{ + description = "IP of my Ansible" +} +``` + +terraform.tfvars + +```none +password = "" # password for Ansible SSH +host = "" # IP of my Ansible +``` + +## Structure of files Ansible for Azure + +```none +. +├── group_vars + └── all +├── ansible.cfg +└── instance.yml +``` + +## File contents of Ansible for Azure + +ansible.cfg + +```none +[defaults] +inventory = /root/az/ip.txt +host_key_checking= False +remote_user=vyos +``` + +instance.yml + +```none +############################################################################## +# About tasks: +# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds +# "Configure general settings for the VyOS hosts group" - make provisioning into Azure VyOS node +# You have to add all necessary cammans of VyOS under the block "lines:" +############################################################################## + + +- name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true +``` + +group_vars/all + +```none +ansible_connection: ansible.netcommon.network_cli +ansible_network_os: vyos.vyos.vyos + +# user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf +ansible_user: vyos +ansible_ssh_pass: Vyos0! +``` + +## Sourse files for Azure from GIT + +All files about the article can be found [here] + +[here]: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Azure_terraform_ansible_single_vyos_instance-main diff --git a/docs/automation/terraform/terraformAZ.rst b/docs/automation/terraform/terraformAZ.rst deleted file mode 100644 index a0fea023..00000000 --- a/docs/automation/terraform/terraformAZ.rst +++ /dev/null @@ -1,488 +0,0 @@ -:lastproofread: 2024-03-03 - -.. _terraformAZ: - -Deploying VyOS in the Azure cloud -================================= - -With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the Azure cloud. If necessary, the infrastructure can be removed using terraform. -Also we will make provisioning using Ansible. - -In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the Azure cloud and make provisioning using Ansible. - -Preparation steps for deploying VyOS on Azure ---------------------------------------------- - -How to create a single instance and install your configuration using Terraform+Ansible+Azure -Step by step: - -Azure - - 1 Create an account with Azure - -Terraform - - - 1 Create an UNIX or Windows instance - - 2 Download and install Terraform - - 3 Create the folder for example /root/azvyos/ - -.. code-block:: none - - mkdir /root/azvyos - - 4 Copy all files into your Terraform project "/root/azvyos" (vyos.tf, var.tf, terraform.tfvars), more detailed see `Structure of files Terrafom for Azure`_ - - 5 Login with Azure using the command - -.. code-block:: none - - az login - -2.6 Type the commands : - -.. code-block:: none - - cd / - terraform init - -Ansible - - - 1 Create an UNIX instance whenever you want (local, cloud, and so on) - - 2 Download and install Ansible - - 3 Create the folder for example /root/az/ - - 4 Copy all files into your Ansible project "/root/az/" (ansible.cfg, instance.yml,"all"), more detailed see `Structure of files Ansible for Azure`_ - - -Start - - -Type the commands on your Terrafom instance: - -.. code-block:: none - - cd / - terraform plan - terraform apply - yes - -After executing all the commands you will have your VyOS instance on the Azure cloud with your configuration, it's a very convenient desition. -If you need to delete the instance please type the command: - -.. code-block:: none - - terraform destroy - -Structure of files Terrafom for Azure -------------------------------------- - -.. code-block:: none - - . - ├── vyos.tf # The main script - ├── var.tf # File for the changing version of Terraform. - └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) - -File contents of Terrafom for Azure ------------------------------------ - -vyos.tf - -.. code-block:: none - - - ############################################################################## - # HashiCorp Guide to Using Terraform on Azure - # This Terraform configuration will create the following: - # Resource group with a virtual network and subnet - # An VyOS server without ssh key (only login+password) - ############################################################################## - - # Chouse a provider - - provider "azurerm" { - features {} - } - - # Create a resource group. In Azure every resource belongs to a - # resource group. - - resource "azurerm_resource_group" "azure_vyos" { - name = "${var.resource_group}" - location = "${var.location}" - } - - # The next resource is a Virtual Network. - - resource "azurerm_virtual_network" "vnet" { - name = "${var.virtual_network_name}" - location = "${var.location}" - address_space = ["${var.address_space}"] - resource_group_name = "${var.resource_group}" - } - - # Build a subnet to run our VMs in. - - resource "azurerm_subnet" "subnet" { - name = "${var.prefix}subnet" - virtual_network_name = "${azurerm_virtual_network.vnet.name}" - resource_group_name = "${var.resource_group}" - address_prefixes = ["${var.subnet_prefix}"] - } - - ############################################################################## - # Build an VyOS VM from the Marketplace - # To finde nessesery image use the command: - # - # az vm image list --offer vyos --all - # - # Now that we have a network, we'll deploy an VyOS server. - # An Azure Virtual Machine has several components. In this example we'll build - # a security group, a network interface, a public ip address, a storage - # account and finally the VM itself. Terraform handles all the dependencies - # automatically, and each resource is named with user-defined variables. - ############################################################################## - - - # Security group to allow inbound access on port 22 (ssh) - - resource "azurerm_network_security_group" "vyos-sg" { - name = "${var.prefix}-sg" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - - security_rule { - name = "SSH" - priority = 100 - direction = "Inbound" - access = "Allow" - protocol = "Tcp" - source_port_range = "*" - destination_port_range = "22" - source_address_prefix = "${var.source_network}" - destination_address_prefix = "*" - } - } - - # A network interface. - - resource "azurerm_network_interface" "vyos-nic" { - name = "${var.prefix}vyos-nic" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - - ip_configuration { - name = "${var.prefix}ipconfig" - subnet_id = "${azurerm_subnet.subnet.id}" - private_ip_address_allocation = "Dynamic" - public_ip_address_id = "${azurerm_public_ip.vyos-pip.id}" - } - } - - # Add a public IP address. - - resource "azurerm_public_ip" "vyos-pip" { - name = "${var.prefix}-ip" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - allocation_method = "Dynamic" - } - - # Build a virtual machine. This is a standard VyOS instance from Marketplace. - - resource "azurerm_virtual_machine" "vyos" { - name = "${var.hostname}-vyos" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - vm_size = "${var.vm_size}" - - network_interface_ids = ["${azurerm_network_interface.vyos-nic.id}"] - delete_os_disk_on_termination = "true" - - # To finde an information about the plan use the command: - # az vm image list --offer vyos --all - - plan { - publisher = "sentriumsl" - name = "vyos-1-3" - product = "vyos-1-2-lts-on-azure" - } - - storage_image_reference { - publisher = "${var.image_publisher}" - offer = "${var.image_offer}" - sku = "${var.image_sku}" - version = "${var.image_version}" - } - - storage_os_disk { - name = "${var.hostname}-osdisk" - managed_disk_type = "Standard_LRS" - caching = "ReadWrite" - create_option = "FromImage" - } - - os_profile { - computer_name = "${var.hostname}" - admin_username = "${var.admin_username}" - admin_password = "${var.admin_password}" - } - - os_profile_linux_config { - disable_password_authentication = false - } - } - - data "azurerm_public_ip" "example" { - depends_on = ["azurerm_virtual_machine.vyos"] - name = "vyos-ip" - resource_group_name = "${var.resource_group}" - } - output "public_ip_address" { - value = data.azurerm_public_ip.example.ip_address - } - - # IP of AZ instance copied to a file ip.txt in local system - - resource "local_file" "ip" { - content = data.azurerm_public_ip.example.ip_address - filename = "ip.txt" - } - - #Connecting to the Ansible control node using SSH connection - - resource "null_resource" "nullremote1" { - depends_on = ["azurerm_virtual_machine.vyos"] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - - # Copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/az/ip.txt" - } - } - - resource "null_resource" "nullremote2" { - depends_on = ["azurerm_virtual_machine.vyos"] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - - # Command to run ansible playbook on remote Linux OS - - provisioner "remote-exec" { - - inline = [ - "cd /root/az/", - "ansible-playbook instance.yml" - ] - } - } - - -var.tf - -.. code-block:: none - - ############################################################################## - # Variables File - # - # Here is where we store the default values for all the variables used in our - # Terraform code. - ############################################################################## - - variable "resource_group" { - description = "The name of your Azure Resource Group." - default = "my_resource_group" - } - - variable "prefix" { - description = "This prefix will be included in the name of some resources." - default = "vyos" - } - - variable "hostname" { - description = "Virtual machine hostname. Used for local hostname, DNS, and storage-related names." - default = "vyos_terraform" - } - - variable "location" { - description = "The region where the virtual network is created." - default = "centralus" - } - - variable "virtual_network_name" { - description = "The name for your virtual network." - default = "vnet" - } - - variable "address_space" { - description = "The address space that is used by the virtual network. You can supply more than one address space. Changing this forces a new resource to be created." - default = "10.0.0.0/16" - } - - variable "subnet_prefix" { - description = "The address prefix to use for the subnet." - default = "10.0.10.0/24" - } - - variable "storage_account_tier" { - description = "Defines the storage tier. Valid options are Standard and Premium." - default = "Standard" - } - - variable "storage_replication_type" { - description = "Defines the replication type to use for this storage account. Valid options include LRS, GRS etc." - default = "LRS" - } - - # The most chippers size - - variable "vm_size" { - description = "Specifies the size of the virtual machine." - default = "Standard_B1s" - } - - variable "image_publisher" { - description = "Name of the publisher of the image (az vm image list)" - default = "sentriumsl" - } - - variable "image_offer" { - description = "Name of the offer (az vm image list)" - default = "vyos-1-2-lts-on-azure" - } - - variable "image_sku" { - description = "Image SKU to apply (az vm image list)" - default = "vyos-1-3" - } - - variable "image_version" { - description = "Version of the image to apply (az vm image list)" - default = "1.3.3" - } - - variable "admin_username" { - description = "Administrator user name" - default = "vyos" - } - - variable "admin_password" { - description = "Administrator password" - default = "Vyos0!" - } - - variable "source_network" { - description = "Allow access from this network prefix. Defaults to '*'." - default = "*" - } - - variable "password" { - description = "pass for Ansible" - type = string - sensitive = true - } - variable "host"{ - description = "IP of my Ansible" - } - -terraform.tfvars - -.. code-block:: none - - password = "" # password for Ansible SSH - host = "" # IP of my Ansible - - -Structure of files Ansible for Azure ------------------------------------- - -.. code-block:: none - - . - ├── group_vars - └── all - ├── ansible.cfg - └── instance.yml - - -File contents of Ansible for Azure ----------------------------------- - -ansible.cfg - -.. code-block:: none - - [defaults] - inventory = /root/az/ip.txt - host_key_checking= False - remote_user=vyos - - -instance.yml - - -.. code-block:: none - - ############################################################################## - # About tasks: - # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds - # "Configure general settings for the VyOS hosts group" - make provisioning into Azure VyOS node - # You have to add all necessary cammans of VyOS under the block "lines:" - ############################################################################## - - - - name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true - - -group_vars/all - -.. code-block:: none - - ansible_connection: ansible.netcommon.network_cli - ansible_network_os: vyos.vyos.vyos - - # user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf - ansible_user: vyos - ansible_ssh_pass: Vyos0! - -Sourse files for Azure from GIT -------------------------------- - -All files about the article can be found here_ - -.. _here: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Azure_terraform_ansible_single_vyos_instance-main - - diff --git a/docs/automation/terraform/terraformGoogle.md b/docs/automation/terraform/terraformGoogle.md new file mode 100644 index 00000000..e69de29b diff --git a/docs/automation/terraform/terraformGoogle.rst b/docs/automation/terraform/terraformGoogle.rst deleted file mode 100644 index e69de29b..00000000 diff --git a/docs/automation/terraform/terraformvSphere.md b/docs/automation/terraform/terraformvSphere.md new file mode 100644 index 00000000..55b9860b --- /dev/null +++ b/docs/automation/terraform/terraformvSphere.md @@ -0,0 +1,377 @@ +--- +lastproofread: '2024-03-03' +--- + +(terraformvsphere)= + +# Deploying VyOS in the vSphere infrastructure + +With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the vSphere. +Also we will make provisioning using Ansible. + +In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the vSphere cloud and make provisioning using Ansible. + +## Preparation steps for deploying VyOS on vSphere + +How to create a single instance and install your configuration using Terraform+Ansible+vSphere +Step by step: + +vSphere + +> 1 Collect all data in to file "terraform.tfvars" and create resources for example "terraform" + +Terraform + +> 1 Create an UNIX or Windows instance +> +> 2 Download and install Terraform +> +> 3 Create the folder for example /root/vsphereterraform + +```none +mkdir /root/vsphereterraform + + + 4 Copy all files into your Terraform project "/root/vsphereterraform" (vyos.tf, var.tf, terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for vSphere`_ + + 5 Type the commands : +``` + +```none +cd / +terraform init +``` + +Ansible + +> 1 Create an UNIX instance whenever you want (local, cloud, and so on) +> +> 2 Download and install Ansible +> +> 3 Create the folder for example /root/vsphereterraform/ +> +> 4 Copy all files into your Ansible project "/root/vsphereterraform/" (ansible.cfg, instance.yml,"all"), more detailed see [Structure of files Ansible for vSphere] + +Start + +Type the commands on your Terrafom instance: + +```none +cd / +terraform plan +terraform apply +yes +``` + +After executing all the commands you will have your VyOS instance on the vSphere with your configuration, it's a very convenient desition. +If you need to delete the instance please type the command: + +```none +terraform destroy +``` + +## Structure of files Terrafom for vSphere + +```none +. +├── vyos.tf # The main script +├── versions.tf # File for the changing version of Terraform. +├── var.tf # File for the changing version of Terraform. +└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) +``` + +## File contents of Terrafom for vSphere + +vyos.tf + +```none +provider "vsphere" { + user = var.vsphere_user + password = var.vsphere_password + vsphere_server = var.vsphere_server + allow_unverified_ssl = true +} + +data "vsphere_datacenter" "datacenter" { + name = var.datacenter +} + +data "vsphere_datastore" "datastore" { + name = var.datastore + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +data "vsphere_compute_cluster" "cluster" { + name = var.cluster + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +data "vsphere_resource_pool" "default" { + name = format("%s%s", data.vsphere_compute_cluster.cluster.name, "/Resources/terraform") # set as you need + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +data "vsphere_host" "host" { + name = var.host + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +data "vsphere_network" "network" { + name = var.network_name + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +# Deployment of VM from Remote OVF +resource "vsphere_virtual_machine" "vmFromRemoteOvf" { + name = var.remotename + datacenter_id = data.vsphere_datacenter.datacenter.id + datastore_id = data.vsphere_datastore.datastore.id + host_system_id = data.vsphere_host.host.id + resource_pool_id = data.vsphere_resource_pool.default.id + network_interface { + network_id = data.vsphere_network.network.id + } + wait_for_guest_net_timeout = 2 + wait_for_guest_ip_timeout = 2 + + ovf_deploy { + allow_unverified_ssl_cert = true + remote_ovf_url = var.url_ova + disk_provisioning = "thin" + ip_protocol = "IPv4" + ip_allocation_policy = "dhcpPolicy" + ovf_network_map = { + "Network 1" = data.vsphere_network.network.id + "Network 2" = data.vsphere_network.network.id + } + } + vapp { + properties = { + "password" = "12345678", + "local-hostname" = "terraform_vyos" + } + } +} + +output "ip" { + description = "default ip address of the deployed VM" + value = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address +} + +# IP of vSphere instance copied to a file ip.txt in local system + +resource "local_file" "ip" { + content = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address + filename = "ip.txt" +} + +#Connecting to the Ansible control node using SSH connection + +resource "null_resource" "nullremote1" { +depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] +connection { + type = "ssh" + user = "root" + password = var.ansiblepassword + host = var.ansiblehost + +} + +# Copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/vsphere/ip.txt" + } +} + +resource "null_resource" "nullremote2" { +depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] +connection { + type = "ssh" + user = "root" + password = var.ansiblepassword + host = var.ansiblehost +} + +# Command to run ansible playbook on remote Linux OS + +provisioner "remote-exec" { + + inline = [ + "cd /root/vsphere/", + "ansible-playbook instance.yml" +] +} +} +``` + +versions.tf + +```none +# Copyright (c) HashiCorp, Inc. +# SPDX-License-Identifier: MPL-2.0 + +terraform { + required_providers { + vsphere = { + source = "hashicorp/vsphere" + version = "2.4.0" + } + } +} +``` + +var.tf + +```none +# Copyright (c) HashiCorp, Inc. +# SPDX-License-Identifier: MPL-2.0 + +variable "vsphere_server" { + description = "vSphere server" + type = string +} + +variable "vsphere_user" { + description = "vSphere username" + type = string +} + +variable "vsphere_password" { + description = "vSphere password" + type = string + sensitive = true +} + +variable "datacenter" { + description = "vSphere data center" + type = string +} + +variable "cluster" { + description = "vSphere cluster" + type = string +} + +variable "datastore" { + description = "vSphere datastore" + type = string +} + +variable "network_name" { + description = "vSphere network name" + type = string +} + +variable "host" { + description = "name if yor host" + type = string +} + +variable "remotename" { + description = "the name of you VM" + type = string +} + +variable "url_ova" { + description = "the URL to .OVA file or cloude store" + type = string +} + +variable "ansiblepassword" { + description = "Ansible password" + type = string +} + +variable "ansiblehost" { + description = "Ansible host name or IP" + type = string +} +``` + +terraform.tfvars + +```none +vsphere_user = "" +vsphere_password = "" +vsphere_server = "" +datacenter = "" +datastore = "" +cluster = "" +network_name = "" +host = "" +url_ova = "" +ansiblepassword = "" +ansiblehost = "" +remotename = "" +``` + +## Structure of files Ansible for vSphere + +```none +. +├── group_vars + └── all +├── ansible.cfg +└── instance.yml +``` + +## File contents of Ansible for vSphere + +ansible.cfg + +```none +[defaults] +inventory = /root/vsphere/ip.txt +host_key_checking= False +remote_user=vyos +``` + +instance.yml + +```none +############################################################################## +# About tasks: +# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds +# "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node +# You have to add all necessary cammans of VyOS under the block "lines:" +############################################################################## + + +- name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server 8.8.8.8 + save: + true +``` + +group_vars/all + +```none +ansible_connection: ansible.netcommon.network_cli +ansible_network_os: vyos.vyos.vyos + +# user and password gets from terraform variables "admin_username" and "admin_password" +ansible_user: vyos +# get from vyos.tf "vapp" +ansible_ssh_pass: 12345678 +``` + +## Sourse files for vSphere from GIT + +All files about the article can be found [here] + +[here]: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Vsphere_terraform_ansible_single_vyos_instance-main diff --git a/docs/automation/terraform/terraformvSphere.rst b/docs/automation/terraform/terraformvSphere.rst deleted file mode 100644 index 5d39261b..00000000 --- a/docs/automation/terraform/terraformvSphere.rst +++ /dev/null @@ -1,400 +0,0 @@ -:lastproofread: 2024-03-03 - -.. _terraformvSphere: - -Deploying VyOS in the vSphere infrastructure -============================================ - -With the help of Terraform, you can quickly deploy VyOS-based infrastructure in the vSphere. -Also we will make provisioning using Ansible. - -In this case, we'll create the necessary files for Terraform and Ansible next using Terraform we'll create a single instance on the vSphere cloud and make provisioning using Ansible. - -Preparation steps for deploying VyOS on vSphere ------------------------------------------------ - -How to create a single instance and install your configuration using Terraform+Ansible+vSphere -Step by step: - - -vSphere - - - 1 Collect all data in to file "terraform.tfvars" and create resources for example "terraform" - - -Terraform - - - 1 Create an UNIX or Windows instance - - 2 Download and install Terraform - - 3 Create the folder for example /root/vsphereterraform - -.. code-block:: none - - mkdir /root/vsphereterraform - - - 4 Copy all files into your Terraform project "/root/vsphereterraform" (vyos.tf, var.tf, terraform.tfvars,version.tf), more detailed see `Structure of files Terrafom for vSphere`_ - - 5 Type the commands : - -.. code-block:: none - - cd / - terraform init - - -Ansible - - - 1 Create an UNIX instance whenever you want (local, cloud, and so on) - - 2 Download and install Ansible - - 3 Create the folder for example /root/vsphereterraform/ - - 4 Copy all files into your Ansible project "/root/vsphereterraform/" (ansible.cfg, instance.yml,"all"), more detailed see `Structure of files Ansible for vSphere`_ - - -Start - - -Type the commands on your Terrafom instance: - -.. code-block:: none - - cd / - terraform plan - terraform apply - yes - - -After executing all the commands you will have your VyOS instance on the vSphere with your configuration, it's a very convenient desition. -If you need to delete the instance please type the command: - -.. code-block:: none - - terraform destroy - - -Structure of files Terrafom for vSphere ---------------------------------------- - -.. code-block:: none - - . - ├── vyos.tf # The main script - ├── versions.tf # File for the changing version of Terraform. - ├── var.tf # File for the changing version of Terraform. - └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) - - -File contents of Terrafom for vSphere -------------------------------------- - -vyos.tf - -.. code-block:: none - - provider "vsphere" { - user = var.vsphere_user - password = var.vsphere_password - vsphere_server = var.vsphere_server - allow_unverified_ssl = true - } - - data "vsphere_datacenter" "datacenter" { - name = var.datacenter - } - - data "vsphere_datastore" "datastore" { - name = var.datastore - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - data "vsphere_compute_cluster" "cluster" { - name = var.cluster - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - data "vsphere_resource_pool" "default" { - name = format("%s%s", data.vsphere_compute_cluster.cluster.name, "/Resources/terraform") # set as you need - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - data "vsphere_host" "host" { - name = var.host - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - data "vsphere_network" "network" { - name = var.network_name - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - # Deployment of VM from Remote OVF - resource "vsphere_virtual_machine" "vmFromRemoteOvf" { - name = var.remotename - datacenter_id = data.vsphere_datacenter.datacenter.id - datastore_id = data.vsphere_datastore.datastore.id - host_system_id = data.vsphere_host.host.id - resource_pool_id = data.vsphere_resource_pool.default.id - network_interface { - network_id = data.vsphere_network.network.id - } - wait_for_guest_net_timeout = 2 - wait_for_guest_ip_timeout = 2 - - ovf_deploy { - allow_unverified_ssl_cert = true - remote_ovf_url = var.url_ova - disk_provisioning = "thin" - ip_protocol = "IPv4" - ip_allocation_policy = "dhcpPolicy" - ovf_network_map = { - "Network 1" = data.vsphere_network.network.id - "Network 2" = data.vsphere_network.network.id - } - } - vapp { - properties = { - "password" = "12345678", - "local-hostname" = "terraform_vyos" - } - } - } - - output "ip" { - description = "default ip address of the deployed VM" - value = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address - } - - # IP of vSphere instance copied to a file ip.txt in local system - - resource "local_file" "ip" { - content = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address - filename = "ip.txt" - } - - #Connecting to the Ansible control node using SSH connection - - resource "null_resource" "nullremote1" { - depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] - connection { - type = "ssh" - user = "root" - password = var.ansiblepassword - host = var.ansiblehost - - } - - # Copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/vsphere/ip.txt" - } - } - - resource "null_resource" "nullremote2" { - depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] - connection { - type = "ssh" - user = "root" - password = var.ansiblepassword - host = var.ansiblehost - } - - # Command to run ansible playbook on remote Linux OS - - provisioner "remote-exec" { - - inline = [ - "cd /root/vsphere/", - "ansible-playbook instance.yml" - ] - } - } - - -versions.tf - -.. code-block:: none - - # Copyright (c) HashiCorp, Inc. - # SPDX-License-Identifier: MPL-2.0 - - terraform { - required_providers { - vsphere = { - source = "hashicorp/vsphere" - version = "2.4.0" - } - } - } - -var.tf - -.. code-block:: none - - # Copyright (c) HashiCorp, Inc. - # SPDX-License-Identifier: MPL-2.0 - - variable "vsphere_server" { - description = "vSphere server" - type = string - } - - variable "vsphere_user" { - description = "vSphere username" - type = string - } - - variable "vsphere_password" { - description = "vSphere password" - type = string - sensitive = true - } - - variable "datacenter" { - description = "vSphere data center" - type = string - } - - variable "cluster" { - description = "vSphere cluster" - type = string - } - - variable "datastore" { - description = "vSphere datastore" - type = string - } - - variable "network_name" { - description = "vSphere network name" - type = string - } - - variable "host" { - description = "name if yor host" - type = string - } - - variable "remotename" { - description = "the name of you VM" - type = string - } - - variable "url_ova" { - description = "the URL to .OVA file or cloude store" - type = string - } - - variable "ansiblepassword" { - description = "Ansible password" - type = string - } - - variable "ansiblehost" { - description = "Ansible host name or IP" - type = string - } - -terraform.tfvars - -.. code-block:: none - - vsphere_user = "" - vsphere_password = "" - vsphere_server = "" - datacenter = "" - datastore = "" - cluster = "" - network_name = "" - host = "" - url_ova = "" - ansiblepassword = "" - ansiblehost = "" - remotename = "" - - -Structure of files Ansible for vSphere --------------------------------------- - -.. code-block:: none - - . - ├── group_vars - └── all - ├── ansible.cfg - └── instance.yml - - -File contents of Ansible for vSphere ------------------------------------- - -ansible.cfg - -.. code-block:: none - - [defaults] - inventory = /root/vsphere/ip.txt - host_key_checking= False - remote_user=vyos - - -instance.yml - -.. code-block:: none - - ############################################################################## - # About tasks: - # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds - # "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node - # You have to add all necessary cammans of VyOS under the block "lines:" - ############################################################################## - - - - name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server 8.8.8.8 - save: - true - - -group_vars/all - -.. code-block:: none - - ansible_connection: ansible.netcommon.network_cli - ansible_network_os: vyos.vyos.vyos - - # user and password gets from terraform variables "admin_username" and "admin_password" - ansible_user: vyos - # get from vyos.tf "vapp" - ansible_ssh_pass: 12345678 - - -Sourse files for vSphere from GIT ---------------------------------- - -All files about the article can be found here_ - -.. _here: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Vsphere_terraform_ansible_single_vyos_instance-main - diff --git a/docs/automation/terraform/terraformvyos.md b/docs/automation/terraform/terraformvyos.md new file mode 100644 index 00000000..cb1ca1ee --- /dev/null +++ b/docs/automation/terraform/terraformvyos.md @@ -0,0 +1,37 @@ +--- +lastproofread: '2024-03-03' +--- + +(terraformvyos)= + +# Terraform for VyOS + +VyOS supports development infrastructure via Terraform and provisioning via Ansible. +Terraform allows you to automate the process of deploying instances on many cloud and virtual platforms. +In this article, we will look at using terraforms to deploy VyOS on platforms - AWS, Azure, and vSphere. +For more details about Terraform please have a look here [link]. + +Need to [install] Terraform + +Structure of files in the standard Terraform project: + +```none +. +├── main.tf # The main script +├── version.tf # File for the changing version of Terraform. +├── variables.tf # The file of all variables in "main.tf" +└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) +``` + +General commands that we will use for running Terraform scripts + +```none +cd / # go to the Terrafom project +terraform init # install all addons and provider (aws az and so on) +terraform plan # show what is changing +terraform apply # run script +yes # apply running +``` + +[install]: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli +[link]: https://developer.hashicorp.com/terraform/intro diff --git a/docs/automation/terraform/terraformvyos.rst b/docs/automation/terraform/terraformvyos.rst deleted file mode 100644 index 42dc7492..00000000 --- a/docs/automation/terraform/terraformvyos.rst +++ /dev/null @@ -1,39 +0,0 @@ -:lastproofread: 2024-03-03 - -.. _terraformvyos: - -Terraform for VyOS -================== - -VyOS supports development infrastructure via Terraform and provisioning via Ansible. -Terraform allows you to automate the process of deploying instances on many cloud and virtual platforms. -In this article, we will look at using terraforms to deploy VyOS on platforms - AWS, Azure, and vSphere. -For more details about Terraform please have a look here link_. - -Need to install_ Terraform - -Structure of files in the standard Terraform project: - -.. code-block:: none - - . - ├── main.tf # The main script - ├── version.tf # File for the changing version of Terraform. - ├── variables.tf # The file of all variables in "main.tf" - └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) - - -General commands that we will use for running Terraform scripts - - -.. code-block:: none - - cd / # go to the Terrafom project - terraform init # install all addons and provider (aws az and so on) - terraform plan # show what is changing - terraform apply # run script - yes # apply running - - -.. _link: https://developer.hashicorp.com/terraform/intro -.. _install: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli \ No newline at end of file diff --git a/docs/automation/vyos-ansible.md b/docs/automation/vyos-ansible.md new file mode 100644 index 00000000..64efddb3 --- /dev/null +++ b/docs/automation/vyos-ansible.md @@ -0,0 +1,89 @@ +--- +lastproofread: '2023-01-16' +--- + +(vyos-ansible)= + +# Ansible + +VyOS supports configuration via ansible. +Need to install `ansible` and `python3-paramiko` module + +Structure of files + +```none +. +├── ansible.cfg +├── files +│   └── id_rsa_docker.pub +├── hosts +└── main.yml +``` + +## File contents + +ansible.cfg + +```none +[defaults] +host_key_checking = no +retry_files_enabled = False +ANSIBLE_INVENTORY_UNPARSED_FAILED = true +``` + +id_rsa_docker.pub. Needs to declare only public key exactly. + +```none +AAAAB3NzaC1yc2EAAAADAQABAAABAQCoDgfhQJuJRFWJijHn7ZinZ3NWp4hWVrt7HFcvn0kgtP/5PeCtMt +``` + +hosts + +```none +[vyos_hosts] +r11 ansible_ssh_host=192.0.2.11 + +[vyos_hosts:vars] +ansible_python_interpreter=/usr/bin/python3 +ansible_user=vyos +ansible_ssh_pass=vyos +ansible_network_os=vyos +ansible_connection=network_cli +``` + +main.yml + +```none +--- + +- hosts: r11 + + connection: network_cli + gather_facts: 'no' + + tasks: + - name: Configure remote r11 + vyos_config: + lines: + - set system host-name r11 + - set system name-server 203.0.113.254 + - set service ssh disable-host-validation + - set system login user vyos authentication public-keys docker@work type ssh-rsa + - set system login user vyos authentication public-keys docker@work key "{{ lookup('file', 'id_rsa_docker.pub') }}" + - set system time-zone America/Los_Angeles + - set interfaces ethernet eth0 description WAN +``` + +## Run ansible + +```none +$ ansible-playbook -i hosts main.yml + +PLAY [r11] ****************************************************************************************************************************************************************************************************** + +TASK [Configure remote r11] ************************************************************************************************************************************************************************************* +changed: [r11] + +PLAY RECAP ***************************************************************************************************************************************************************************************************** +r11 : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +``` diff --git a/docs/automation/vyos-ansible.rst b/docs/automation/vyos-ansible.rst deleted file mode 100644 index 0ebcb924..00000000 --- a/docs/automation/vyos-ansible.rst +++ /dev/null @@ -1,93 +0,0 @@ -:lastproofread: 2023-01-16 - -.. _vyos-ansible: - -Ansible -======= - -VyOS supports configuration via ansible. -Need to install ``ansible`` and ``python3-paramiko`` module - -Structure of files - -.. code-block:: none - - . - ├── ansible.cfg - ├── files - │   └── id_rsa_docker.pub - ├── hosts - └── main.yml - - -File contents -------------- - -ansible.cfg - -.. code-block:: none - - [defaults] - host_key_checking = no - retry_files_enabled = False - ANSIBLE_INVENTORY_UNPARSED_FAILED = true - -id_rsa_docker.pub. Needs to declare only public key exactly. - -.. code-block:: none - - AAAAB3NzaC1yc2EAAAADAQABAAABAQCoDgfhQJuJRFWJijHn7ZinZ3NWp4hWVrt7HFcvn0kgtP/5PeCtMt - - -hosts - -.. code-block:: none - - [vyos_hosts] - r11 ansible_ssh_host=192.0.2.11 - - [vyos_hosts:vars] - ansible_python_interpreter=/usr/bin/python3 - ansible_user=vyos - ansible_ssh_pass=vyos - ansible_network_os=vyos - ansible_connection=network_cli - -main.yml - -.. code-block:: none - - --- - - - hosts: r11 - - connection: network_cli - gather_facts: 'no' - - tasks: - - name: Configure remote r11 - vyos_config: - lines: - - set system host-name r11 - - set system name-server 203.0.113.254 - - set service ssh disable-host-validation - - set system login user vyos authentication public-keys docker@work type ssh-rsa - - set system login user vyos authentication public-keys docker@work key "{{ lookup('file', 'id_rsa_docker.pub') }}" - - set system time-zone America/Los_Angeles - - set interfaces ethernet eth0 description WAN - -Run ansible ------------ - -.. code-block:: none - - $ ansible-playbook -i hosts main.yml - - PLAY [r11] ****************************************************************************************************************************************************************************************************** - - TASK [Configure remote r11] ************************************************************************************************************************************************************************************* - changed: [r11] - - PLAY RECAP ***************************************************************************************************************************************************************************************************** - r11 : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - diff --git a/docs/automation/vyos-api.md b/docs/automation/vyos-api.md new file mode 100644 index 00000000..df26aed9 --- /dev/null +++ b/docs/automation/vyos-api.md @@ -0,0 +1,383 @@ +--- +lastproofread: '2023-01-16' +--- + +(vyosapi)= + +# VyOS API + +For configuration and enabling the API see {ref}`http-api` + +## Authentication + +All endpoints only listen on HTTP POST requests and the API KEY must set as +`key` in the formdata. + +Below see one example for curl and one for python. +The rest of the documentation is reduced to curl. + +```none +curl --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "showConfig", "path": []}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' +``` + +```python +import requests +url = "https://vyos/retrieve" +payload={'data': '{"op": "showConfig", "path": []}', + 'key': 'MY-HTTPS-API-PLAINTEXT-KEY' + } +headers = {} +response = requests.request("POST", url, headers=headers, data=payload) +print(response.text) +``` + +## API Endpoints + +### /retrieve + +With the `retrieve` endpoint you get parts or the whole configuration. + +To get the whole configuration, pass an empty list to the `path` field + +```none +curl --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "showConfig", "path": []}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + + +response (shorted) +{ + "success": true, + "data": { + "interfaces": { + "ethernet": { + "eth0": { + "address": "dhcp", + "duplex": "auto", + "hw-id": "50:00:00:01:00:00", + "speed": "auto" + }, + "eth1": { + "duplex": "auto", + "hw-id": "50:00:00:01:00:01", + "speed": "auto" + ... + }, + "error": null +} +``` + +To only get a part of the configuration, for example `system syslog`. + +```none +curl -k --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "showConfig", "path": ["system", "syslog"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + + +response: +{ + "success": true, + "data": { + "global": { + "facility": { + "all": { + "level": "info" + }, + "protocols": { + "level": "debug" + } + } + } + }, + "error": null +} +``` + +if you just want the Value of a multi-valued node, use the `returnValues` +operation. + +For example, get the addresses of a `dum0` interface. + +```none +curl -k --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "returnValues", "path": ["interfaces","dummy","dum0","address"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +respone: +{ + "success": true, + "data": [ + "10.10.10.10/24", + "10.10.10.11/24", + "10.10.10.12/24" + ], + "error": null +} +``` + +To check existence of a configuration path, use the `exists` operation. + +For example, check an existing path: + +```none +curl -k --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "exists", "path": ["service","https","api"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": true, + "error": null +} +``` + +versus a non-existent path: + +```none +curl -k --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "exists", "path": ["service","non","existent","path"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": false, + "error": null +} +``` + +### /reset + +The `reset` endpoint run a `reset` command. + +```none +curl --location --request POST 'https://vyos/reset' \ +--form data='{"op": "reset", "path": ["ip", "bgp", "192.0.2.11"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +respone: +{ + "success": true, + "data": "", + "error": null +} +``` + +### /reboot + +To initiate a reboot use the `reboot` endpoint. + +```none +curl --location --request POST 'https://vyos/reboot' \ +--form data='{"op": "reboot", "path": ["now"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +respone: +{ + "success": true, + "data": "", + "error": null +} +``` + +### /poweroff + +To power off the system use the `poweroff` endpoint. + +```none +curl --location --request POST 'https://vyos/poweroff' \ +--form data='{"op": "poweroff", "path": ["now"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +respone: +{ + "success": true, + "data": "", + "error": null +} +``` + +### /image + +To add or delete an image, use the `/image` endpoint. + +add an image + +```none +curl -k --location --request POST 'https://vyos/image' \ +--form data='{"op": "add", "url": "https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +respone (shorted): +{ + "success": true, + "data": "Trying to fetch ISO file from https://downloads.vyos.io/rolling-latest.iso\n + ... + Setting up grub configuration...\nDone.\n", + "error": null +} +``` + +delete an image, for example `1.3-rolling-202006070117` + +```none +curl -k --location --request POST 'https://vyos/image' \ +--form data='{"op": "delete", "name": "1.3-rolling-202006070117"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "Deleting the \"1.3-rolling-202006070117\" image...\nDone\n", + "error": null +} +``` + +### /show + +The `/show` endpoint is to show everything in the operational mode. + +For example, show which images are installed. + +```none +curl -k --location --request POST 'https://vyos/show' \ +--form data='{"op": "show", "path": ["system", "image"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "The system currently has the following image(s) installed:\n\n + 1: 1.4-rolling-202102280559 (default boot)\n + 2: 1.4-rolling-202102230218\n + 3: 1.3-beta-202102210443\n\n", + "error": null +} +``` + +### /generate + +The `generate` endpoint run a `generate` command. + +```none +curl -k --location --request POST 'https://vyos/generate' \ +--form data='{"op": "generate", "path": ["pki", "wireguard", "key-pair"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "Private key: CFZR2eyhoVZwk4n3JFPMJx3E145f1EYgDM+ubytXYVY=\n + Public key: jjtpPT8ycI1Q0bNtrWuxAkO4k88Xwzg5VHV9xGZ58lU=\n\n", + "error": null +} +``` + +### /configure + +You can pass a `set`, `delete` or `comment` command to the +`/configure` endpoint. + +`set` a single command + +```none +curl -k --location --request POST 'https://vyos/configure' \ +--form data='{"op": "set", "path": ["interfaces", "dummy", "dum1", "address", "10.11.0.1/32"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` + +`delete` a single command + +```none +curl -k --location --request POST 'https://vyos/configure' \ +--form data='{"op": "delete", "path": ["interfaces", "dummy", "dum1", "address", "10.11.0.1/32"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` + +The API pushes every request to a session and commit it. +But some of VyOS components like DHCP and PPPoE Servers, IPSec, VXLAN, and +other tunnels require full configuration for commit. +The endpoint will process multiple commands when you pass them as a list to +the `data` field. + +```none +curl -k --location --request POST 'https://vyos/configure' \ +--form data='[{"op": "set","path":["interfaces","vxlan","vxlan1","remote","203.0.113.99"]}, {"op": "set","path":["interfaces","vxlan","vxlan1","vni","1"]}]' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` + +### /config-file + +The endpoint `/config-file` is to save or load a configuration. + +Save a running configuration to the startup configuration. +When you don't specify the file when saving, it saves to +`/config/config.boot`. + +```none +curl -k --location --request POST 'https://vyos/config-file' \ +--form data='{"op": "save"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "Saving configuration to '/config/config.boot'...\nDone\n", + "error": null +} +``` + +Save a running configuration to a file. + +```none +curl -k --location --request POST 'https://vyos/config-file' \ +--form data='{"op": "save", "file": "/config/test.config"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "Saving configuration to '/config/test.config'...\nDone\n", + "error": null +} +``` + +To Load a configuration file. + +```none +curl -k --location --request POST 'https://vyos/config-file' \ +--form data='{"op": "load", "file": "/config/test.config"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` diff --git a/docs/automation/vyos-api.rst b/docs/automation/vyos-api.rst deleted file mode 100644 index 60247fae..00000000 --- a/docs/automation/vyos-api.rst +++ /dev/null @@ -1,406 +0,0 @@ -:lastproofread: 2023-01-16 - -.. _vyosapi: - -######## -VyOS API -######## - -For configuration and enabling the API see :ref:`http-api` - -************** -Authentication -************** - -All endpoints only listen on HTTP POST requests and the API KEY must set as -``key`` in the formdata. - -Below see one example for curl and one for python. -The rest of the documentation is reduced to curl. - -.. code-block:: none - - curl --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "showConfig", "path": []}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - -.. code-block:: python - - import requests - url = "https://vyos/retrieve" - payload={'data': '{"op": "showConfig", "path": []}', - 'key': 'MY-HTTPS-API-PLAINTEXT-KEY' - } - headers = {} - response = requests.request("POST", url, headers=headers, data=payload) - print(response.text) - - -************* -API Endpoints -************* - -/retrieve -========= - -With the ``retrieve`` endpoint you get parts or the whole configuration. - -To get the whole configuration, pass an empty list to the ``path`` field - -.. code-block:: none - - curl --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "showConfig", "path": []}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - - response (shorted) - { - "success": true, - "data": { - "interfaces": { - "ethernet": { - "eth0": { - "address": "dhcp", - "duplex": "auto", - "hw-id": "50:00:00:01:00:00", - "speed": "auto" - }, - "eth1": { - "duplex": "auto", - "hw-id": "50:00:00:01:00:01", - "speed": "auto" - ... - }, - "error": null - } - - -To only get a part of the configuration, for example ``system syslog``. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "showConfig", "path": ["system", "syslog"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - - response: - { - "success": true, - "data": { - "global": { - "facility": { - "all": { - "level": "info" - }, - "protocols": { - "level": "debug" - } - } - } - }, - "error": null - } - -if you just want the Value of a multi-valued node, use the ``returnValues`` -operation. - -For example, get the addresses of a ``dum0`` interface. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "returnValues", "path": ["interfaces","dummy","dum0","address"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - respone: - { - "success": true, - "data": [ - "10.10.10.10/24", - "10.10.10.11/24", - "10.10.10.12/24" - ], - "error": null - } - -To check existence of a configuration path, use the ``exists`` operation. - -For example, check an existing path: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "exists", "path": ["service","https","api"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": true, - "error": null - } - -versus a non-existent path: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "exists", "path": ["service","non","existent","path"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": false, - "error": null - } - -/reset -====== - -The ``reset`` endpoint run a ``reset`` command. - -.. code-block:: none - - curl --location --request POST 'https://vyos/reset' \ - --form data='{"op": "reset", "path": ["ip", "bgp", "192.0.2.11"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - respone: - { - "success": true, - "data": "", - "error": null - } - -/reboot -======= - -To initiate a reboot use the ``reboot`` endpoint. - -.. code-block:: none - - curl --location --request POST 'https://vyos/reboot' \ - --form data='{"op": "reboot", "path": ["now"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - respone: - { - "success": true, - "data": "", - "error": null - } - -/poweroff -========= - -To power off the system use the ``poweroff`` endpoint. - -.. code-block:: none - - curl --location --request POST 'https://vyos/poweroff' \ - --form data='{"op": "poweroff", "path": ["now"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - respone: - { - "success": true, - "data": "", - "error": null - } - - -/image -====== - -To add or delete an image, use the ``/image`` endpoint. - -add an image - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/image' \ - --form data='{"op": "add", "url": "https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - respone (shorted): - { - "success": true, - "data": "Trying to fetch ISO file from https://downloads.vyos.io/rolling-latest.iso\n - ... - Setting up grub configuration...\nDone.\n", - "error": null - } - -delete an image, for example ``1.3-rolling-202006070117`` - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/image' \ - --form data='{"op": "delete", "name": "1.3-rolling-202006070117"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "Deleting the \"1.3-rolling-202006070117\" image...\nDone\n", - "error": null - } - - -/show -===== - -The ``/show`` endpoint is to show everything in the operational mode. - -For example, show which images are installed. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/show' \ - --form data='{"op": "show", "path": ["system", "image"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "The system currently has the following image(s) installed:\n\n - 1: 1.4-rolling-202102280559 (default boot)\n - 2: 1.4-rolling-202102230218\n - 3: 1.3-beta-202102210443\n\n", - "error": null - } - - -/generate -========= - -The ``generate`` endpoint run a ``generate`` command. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/generate' \ - --form data='{"op": "generate", "path": ["pki", "wireguard", "key-pair"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "Private key: CFZR2eyhoVZwk4n3JFPMJx3E145f1EYgDM+ubytXYVY=\n - Public key: jjtpPT8ycI1Q0bNtrWuxAkO4k88Xwzg5VHV9xGZ58lU=\n\n", - "error": null - } - - -/configure -========== - -You can pass a ``set``, ``delete`` or ``comment`` command to the -``/configure`` endpoint. - -``set`` a single command - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/configure' \ - --form data='{"op": "set", "path": ["interfaces", "dummy", "dum1", "address", "10.11.0.1/32"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } - - -``delete`` a single command - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/configure' \ - --form data='{"op": "delete", "path": ["interfaces", "dummy", "dum1", "address", "10.11.0.1/32"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } - -The API pushes every request to a session and commit it. -But some of VyOS components like DHCP and PPPoE Servers, IPSec, VXLAN, and -other tunnels require full configuration for commit. -The endpoint will process multiple commands when you pass them as a list to -the ``data`` field. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/configure' \ - --form data='[{"op": "set","path":["interfaces","vxlan","vxlan1","remote","203.0.113.99"]}, {"op": "set","path":["interfaces","vxlan","vxlan1","vni","1"]}]' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } - - -/config-file -============ - -The endpoint ``/config-file`` is to save or load a configuration. - -Save a running configuration to the startup configuration. -When you don't specify the file when saving, it saves to -``/config/config.boot``. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/config-file' \ - --form data='{"op": "save"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "Saving configuration to '/config/config.boot'...\nDone\n", - "error": null - } - - -Save a running configuration to a file. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/config-file' \ - --form data='{"op": "save", "file": "/config/test.config"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "Saving configuration to '/config/test.config'...\nDone\n", - "error": null - } - - -To Load a configuration file. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/config-file' \ - --form data='{"op": "load", "file": "/config/test.config"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } diff --git a/docs/automation/vyos-napalm.md b/docs/automation/vyos-napalm.md new file mode 100644 index 00000000..8ca78813 --- /dev/null +++ b/docs/automation/vyos-napalm.md @@ -0,0 +1,142 @@ +--- +lastproofread: '2023-01-16' +--- + +(vyos-napalm)= + +# Napalm + +VyOS supports some [napalm] functions for configuration and op-mode. +It requires more tests. + +Install `napalm-vyos` module + +```none +apt install python3-pip +pip3 install napalm +pip3 install napalm-vyos +``` + +## Op-mode + +```none +#!/usr/bin/env python3 + +import json +from napalm import get_network_driver + +driver = get_network_driver('vyos') + +vyos_router = driver( + hostname="192.0.2.1", + username="vyos", + password="vyospass", + optional_args={"port": 22}, +) + +vyos_router.open() +output = vyos_router.get_facts() +print(json.dumps(output, indent=4)) + +output = vyos_router.get_arp_table() +print(json.dumps(output, indent=4)) + +vyos_router.close() +``` + +Output op-mode + +```none +$ ./vyos-napalm.py +{ + "uptime": 7185, + "vendor": "VyOS", + "os_version": "1.3.0-rc5", + "serial_number": "", + "model": "Standard PC (Q35 + ICH9, 2009)", + "hostname": "r4-1.3", + "fqdn": "vyos.local", + "interface_list": [ + "eth0", + "eth1", + "eth2", + "lo", + "vtun10" + ] +} +[ + { + "interface": "eth1", + "mac": "52:54:00:b2:38:2c", + "ip": "192.0.2.2", + "age": 0.0 + }, + { + "interface": "eth0", + "mac": "52:54:00:a2:b9:5b", + "ip": "203.0.113.11", + "age": 0.0 + } +] +``` + +## Configuration + +We need 2 files, commands.conf and script itself. + +Content of commands.conf + +```none +set service ssh disable-host-validation +set service ssh port '2222' +set system name-server '192.0.2.8' +set system name-server '203.0.113.8' +set interfaces ethernet eth1 description 'FOO' +``` + +Script vyos-napalm.py + +```none +#!/usr/bin/env python3 + +from napalm import get_network_driver + +driver = get_network_driver('vyos') + +vyos_router = driver( + hostname="192.0.2.1", + username="vyos", + password="vyospass", + optional_args={"port": 22}, +) + +vyos_router.open() +vyos_router.load_merge_candidate(filename='commands.conf') +diffs = vyos_router.compare_config() + +if bool(diffs) == True: + print(diffs) + vyos_router.commit_config() +else: + print('No configuration changes to commit') + vyos_router.discard_config() + +vyos_router.close() +``` + +Output + +```none +$./vyos-napalm.py +[edit interfaces ethernet eth1] ++description FOO +[edit service ssh] ++disable-host-validation ++port 2222 +[edit system] ++name-server 192.0.2.8 ++name-server 203.0.113.8 +[edit] +``` + +[napalm]: https://napalm.readthedocs.io/en/latest/base.html diff --git a/docs/automation/vyos-napalm.rst b/docs/automation/vyos-napalm.rst deleted file mode 100644 index 75e20b3c..00000000 --- a/docs/automation/vyos-napalm.rst +++ /dev/null @@ -1,144 +0,0 @@ -:lastproofread: 2023-01-16 - -.. _vyos-napalm: - -Napalm -====== - -VyOS supports some napalm_ functions for configuration and op-mode. -It requires more tests. - -Install ``napalm-vyos`` module - -.. code-block:: none - - apt install python3-pip - pip3 install napalm - pip3 install napalm-vyos - - -Op-mode -------- - -.. code-block:: none - - #!/usr/bin/env python3 - - import json - from napalm import get_network_driver - - driver = get_network_driver('vyos') - - vyos_router = driver( - hostname="192.0.2.1", - username="vyos", - password="vyospass", - optional_args={"port": 22}, - ) - - vyos_router.open() - output = vyos_router.get_facts() - print(json.dumps(output, indent=4)) - - output = vyos_router.get_arp_table() - print(json.dumps(output, indent=4)) - - vyos_router.close() - -Output op-mode - -.. code-block:: none - - $ ./vyos-napalm.py - { - "uptime": 7185, - "vendor": "VyOS", - "os_version": "1.3.0-rc5", - "serial_number": "", - "model": "Standard PC (Q35 + ICH9, 2009)", - "hostname": "r4-1.3", - "fqdn": "vyos.local", - "interface_list": [ - "eth0", - "eth1", - "eth2", - "lo", - "vtun10" - ] - } - [ - { - "interface": "eth1", - "mac": "52:54:00:b2:38:2c", - "ip": "192.0.2.2", - "age": 0.0 - }, - { - "interface": "eth0", - "mac": "52:54:00:a2:b9:5b", - "ip": "203.0.113.11", - "age": 0.0 - } - ] - -Configuration -------------- - -We need 2 files, commands.conf and script itself. - -Content of commands.conf - -.. code-block:: none - - set service ssh disable-host-validation - set service ssh port '2222' - set system name-server '192.0.2.8' - set system name-server '203.0.113.8' - set interfaces ethernet eth1 description 'FOO' - -Script vyos-napalm.py - -.. code-block:: none - - #!/usr/bin/env python3 - - from napalm import get_network_driver - - driver = get_network_driver('vyos') - - vyos_router = driver( - hostname="192.0.2.1", - username="vyos", - password="vyospass", - optional_args={"port": 22}, - ) - - vyos_router.open() - vyos_router.load_merge_candidate(filename='commands.conf') - diffs = vyos_router.compare_config() - - if bool(diffs) == True: - print(diffs) - vyos_router.commit_config() - else: - print('No configuration changes to commit') - vyos_router.discard_config() - - vyos_router.close() - -Output - -.. code-block:: none - - $./vyos-napalm.py - [edit interfaces ethernet eth1] - +description FOO - [edit service ssh] - +disable-host-validation - +port 2222 - [edit system] - +name-server 192.0.2.8 - +name-server 203.0.113.8 - [edit] - -.. _napalm: https://napalm.readthedocs.io/en/latest/base.html \ No newline at end of file diff --git a/docs/automation/vyos-netmiko.md b/docs/automation/vyos-netmiko.md new file mode 100644 index 00000000..da042b6c --- /dev/null +++ b/docs/automation/vyos-netmiko.md @@ -0,0 +1,72 @@ +--- +lastproofread: '2023-01-16' +--- + +(vyos-netmiko)= + +# Netmiko + +VyOS supports configuration via [netmiko]. +It requires to install `python3-netmiko` module. + +## Example + +```none +#!/usr/bin/env python3 + +from netmiko import ConnectHandler + +vyos_router = { + "device_type": "vyos", + "host": "192.0.2.1", + "username": "vyos", + "password": "vyospass", + "port": 22, + } + +net_connect = ConnectHandler(**vyos_router) + +config_commands = [ + 'set interfaces ethernet eth0 description WAN', + 'set interfaces ethernet eth1 description LAN', + ] + +# set configuration +output = net_connect.send_config_set(config_commands, exit_config_mode=False) +print(output) + +# commit configuration +output = net_connect.commit() +print(output) + +# op-mode commands +output = net_connect.send_command("run show interfaces") +print(output) +``` + +Output + +```none +$ ./vyos-netmiko.py +configure +set interfaces ethernet eth0 description WAN +[edit] +vyos@r4-1.3# set interfaces ethernet eth1 description LAN +[edit] +vyos@r4-1.3# +commit +[edit] +vyos@r4-1.3# +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 203.0.113.1/24 u/u WAN +eth1 192.0.2.1/30 u/u LAN +eth2 - u/u +lo 127.0.0.1/8 u/u + ::1/128 +vtun10 10.10.0.1/24 u/u +[edit] +``` + +[netmiko]: https://github.com/ktbyers/netmiko diff --git a/docs/automation/vyos-netmiko.rst b/docs/automation/vyos-netmiko.rst deleted file mode 100644 index 075b0f34..00000000 --- a/docs/automation/vyos-netmiko.rst +++ /dev/null @@ -1,72 +0,0 @@ -:lastproofread: 2023-01-16 - -.. _vyos-netmiko: - -Netmiko -======= - -VyOS supports configuration via netmiko_. -It requires to install ``python3-netmiko`` module. - -Example -------- - -.. code-block:: none - - #!/usr/bin/env python3 - - from netmiko import ConnectHandler - - vyos_router = { - "device_type": "vyos", - "host": "192.0.2.1", - "username": "vyos", - "password": "vyospass", - "port": 22, - } - - net_connect = ConnectHandler(**vyos_router) - - config_commands = [ - 'set interfaces ethernet eth0 description WAN', - 'set interfaces ethernet eth1 description LAN', - ] - - # set configuration - output = net_connect.send_config_set(config_commands, exit_config_mode=False) - print(output) - - # commit configuration - output = net_connect.commit() - print(output) - - # op-mode commands - output = net_connect.send_command("run show interfaces") - print(output) - -Output - -.. code-block:: none - - $ ./vyos-netmiko.py - configure - set interfaces ethernet eth0 description WAN - [edit] - vyos@r4-1.3# set interfaces ethernet eth1 description LAN - [edit] - vyos@r4-1.3# - commit - [edit] - vyos@r4-1.3# - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 203.0.113.1/24 u/u WAN - eth1 192.0.2.1/30 u/u LAN - eth2 - u/u - lo 127.0.0.1/8 u/u - ::1/128 - vtun10 10.10.0.1/24 u/u - [edit] - -.. _netmiko: https://github.com/ktbyers/netmiko diff --git a/docs/automation/vyos-salt.md b/docs/automation/vyos-salt.md new file mode 100644 index 00000000..42e7bd6e --- /dev/null +++ b/docs/automation/vyos-salt.md @@ -0,0 +1,209 @@ +--- +lastproofread: '2023-01-16' +--- + +(vyos-salt)= + +```{include} /_include/need_improvement.txt +``` + +# Salt + +VyOS supports op-mode and configuration via [salt]. + +Without proxy it requires VyOS minion configuration +and supports op-mode data: + +```none +set service salt-minion id 'r14' +set service salt-minion master '192.0.2.250' +``` + +Check salt-keys on the salt master + +```none +/ # salt-key --list-all +Accepted Keys: +r11 +Denied Keys: +Unaccepted Keys: +r14 +Rejected Keys: +``` + +Accept minion key + +```none +/ # salt-key --accept r14 +The following keys are going to be accepted: +Unaccepted Keys: +r14 +Proceed? [n/Y] y +Key for minion r14 accepted. +``` + +Check that salt master can communicate with minions + +```none +/ # salt '*' test.ping +r14: + True +r11: + True +``` + +At this step we can get some op-mode information from VyOS nodes: + +```none +/ # salt '*' network.interface eth0 +r11: + |_ + ---------- + address: + 192.0.2.11 + broadcast: + 192.0.2.255 + label: + eth0 + netmask: + 255.255.255.0 +r14: + |_ + ---------- + address: + 192.0.2.14 + broadcast: + 192.0.2.255 + label: + eth0 + netmask: + 255.255.255.0 + + +/ # salt r14 network.arp +r14: + ---------- + aa:bb:cc:dd:f3:db: + 192.0.2.1 + aa:bb:cc:dd:2e:80: + 203.0.113.1 +``` + +## Netmiko-proxy + +It is possible to configure VyOS via [netmiko] proxy module. +It requires a minion with installed packet `python3-netmiko` module +who has a connection to VyOS nodes. Salt-minion have to communicate +with salt master + +### Configuration + +Salt master configuration: + +```none +/ # cat /etc/salt/master +file_roots: + base: + - /srv/salt/states + +pillar_roots: + base: + - /srv/salt/pillars +``` + +Structure of /srv/salt: + +```none +/ # tree /srv/salt/ +/srv/salt/ +|___ pillars +| |__ r11-proxy.sls +| |__ top.sls +|___ states + |__ commands.txt +``` + +top.sls + +```none +/ # cat /srv/salt/pillars/top.sls +base: + r11-proxy: + - r11-proxy +``` + +r11-proxy.sls Includes parameters for connecting to salt-proxy minion + +```none +/ # cat /srv/salt/pillars/r11-proxy.sls +proxy: + proxytype: netmiko # how to connect to proxy minion, change it + device_type: vyos # + host: 192.0.2.250 + username: user + password: secret_passwd +``` + +commands.txt + +```none +/ # cat /srv/salt/states/commands.txt +set interfaces ethernet eth0 description 'WAN' +set interfaces ethernet eth1 description 'LAN' +``` + +Check that proxy minion is alive: + +```none +/ # salt r11-proxy test.ping +r11-proxy: + True +/ # +``` + +### Examples + +Example of op-mode: + +```none +/ # salt r11-proxy netmiko.send_command 'show interfaces ethernet eth0 brief' host=192.0.2.14 device_type=vyos username=vyos password=vyos +r11-proxy: + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 192.0.2.14/24 u/u Upstream +/ # +``` + +Example of configuration: + +```none +/ # salt r11-proxy netmiko.send_config config_commands=['set interfaces ethernet eth0 description Link_to_WAN'] commit=True host=192.0.2.14 device_type=vyos username=vyos password=vyos +r11-proxy: + configure + set interfaces ethernet eth0 description Link_to_WAN + [edit] + vyos@r14# commit + [edit] + vyos@r14# +/ # +``` + +Example of configuration commands from the file "/srv/salt/states/commands.txt" + +```none +/ # salt r11-proxy netmiko.send_config config_file=salt://commands.txt commit=True host=192.0.2.11 device_type=vyos username=vyos password=vyos +r11-proxy: + configure + set interfaces ethernet eth0 description 'WAN' + [edit] + vyos@r1# set interfaces ethernet eth1 description 'LAN' + [edit] + vyos@r1# commit + [edit] + vyos@r1# +/ # +``` + +[netmiko]: https://docs.saltproject.io/en/latest/ref/modules/all/salt.modules.netmiko_mod.html#module-salt.modules.netmiko_mod +[salt]: https://docs.saltproject.io/en/latest/contents.html diff --git a/docs/automation/vyos-salt.rst b/docs/automation/vyos-salt.rst deleted file mode 100644 index 12be32a1..00000000 --- a/docs/automation/vyos-salt.rst +++ /dev/null @@ -1,216 +0,0 @@ -:lastproofread: 2023-01-16 - -.. _vyos-salt: - -.. include:: /_include/need_improvement.txt - -Salt -==== - -VyOS supports op-mode and configuration via salt_. - -Without proxy it requires VyOS minion configuration -and supports op-mode data: - -.. code-block:: none - - set service salt-minion id 'r14' - set service salt-minion master '192.0.2.250' - -Check salt-keys on the salt master - -.. code-block:: none - - / # salt-key --list-all - Accepted Keys: - r11 - Denied Keys: - Unaccepted Keys: - r14 - Rejected Keys: - -Accept minion key - -.. code-block:: none - - / # salt-key --accept r14 - The following keys are going to be accepted: - Unaccepted Keys: - r14 - Proceed? [n/Y] y - Key for minion r14 accepted. - - - -Check that salt master can communicate with minions - -.. code-block:: none - - / # salt '*' test.ping - r14: - True - r11: - True - -At this step we can get some op-mode information from VyOS nodes: - -.. code-block:: none - - / # salt '*' network.interface eth0 - r11: - |_ - ---------- - address: - 192.0.2.11 - broadcast: - 192.0.2.255 - label: - eth0 - netmask: - 255.255.255.0 - r14: - |_ - ---------- - address: - 192.0.2.14 - broadcast: - 192.0.2.255 - label: - eth0 - netmask: - 255.255.255.0 - - - / # salt r14 network.arp - r14: - ---------- - aa:bb:cc:dd:f3:db: - 192.0.2.1 - aa:bb:cc:dd:2e:80: - 203.0.113.1 - - - - -Netmiko-proxy -------------- - -It is possible to configure VyOS via netmiko_ proxy module. -It requires a minion with installed packet ``python3-netmiko`` module -who has a connection to VyOS nodes. Salt-minion have to communicate -with salt master - -Configuration -^^^^^^^^^^^^^ - -Salt master configuration: - -.. code-block:: none - - / # cat /etc/salt/master - file_roots: - base: - - /srv/salt/states - - pillar_roots: - base: - - /srv/salt/pillars - -Structure of /srv/salt: - -.. code-block:: none - - / # tree /srv/salt/ - /srv/salt/ - |___ pillars - | |__ r11-proxy.sls - | |__ top.sls - |___ states - |__ commands.txt - -top.sls - -.. code-block:: none - - / # cat /srv/salt/pillars/top.sls - base: - r11-proxy: - - r11-proxy - - -r11-proxy.sls Includes parameters for connecting to salt-proxy minion - -.. code-block:: none - - / # cat /srv/salt/pillars/r11-proxy.sls - proxy: - proxytype: netmiko # how to connect to proxy minion, change it - device_type: vyos # - host: 192.0.2.250 - username: user - password: secret_passwd - -commands.txt - -.. code-block:: none - - / # cat /srv/salt/states/commands.txt - set interfaces ethernet eth0 description 'WAN' - set interfaces ethernet eth1 description 'LAN' - -Check that proxy minion is alive: - -.. code-block:: none - - / # salt r11-proxy test.ping - r11-proxy: - True - / # - -Examples -^^^^^^^^ - -Example of op-mode: - -.. code-block:: none - - / # salt r11-proxy netmiko.send_command 'show interfaces ethernet eth0 brief' host=192.0.2.14 device_type=vyos username=vyos password=vyos - r11-proxy: - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 192.0.2.14/24 u/u Upstream - / # - -Example of configuration: - -.. code-block:: none - - / # salt r11-proxy netmiko.send_config config_commands=['set interfaces ethernet eth0 description Link_to_WAN'] commit=True host=192.0.2.14 device_type=vyos username=vyos password=vyos - r11-proxy: - configure - set interfaces ethernet eth0 description Link_to_WAN - [edit] - vyos@r14# commit - [edit] - vyos@r14# - / # - -Example of configuration commands from the file "/srv/salt/states/commands.txt" - -.. code-block:: none - - / # salt r11-proxy netmiko.send_config config_file=salt://commands.txt commit=True host=192.0.2.11 device_type=vyos username=vyos password=vyos - r11-proxy: - configure - set interfaces ethernet eth0 description 'WAN' - [edit] - vyos@r1# set interfaces ethernet eth1 description 'LAN' - [edit] - vyos@r1# commit - [edit] - vyos@r1# - / # - -.. _salt: https://docs.saltproject.io/en/latest/contents.html -.. _netmiko: https://docs.saltproject.io/en/latest/ref/modules/all/salt.modules.netmiko_mod.html#module-salt.modules.netmiko_mod \ No newline at end of file diff --git a/docs/changelog/1.2.1.md b/docs/changelog/1.2.1.md new file mode 100644 index 00000000..967d566e --- /dev/null +++ b/docs/changelog/1.2.1.md @@ -0,0 +1,50 @@ +# 1.2.1 + +VyOS 1.2.1 is a maintenance release made in April 2019. + +## Resolved issues + +- Package updates: kernel 4.19.32, open-vm-tools 10.3, latest Intel NIC drivers +- {vytask}`T1326` The kernel now includes drivers for various USB serial + adapters, which allows people to add a serial console to a machine without + onboard RS232, or connect to something else from the router +- The collection of network card firmware is now much more extensive +- {vytask}`T1271` VRRP now correctly uses a virtual rather than physical MAC + addresses in the RFC-compliant mode +- {vytask}`T1330` DHCP WPAD URL option works correctly again +- {vytask}`T1312` Many to many NAT rules now can use source/destination and + translation networks of non-matching size. If 1:1 network bits translation is + desired, it's now users responsibility to check if prefix length matches. +- {vytask}`T1290` IPv6 network prefix translation is fixed +- {vytask}`T1308` Non-alphanumeric characters such as `>` can now be safely + used in PPPoE passwords +- {vytask}`T1305` `show | commands` no longer fails when a config section ends + with a leaf node such as `timezone` in `show system | commands` +- {vytask}`T1235` `show | commands` correctly works in config mode now +- {vytask}`T1298` VTI is now compatible with the DHCP-interface IPsec option +- {vytask}`T1277` `show dhcp server statistics` command was broken in latest + Crux +- {vytask}`T1261` An issue with TFTP server refusing to listen on addresses + other than loopback was fixed +- {vytask}`T1224` Template issue that might cause UDP broadcast relay fail to + start is fixed +- {vytask}`T1067` VXLAN value validation is improved +- {vytask}`T1211` Blank hostnames in DHCP updates no longer can crash DNS + forwarding +- {vytask}`T1322` Correct configuration is now generated for DHCPv6 relays with + more than one upstream interface +- {vytask}`T1234` `relay-agents-packets` option works correctly now +- {vytask}`T1231` Dynamic DNS data is now cleaned on configuration change +- {vytask}`T1282` Remote Syslog can now use a fully qualified domain name +- {vytask}`T1279` ACPI power off works again +- {vytask}`T1247` Negation in WAN load balancing rules works again +- {vytask}`T1218` FRR staticd now starts on boot correctly +- {vytask}`T1296` The installer now correctly detects SD card devices +- {vytask}`T1225` Wireguard peers can be disabled now +- {vytask}`T1217` The issue with Wireguard interfaces impossible to delete + is fixed +- {vytask}`T1160` Unintended IPv6 access is fixed in SNMP configuration +- {vytask}`T1060` It's now possible to exclude hosts from the transparent + web proxy +- {vytask}`T484` An issue with rules impossible to delete from the zone-based + firewall is fixed diff --git a/docs/changelog/1.2.1.rst b/docs/changelog/1.2.1.rst deleted file mode 100644 index 4f22dd0a..00000000 --- a/docs/changelog/1.2.1.rst +++ /dev/null @@ -1,52 +0,0 @@ -1.2.1 -===== - -VyOS 1.2.1 is a maintenance release made in April 2019. - -Resolved issues ---------------- - -* Package updates: kernel 4.19.32, open-vm-tools 10.3, latest Intel NIC drivers -* :vytask:`T1326` The kernel now includes drivers for various USB serial - adapters, which allows people to add a serial console to a machine without - onboard RS232, or connect to something else from the router -* The collection of network card firmware is now much more extensive -* :vytask:`T1271` VRRP now correctly uses a virtual rather than physical MAC - addresses in the RFC-compliant mode -* :vytask:`T1330` DHCP WPAD URL option works correctly again -* :vytask:`T1312` Many to many NAT rules now can use source/destination and - translation networks of non-matching size. If 1:1 network bits translation is - desired, it's now users responsibility to check if prefix length matches. -* :vytask:`T1290` IPv6 network prefix translation is fixed -* :vytask:`T1308` Non-alphanumeric characters such as ``>`` can now be safely - used in PPPoE passwords -* :vytask:`T1305` ``show | commands`` no longer fails when a config section ends - with a leaf node such as ``timezone`` in ``show system | commands`` -* :vytask:`T1235` ``show | commands`` correctly works in config mode now -* :vytask:`T1298` VTI is now compatible with the DHCP-interface IPsec option -* :vytask:`T1277` ``show dhcp server statistics`` command was broken in latest - Crux -* :vytask:`T1261` An issue with TFTP server refusing to listen on addresses - other than loopback was fixed -* :vytask:`T1224` Template issue that might cause UDP broadcast relay fail to - start is fixed -* :vytask:`T1067` VXLAN value validation is improved -* :vytask:`T1211` Blank hostnames in DHCP updates no longer can crash DNS - forwarding -* :vytask:`T1322` Correct configuration is now generated for DHCPv6 relays with - more than one upstream interface -* :vytask:`T1234` ``relay-agents-packets`` option works correctly now -* :vytask:`T1231` Dynamic DNS data is now cleaned on configuration change -* :vytask:`T1282` Remote Syslog can now use a fully qualified domain name -* :vytask:`T1279` ACPI power off works again -* :vytask:`T1247` Negation in WAN load balancing rules works again -* :vytask:`T1218` FRR staticd now starts on boot correctly -* :vytask:`T1296` The installer now correctly detects SD card devices -* :vytask:`T1225` Wireguard peers can be disabled now -* :vytask:`T1217` The issue with Wireguard interfaces impossible to delete - is fixed -* :vytask:`T1160` Unintended IPv6 access is fixed in SNMP configuration -* :vytask:`T1060` It's now possible to exclude hosts from the transparent - web proxy -* :vytask:`T484` An issue with rules impossible to delete from the zone-based - firewall is fixed \ No newline at end of file diff --git a/docs/changelog/1.2.2.md b/docs/changelog/1.2.2.md new file mode 100644 index 00000000..972a38be --- /dev/null +++ b/docs/changelog/1.2.2.md @@ -0,0 +1,43 @@ +# 1.2.2 + +1.2.2 is a maintenance release made in July 2019. + +## New features + +- Options for per-interface MSS clamping. +- BGP extended next-hop capability +- Relaxed BGP multipath option +- Internal and external options for "remote-as" (accept any AS as long as it's + the same to this router or different, respectively) +- "Unnumbered" (interface-based) BGP peers +- BGP no-prepend option +- Additive BGP community option +- OSPFv3 network type option +- Custom arguments for VRRP scripts +- A script for querying values from config files + +## Resolved issues + +- Linux kernel 4.19.54, including a fix for the TCP SACK vulnerability +- {vytask}`T1371` VRRP health-check scripts now can use arguments +- {vytask}`T1497` DNS server addresses coming from a DHCP server are now + correctly propagated to resolv.conf +- {vytask}`T1469` Domain-specific name servers in DNS forwarding are now used + for recursive queries +- {vytask}`T1433` `run show dhcpv6 server leases` now display leases correctly +- {vytask}`T1461` Deleting `firewall options` node no longer causes errors +- {vytask}`T1458` Correct hostname is sent to remote syslog again +- {vytask}`T1438` Board serial number from DMI is correctly displayed in + `show version` +- {vytask}`T1358`, {vytask}`T1355`, {vytask}`T1294` Multiple corrections in + remote syslog config +- {vytask}`T1255` Fixed missing newline in `/etc/hosts` +- {vytask}`T1174` `system domain-name` is correctly included in + `/etc/resolv.conf` +- {vytask}`T1465` Fixed priority inversion in `interfaces vti vtiX ip` + settings +- {vytask}`T1446` Fixed errors when installing with RAID1 on UEFI machines +- {vytask}`T1387` Fixed an error on disabling an interfaces that has no address +- {vytask}`T1367` Fixed deleting VLAN interface with non-default MTU +- {vytask}`T1505` vyos.config `return_effective_values()` function now + correctly returns a list rather than a string diff --git a/docs/changelog/1.2.2.rst b/docs/changelog/1.2.2.rst deleted file mode 100644 index 17ba941f..00000000 --- a/docs/changelog/1.2.2.rst +++ /dev/null @@ -1,46 +0,0 @@ -1.2.2 -===== - -1.2.2 is a maintenance release made in July 2019. - -New features ------------- - -* Options for per-interface MSS clamping. -* BGP extended next-hop capability -* Relaxed BGP multipath option -* Internal and external options for "remote-as" (accept any AS as long as it's - the same to this router or different, respectively) -* "Unnumbered" (interface-based) BGP peers -* BGP no-prepend option -* Additive BGP community option -* OSPFv3 network type option -* Custom arguments for VRRP scripts -* A script for querying values from config files - -Resolved issues ---------------- - -* Linux kernel 4.19.54, including a fix for the TCP SACK vulnerability -* :vytask:`T1371` VRRP health-check scripts now can use arguments -* :vytask:`T1497` DNS server addresses coming from a DHCP server are now - correctly propagated to resolv.conf -* :vytask:`T1469` Domain-specific name servers in DNS forwarding are now used - for recursive queries -* :vytask:`T1433` ``run show dhcpv6 server leases`` now display leases correctly -* :vytask:`T1461` Deleting ``firewall options`` node no longer causes errors -* :vytask:`T1458` Correct hostname is sent to remote syslog again -* :vytask:`T1438` Board serial number from DMI is correctly displayed in - ``show version`` -* :vytask:`T1358`, :vytask:`T1355`, :vytask:`T1294` Multiple corrections in - remote syslog config -* :vytask:`T1255` Fixed missing newline in ``/etc/hosts`` -* :vytask:`T1174` ``system domain-name`` is correctly included in - ``/etc/resolv.conf`` -* :vytask:`T1465` Fixed priority inversion in ``interfaces vti vtiX ip`` - settings -* :vytask:`T1446` Fixed errors when installing with RAID1 on UEFI machines -* :vytask:`T1387` Fixed an error on disabling an interfaces that has no address -* :vytask:`T1367` Fixed deleting VLAN interface with non-default MTU -* :vytask:`T1505` vyos.config ``return_effective_values()`` function now - correctly returns a list rather than a string \ No newline at end of file diff --git a/docs/changelog/1.2.3.md b/docs/changelog/1.2.3.md new file mode 100644 index 00000000..96ca1818 --- /dev/null +++ b/docs/changelog/1.2.3.md @@ -0,0 +1,58 @@ +# 1.2.3 + +1.2.3 is a maintenance and feature backport release made in September 2019. + +## New features + +- HTTP API +- {vytask}`T1524` "set service dns forwarding allow-from \" + option for limiting queries to specific client networks +- {vytask}`T1503` Functions for checking if a commit is in progress +- {vytask}`T1543` "set system contig-mangement commit-archive source-address" + option +- {vytask}`T1554` Intel NIC drivers now support receive side scaling and + multiqueue + +## Resolved issues + +- {vytask}`T1209` OSPF max-metric values over 100 no longer causes commit + errors +- {vytask}`T1333` Fixes issue with DNS forwarding not performing recursive + lookups on domain specific forwarders +- {vytask}`T1362` Special characters in VRRP passwords are handled correctly +- {vytask}`T1377` BGP weight is applied properly +- {vytask}`T1420` Fixed permission for log files +- {vytask}`T1425` Wireguard interfaces now support /31 addresses +- {vytask}`T1428` Wireguard correctly handles firewall marks +- {vytask}`T1439` DHCPv6 static mappings now work correctly +- {vytask}`T1450` Flood ping commands now works correctly +- {vytask}`T1460` Op mode "show firewall" commands now support counters longer + than 8 digits (T1460) +- {vytask}`T1465` Fixed priority inversion in VTI commands +- {vytask}`T1468` Fixed remote-as check in the BGP route-reflector-client option +- {vytask}`T1472` It's now possible to re-create VRRP groups with RFC + compatibility mode enabled +- {vytask}`T1527` Fixed a typo in DHCPv6 server help strings +- {vytask}`T1529` Unnumbered BGP peers now support VLAN interfaces +- {vytask}`T1530` Fixed "set system syslog global archive file" command +- {vytask}`T1531` Multiple fixes in cluster configuration scripts +- {vytask}`T1537` Fixed missing help text for "service dns" +- {vytask}`T1541` Fixed input validation in DHCPv6 relay options +- {vytask}`T1551` It's now possible to create a QinQ interface and a firewall + assigned to it in one commit +- {vytask}`T1559` URL filtering now uses correct rule database path and works + again +- {vytask}`T1579` "show log vpn ipsec" command works again +- {vytask}`T1576` "show arp interface \" command works again +- {vytask}`T1605` Fixed regression in L2TP/IPsec server +- {vytask}`T1613` Netflow/sFlow captures IPv6 traffic correctly +- {vytask}`T1616` "renew dhcpv6" command now works from op mode +- {vytask}`T1642` BGP remove-private-as option iBGP vs eBGP check works + correctly now +- {vytask}`T1540`, {vytask}`T1360`, {vytask}`T1264`, {vytask}`T1623` Multiple + improvements in name servers and hosts configuration handling + +## Internals + +`/etc/resolv.conf` and `/etc/hosts` files are now managed by the +*vyos-hostsd* service that listens on a ZMQ socket for update messages. diff --git a/docs/changelog/1.2.3.rst b/docs/changelog/1.2.3.rst deleted file mode 100644 index 653beec1..00000000 --- a/docs/changelog/1.2.3.rst +++ /dev/null @@ -1,62 +0,0 @@ -1.2.3 -===== - -1.2.3 is a maintenance and feature backport release made in September 2019. - -New features ------------- - -* HTTP API -* :vytask:`T1524` "set service dns forwarding allow-from " - option for limiting queries to specific client networks -* :vytask:`T1503` Functions for checking if a commit is in progress -* :vytask:`T1543` "set system contig-mangement commit-archive source-address" - option -* :vytask:`T1554` Intel NIC drivers now support receive side scaling and - multiqueue - -Resolved issues ---------------- - -* :vytask:`T1209` OSPF max-metric values over 100 no longer causes commit - errors -* :vytask:`T1333` Fixes issue with DNS forwarding not performing recursive - lookups on domain specific forwarders -* :vytask:`T1362` Special characters in VRRP passwords are handled correctly -* :vytask:`T1377` BGP weight is applied properly -* :vytask:`T1420` Fixed permission for log files -* :vytask:`T1425` Wireguard interfaces now support /31 addresses -* :vytask:`T1428` Wireguard correctly handles firewall marks -* :vytask:`T1439` DHCPv6 static mappings now work correctly -* :vytask:`T1450` Flood ping commands now works correctly -* :vytask:`T1460` Op mode "show firewall" commands now support counters longer - than 8 digits (T1460) -* :vytask:`T1465` Fixed priority inversion in VTI commands -* :vytask:`T1468` Fixed remote-as check in the BGP route-reflector-client option -* :vytask:`T1472` It's now possible to re-create VRRP groups with RFC - compatibility mode enabled -* :vytask:`T1527` Fixed a typo in DHCPv6 server help strings -* :vytask:`T1529` Unnumbered BGP peers now support VLAN interfaces -* :vytask:`T1530` Fixed "set system syslog global archive file" command -* :vytask:`T1531` Multiple fixes in cluster configuration scripts -* :vytask:`T1537` Fixed missing help text for "service dns" -* :vytask:`T1541` Fixed input validation in DHCPv6 relay options -* :vytask:`T1551` It's now possible to create a QinQ interface and a firewall - assigned to it in one commit -* :vytask:`T1559` URL filtering now uses correct rule database path and works - again -* :vytask:`T1579` "show log vpn ipsec" command works again -* :vytask:`T1576` "show arp interface " command works again -* :vytask:`T1605` Fixed regression in L2TP/IPsec server -* :vytask:`T1613` Netflow/sFlow captures IPv6 traffic correctly -* :vytask:`T1616` "renew dhcpv6" command now works from op mode -* :vytask:`T1642` BGP remove-private-as option iBGP vs eBGP check works - correctly now -* :vytask:`T1540`, :vytask:`T1360`, :vytask:`T1264`, :vytask:`T1623` Multiple - improvements in name servers and hosts configuration handling - -Internals ---------- - -``/etc/resolv.conf`` and ``/etc/hosts`` files are now managed by the -*vyos-hostsd* service that listens on a ZMQ socket for update messages. \ No newline at end of file diff --git a/docs/changelog/1.2.4.md b/docs/changelog/1.2.4.md new file mode 100644 index 00000000..bc098699 --- /dev/null +++ b/docs/changelog/1.2.4.md @@ -0,0 +1,75 @@ +# 1.2.4 + +1.2.4 is a maintenance release made in December 2019. + +## Resolved issues + +- {vytask}`T258` Can not configure wan load-balancing on vyos-1.2 +- {vytask}`T818` SNMP v3 - remove required engineid from user node +- {vytask}`T1030` Upgrade ddclient from 3.8.2 to 3.9. + (support Cloudflare API v4) +- {vytask}`T1183` BFD Support via FRR +- {vytask}`T1299` Allow SNMPd to be extended with custom scripts +- {vytask}`T1351` accel-pppoe adding CIDR based IP pool option +- {vytask}`T1391` In route-map set community additive +- {vytask}`T1394` syslog systemd and host_name.py race condition +- {vytask}`T1401` Copying files with the FTP protocol fails if the passwor + contains special characters +- {vytask}`T1421` OpenVPN client push-route stopped working, needs added quotes + to fix +- {vytask}`T1430` Add options for custom DHCP client-id and hostname +- {vytask}`T1447` Python subprocess called without import in host_name.py +- {vytask}`T1470` improve output of "show dhcpv6 server leases" +- {vytask}`T1485` Enable 'AdvIntervalOpt' option in for radvd.conf +- {vytask}`T1496` Separate rolling release and LTS kernel builds +- {vytask}`T1560` "set load-balancing wan rule 0" causes segfault and prevent + load balancing from starting +- {vytask}`T1568` strip-private command improvement for additional masking o + IPv6 and MAC address +- {vytask}`T1578` completion offers "show table", but show table does not exist +- {vytask}`T1593` Support ip6gre +- {vytask}`T1597` /usr/sbin/rsyslogd after deleting "system syslog" +- {vytask}`T1638` vyos-hostsd not setting system domain name +- {vytask}`T1678` hostfile-update missing line feed +- {vytask}`T1694` NTPd: Do not listen on all interfaces by default +- {vytask}`T1701` Delete domain-name and domain-search won't work +- {vytask}`T1705` High CPU usage by bgpd when snmp is active +- {vytask}`T1707` DHCP static mapping and exclude address not working +- {vytask}`T1708` Update Rolling Release Kernel to 4.19.76 +- {vytask}`T1709` Update WireGuard to 0.0.20190913 +- {vytask}`T1716` Update Intel NIC drivers to recent versions +- {vytask}`T1726` Update Linux Firmware binaries to a more recen + version 2019-03-14 -> 2019-10-07 +- {vytask}`T1728` Update Linux Kernel to 4.19.79 +- {vytask}`T1737` SNMP tab completion missing +- {vytask}`T1738` Copy SNMP configuration from node to node raises exception +- {vytask}`T1740` Broken OSPFv2 virtual-link authentication +- {vytask}`T1742` NHRP unable to commit. +- {vytask}`T1745` dhcp-server commit fails with "DHCP range stop address + must be greater or equal to the range start address y!" when static mapping + has same IP as range stop +- {vytask}`T1749` numeric validator doesn't support multiple ranges +- {vytask}`T1769` Remove complex SNMPv3 Transport Security Model (TSM) +- {vytask}`T1772` \ constraints in XML are partially broken +- {vytask}`T1778` Kilobits/Megabits difference in configuration Vyos/FRR +- {vytask}`T1780` Adding ipsec ike closeaction +- {vytask}`T1786` disable-dhcp-nameservers is missed in current host_name.p + implementation +- {vytask}`T1788` Intel QAT (QuickAssist Technology ) implementation +- {vytask}`T1792` Update WireGuard to Debian release 0.0.20191012-1 +- {vytask}`T1800` Update Linux Kernel to v4.19.84 +- {vytask}`T1809` Wireless: SSID scan does not work in AP mode +- {vytask}`T1811` Upgrade from 1.1.8: Config file migratio + failed: module=l2tp +- {vytask}`T1812` DHCP: hostnames of clients not resolving afte + update v1.2.3 -> 1.2-rolling +- {vytask}`T1819` Reboot kills SNMPv3 configuration +- {vytask}`T1822` Priority inversion wireless interface dhcpv6 +- {vytask}`T1825` Improve DHCP configuration error message +- {vytask}`T1836` import-conf-mode-commands in vyos-1x/scripts fails + to create an xml +- {vytask}`T1839` LLDP shows "VyOS unknown" instead of "VyOS" +- {vytask}`T1841` PPP ipv6-up.d direcotry missing +- {vytask}`T1893` igmp-proxy: Do not allow adding unknown interface +- {vytask}`T1903` Implementation udev predefined interface naming +- {vytask}`T1904` update eth1 and eth2 link files for the vep4600 diff --git a/docs/changelog/1.2.4.rst b/docs/changelog/1.2.4.rst deleted file mode 100644 index 3e228880..00000000 --- a/docs/changelog/1.2.4.rst +++ /dev/null @@ -1,77 +0,0 @@ -1.2.4 -===== - -1.2.4 is a maintenance release made in December 2019. - -Resolved issues ---------------- - -* :vytask:`T258` Can not configure wan load-balancing on vyos-1.2 -* :vytask:`T818` SNMP v3 - remove required engineid from user node -* :vytask:`T1030` Upgrade ddclient from 3.8.2 to 3.9. - (support Cloudflare API v4) -* :vytask:`T1183` BFD Support via FRR -* :vytask:`T1299` Allow SNMPd to be extended with custom scripts -* :vytask:`T1351` accel-pppoe adding CIDR based IP pool option -* :vytask:`T1391` In route-map set community additive -* :vytask:`T1394` syslog systemd and host_name.py race condition -* :vytask:`T1401` Copying files with the FTP protocol fails if the passwor - contains special characters -* :vytask:`T1421` OpenVPN client push-route stopped working, needs added quotes - to fix -* :vytask:`T1430` Add options for custom DHCP client-id and hostname -* :vytask:`T1447` Python subprocess called without import in host_name.py -* :vytask:`T1470` improve output of "show dhcpv6 server leases" -* :vytask:`T1485` Enable 'AdvIntervalOpt' option in for radvd.conf -* :vytask:`T1496` Separate rolling release and LTS kernel builds -* :vytask:`T1560` "set load-balancing wan rule 0" causes segfault and prevent - load balancing from starting -* :vytask:`T1568` strip-private command improvement for additional masking o - IPv6 and MAC address -* :vytask:`T1578` completion offers "show table", but show table does not exist -* :vytask:`T1593` Support ip6gre -* :vytask:`T1597` /usr/sbin/rsyslogd after deleting "system syslog" -* :vytask:`T1638` vyos-hostsd not setting system domain name -* :vytask:`T1678` hostfile-update missing line feed -* :vytask:`T1694` NTPd: Do not listen on all interfaces by default -* :vytask:`T1701` Delete domain-name and domain-search won't work -* :vytask:`T1705` High CPU usage by bgpd when snmp is active -* :vytask:`T1707` DHCP static mapping and exclude address not working -* :vytask:`T1708` Update Rolling Release Kernel to 4.19.76 -* :vytask:`T1709` Update WireGuard to 0.0.20190913 -* :vytask:`T1716` Update Intel NIC drivers to recent versions -* :vytask:`T1726` Update Linux Firmware binaries to a more recen - version 2019-03-14 -> 2019-10-07 -* :vytask:`T1728` Update Linux Kernel to 4.19.79 -* :vytask:`T1737` SNMP tab completion missing -* :vytask:`T1738` Copy SNMP configuration from node to node raises exception -* :vytask:`T1740` Broken OSPFv2 virtual-link authentication -* :vytask:`T1742` NHRP unable to commit. -* :vytask:`T1745` dhcp-server commit fails with "DHCP range stop address - must be greater or equal to the range start address y!" when static mapping - has same IP as range stop -* :vytask:`T1749` numeric validator doesn't support multiple ranges -* :vytask:`T1769` Remove complex SNMPv3 Transport Security Model (TSM) -* :vytask:`T1772` constraints in XML are partially broken -* :vytask:`T1778` Kilobits/Megabits difference in configuration Vyos/FRR -* :vytask:`T1780` Adding ipsec ike closeaction -* :vytask:`T1786` disable-dhcp-nameservers is missed in current host_name.p - implementation -* :vytask:`T1788` Intel QAT (QuickAssist Technology ) implementation -* :vytask:`T1792` Update WireGuard to Debian release 0.0.20191012-1 -* :vytask:`T1800` Update Linux Kernel to v4.19.84 -* :vytask:`T1809` Wireless: SSID scan does not work in AP mode -* :vytask:`T1811` Upgrade from 1.1.8: Config file migratio - failed: module=l2tp -* :vytask:`T1812` DHCP: hostnames of clients not resolving afte - update v1.2.3 -> 1.2-rolling -* :vytask:`T1819` Reboot kills SNMPv3 configuration -* :vytask:`T1822` Priority inversion wireless interface dhcpv6 -* :vytask:`T1825` Improve DHCP configuration error message -* :vytask:`T1836` import-conf-mode-commands in vyos-1x/scripts fails - to create an xml -* :vytask:`T1839` LLDP shows "VyOS unknown" instead of "VyOS" -* :vytask:`T1841` PPP ipv6-up.d direcotry missing -* :vytask:`T1893` igmp-proxy: Do not allow adding unknown interface -* :vytask:`T1903` Implementation udev predefined interface naming -* :vytask:`T1904` update eth1 and eth2 link files for the vep4600 \ No newline at end of file diff --git a/docs/changelog/1.2.5.md b/docs/changelog/1.2.5.md new file mode 100644 index 00000000..4e0c67bb --- /dev/null +++ b/docs/changelog/1.2.5.md @@ -0,0 +1,68 @@ +# 1.2.5 + +1.2.5 is a maintenance release made in April 2020. + +## Resolved issues + +- {vytask}`T1020` OSPF Stops distributing default route after a while +- {vytask}`T1228` pppoe default-route force option not working (Rel 1.2.0-rc11) +- {vytask}`T1301` bgp peer-groups don't work when "no-ipv4-unicast" is enabled. +- {vytask}`T1341` Adding rate-limiter for pppoe server users +- {vytask}`T1376` Incorrect DHCP lease counting +- {vytask}`T1392` Large firewall rulesets cause the system to lose configuration + and crash at startup +- {vytask}`T1416` 2 dhcp server run in failover mode can't sync hostname with + each other +- {vytask}`T1452` accel-pppoe - add vendor option to shaper +- {vytask}`T1490` BGP configuration (is lost|not applied) when updating + 1.1.8 -> 1.2.1 +- {vytask}`T1780` Adding ipsec ike closeaction +- {vytask}`T1803` Unbind NTP while it's not requested... +- {vytask}`T1821` "authentication mode radius" has no effect for PPPoE server +- {vytask}`T1827` Increase default gc_thresh +- {vytask}`T1828` Missing completion helper for "set system syslog host + 192.0.2.1 facility all protocol" +- {vytask}`T1832` radvd adding feature DNSSL branch.example.com example.com to + existing package +- {vytask}`T1837` PPPoE unrecognized option 'replacedefaultroute' +- {vytask}`T1851` wireguard - changing the pubkey on an existing peer seems to + destroy the running config. +- {vytask}`T1858` l2tp: Delete depricated outside-nexthop and add gateway-address +- {vytask}`T1864` Lower IPSec DPD timeout lower limit from 10s -> 2s +- {vytask}`T1879` Extend Dynamic DNS XML definition value help strings and + validators +- {vytask}`T1881` Execute permissions are removed from custom SNMP scripts at + commit time +- {vytask}`T1884` Keeping VRRP transition-script native behaviour and adding + stop-script +- {vytask}`T1891` Router announcements broken on boot +- {vytask}`T1900` Enable SNMP for VRRP. +- {vytask}`T1902` Add redistribute non main table in bgp +- {vytask}`T1909` Incorrect behaviour of static routes with overlapping networks +- {vytask}`T1913` "system ipv6 blacklist" command has no effect +- {vytask}`T1914` IPv6 multipath hash policy does not apply +- {vytask}`T1917` Update WireGuard to Debian release 0.0.20191219-1 +- {vytask}`T1934` Change default hostname when deploy from OVA without params. +- {vytask}`T1935` NIC identification and usage problem in Hyper-V environments +- {vytask}`T1936` pppoe-server CLI control features +- {vytask}`T1964` SNMP Script-extensions allows names with spaces, but commit + fails +- {vytask}`T1967` BGP parameter "enforce-first-as" does not work anymore +- {vytask}`T1970` Correct adding interfaces on boot +- {vytask}`T1971` Missing modules in initrd.img for PXE boot +- {vytask}`T1998` Update FRR to 7.3 +- {vytask}`T2001` Error when router reboot +- {vytask}`T2032` Monitor bandwidth bits +- {vytask}`T2059` Set source-validation on bond vif don't work +- {vytask}`T2066` PPPoE interface can be created multiple times - last wins +- {vytask}`T2069` PPPoE-client does not works with service-name option +- {vytask}`T2077` ISO build from crux branch is failing +- {vytask}`T2079` Update Linux Kernel to v4.19.106 +- {vytask}`T2087` Add maxfail 0 option to pppoe configuration. +- {vytask}`T2100` BGP route adverisement wih checks rib +- {vytask}`T2120` "reset vpn ipsec-peer" doesn't work with named peers +- {vytask}`T2197` Cant add vif-s interface into a bridge +- {vytask}`T2228` WireGuard does not allow ports < 1024 to be used +- {vytask}`T2252` HTTP API add system image can return '504 Gateway Time-out' +- {vytask}`T2272` Set system flow-accounting disable-imt has syntax error +- {vytask}`T2276` PPPoE server vulnerability diff --git a/docs/changelog/1.2.5.rst b/docs/changelog/1.2.5.rst deleted file mode 100644 index 438e84f2..00000000 --- a/docs/changelog/1.2.5.rst +++ /dev/null @@ -1,70 +0,0 @@ -1.2.5 -===== - -1.2.5 is a maintenance release made in April 2020. - -Resolved issues ---------------- - -* :vytask:`T1020` OSPF Stops distributing default route after a while -* :vytask:`T1228` pppoe default-route force option not working (Rel 1.2.0-rc11) -* :vytask:`T1301` bgp peer-groups don't work when "no-ipv4-unicast" is enabled. -* :vytask:`T1341` Adding rate-limiter for pppoe server users -* :vytask:`T1376` Incorrect DHCP lease counting -* :vytask:`T1392` Large firewall rulesets cause the system to lose configuration - and crash at startup -* :vytask:`T1416` 2 dhcp server run in failover mode can't sync hostname with - each other -* :vytask:`T1452` accel-pppoe - add vendor option to shaper -* :vytask:`T1490` BGP configuration (is lost|not applied) when updating - 1.1.8 -> 1.2.1 -* :vytask:`T1780` Adding ipsec ike closeaction -* :vytask:`T1803` Unbind NTP while it's not requested... -* :vytask:`T1821` "authentication mode radius" has no effect for PPPoE server -* :vytask:`T1827` Increase default gc_thresh -* :vytask:`T1828` Missing completion helper for "set system syslog host - 192.0.2.1 facility all protocol" -* :vytask:`T1832` radvd adding feature DNSSL branch.example.com example.com to - existing package -* :vytask:`T1837` PPPoE unrecognized option 'replacedefaultroute' -* :vytask:`T1851` wireguard - changing the pubkey on an existing peer seems to - destroy the running config. -* :vytask:`T1858` l2tp: Delete depricated outside-nexthop and add gateway-address -* :vytask:`T1864` Lower IPSec DPD timeout lower limit from 10s -> 2s -* :vytask:`T1879` Extend Dynamic DNS XML definition value help strings and - validators -* :vytask:`T1881` Execute permissions are removed from custom SNMP scripts at - commit time -* :vytask:`T1884` Keeping VRRP transition-script native behaviour and adding - stop-script -* :vytask:`T1891` Router announcements broken on boot -* :vytask:`T1900` Enable SNMP for VRRP. -* :vytask:`T1902` Add redistribute non main table in bgp -* :vytask:`T1909` Incorrect behaviour of static routes with overlapping networks -* :vytask:`T1913` "system ipv6 blacklist" command has no effect -* :vytask:`T1914` IPv6 multipath hash policy does not apply -* :vytask:`T1917` Update WireGuard to Debian release 0.0.20191219-1 -* :vytask:`T1934` Change default hostname when deploy from OVA without params. -* :vytask:`T1935` NIC identification and usage problem in Hyper-V environments -* :vytask:`T1936` pppoe-server CLI control features -* :vytask:`T1964` SNMP Script-extensions allows names with spaces, but commit - fails -* :vytask:`T1967` BGP parameter "enforce-first-as" does not work anymore -* :vytask:`T1970` Correct adding interfaces on boot -* :vytask:`T1971` Missing modules in initrd.img for PXE boot -* :vytask:`T1998` Update FRR to 7.3 -* :vytask:`T2001` Error when router reboot -* :vytask:`T2032` Monitor bandwidth bits -* :vytask:`T2059` Set source-validation on bond vif don't work -* :vytask:`T2066` PPPoE interface can be created multiple times - last wins -* :vytask:`T2069` PPPoE-client does not works with service-name option -* :vytask:`T2077` ISO build from crux branch is failing -* :vytask:`T2079` Update Linux Kernel to v4.19.106 -* :vytask:`T2087` Add maxfail 0 option to pppoe configuration. -* :vytask:`T2100` BGP route adverisement wih checks rib -* :vytask:`T2120` "reset vpn ipsec-peer" doesn't work with named peers -* :vytask:`T2197` Cant add vif-s interface into a bridge -* :vytask:`T2228` WireGuard does not allow ports < 1024 to be used -* :vytask:`T2252` HTTP API add system image can return '504 Gateway Time-out' -* :vytask:`T2272` Set system flow-accounting disable-imt has syntax error -* :vytask:`T2276` PPPoE server vulnerability \ No newline at end of file diff --git a/docs/changelog/1.2.6.md b/docs/changelog/1.2.6.md new file mode 100644 index 00000000..0815bb05 --- /dev/null +++ b/docs/changelog/1.2.6.md @@ -0,0 +1,104 @@ +# 1.2.6-S1 + +1.2.6-S1 is a security release release made in September 2020. + +## Resolved issues + +VyOS 1.2.6 release was found to be suspectible to CVE-2020-10995. It's a low- +impact vulnerability in the PowerDNS recursor that allows an attacker to cause +performance degradation via a specially crafted authoritative DNS server reply. + +- {vytask}`T2899` remote syslog server migration error on update + +# 1.2.6 + +1.2.6 is a maintenance release made in September 2020. + +(resovled-issues-1-2-6)= + +## Resolved issues + +- {vytask}`T103` DHCP server prepends shared network name to hostnames +- {vytask}`T125` Missing PPPoE interfaces in l2tp configuration +- {vytask}`T1194` cronjob is being setup even if not saved +- {vytask}`T1205` module pcspkr missing +- {vytask}`T1219` Redundant active-active configuration, asymmetric routing and + conntrack-sync cache +- {vytask}`T1220` Show transceiver information from plugin modules, e.g SFP+, + QSFP +- {vytask}`T1221` BGP - Default route injection is not processed by the specific + route-map +- {vytask}`T1241` Remove of policy route throws CLI error +- {vytask}`T1291` Under certain conditions the VTI will stay forever down +- {vytask}`T1463` Missing command `show ip bgp scan` appears in command + completion +- {vytask}`T1575` `show snmp mib ifmib` crashes with IndexError +- {vytask}`T1699` Default net.ipv6.route.max_size 32768 is too low +- {vytask}`T1729` PIM (Protocol Independent Multicast) implementation +- {vytask}`T1901` Semicolon in values is interpreted as a part of the shell + command by validators +- {vytask}`T1934` Change default hostname when deploy from OVA without params. +- {vytask}`T1938` syslog doesn't start automatically +- {vytask}`T1949` Multihop IPv6 BFD is unconfigurable +- {vytask}`T1953` DDNS service name validation rejects valid service names +- {vytask}`T1956` PPPoE server: support PADO-delay +- {vytask}`T1973` Allow route-map to match on BGP local preference value +- {vytask}`T1974` Allow route-map to set administrative distance +- {vytask}`T1982` Increase rotation for atop.acct +- {vytask}`T1983` Expose route-map when BGP routes are programmed in to FIB +- {vytask}`T1985` pppoe: Enable ipv6 modules without configured ipv6 pools +- {vytask}`T2000` strongSwan does not install routes to table 220 in certain + cases +- {vytask}`T2021` OSPFv3 doesn't support decimal area syntax +- {vytask}`T2062` Wrong dhcp-server static route subnet bytes +- {vytask}`T2091` swanctl.conf file is not generated properly is more than one + IPsec profile is used +- {vytask}`T2131` Improve syslog remote host CLI definition +- {vytask}`T2224` Update Linux Kernel to v4.19.114 +- {vytask}`T2286` IPoE server vulnerability +- {vytask}`T2303` Unable to delete the image version that came from OVA +- {vytask}`T2305` Add release name to "show version" command +- {vytask}`T2311` Statically configured name servers may not take precedence + over ones from DHCP +- {vytask}`T2327` Unable to create syslog server entry with different port +- {vytask}`T2332` Backport node option for a syslog server +- {vytask}`T2342` Bridge l2tpv3 + ethX errors +- {vytask}`T2344` PPPoE server client static IP assignment silently fails +- {vytask}`T2385` salt-minion: improve completion helpers +- {vytask}`T2389` BGP community-list unknown command +- {vytask}`T2398` op-mode "dhcp client leases interface" completion helper + misses interfaces +- {vytask}`T2402` Live ISO should warn when configuring that changes won't + persist +- {vytask}`T2443` NHRP: Add debugging information to syslog +- {vytask}`T2448` `monitor protocol bgp` subcommands fail with 'command + incomplete' +- {vytask}`T2458` Update FRR to 7.3.1 +- {vytask}`T2476` Bond member description change leads to network outage +- {vytask}`T2478` login radius: use NAS-IP-Address if defined source address +- {vytask}`T2482` Update PowerDNS recursor to 4.3.1 for CVE-2020-10995 +- {vytask}`T2517` vyos-container: link_filter: No such file or directory +- {vytask}`T2526` Wake-On-Lan CLI implementation +- {vytask}`T2528` "update dns dynamic" throws FileNotFoundError excepton +- {vytask}`T2536` "show log dns forwarding" still refers to dnsmasq +- {vytask}`T2538` Update Intel NIC drivers to recent release (preparation for + Kernel >=5.4) +- {vytask}`T2545` Show physical device offloading capabilities for specified + ethernet interface +- {vytask}`T2563` Wrong interface binding for Dell VEP 1445 +- {vytask}`T2605` SNMP service is not disabled by default +- {vytask}`T2625` Provide generic Library for package builds +- {vytask}`T2686` FRR: BGP: large-community configuration is not applied + properly after upgrading FRR to 7.3.x series +- {vytask}`T2701` `vpn ipsec pfs enable` doesn't work with IKE groups +- {vytask}`T2728` Protocol option ignored for IPSec peers in transport mode +- {vytask}`T2734` WireGuard: fwmark CLI definition is inconsistent +- {vytask}`T2757` "show system image version" contains additional new-line + character breaking output +- {vytask}`T2797` Update Linux Kernel to v4.19.139 +- {vytask}`T2822` Update Linux Kernel to v4.19.141 +- {vytask}`T2829` PPPoE server: mppe setting is implemented as node instead of + leafNode +- {vytask}`T2831` Update Linux Kernel to v4.19.142 +- {vytask}`T2852` rename dynamic dns interface breaks ddclient.cache permissions +- {vytask}`T2853` Intel QAT acceleration does not work diff --git a/docs/changelog/1.2.6.rst b/docs/changelog/1.2.6.rst deleted file mode 100644 index 70786d07..00000000 --- a/docs/changelog/1.2.6.rst +++ /dev/null @@ -1,108 +0,0 @@ -1.2.6-S1 -======== - -1.2.6-S1 is a security release release made in September 2020. - -Resolved issues ---------------- - -VyOS 1.2.6 release was found to be suspectible to CVE-2020-10995. It's a low- -impact vulnerability in the PowerDNS recursor that allows an attacker to cause -performance degradation via a specially crafted authoritative DNS server reply. - -* :vytask:`T2899` remote syslog server migration error on update - -1.2.6 -===== - -1.2.6 is a maintenance release made in September 2020. - -.. _resovled issues 1.2.6: - -Resolved issues ---------------- - -* :vytask:`T103` DHCP server prepends shared network name to hostnames -* :vytask:`T125` Missing PPPoE interfaces in l2tp configuration -* :vytask:`T1194` cronjob is being setup even if not saved -* :vytask:`T1205` module pcspkr missing -* :vytask:`T1219` Redundant active-active configuration, asymmetric routing and - conntrack-sync cache -* :vytask:`T1220` Show transceiver information from plugin modules, e.g SFP+, - QSFP -* :vytask:`T1221` BGP - Default route injection is not processed by the specific - route-map -* :vytask:`T1241` Remove of policy route throws CLI error -* :vytask:`T1291` Under certain conditions the VTI will stay forever down -* :vytask:`T1463` Missing command `show ip bgp scan` appears in command - completion -* :vytask:`T1575` `show snmp mib ifmib` crashes with IndexError -* :vytask:`T1699` Default net.ipv6.route.max_size 32768 is too low -* :vytask:`T1729` PIM (Protocol Independent Multicast) implementation -* :vytask:`T1901` Semicolon in values is interpreted as a part of the shell - command by validators -* :vytask:`T1934` Change default hostname when deploy from OVA without params. -* :vytask:`T1938` syslog doesn't start automatically -* :vytask:`T1949` Multihop IPv6 BFD is unconfigurable -* :vytask:`T1953` DDNS service name validation rejects valid service names -* :vytask:`T1956` PPPoE server: support PADO-delay -* :vytask:`T1973` Allow route-map to match on BGP local preference value -* :vytask:`T1974` Allow route-map to set administrative distance -* :vytask:`T1982` Increase rotation for atop.acct -* :vytask:`T1983` Expose route-map when BGP routes are programmed in to FIB -* :vytask:`T1985` pppoe: Enable ipv6 modules without configured ipv6 pools -* :vytask:`T2000` strongSwan does not install routes to table 220 in certain - cases -* :vytask:`T2021` OSPFv3 doesn't support decimal area syntax -* :vytask:`T2062` Wrong dhcp-server static route subnet bytes -* :vytask:`T2091` swanctl.conf file is not generated properly is more than one - IPsec profile is used -* :vytask:`T2131` Improve syslog remote host CLI definition -* :vytask:`T2224` Update Linux Kernel to v4.19.114 -* :vytask:`T2286` IPoE server vulnerability -* :vytask:`T2303` Unable to delete the image version that came from OVA -* :vytask:`T2305` Add release name to "show version" command -* :vytask:`T2311` Statically configured name servers may not take precedence - over ones from DHCP -* :vytask:`T2327` Unable to create syslog server entry with different port -* :vytask:`T2332` Backport node option for a syslog server -* :vytask:`T2342` Bridge l2tpv3 + ethX errors -* :vytask:`T2344` PPPoE server client static IP assignment silently fails -* :vytask:`T2385` salt-minion: improve completion helpers -* :vytask:`T2389` BGP community-list unknown command -* :vytask:`T2398` op-mode "dhcp client leases interface" completion helper - misses interfaces -* :vytask:`T2402` Live ISO should warn when configuring that changes won't - persist -* :vytask:`T2443` NHRP: Add debugging information to syslog -* :vytask:`T2448` `monitor protocol bgp` subcommands fail with 'command - incomplete' -* :vytask:`T2458` Update FRR to 7.3.1 -* :vytask:`T2476` Bond member description change leads to network outage -* :vytask:`T2478` login radius: use NAS-IP-Address if defined source address -* :vytask:`T2482` Update PowerDNS recursor to 4.3.1 for CVE-2020-10995 -* :vytask:`T2517` vyos-container: link_filter: No such file or directory -* :vytask:`T2526` Wake-On-Lan CLI implementation -* :vytask:`T2528` "update dns dynamic" throws FileNotFoundError excepton -* :vytask:`T2536` "show log dns forwarding" still refers to dnsmasq -* :vytask:`T2538` Update Intel NIC drivers to recent release (preparation for - Kernel >=5.4) -* :vytask:`T2545` Show physical device offloading capabilities for specified - ethernet interface -* :vytask:`T2563` Wrong interface binding for Dell VEP 1445 -* :vytask:`T2605` SNMP service is not disabled by default -* :vytask:`T2625` Provide generic Library for package builds -* :vytask:`T2686` FRR: BGP: large-community configuration is not applied - properly after upgrading FRR to 7.3.x series -* :vytask:`T2701` `vpn ipsec pfs enable` doesn't work with IKE groups -* :vytask:`T2728` Protocol option ignored for IPSec peers in transport mode -* :vytask:`T2734` WireGuard: fwmark CLI definition is inconsistent -* :vytask:`T2757` "show system image version" contains additional new-line - character breaking output -* :vytask:`T2797` Update Linux Kernel to v4.19.139 -* :vytask:`T2822` Update Linux Kernel to v4.19.141 -* :vytask:`T2829` PPPoE server: mppe setting is implemented as node instead of - leafNode -* :vytask:`T2831` Update Linux Kernel to v4.19.142 -* :vytask:`T2852` rename dynamic dns interface breaks ddclient.cache permissions -* :vytask:`T2853` Intel QAT acceleration does not work \ No newline at end of file diff --git a/docs/changelog/1.3.md b/docs/changelog/1.3.md new file mode 100644 index 00000000..70eeea87 --- /dev/null +++ b/docs/changelog/1.3.md @@ -0,0 +1,4317 @@ +# 1.3 Equuleus + +% Please don't add anything by hand. +% This file is managed by the script: +% _ext/releasenotes.py + +## 2024-04-25 + +- {vytask}`T6249` `(default): ISO builder fails because of changed buster-backport repository` + +## 2024-04-23 + +- {vytask}`T6261` `(default): Typo in op_mode connect_disconnect print statement for check_ppp_running` + +## 2024-04-17 + +- {vytask}`T6243` `(bug): Update vyos-http-api-tools for package idna security advisory` + +## 2024-04-12 + +- {vytask}`T3437` `(bug): BGP Confederation Addition Causes Error` + +## 2024-04-10 + +- {vytask}`T6124` `(bug): Docker equuleus build image doesn't build due to fpm` + +## 2024-04-08 + +- {vytask}`T6196` `(bug): Route-map and summary-only do not work in BGP aggregation at the same time` + +## 2024-04-07 + +- {vytask}`T1244` `(default): Support for StartupResync in conntrackd` + +## 2024-04-05 + +- {vytask}`T2590` `(bug): DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c` + +## 2024-04-04 + +- {vytask}`T4146` `(bug): Nginx should not listen on port 80` +- {vytask}`T1976` `(default): deleting address-family under neighbor will disable neighbor` +- {vytask}`T5625` `(default): "restart vpn" does not work if ipsec-interfaces is not set` +- {vytask}`T3020` `(bug): The "scp" example is wrong in the bash-completion for "set system config-management commit-archive location"` +- {vytask}`T2250` `(default): vyos-build "make iso" error if configure was ran outside of the docker container` +- {vytask}`T2139` `(default): openvpn: allow "dh-file none" to disable DH for ECDH keys` +- {vytask}`T2014` `(default): Use vendor specific NTP Pool hostname` +- {vytask}`T1118` `(bug): Obsolete "utc" option in time selector in firewall` +- {vytask}`T948` `(feature): integrate aws cloud watch scripts into AMI` + +## 2024-04-02 + +- {vytask}`T6150` `(bug): Impossible to set a static IP address via Radius in IPoE` + +## 2024-04-01 + +- {vytask}`T6193` `(bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP name-server option" for VLAN interfaces` + +## 2024-03-22 + +- {vytask}`T6110` `(bug): dhcp server - If failover is defined, range is required` +- {vytask}`T5624` `(default): Remove /etc/debian_version from the image` + +## 2024-03-11 + +- {vytask}`T2998` `(bug): SNMP v3 oid "exclude" option doesn't work` +- {vytask}`T6096` `(bug): Config commits are not synced properly because 00vyos-sync is deleted by vyos-router` +- {vytask}`T6057` `(feature): Add ability to disable syslog for conntrackd` +- {vytask}`T5504` `(feature): Keepalived VRRP ability to set more than one peer-address` + +## 2024-03-07 + +- {vytask}`T3992` `(bug): Traceback on adding interface to bridge with configured ip address` + +## 2024-03-06 + +- {vytask}`T6088` `(bug): Configuration corrupted after saving and powercut or force reboot` + +## 2024-02-16 + +- {vytask}`T2113` `(bug): OpenVPN Options error: you cannot use --verify-x509-name with --compat-names or --no-name-remapping` +- {vytask}`T5418` `(bug): PPPoE-Server Client IP pool Subnet` + +## 2024-02-15 + +- {vytask}`T2612` `(bug): HTTPS API, changing API key fails but goes through` +- {vytask}`T656` `(enhancment): Rewrite wirelessmodem in new style XML interface definition` + +## 2024-02-14 + +- {vytask}`T2044` `(bug): RPKI doesn't boot properly` + +## 2024-02-08 + +- {vytask}`T6014` `(feature): Bump keepalived version` + +## 2024-02-07 + +- {vytask}`T6017` `(bug): Update vyos-http-api-tools for security advisory` + +## 2024-02-02 + +- {vytask}`T5914` `(bug): CVE-2023-48795 - Terrapin vulnerability` +- {vytask}`T5739` `(bug): Password recovery does not work if public keys are configured` + +## 2024-02-01 + +- {vytask}`T5967` `(bug): Multi-hop BFD connections can't be established; please add minimum-ttl option.` + +## 2024-01-22 + +- {vytask}`T4721` `(feature): Static IPv6 Route Tags Missing` + +## 2024-01-20 + +- {vytask}`T5187` `(bug): Update Realtek r8152 driver` +- {vytask}`T5182` `(bug): Update Intel ice driver` +- {vytask}`T5180` `(bug): initramfs-tools ignores firmware from updates directory` +- {vytask}`T4990` `(bug): Commit results may not be properly saved if power is cut immediately after a successful commit` +- {vytask}`T4039` `(feature): Rsyslog to use 'protocol23format' for protocol UDP` +- {vytask}`T3813` `(bug): Some custom sysctl parameters can't be applied bug` +- {vytask}`T2579` `(feature): The root task for VRF features` +- {vytask}`T2546` `(feature): The root task for rewriting [op-mode] to XML` +- {vytask}`T2452` `(default): Serial console related issues` + +## 2024-01-19 + +- {vytask}`T5543` `(bug): Fix source address handling in static joins` + +## 2024-01-14 + +- {vytask}`T5715` `(bug): IPSec VPN: restart vpn is not working` + +## 2024-01-13 + +- {vytask}`T5924` `(bug): Build cannot pass the smoketest dialup-router-medium-vpn` + +## 2024-01-11 + +- {vytask}`T5275` `(default): Add op mode commands for exporting certificates to PEM files with correct headers` +- {vytask}`T5274` `(default): Add a deprecation warning for OpenVPN site-to-site with pre-shared secret` +- {vytask}`T3191` `(bug): PAM RADIUS freezing when accounting does not configured on RADIUS server` + +## 2024-01-10 + +- {vytask}`T4646` `(bug): USB serial output console does not work` +- {vytask}`T4466` `(bug): intel i225-v nic does not detect link after boot` +- {vytask}`T4222` `(feature): Support for TWAMP as round-trip metric` +- {vytask}`T1369` `(bug): GCP Networking Failure` + +## 2024-01-09 + +- {vytask}`T3242` `(bug): PPPoE Server overhead on virtual interfaces creation` +- {vytask}`T2755` `(default): Requirements for partial interface setup` +- {vytask}`T2494` `(bug): systemd dependencies issues` +- {vytask}`T2343` `(feature): Disable memory ballooning in VM templates` +- {vytask}`T2254` `(default): Provide more information on the build branch in the version data` +- {vytask}`T2223` `(feature): convert operational show interfaces to python/XML` +- {vytask}`T1925` `(bug): DMVPN is always listed as down in "show vpn ipsec sa"` +- {vytask}`T1297` `(feature): Add GARP settings to VRRP/keepalived` + +## 2024-01-08 + +- {vytask}`T5318` `(bug): Security Vulnerabilities for VyOS 1.3.3` +- {vytask}`T3980` `(bug): vrrp transition-script validator makes warning fatal and also causes a python NameError exception` +- {vytask}`T2799` `(feature): VyOS Certificates Manager` + +## 2023-12-29 + +- {vytask}`T5852` `(bug): Reboots fail with eapol WAN interface` + +## 2023-12-22 + +- {vytask}`T4760` `(bug): VyOS does not support running multiple instances of DHCPv6 clients` + +## 2023-12-21 + +- {vytask}`T5714` `(bug): IPSec VPN: op-mode: "show log vpn" does not show results` +- {vytask}`T3039` `(feature): Resize a root partition and filesystem automatically during deployment in virtual environments` +- {vytask}`T2404` `(bug): Cannot change MTU` +- {vytask}`T2353` `(bug): Interface [conf_mode] errors parent task` +- {vytask}`T5796` `(bug): Openconnect - HTTPS security headers are missing` + +## 2023-12-19 + +- {vytask}`T2116` `(feature): Processing configuration via Cloud-init User-Data` + +## 2023-12-18 + +- {vytask}`T2191` `(feature): Using tallow to block sshd probes` + +## 2023-12-15 + +- {vytask}`T5824` `(bug): busybox cannot connect some websites from initramfs` + +## 2023-12-12 + +- {vytask}`T5817` `(bug): Show openvpn server fails in some cases` +- {vytask}`T5413` `(default): Deny the opportunity to use one public/private key pair on both wireguard peers.` + +## 2023-11-30 + +- {vytask}`T4601` `(bug): dhcp : relay agent IP address issue.` + +## 2023-11-28 + +- {vytask}`T5777` `(bug): frr: backport and upstream recent bgpd daemon crashes` + +## 2023-11-27 + +- {vytask}`T5763` `(bug): Fix imprecise check for remote file name in vyos-load-config.py` + +## 2023-11-25 + +- {vytask}`T5655` `(bug): commit-archive: Ctrl+C should not eror out with stack trace, signal should be cought` + +## 2023-11-24 + +- {vytask}`T5402` `(bug): VRRP router with rfc3768-compatibility sends multiple ARP replies` + +## 2023-11-22 + +- {vytask}`T5578` `(bug): "ikev2-reauth" description contains outdated information` + +## 2023-11-15 + +- {vytask}`T5661` `(enhancment): Add show show ssh dynamic-protection attacker and show log ssh dynamic-protection` +- {vytask}`T1276` `(bug): dhcp relay + VLAN fails` + +## 2023-11-07 + +- {vytask}`T5586` `(feature): Disable by default SNMP for Keepalived VRRP` + +## 2023-11-06 + +- {vytask}`T4269` `(feature): node.def generator should automatically add default values` + +## 2023-10-26 + +- {vytask}`T5684` `(bug): services using VRF generates the error "Failed to load BPF prog: 'Operation not permitted'" when the system boots.` +- {vytask}`T5594` `(bug): VRRP - Error if using IPv6 Link Local as hello source address` + +## 2023-10-21 + +- {vytask}`T5670` `(bug): bridge: missing member interface validator` +- {vytask}`T5191` `(default): Replace underscores with hyphens in command-line options generated by vyos.opmode` +- {vytask}`T4402` `(bug): OpenVPN client-ip-pool option is broken` +- {vytask}`T2719` `(feature): Standardized op mode script structure` + +## 2023-10-19 + +- {vytask}`T5669` `(bug): VXLAN interface changing port does not work` + +## 2023-10-17 + +- {vytask}`T5235` `(bug): SSH keys with special characters cannot be applied via Cloud-init` + +## 2023-10-08 + +- {vytask}`T5630` `(feature): pppoe: allow to specify MRU in addition to already configurable MTU` + +## 2023-10-06 + +- {vytask}`T5576` `(feature): Add bgp remove-private-as all option` + +## 2023-10-04 + +- {vytask}`T5632` `(feature): Add jq package to parse JSON files` + +## 2023-09-25 + +- {vytask}`T5533` `(bug): Keepalived VRRP IPv6 group enters in FAULT state` + +## 2023-09-20 + +- {vytask}`T5271` `(default): Add support for peer-fingerprint to OpenVPN` + +## 2023-09-11 + +- {vytask}`T5557` `(bug): bgp: Use treat-as-withdraw for tunnel encapsulation attribute CVE-2023-38802` +- {vytask}`T3424` `(default): PPPoE IA-PD doesn't work in VRF` + +## 2023-09-10 + +- {vytask}`T5555` `(bug): Fix timezone migrator (system 13-to-14)` +- {vytask}`T5545` `(bug): sflow is not working` + +## 2023-09-08 + +- {vytask}`T4426` `(default): Add arpwatch to the image` + +## 2023-09-05 + +- {vytask}`T5524` `(feature): Add config directory to liveCD` +- {vytask}`T2958` `(bug): DHCP server doesn't work from a live CD` +- {vytask}`T5428` `(bug): dhcp: client renewal fails when running inside VRF` + +## 2023-09-04 + +- {vytask}`T5506` `(bug): Container bridge interfaces do not have a link-local address` + +## 2023-08-31 + +- {vytask}`T5190` `(feature): Cloud-Init cannot fetch Meta-data on machines where the main Ethernet interface is not eth0` +- {vytask}`T5140` `(bug): Firewall network-group problems` +- {vytask}`T4895` `(bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data` +- {vytask}`T4874` `(default): Add Warning message to Equuleus` +- {vytask}`T4855` `(bug): Trying to create more than one tunnel of the same type to the same address causes unhandled exception` +- {vytask}`T4776` `(bug): NVME storage is not detected properly during installation` +- {vytask}`T3546` `(feature): Add support for running scripts on PPPoE server session events` +- {vytask}`T738` `(feature): Add local-port and resolver port options for powerdns in CLI configuration tree` + +## 2023-08-30 + +- {vytask}`T5221` `(bug): BGP as-override behavior differs from new FRR and other vendors` +- {vytask}`T4933` `(default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a nondescript error` +- {vytask}`T4790` `(bug): RADIUS login does not work if sum of timeouts more than 50s` +- {vytask}`T4475` `(bug): route-map does not support ipv6 peer` +- {vytask}`T4459` `(bug): API service with VRF doesn't work in 1.3.1` +- {vytask}`T4407` `(bug): Network-config v2 is broken in Cloud-init 22.1 and VyOS 1.3` +- {vytask}`T4113` `(bug): Incorrect GRUB configuration parsing` +- {vytask}`T1764` `(bug): Use lists instead of whitespace-separated strings in vyos.config` +- {vytask}`T4121` `(bug): Nameservers from DHCP client cannot be used in specific cases` +- {vytask}`T4151` `(feature): IPV6 local PBR Support` +- {vytask}`T4306` `(default): Do not check for ditry repository when building release images` + +## 2023-08-29 + +- {vytask}`T3940` `(bug): DHCP client does not remove IP address when stopped by the 02-vyos-stopdhclient hook` +- {vytask}`T3713` `(default): Create a meta-package for user utilities` +- {vytask}`T3339` `(bug): Cloud-Init domain search setting not applied` +- {vytask}`T2640` `(feature): Running VyOS inside Docker containers` +- {vytask}`T3577` `(bug): Generating vpn x509 key pair fails with command not found` + +## 2023-08-28 + +- {vytask}`T4745` `(bug): CLI TAB issue with values with '-' at the beginning in conf mode` +- {vytask}`T2611` `(bug): Prefix list names are shared between ipv4 and ipv6` +- {vytask}`T2296` `(default): Upgrade WALinux to 2.2.41` +- {vytask}`T2123` `(default): Configure 3 NTP servers` +- {vytask}`T469` `(bug): Problem after commit with errors` + +## 2023-08-25 + +- {vytask}`T4412` `(bug): commit archive: reboot not working with sftp` +- {vytask}`T3702` `(feature): Policy: Allow routing by fwmark` +- {vytask}`T3536` `(default): Unable to list all available routes` + +## 2023-08-24 + +- {vytask}`T5006` `(bug): Http api segfault with concurrent requests` +- {vytask}`T5305` `(bug): REST API configure operation should not be defined as async` + +## 2023-08-23 + +- {vytask}`T5387` `(feature): dhcp6c: add a no release option` + +## 2023-08-20 + +- {vytask}`T5470` `(bug): wlan: can not disable interface if SSID is not configured` + +## 2023-08-17 + +- {vytask}`T5486` `(bug): Service dns dynamic cannot pass the smoketest` +- {vytask}`T5223` `(bug): tunnel key doesn't clear` + +## 2023-08-15 + +- {vytask}`T5273` `(default): Add op mode commands for displaying certificate details and fingerprints` +- {vytask}`T5270` `` (default): Make OpenVPN `tls dh-params` optional `` + +## 2023-08-10 + +- {vytask}`T5329` `(bug): Wireguard interface as GRE tunnel source causes configuration error on boot` + +## 2023-07-24 + +- {vytask}`T5354` `(feature): Add sshguard to protect against brut-forces for 1.3` + +## 2023-07-17 + +- {vytask}`T2051` `(bug): Throughput anomalies` + +## 2023-07-14 + +- {vytask}`T305` `(default): loadbalancing does not work with one pppoe connection and another connection of either dhcp or static` + +## 2023-07-13 + +- {vytask}`T3045` `(bug): Changes to Conntrack-Sync don't apply correctly (Mutlicast->UDP)` +- {vytask}`T971` `(bug): authentication public-keys options quoting issue` + +## 2023-07-12 + +- {vytask}`T5009` `(bug): op-mode command: restart dhcp relay-agent not working` +- {vytask}`T4927` `(bug): Need to change restart to reload-or-restart in Webproxy module` +- {vytask}`T3835` `(bug): vyos router 1.2.7 snmp Dos bug` +- {vytask}`T4959` `(feature): Add container registry authentication config for containers` +- {vytask}`T425` `(feature): AWS CloudWatch monitoring scripts` + +## 2023-07-11 + +- {vytask}`T4862` `(bug): webproxy domain-block does not work` +- {vytask}`T4844` `(bug): Incorrect permissions of the safeguard DB directory` +- {vytask}`T4262` `(bug): install image doesn't respect chosen root partition size` +- {vytask}`T3810` `(bug): webproxy squidguard rules don't work properly after rewriting to python.` +- {vytask}`T1928` `(bug): Is the 'Welcome to VyOS' message when using SSH an information leak?` +- {vytask}`T4737` `(bug): FRRouting/zebra 7.5.1 does not redistribute routes to other protocols` +- {vytask}`T3852` `(bug): DHCP client issue - interface has two dhclient processes when link is unpluged and then plug again` +- {vytask}`T2118` `(bug): Failure to boot after power outage due to dirty filesystem and no fsck in initramfs` + +## 2023-07-05 + +- {vytask}`T5331` `(bug): ath10k_pci not functioning` + +## 2023-06-30 + +- {vytask}`T5315` `(feature): vrrp: add support for version 3` +- {vytask}`T5313` `(bug): UDP broadcast relay - missing verify() that relay interfaces have an IP address assigned` + +## 2023-06-26 + +- {vytask}`T5272` `(default): Upgrade OpenVPN to 2.6 in Equuleus` +- {vytask}`T5265` `(bug): WAN load-balancing: missing completion helpers` + +## 2023-06-25 + +- {vytask}`T5240` `(bug): Service router-advert failed to start radvd with more then 3 name-servers` + +## 2023-06-21 + +- {vytask}`T5280` `(bug): Update Expired keys (2023-06-08) for PowerDNS` + +## 2023-06-13 + +- {vytask}`T5213` `(feature): Accel-ppp sending accounting interim updates acct-interim-interval option` + +## 2023-05-29 + +- {vytask}`T5243` `(bug): Default route is inactive if an interface has multiple ip addresses of the same subnet in 1.3.2 Equuleus` + +## 2023-05-19 + +- {vytask}`T5186` `(bug): QoS test cannot pass for 1.3` + +## 2023-05-12 + +- {vytask}`T2769` `(feature): Add VRF support for syslog` + +## 2023-05-08 + +- {vytask}`T5212` `(bug): snmp community name -error with special carracter` + +## 2023-04-27 + +- {vytask}`T5175` `(bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0` +- {vytask}`T5176` `(bug): http-api: update vyos-http-api-tools for FastAPI security vulnerability` + +## 2023-04-13 + +- {vytask}`T5152` `(bug): Telegraf agent hostname isn't qualified` +- {vytask}`T4727` `(feature): Add RADIUS rate limit support to PPTP server` +- {vytask}`T4939` `(bug): VRRP command no-preempt not work as expected` +- {vytask}`T3608` `(default): Standardize warnings from configure scripts` + +## 2023-04-05 + +- {vytask}`T4975` `(bug): CLI does not work after cutting off the power or reset` +- {vytask}`T5136` `(bug): Possible config corruption on upgrade` + +## 2023-04-01 + +- {vytask}`T5047` `(bug): Recreate only a specific container` + +## 2023-03-31 + +- {vytask}`T5111` `(bug): pppd-dns.service startup failed` + +## 2023-03-29 + +- {vytask}`T5033` `(bug): generate-public-key command fails for address with multiple public keys like GitHub` +- {vytask}`T5097` `(bug): the operational command "show interfaces ethernet ethx" doesn't reflect a call to 'clear counters'` + +## 2023-03-21 + +- {vytask}`T5098` `(feature): PPPoE client holdoff configuration` + +## 2023-03-19 + +- {vytask}`T4925` `(feature): Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2` + +## 2023-03-16 + +- {vytask}`T3083` `(feature): Add feature event-handler` +- {vytask}`T2516` `(bug): vyos-container: cannot configure ethernet interface` + +## 2023-03-09 + +- {vytask}`T5066` `(bug): Different GRE tunnel but same tunnel keys error` + +## 2023-03-08 + +- {vytask}`T4381` `(default): OpenVPN: Add "Tunnel IP" column in "show openvpn server" operational command` +- {vytask}`T4872` `(bug): Op-mode show openvpn misses a case when parsing for tunnel IP` + +## 2023-03-07 + +- {vytask}`T2838` `(bug): Ethernet device names changing, multiple hw-id being added` +- {vytask}`T2649` `(default): Ensure configration mode scripts conform to coding guidelines` +- {vytask}`T4900` `(default): Cache intermediary results of get_config_diff in Config instance` + +## 2023-03-03 + +- {vytask}`T4625` `(enhancment): Update ocserv to current revision (1.1.6)` + +## 2023-02-28 + +- {vytask}`T4955` `(bug): Openconnect radiusclient.conf generating with extra authserver` +- {vytask}`T4219` `(feature): support incoming-interface (iif) in local PBR` + +## 2023-02-25 + +- {vytask}`T5008` `(bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine` +- {vytask}`T5007` `(bug): Interface multicast setting is invalid` +- {vytask}`T5017` `(bug): Bug with validator interface-name` +- {vytask}`T4992` `(bug): Incorrect check is_local_address for bgp neighbor with option ip_nonlocal_bind set` +- {vytask}`T4978` `(bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.4-rolling-202302041536` +- {vytask}`T4948` `(feature): pppoe: add CLI option to allow definition of host-uniq flag` + +## 2023-02-22 + +- {vytask}`T5011` `(bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu check should be skipped` + +## 2023-02-18 + +- {vytask}`T4743` `(feature): Enable IPv6 address for Dynamic DNS` + +## 2023-02-16 + +- {vytask}`T4971` `(feature): Radius attribute "Framed-Pool" for PPPoE` + +## 2023-02-15 + +- {vytask}`T4993` `(bug): Can't delete conntrack ignore rule` + +## 2023-02-14 + +- {vytask}`T4999` `(feature): vyos.util backport dict_search_recursive` +- {vytask}`T1993` `(feature): Extended pppoe rate-limiter` + +## 2023-02-13 + +- {vytask}`T4153` `(bug): Monitor bandwidth-test initiate not working` + +## 2023-02-11 + +- {vytask}`T2603` `(feature): pppoe-server: reduce min MTU` + +## 2023-02-08 + +- {vytask}`T1288` `(feature): FRR: rewrite staticd backend (/opt/vyatta/share/vyatta-cfg/templates/protocols/static/*)` + +## 2023-02-07 + +- {vytask}`T4117` `(bug): Does not possible to configure PoD/CoA for L2TP vpn` + +## 2023-02-01 + +- {vytask}`T4970` `(default): pin OCaml pcre package to avoid JIT support` + +## 2023-01-30 + +- {vytask}`T4954` `(bug): DNS cannot be configured via Network-Config v1 received from ConfigDrive / Cloud-Init` + +## 2023-01-24 + +- {vytask}`T4949` `(feature): Backport "monitor log" and "show log" op-mode definitions from current to equuleus` +- {vytask}`T4947` `(feature): Support mounting container volumes as ro or rw` + +## 2023-01-23 + +- {vytask}`T4798` `(default): Migrate the file-exists validator away from Python` +- {vytask}`T4683` `(enhancment): Add kitty-terminfo package to build` +- {vytask}`T4875` `(default): Replace Python validator 'interface-name' to avoid Python startup cost` +- {vytask}`T4664` `(bug): Add validation to reject whitespace in tag node value names` + +## 2023-01-22 + +- {vytask}`T4906` `(bug): ipsec connections shows only one connection as up` + +## 2023-01-21 + +- {vytask}`T4896` `(bug): ospfv3: Fix broken not-advertise option` +- {vytask}`T4799` `(bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd` + +## 2023-01-17 + +- {vytask}`T4902` `(bug): snmpd: exclude container storage from monitoring` + +## 2023-01-15 + +- {vytask}`T4832` `(feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)` +- {vytask}`T4918` `(bug): Odd show interface behavior` + +## 2023-01-09 + +- {vytask}`T4922` `(feature): Add ssh-client source-interface CLI option` + +## 2023-01-07 + +- {vytask}`T4884` `(bug): Missing a community6 in snmpd config` + +## 2023-01-05 + +- {vytask}`T3937` `(default): Rewrite "show system memory" in Python to make it usable as a library function` + +## 2023-01-03 + +- {vytask}`T4869` `` (bug): A network with `/32` or `/128` mask cannot be removed from a network-group `` + +## 2022-12-31 + +- {vytask}`T4898` `(feature): Add mtu config option for dummy interfaces` + +## 2022-12-26 + +- {vytask}`T4511` `(bug): IPv6 DNS lookup` +- {vytask}`T4809` `(feature): radvd: Allow use of AdvRASrcAddress` + +## 2022-12-18 + +- {vytask}`T4709` `(bug): TCP MSS clamping broken in equuleus` + +## 2022-12-15 + +- {vytask}`T4671` `(bug): linux-firmware package is missing symlinks defined in WHENCE file` + +## 2022-12-04 + +- {vytask}`T4825` `(feature): interfaces veth/veth-pairs -standalone used` + +## 2022-12-02 + +- {vytask}`T4122` `(bug): interface ip address config missing after upgrade from 1.2.8 to 1.3.0 (when redirect is configured?)` +- {vytask}`T1024` `(feature): Policy Based Routing by DSCP` + +## 2022-11-23 + +- {vytask}`T4793` `(feature): Create warning message about disable-route-autoinstall when ipsec vti is used` + +## 2022-11-21 + +- {vytask}`T4812` `(feature): IPsec ability to show all configured connections` + +## 2022-11-06 + +- {vytask}`T2913` `(bug): Failure to install fpm while building builder docker image` + +## 2022-11-04 + +- {vytask}`T2417` `(feature): Python validator cleanup` + +## 2022-11-01 + +- {vytask}`T4177` `(bug): Strip-private doesn't work for service monitoring` + +## 2022-10-31 + +- {vytask}`T1875` `(feature): Add the ability to use network address as BGP neighbor (bgp listen range)` +- {vytask}`T4785` `(feature): snmp: Allow !, @, * and # in community name` + +## 2022-10-21 + +- {vytask}`T2189` `(bug): Adding a large port-range will take ~ 20 minutes to commit` + +## 2022-10-18 + +- {vytask}`T4533` `(bug): Radius clients don’t have simple permissions` + +## 2022-10-13 + +- {vytask}`T4312` `(bug): Telegraf configuration doesn't accept IPs for URL` + +## 2022-10-12 + +- {vytask}`T4730` `(bug): Conntrack-sync error - listen-address is not the correct type in config as it should be` + +## 2022-10-11 + +- {vytask}`T4680` `(bug): Telegraf prometheus-client listen-address invalid format` + +## 2022-10-04 + +- {vytask}`T4702` `(bug): Wireguard peers configuration is not synchronized with CLI` +- {vytask}`T4652` `(feature): Upgrade PowerDNS recursor to 4.7 series` +- {vytask}`T4648` `(default): PPPoE: Ignore default router from RA when PPPoE default-route is set to none` +- {vytask}`T4582` `(default): Router-advert: Preferred lifetime cannot equal valid lifetime in PIOs` + +## 2022-09-17 + +- {vytask}`T4666` `(bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584` + +## 2022-09-15 + +- {vytask}`T4679` `(bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address` +- {vytask}`T4630` `(bug): Prevent attempts to use the same interface as a source interface for pseudo-ethernet and MACsec at the same time` + +## 2022-09-12 + +- {vytask}`T4647` `(feature): Add Google Virtual NIC (gVNIC) support` + +## 2022-09-05 + +- {vytask}`T4668` `(bug): Adding/removing members from bond doesn't work/results in incorrect interface state` +- {vytask}`T4628` `(bug): ConfigTree() throws ValueError() if tagNode contains whitespaces` + +## 2022-08-29 + +- {vytask}`T4653` `(bug): Interface offload options are not applied correctly` +- {vytask}`T4061` `(default): Add util function to check for completion of boot config` +- {vytask}`T4654` `(bug): RPKI cache incorrect description` +- {vytask}`T4572` `(bug): Add an option to force interface MTU to the value received from DHCP` + +## 2022-08-26 + +- {vytask}`T4642` `(bug): proxy: hyphen not allowed in proxy URL` + +## 2022-08-23 + +- {vytask}`T4618` `(bug): Traffic policy not set on virtual interfaces` +- {vytask}`T4538` `(bug): Macsec does not work correctly when the interface status changes.` + +## 2022-08-22 + +- {vytask}`T4629` `(bug): Raised ConfigErrors contain dict instead of only the dict key` +- {vytask}`T4632` `(bug): VLAN-aware bridge not working` + +## 2022-08-19 + +- {vytask}`T4616` `(bug): openconnect: KeyError: 'local_users'` +- {vytask}`T4614` `(feature): OpenConnect split-dns directive` + +## 2022-08-16 + +- {vytask}`T4592` `(bug): macsec: can not create two interfaces using the same source-interface` +- {vytask}`T4584` `(bug): hostap: create custom package build` +- {vytask}`T4537` `(bug): MACsec not working with cipher gcm-aes-256` + +## 2022-08-15 + +- {vytask}`T4565` `(bug): vlan aware bridge not working with - Kernel: T3318: update Linux Kernel to v5.4.205 #249` +- {vytask}`T4206` `(bug): Policy Based Routing with DHCP Interface Issue` +- {vytask}`T2763` `(feature): New SNMP resource request - SNMP over TCP` + +## 2022-08-14 + +- {vytask}`T4579` `(bug): bridge: can not delete member interface CLI option when VLAN is enabled` +- {vytask}`T4421` `(default): Add support for floating point numbers in the numeric validator` +- {vytask}`T4415` `(bug): Include license/copyright files in the image but remove user documentation from /usr/share/doc to reduce its size` +- {vytask}`T4313` `(bug): "generate public-key-command" throws unhandled exceptions when it cannot retrieve the key` +- {vytask}`T4082` `(bug): Add op mode command to restart ldpd` +- {vytask}`T3714` `(bug): Some sysctl custom parameters disappear after reboot` +- {vytask}`T4260` `(bug): Extend vyos.configdict.node_changed() to support recursiveness` +- {vytask}`T3785` `(default): Add unicode support to configtree backend` +- {vytask}`T3507` `(bug): Bond with mode LACP show u/u in show interfaces even if peer is not configured` + +## 2022-08-11 + +- {vytask}`T4476` `(default): Next steps after installation is not communicated properly to new users` + +## 2022-08-02 + +- {vytask}`T4515` `(default): Reduce telegraf binary size` + +## 2022-07-30 + +- {vytask}`T4575` `(feature): vyos.utill add new wrapper "rc_cmd" to get the return code and output` +- {vytask}`T4532` `(bug): Flow-accounting IPv6 server/receiver bug` + +## 2022-07-27 + +- {vytask}`T4571` `(bug): Sflow with vrf configured does not use vrf to validate agent-address IP from vrf-configured interfaces` + +## 2022-07-18 + +- {vytask}`T4228` `(bug): bond: OS error thrown when two bonds use the same member` +- {vytask}`T4534` `(bug): bond: bridge: error out if member interface is assigned to a VRF instance` +- {vytask}`T4525` `(bug): Delete interface from VRF and add it to bonding error` +- {vytask}`T4522` `(feature): bond: add ability to specify mii monitor interval via CLI` +- {vytask}`T4521` `(bug): bond: ARP monitor interval is not configured despite set via CLI` + +## 2022-07-14 + +- {vytask}`T4491` `(bug): Use empty string for internal name of root node of config_tree` + +## 2022-07-13 + +- {vytask}`T1375` `(feature): Add clear dhcp server lease function` + +## 2022-07-12 + +- {vytask}`T4527` `(bug): Prevent to create VRF name default` +- {vytask}`T4084` `(default): Dehardcode the default login banner` +- {vytask}`T3864` `(enhancment): Add Edgecore build to VyOS 1.3 Equuleus` + +## 2022-07-09 + +- {vytask}`T4507` `(feature): IPoE-server add multiplier option for shaper` +- {vytask}`T4468` `(bug): web-proxy source group cannot start with a number bug` +- {vytask}`T4373` `(feature): PPPoE-server add multiplier option for shaper` + +## 2022-07-07 + +- {vytask}`T4456` `(bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many messages` +- {vytask}`T4509` `(feature): Feature Request: DNS64` + +## 2022-07-06 + +- {vytask}`T4513` `(bug): Webproxy monitor commands do not work` + +## 2022-07-05 + +- {vytask}`T4510` `(bug): set system static-host-mapping doesn't allow IPv4 and IPv6 for same name.` +- {vytask}`T2654` `(bug): Multiple names unable to be assigned to the same static mapping` +- {vytask}`T2683` `(default): no dual stack in system static-host-mapping host-name` + +## 2022-07-01 + +- {vytask}`T4489` `(bug): MPLS sysctl not persistent for tunnel interfaces` + +## 2022-06-20 + +- {vytask}`T1856` `(feature): Support configuring IPSec SA bytes` + +## 2022-06-16 + +- {vytask}`T3866` `(bug): Configs with DNS forwarding listening on OpenVPN interfaces or interfaces without a fixed address cannot be migrated to the new syntax` + +## 2022-06-15 + +- {vytask}`T1890` `(feature): Metatask: rewrite flow-accounting to XML and Python` + +## 2022-06-09 + +- {vytask}`T2580` `(feature): Support for ip pools for ippoe` + +## 2022-06-08 + +- {vytask}`T4447` `` (bug): DHCPv6 prefix delegation `sla-id` limited to 128 `` +- {vytask}`T4350` `(bug): DMVPN opennhrp spokes dont work behind NAT` + +## 2022-05-30 + +- {vytask}`T4315` `(feature): Telegraf - Output to prometheus` + +## 2022-05-27 + +- {vytask}`T4441` `(bug): wwan: connection not possible after a change added after 1.3.1-S1 release` + +## 2022-05-26 + +- {vytask}`T4442` `(feature): HTTP API add action "reset"` + +## 2022-05-25 + +- {vytask}`T2194` `(default): "show firewall" garbled output` + +## 2022-05-19 + +- {vytask}`T4430` `(bug): Show firewall output with visual shift default rule` + +## 2022-05-16 + +- {vytask}`T4377` `(default): generate tech-support archive includes previous archives` + +## 2022-05-12 + +- {vytask}`T4100` `(feature): Firewall increase maximum number of rules` + +## 2022-05-11 + +- {vytask}`T4405` `` (bug): DHCP client sometimes ignores `no-default-route` option of an interface `` + +## 2022-05-10 + +- {vytask}`T1972` `(feature): Allow setting interface name for virtual_ipaddress in VRRP VRID` + +## 2022-05-07 + +- {vytask}`T4361` `` (bug): `vyos.config.exists()` does not work for nodes with multiple values `` +- {vytask}`T4354` `(bug): Slave interfaces fall out from bonding during configuration change` + +## 2022-05-03 + +- {vytask}`T4395` `(feature): Extend show vpn debug` + +## 2022-05-01 + +- {vytask}`T4369` `(bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node` +- {vytask}`T4363` `(bug): salt-minion: default mine_interval option is not set` + +## 2022-04-29 + +- {vytask}`T4388` `(bug): dhcp-server: missing constraint on tftp-server-name option` +- {vytask}`T4366` `(bug): geneve: interface is removed on changes to e.g. description` + +## 2022-04-26 + +- {vytask}`T4235` `(default): Add config tree diff algorithm` + +## 2022-04-19 + +- {vytask}`T4344` `(bug): DHCP statistics not matching, conf-mode generates incorrect pool name with dash` +- {vytask}`T4268` `(bug): Elevated LA while using VyOS monitoring feature` + +## 2022-04-08 + +- {vytask}`T4331` `(bug): IPv6 link local addresses are not configured when an interface is in a VRF` +- {vytask}`T4339` `(bug): wwan: tab-completion results in "No such file or directory" if there is no WWAN interface` +- {vytask}`T4338` `(bug): wwan: changing interface description should not trigger reconnect` +- {vytask}`T4324` `(bug): wwan: check alive script should only be run via cron if a wwan interface is configured at all` + +## 2022-04-07 + +- {vytask}`T4330` `(bug): MTU settings cannot be applied when IPv6 is disabled` +- {vytask}`T4346` `(feature): Deprecate "system ipv6 disable" option to disable address family within OS kernel` +- {vytask}`T4337` `(bug): isis: IETF SPF delay algorithm can not be configured - results in vyos.frr.CommitError` +- {vytask}`T4319` `(bug): The command "set system ipv6 disable" doesn't work as expected.` +- {vytask}`T4341` `(feature): login: disable user-account prior to deletion and wait until deletion is complete` +- {vytask}`T4336` `(feature): isis: add support for MD5 authentication password on a circuit` + +## 2022-04-06 + +- {vytask}`T4308` `(feature): Op-comm "Show log frr" to view specific protocol logs` + +## 2022-03-29 + +- {vytask}`T3686` `(bug): Bridging OpenVPN tap with no local-address breaks` + +## 2022-03-24 + +- {vytask}`T4294` `(bug): Adding a new openvpn-option does not restart the OpenVPN process` +- {vytask}`T4230` `(bug): OpenVPN server configuration deleted after reboot when using a VRRP virtual-address` + +## 2022-03-21 + +- {vytask}`T4311` `(bug): CVE-2021-4034: local privilege escalation in PolKit` +- {vytask}`T4310` `(bug): CVE-2022-0778: infinite loop in OpenSSL certificate parsing` + +## 2022-03-12 + +- {vytask}`T4296` `(bug): Interface config injected by Cloud-Init may interfere with VyOS native` +- {vytask}`T4002` `(default): firewall group network-group long names restriction incorrect behavior` + +## 2022-03-11 + +- {vytask}`T4297` `(bug): Interface configuration saving fails for ice/iavf based interfaces because they can't change speed/duplex settings` + +## 2022-03-05 + +- {vytask}`T4259` `(bug): The conntrackd daemon can be started wrongly` + +## 2022-02-28 + +- {vytask}`T4273` `(bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config` +- {vytask}`T4115` `(bug): reboot in not working as expected` + +## 2022-02-24 + +- {vytask}`T4267` `(bug): Error - Missing required "ip key" parameter` + +## 2022-02-23 + +- {vytask}`T4264` `(bug): vxlan: interface is destroyed and rebuild on description change` +- {vytask}`T4263` `(bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes` + +## 2022-02-21 + +- {vytask}`T4120` `(feature): [VXLAN] add ability to set multiple unicast-remotes` + +## 2022-02-20 + +- {vytask}`T4261` `(feature): MACsec: add DHCP client support` +- {vytask}`T4203` `(bug): Reconfigure DHCP client interface causes brief outages` + +## 2022-02-19 + +- {vytask}`T4258` `(bug): [DHCP-SERVER] error parameter on Failover` + +## 2022-02-17 + +- {vytask}`T4241` `(bug): ocserv openconnect looks broken in recent bulds of 1.3 Equuleus` +- {vytask}`T4255` `(bug): Unexpected print of dict bridge on delete` +- {vytask}`T4240` `(bug): Cannot add wlan0 to bridge via configure` +- {vytask}`T4154` `(bug): Error add second gre tunnel with the same source interface` + +## 2022-02-16 + +- {vytask}`T4237` `(bug): Conntrack-sync error - error adding listen-address command` + +## 2022-02-15 + +- {vytask}`T4201` `(bug): Firewall - ICMPv6 matches not working as expected on 1.3.0` +- {vytask}`T3006` `(bug): Accel-PPP & vlan-mon config get invalid VLAN` +- {vytask}`T3494` `(bug): DHCPv6 leases traceback when PD using` + +## 2022-02-13 + +- {vytask}`T4242` `(bug): ethernet speed/duplex can never be switched back to auto/auto` +- {vytask}`T4191` `(bug): Lost access to host after VRF re-creating` + +## 2022-02-11 + +- {vytask}`T3872` `(feature): Add configurable telegraf monitoring service` +- {vytask}`T4234` `(bug): Show firewall partly broken in 1.3.x` + +## 2022-02-10 + +- {vytask}`T4165` `(bug): Custom conntrack rules cannot be deleted` + +## 2022-02-08 + +- {vytask}`T4227` `(bug): Typo in help completion of hello-time option of bridge interface` + +## 2022-02-07 + +- {vytask}`T4233` `(bug): ssh: sync regex for allow/deny usernames to "system login"` +- {vytask}`T4087` `(feature): IPsec IKE-group proposals limit of 10 pieces` + +## 2022-02-05 + +- {vytask}`T4226` `(bug): VRRP transition-script does not work for groups name which contains -(minus) sign` + +## 2022-02-04 + +- {vytask}`T4196` `(bug): DHCP server client-prefix-length parameter results in non-functional leases` + +## 2022-02-03 + +- {vytask}`T3643` `(bug): show vpn ipsec sa doesn't show tunnels in "down" state` + +## 2022-02-01 + +- {vytask}`T4198` `(bug): Error shown on commit` + +## 2022-01-28 + +- {vytask}`T4184` `(bug): NTP allow-clients address doesn't work it allows to use ntp server for all addresses` + +## 2022-01-24 + +- {vytask}`T4204` `(feature): Update Accel-PPP to a newer revision` + +## 2022-01-17 + +- {vytask}`T3164` `(bug): console-server ssh does not work with RADIUS PAM auth` + +## 2022-01-15 + +- {vytask}`T4183` `(feature): IPv6 link-local address not accepted as wireguard peer` +- {vytask}`T4110` `(feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0` + +## 2022-01-12 + +- {vytask}`T4168` `(bug): IPsec VPN is impossible to restart when DMVPN is configured` +- {vytask}`T4167` `(bug): DMVPN apply wrong param on the first configuration` +- {vytask}`T4152` `(bug): NHRP shortcut-target holding-time does not work` + +## 2022-01-10 + +- {vytask}`T3299` `(bug): Allow the web proxy service to listen on all IP addresses` +- {vytask}`T3115` `(feature): Add support for firewall on L3 VIF bridge interface` + +## 2022-01-09 + +- {vytask}`T3822` `` (bug): OpenVPN processes do not have permission to read key files generated with `run generate openvpn key` `` +- {vytask}`T4142` `(bug): Input ifbX interfaces not displayed in op-mode` +- {vytask}`T3914` `(bug): VRRP rfc3768-compatibility doesn't work with unicast peers` + +## 2022-01-07 + +- {vytask}`T3924` `(bug): VRRP stops working with VRF` + +## 2022-01-06 + +- {vytask}`T4141` `(bug): Set high-availability vrrp sync-group without members error` + +## 2022-01-03 + +- {vytask}`T4065` `(bug): IPSEC configuration error: connection to unix:///var/run/charon.ctl failed: No such file or directory` +- {vytask}`T4052` `(bug): Validator return traceback on VRRP configuration with the script path not in config dir` +- {vytask}`T4128` `(bug): keepalived: Upgrade package to add VRF support` + +## 2021-12-31 + +- {vytask}`T4081` `(bug): VRRP health-check script stops working when setting up a sync group` + +## 2021-12-29 + +- {vytask}`T2922` `` (bug): The `vpn ipsec logging log-modes` miss the IPSec daemons state check `` +- {vytask}`T2695` `(bug): Flow-accounting bug with subinterfaces` +- {vytask}`T2400` `(default): OpenVPN: dont restart server if no need` +- {vytask}`T4086` `(default): system login banner is not removed on deletion.` + +## 2021-12-28 + +- {vytask}`T3380` `(bug): "show vpn ike sa" does not display IPv6 peers` +- {vytask}`T2933` `(feature): VRRP add option virtual_ipaddress_excluded` + +## 2021-12-27 + +- {vytask}`T2566` `(bug): sstp not able to run tunnels ipv6 only` +- {vytask}`T4093` `(bug): SNMPv3 snmpd.conf generation bug` +- {vytask}`T2764` `(enhancment): Increase maximum number of NAT rules` + +## 2021-12-26 + +- {vytask}`T4104` `(bug): RAID1: "add raid md0 member sda1" does not restore boot sector` + +## 2021-12-25 + +- {vytask}`T4101` `(bug): commit-archive: Use of uninitialized value $source_address in concatenation` +- {vytask}`T4055` `(feature): Add VRF support for HTTP(S) API service` + +## 2021-12-24 + +- {vytask}`T3854` `(bug): Missing op-mode commands for conntrack-sync` + +## 2021-12-23 + +- {vytask}`T4092` `(bug): IKEv2 mobike commit failed with DMVPN nhrp` +- {vytask}`T3354` `(default): Convert strip-private script from Perl to Python` + +## 2021-12-22 + +- {vytask}`T3356` `(feature): Script for remote file transfers` + +## 2021-12-21 + +- {vytask}`T4053` `(bug): VRRP impossible to set scripts out of the /config directory` +- {vytask}`T4013` `(bug): Add pkg cloudwatch for AWS images` +- {vytask}`T3913` `(bug): VRF traffic fails after upgrade from 1.3.0-RC6 to 1.3.0-EPA1/2` + +## 2021-12-20 + +- {vytask}`T4088` `(default): Fix typo in login banner` + +## 2021-12-19 + +- {vytask}`T3912` `(default): Use a more informative default post-login banner` + +## 2021-12-17 + +- {vytask}`T3176` `(bug): Ordering of ports on EdgeCore SAF51015I is mixed up?` +- {vytask}`T4059` `(bug): VRRP sync-group transition script does not persist after reboot` + +## 2021-12-16 + +- {vytask}`T4046` `(feature): Sflow - Add Source address parameter` +- {vytask}`T2615` `(default): Provide an explicit option for server fingerprint in commit archive, and make insecure the default` +- {vytask}`T4076` `(enhancment): Allow setting CORS options in HTTP API` +- {vytask}`T3378` `(bug): commit-archive source-address broken for IPv6 addresses` + +## 2021-12-15 + +- {vytask}`T4077` `(bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"` +- {vytask}`T4073` `(bug): "show protocols bfd peer <>" shows incorrect peer information.` + +## 2021-12-14 + +- {vytask}`T4071` `(feature): Allow HTTP API to bind to unix domain socket` + +## 2021-12-12 + +- {vytask}`T4036` `(bug): VXLAN incorrect raiseError if set multicast network instead of singe address` + +## 2021-12-10 + +- {vytask}`T4068` `(feature): Python: ConfigError should insert line breaks into the error message` + +## 2021-12-09 + +- {vytask}`T4033` `(bug): VRRP - Error security when setting scripts` +- {vytask}`T4064` `(bug): IP address for vif is not removed from the system when deleted in configuration` +- {vytask}`T4063` `(bug): VRRP log error - /usr/libexec/vyos/vyos-vrrp-conntracksync.sh - No such file or directory` +- {vytask}`T4060` `(enhancment): Extend configquery for use before boot configuration is complete` + +## 2021-12-08 + +- {vytask}`T4024` `(bug): Access-lists and prefix-lists disappear when setting ldp hello-ipv4-interval` + +## 2021-12-07 + +- {vytask}`T4041` `(servicerequest): "transition-script" doesn't work on "sync-group"` + +## 2021-12-06 + +- {vytask}`T4012` `(feature): Add VRF support for TFTP` + +## 2021-12-05 + +- {vytask}`T4034` `(bug): "make xcp-ng-iso" still includes vyos-xe-guest-utilities` +- {vytask}`T2076` `(feature): RAID install: sfdisk change-id is deprecated in favor of --part-type` +- {vytask}`T1126` `(bug): Reusing a RAID from a BIOS install in an EFI install causes a failure to boot` + +## 2021-12-04 + +- {vytask}`T4049` `(feature): support command-style output with compare command` +- {vytask}`T4047` `(bug): Wrong regex validation in XML definitions` +- {vytask}`T4045` `(bug): Unable to "format disk like "` + +## 2021-12-02 + +- {vytask}`T4035` `(bug): Geneve interfaces aren't displayed by operational mode commands` + +## 2021-12-01 + +- {vytask}`T3695` `(bug): OpenConnect reports commit success when ocserv fails to start due to SSL cert/key file issues` + +## 2021-11-30 + +- {vytask}`T3725` `(feature): show configuration in json format` + +## 2021-11-29 + +- {vytask}`T2661` `(bug): SSTP wrong certificates check` +- {vytask}`T3946` `(enhancment): Automatically resize the root partition if the drive has extra space` + +## 2021-11-28 + +- {vytask}`T3999` `(bug): show lldp neighbor Traceback error` + +## 2021-11-26 + +- {vytask}`T4019` `(bug): Smoketests for SSTP and openconnect fails` + +## 2021-11-25 + +- {vytask}`T4005` `(feature): Feature Request: IPsec IKEv1 + IKEv2 for one peer` + +## 2021-11-24 + +- {vytask}`T4015` `(feature): Update Accel-PPP to a newer revision` +- {vytask}`T1083` `(feature): Implement persistent/random address and port mapping options for NAT rules` + +## 2021-11-23 + +- {vytask}`T3990` `(bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to files left behind in /var/tmp/frr/ after reboot)` + +## 2021-11-20 + +- {vytask}`T4004` `(bug): IPsec ike-group parameters are not saved correctly (after reboot)` + +## 2021-11-19 + +- {vytask}`T4003` `(bug): API for "show interfaces ethernet" does not include the interface description` +- {vytask}`T4011` `(bug): ethernet: deleting interface should place interface in admin down state` + +## 2021-11-18 + +- {vytask}`T3995` `(feature): OpenVPN: do not stop/start service on configuration change` +- {vytask}`T4008` `(feature): dhcp: change client retry interval form 300 -> 60 seconds` +- {vytask}`T3795` `(bug): WWAN: issues with non connected interface / no signal` + +## 2021-11-17 + +- {vytask}`T3350` `(bug): OpenVPN config file generation broken` +- {vytask}`T3996` `(bug): SNMP service error in log` + +## 2021-11-15 + +- {vytask}`T3934` `(bug): Openconnect VPN broken: ocserv-worker general protection fault on client connect` +- {vytask}`T3724` `(feature): Allow setting host-name in l2tp section of accel-ppp` + +## 2021-11-14 + +- {vytask}`T3974` `(bug): route-map commit fails if interface does not exist` + +## 2021-11-11 + +- {vytask}`T1349` `(bug): L2TP remote-access vpn terminated and not showing as connected` +- {vytask}`T1058` `(default): hw-id is ignored when naming interfaces` +- {vytask}`T914` `(feature): Extend list_interfaces.py to support multiple interface types` +- {vytask}`T688` `(enhancment): Move component versions used for config migration purposes into vyos-1x` + +## 2021-11-10 + +- {vytask}`T3982` `(bug): DHCP server commit fails if static-mapping contains + or .` + +## 2021-11-09 + +- {vytask}`T3962` `(bug): Image cannot be built without open-vm-tools` +- {vytask}`T2088` `(bug): Increased boot time from 1.2.4 -> 1.3 rolling by 100%` +- {vytask}`T2136` `(bug): XML command definition convertor doesn't disallow tag nodes with multi flag on` + +## 2021-11-07 + +- {vytask}`T2874` `(feature): Add MTU and TCP-MSS discovery tool` +- {vytask}`T3626` `(bug): Configuring and disabling DHCP Server` + +## 2021-11-06 + +- {vytask}`T3971` `(feature): Ability to build ISO images for XCP-NG hypervisor` +- {vytask}`T3514` `(bug): NIC flap at any interface change` + +## 2021-11-05 + +- {vytask}`T3972` `(bug): Removing vif-c interface raises KeyError` + +## 2021-11-04 + +- {vytask}`T3964` `(bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses` + +## 2021-11-03 + +- {vytask}`T3610` `(bug): DHCP-Server creation for not primary IP address fails` + +## 2021-11-01 + +- {vytask}`T3846` `(bug): dmvpn configuration not reapllied after "restart vpn"` +- {vytask}`T3956` `(bug): GRE tunnel - unable to move from source-interface to source-address, commit error` + +## 2021-10-31 + +- {vytask}`T3945` `(feature): Add route-map for bgp aggregate-address` +- {vytask}`T3341` `(bug): Wrong behavior of the "reset vpn ipsec-peer XXX tunnel XXX" command` +- {vytask}`T3954` `(bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated, config system error` +- {vytask}`T3943` `(bug): "netflow source-ip" prevents image upgrades if IP address does not exist locally` + +## 2021-10-29 + +- {vytask}`T3942` `(feature): Generate IPSec debug archive from op-mode` + +## 2021-10-28 + +- {vytask}`T3941` `(bug): "show vpn ipsec sa" shows established time of parent SA not child SA's` + +## 2021-10-27 + +- {vytask}`T3944` `(bug): VRRP fails over when adding new group to master` + +## 2021-10-25 + +- {vytask}`T3935` `(bug): Update from rc5 to EPA2 failed` + +## 2021-10-22 + +- {vytask}`T3188` `(bug): Tunnel local-ip to dhcp-interface Change Fails to Update` + +## 2021-10-21 + +- {vytask}`T3920` `(bug): dhclient exit hook script 01-vyos-cleanup causes too many arguments error` +- {vytask}`T3926` `(bug): strip-private does not sanitize "cisco-authentication" from NHRP configuration` +- {vytask}`T3925` `(feature): Tunnel: dhcp-interface not implemented - use source-interface instead` +- {vytask}`T3927` `(feature): Kernel: Enable kernel support for HW offload of the TLS protocol` + +## 2021-10-20 + +- {vytask}`T3922` `(bug): NHRP: delete fails` +- {vytask}`T3918` `(bug): DHCPv6 prefix delegation incorrect verify error` +- {vytask}`T3921` `(bug): tunnel: KeyError when using dhcp-interface` + +## 2021-10-19 + +- {vytask}`T3396` `(bug): syslog can't be configured with an ipv6 literal destination in 1.2.x` +- {vytask}`T690` `(feature): Allow OpenVPN servers to push routes with custom metric values` + +## 2021-10-17 + +- {vytask}`T3786` `(bug): GRE tunnel source address 0.0.0.0 error` +- {vytask}`T3425` `(bug): Scripts from the /config/scripts/ folder do not run on live system` +- {vytask}`T3217` `(default): Save FRR configuration on each commit` +- {vytask}`T3076` `(bug): Router reboot adds unwanted 'conntrack-sync mcast-group '225.0.0.50'' line to configuration` +- {vytask}`T2800` `(bug): Pseudo-Ethernet: source-interface must not be member of a bridge` +- {vytask}`T3422` `(bug): Dynamic DNS doesn't allow zone field with cloudflare protocol` +- {vytask}`T3381` `(bug): Change GRE tunnel failed` +- {vytask}`T3254` `(bug): Dynamic DNS status shows incorrect last update time` +- {vytask}`T3253` `(bug): rpki: multiple peers cannot be configured` +- {vytask}`T3219` `(default): Typo in openvpn server client config for IPv6 iroute` +- {vytask}`T2100` `(feature): BGP route adverisement wih checks rib` +- {vytask}`T1663` `(enhancment): T1656 equuleus: buster: arm64/aarch64: ipaddrcheck does not complete testing` +- {vytask}`T1243` `(bug): BGP local-as accept wrong values` +- {vytask}`T770` `(bug): Bonded interfaces get updated with incorrect hw-id in config.` +- {vytask}`T697` `(bug): Clean up and sanitize package dependencies` +- {vytask}`T3837` `(default): OpenConnect: Fix typo in help property` +- {vytask}`T1440` `(bug): Creating two DHCPv6 shared-network-names with the same subnet is allowed, causes dhcpd to fail to start.` +- {vytask}`T578` `(feature): Support Linux Container` + +## 2021-10-16 + +- {vytask}`T3879` `(bug): GPG key verification fails when upgrading from a 1.3 beta version` +- {vytask}`T3851` `(bug): Missing ospf and rip options for bridge vifs` + +## 2021-10-13 + +- {vytask}`T3904` `(bug): NTP pool associations silently fail` +- {vytask}`T3277` `(feature): DNS Forwarding - reverse zones` + +## 2021-10-11 + +- {vytask}`T2607` `(feature): Support for pppoe-server radius mode auth and config radius accouting port` + +## 2021-10-10 + +- {vytask}`T3750` `(bug): pdns-recursor 4.4 issue with dont-query and private DNS servers` +- {vytask}`T3885` `(default): dhcpv6-pd: randomly generated DUID is not persisted` +- {vytask}`T3899` `(enhancment): Add support for hd44780 LCD displays` + +## 2021-10-09 + +- {vytask}`T3894` `` (bug): Tunnel Commit Failed if system does not have `eth0` `` + +## 2021-10-08 + +- {vytask}`T3893` `(bug): MGRE Tunnel commit crash If sit tunnel available` + +## 2021-10-04 + +- {vytask}`T3888` `(bug): Incorrect warning when poweroff command executed from configure mode.` +- {vytask}`T3890` `(feature): dhcp(v6): provide op-mode commands to retrieve both server and client logfiles` +- {vytask}`T3889` `(feature): Migrate to journalctl when reading daemon logs` + +## 2021-10-03 + +- {vytask}`T3880` `(bug): EFI boot shows error on display` + +## 2021-10-02 + +- {vytask}`T3882` `(feature): Upgrade PowerDNs recursor to 4.5 series` +- {vytask}`T3883` `(bug): VRF - Delette vrf config on interface` + +## 2021-10-01 + +- {vytask}`T3877` `(bug): VRRP always enabled rfc3768-compatibility even when not specified` + +## 2021-09-30 + +- {vytask}`T3874` `(bug): D-Link Ethernet Interface not working.` + +## 2021-09-27 + +- {vytask}`T3858` `(bug): Deleting OSPFv3 process yields: Unknown command: no router-id` + +## 2021-09-26 + +- {vytask}`T3860` `(bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64 addresses` +- {vytask}`T3857` `(feature): reboot: send wall message to all users for information` +- {vytask}`T3867` `(bug): vxlan: multicast group address is not validated` +- {vytask}`T3859` `(bug): Add "log-adjacency-changes" to ospfv3 process` + +## 2021-09-23 + +- {vytask}`T3850` `(bug): Dots are no longer allowed in SSH public key names` + +## 2021-09-21 + +- {vytask}`T2602` `(bug): pptp/sstp/l2tp add possibility enable or disable CCP` + +## 2021-09-19 + +- {vytask}`T3841` `(feature): dhcp-server: add ping-check option to CLI` +- {vytask}`T2738` `(bug): Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization` +- {vytask}`T3842` `(feature): Backport DHCP server improvements from VyOS 1.4 sagitta to 1.3 equuleus` +- {vytask}`T3840` `(feature): dns forwarding: Cache size should allow values > 10k` +- {vytask}`T3672` `(bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.conf configuration file output` + +## 2021-09-11 + +- {vytask}`T3402` `(feature): Add VyOS programming library for operational level commands` + +## 2021-09-10 + +- {vytask}`T3802` `(bug): Commit fails if ethernet interface doesn't support flow control` +- {vytask}`T3819` `(bug): Upgrade Salt Stack 3002.3 -> 3003 release train` +- {vytask}`T3421` `(bug): MTR/Traceroute broken in 1.3-beta` +- {vytask}`T3820` `(feature): PowerDNS recursor - update from 4.3 -> 4.4 to sync with current` +- {vytask}`T1770` `(bug): webproxy breaks commit and http access on routed client` +- {vytask}`T915` `(feature): MPLS Support` + +## 2021-09-09 + +- {vytask}`T3816` `(bug): Error after entering outbound-interface command in NAT` +- {vytask}`T3814` `(bug): wireguard: commit error showing incorrect peer name from the configured name` +- {vytask}`T3805` `(bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP interface` + +## 2021-09-07 + +- {vytask}`T2322` `(bug): CLI [op-mode] bugs. Root task` +- {vytask}`T1894` `(bug): FRR config not loaded after daemons segfault or restart` +- {vytask}`T3807` `(bug): Op Command "show interfaces wireguard" does not show the output` +- {vytask}`T3808` `(default): ipsec is mistakenly restarted after delete` + +## 2021-09-06 + +- {vytask}`T3806` `(bug): Don't set link local ipv6 address if MTU less then 1280` +- {vytask}`T3803` `(default): Add source-address option to the ping CLI` +- {vytask}`T3431` `(bug): Show version all bug` +- {vytask}`T3362` `(bug): 1.3 - RC1 ifb redirect failing to commit` +- {vytask}`T3291` `(bug): Fault on setting offload RPS with single-core CPU` +- {vytask}`T2920` `(bug): Commit crash when adding the second mGRE tunnel with the same key` +- {vytask}`T2895` `(bug): VPN IPsec "leftsubnet" declared 2 times` +- {vytask}`T2019` `(bug): LLDP wrong config generation for interface 'all'` + +## 2021-09-05 + +- {vytask}`T3804` `(feature): cli: Migrate and merge "system name-servers-dhcp" into "system name-server"` + +## 2021-09-04 + +- {vytask}`T3697` `(bug): Impossible to delete IPsec completely` +- {vytask}`T3619` `(bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage` +- {vytask}`T1785` `(bug): Deleting partitions on disks (Raid1) with default value 'no'` + +## 2021-09-03 + +- {vytask}`T3788` `(bug): Keys are not allowed with ipip and sit tunnels` +- {vytask}`T3683` `(bug): VXLAN not accept ipv6 and source-interface options and mtu bug` +- {vytask}`T3634` `(feature): Add op command option for ping for do not fragment bit to be set` + +## 2021-09-02 + +- {vytask}`T3792` `(bug): login: A hypen present in a username from "system login user" is replaced by an underscore` +- {vytask}`T3790` `(bug): Does not possible to configure PPTP static ip-address to users` + +## 2021-09-01 + +- {vytask}`T2434` `(bug): Duplicate Address Detection Breaks Interfaces` + +## 2021-08-31 + +- {vytask}`T3789` `(feature): Add custom validator for base64 encoded CLI data` +- {vytask}`T3782` `(default): Ingress Shaping with IFB No Longer Functional with 1.3` + +## 2021-08-30 + +- {vytask}`T3777` `(bug): adding IPv6 EUI64 address fails commit in 1.3.0-rc6` +- {vytask}`T3768` `(default): Remove early syntaxVersion implementation` +- {vytask}`T2558` `` (feature): Add some CPU information to `show version` + fix broken hypervisor detection `` +- {vytask}`T2430` `(default): cannot delete specific route static next-hop` +- {vytask}`T1350` `(bug): VRRP transition script will be executed once only` +- {vytask}`T2941` `(default): Using a non-ASCII character in the description field causes UnicodeDecodeError in configsource.py` +- {vytask}`T3787` `(bug): Remove deprecated UDP fragmentation offloading option` +- {vytask}`T3677` `(feature): "sipcalc" not included in 1.3` + +## 2021-08-29 + +- {vytask}`T3708` `(bug): isisd and gre-bridge commit error` +- {vytask}`T3783` `(bug): "set protocols isis spf-delay-ietf" is not working` +- {vytask}`T2750` `(default): Use m4 as a template processor` + +## 2021-08-27 + +- {vytask}`T3182` `(bug): Main blocker Task for FRR 7.4/7.5 series update` +- {vytask}`T2108` `(default): Use minisign/signify instead of GPG for release signing` + +## 2021-08-26 + +- {vytask}`T3781` `(bug): Revert the NAT implementation in 1.3 back to iptables` +- {vytask}`T3776` `(default): Rename FRR daemon restart op-mode commands` +- {vytask}`T3779` `(feature): Backport all 1.4 IS-IS features and configuration to 1.3 except VRF` + +## 2021-08-25 + +- {vytask}`T3773` `(bug): Delete the "show system integrity" command (to prepare for a re-implementation)` +- {vytask}`T1514` `(default): Add ability to restart frr processes` + +## 2021-08-24 + +- {vytask}`T3772` `(bug): VRRP virtual interfaces are not shown in show interfaces` + +## 2021-08-23 + +- {vytask}`T2555` `(bug): XML op-mode generation scripts silently discard XML nodes` + +## 2021-08-21 + +- {vytask}`T3682` `(bug): Remove running dhclient from ether-resume.py` + +## 2021-08-20 + +- {vytask}`T1950` `(default): Store VyOS configuration syntax version data in JSON file` + +## 2021-08-19 + +- {vytask}`T2759` `(bug): validate-value prints error messages from validators that fail even if overall validation succeeds` +- {vytask}`T3234` `(bug): multi_to_list fails in certain cases, with root cause an element redundancy in XML interface-definitions` +- {vytask}`T3732` `(feature): override-default helper should support adding defaultValues to default less nodes` +- {vytask}`T1962` `(default): Add syntax version to schema` + +## 2021-08-17 + +- {vytask}`T2525` `(bug): OSPFv3 missing route map, not establishing` +- {vytask}`T508` `(bug): ISC DHCP incorrect UDP checksum generation` +- {vytask}`T1643` `(bug): Deleting all firewall zones failed and locked out box` +- {vytask}`T1550` `(bug): Add support for Large BGP Community show commands` + +## 2021-08-16 + +- {vytask}`T3738` `(default): openvpn fails if server and authentication are configured` +- {vytask}`T1594` `(bug): l2tpv3 error on IPv6 local-ip` + +## 2021-08-15 + +- {vytask}`T3756` `(default): VyOS generates invalid QR code for wireguard clients` + +## 2021-08-14 + +- {vytask}`T3745` `(feature): op-mode IPSec show vpn ipse sa sorting` +- {vytask}`T521` `(bug): Network services may fail if vyatta-router.service startup takes longer than a few seconds` + +## 2021-08-13 + +- {vytask}`T3740` `(bug): HTTPs API breaks when the address is IPv6` + +## 2021-08-12 + +- {vytask}`T3731` `(bug): verify_accel_ppp_base_service return wrong config error for SSP` +- {vytask}`T3405` `(feature): PPPoE server unit-cache` +- {vytask}`T2432` `(default): dhcpd: Can't create new lease file: Permission denied` +- {vytask}`T3746` `(feature): Inform users logging into the system about a pending reboot` +- {vytask}`T3744` `(default): Dns forwarding statistics formatting missing a new line` + +## 2021-08-10 + +- {vytask}`T3730` `(bug): op-mode conntrack-sync miss some functions` + +## 2021-08-09 + +- {vytask}`T1501` `(bug): VPN Commit Errors` + +## 2021-08-08 + +- {vytask}`T2027` `(bug): get_config_dict is failing when the configuration section is empty/missing` +- {vytask}`T169` `(feature): Image install should put correct serial console device in created GRUB menu entry` + +## 2021-08-07 + +- {vytask}`T548` `(feature): BGP IPv6 multipath support` + +## 2021-08-06 + +- {vytask}`T1153` `(bug): VyOS 1.2.0RC10, RAID-1, fresh install, unable to save config` + +## 2021-08-05 + +- {vytask}`T696` `(feature): Rewrite conntrack sync to XML` + +## 2021-08-04 + +- {vytask}`T3704` `(feature): Add ability to interact with Areca RAID adapers` +- {vytask}`T320` `(default): OSPF does not redistribute connected routes associated with virtual tunnel interfaces` + +## 2021-08-02 + +- {vytask}`T2623` `(bug): Creating sit tunnel fails with “Can not set “local” for tunnel sit tun1 at tunnel creation”` +- {vytask}`T2161` `(default): snmpd cannot start if ipv6 disabled` +- {vytask}`T3601` `(default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.` + +## 2021-08-01 + +- {vytask}`T3707` `(bug): Ping incorrect ip host checks` + +## 2021-07-31 + +- {vytask}`T3716` `(feature): Linux kernel parameters ignore_routes_with_link_down- ignore disconnected routing connections` +- {vytask}`T1626` `(bug): BGP exchanges prefixes without specified address-family` + +## 2021-07-30 + +- {vytask}`T1176` `(default): FRR - BGP replicating routes` +- {vytask}`T1123` `(bug): Inconsistency in community-list naming validation` + +## 2021-07-29 + +- {vytask}`T2931` `(bug): Unicode decode error causes vyos.configd service to restart` +- {vytask}`T2727` `(bug): Add a dotted decimal value validator` +- {vytask}`T2328` `(default): dhcpv6 server not starting (disable check reversed?)` +- {vytask}`T1758` `(default): Switch vyos.config to libvyosconfig` +- {vytask}`T954` `(bug): Using the 10.255.255.0/24 subnet on other interfaces breaks L2TP/IPSec` + +## 2021-07-23 + +- {vytask}`T3699` `(bug): login: verify selected "system login user" name is not already used by the base system.` + +## 2021-07-21 + +- {vytask}`T3689` `(bug): static ipv6 route doesn't deleted in some cases` +- {vytask}`T3685` `(feature): IPv6 PBR doesn't allow setting of an egress interface` + +## 2021-07-20 + +- {vytask}`T3691` `(bug): GRETAP: key is not applied when interface is created` + +## 2021-07-13 + +- {vytask}`T3679` `(default): Point the unexpected exception message link to the new rolling release location` + +## 2021-07-11 + +- {vytask}`T3665` `(bug): Missing VRF support for VxLAN but already documented` + +## 2021-07-06 + +- {vytask}`T3660` `(feature): Conntrack-Sync configuration command to specify destination udp port for peer` + +## 2021-07-01 + +- {vytask}`T3658` `(feature): Add support for dhcpdv6 fixed-prefix6` + +## 2021-06-29 + +- {vytask}`T3593` `(bug): PPPoE server called-sid format does not work` + +## 2021-06-25 + +- {vytask}`T3650` `(bug): OpenVPN: Upgrade package to 2.5.1 before releasing VyOS 1.3.0` +- {vytask}`T3649` `(feature): Add bonding additional hash-policy` + +## 2021-06-24 + +- {vytask}`T2722` `(bug): get_config_dict() and key_mangling=('-', '_') will alter CLI data for tagNodes` + +## 2021-06-22 + +- {vytask}`T3629` `(bug): IPoE server shifting address in the range` + +## 2021-06-20 + +- {vytask}`T3637` `(bug): vrf: bind-to-all didn't work properly` + +## 2021-06-19 + +- {vytask}`T3633` `(feature): Add LRO offload for interface ethernet` + +## 2021-06-17 + +- {vytask}`T3631` `(feature): route-map: migrate "set extcommunity-rt" and "set extcommunity-soo" to "set extcommunity rt|soo" to match FRR syntax` + +## 2021-06-16 + +- {vytask}`T2425` `(feature): Rewrite all policy zebra filters to XML/Python style` +- {vytask}`T3630` `(feature): op-mode: add "show version kernel" command` + +## 2021-06-13 + +- {vytask}`T3620` `(feature): Rename WWAN interface from wirelessmodem to wwan to use QMI interface` +- {vytask}`T3622` `(feature): WWAN: add support for APN authentication` +- {vytask}`T3621` `(bug): PPPoE interface does not validate if password is supplied when username is set` + +## 2021-06-10 + +- {vytask}`T3250` `(bug): PPPoE server: wrong local usernames` +- {vytask}`T3138` `(bug): ddclient improperly updated when apply rfc2136 config` +- {vytask}`T2645` `(default): Editing route-map action requires adding a new rule` + +## 2021-06-09 + +- {vytask}`T3602` `(bug): Renaming BGP Peer Groups Leaves Router Broken` +- {vytask}`T2916` `(bug): A state of VTI interface in a configuration does not being processing properly` + +## 2021-06-08 + +- {vytask}`T3605` `(default): Allow to set prefer-global for ipv6-next-hop` +- {vytask}`T3607` `(feature): [route-map] set ipv6 next-hop prefer-global` + +## 2021-06-07 + +- {vytask}`T3581` `` (bug): Incomplete command `show ipv6 ospfv3 linkstate` `` +- {vytask}`T3516` `(bug): FRR 7.5 adds a second route when you attempt to change a static route distance instead of overwriting the old route` +- {vytask}`T3461` `(bug): OpenConnect Server redundancy check` +- {vytask}`T3455` `(bug): system users can not be added in "edit"` + +## 2021-06-04 + +- {vytask}`T3592` `(feature): Set default TTL 64 for tunnels` + +## 2021-06-01 + +- {vytask}`T406` `(bug): VPN configuration error: IPv6 over IPv4 IPsec is not supported when using IPv6 ONLY tunnel.` + +## 2021-05-30 + +- {vytask}`T1866` `(bug): Commit archive over SFTP doesn't work with non-standard ports` +- {vytask}`T3589` `(feature): op-mode: support clearing out logfiles from CLI` +- {vytask}`T3508` `(bug): Check if there's enough drive space for an upgrade before downloading an image` +- {vytask}`T1506` `(enhancment): commit-archive scp/sftp public key authentication` + +## 2021-05-29 + +- {vytask}`T3135` `(bug): BFD configurations fail to be applied` +- {vytask}`T3103` `(default): Rewrite parts of vyos\frr.py for readability, logging and to fix mulitiline regex "bugs"` +- {vytask}`T2739` `(default): vyos-utils is not compiled with a Jenkins pipeline.` +- {vytask}`T2451` `(bug): Cannot use !tcp or !tcp_udp while adding firewall rule` +- {vytask}`T2436` `(default): equuleus: Testing: vyos-1x: syntax checking Python scripts in PR` +- {vytask}`T2184` `(bug): OpenVPN op_mode tools broken` +- {vytask}`T1944` `(bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure of Zebra` + +## 2021-05-28 + +- {vytask}`T1579` `(feature): Rewrite all interface types in new XML/Python style` + +## 2021-05-27 + +- {vytask}`T2629` `(bug): VXLAN interfaces don't actually allow you to configure most settings` +- {vytask}`T2617` `(feature): Rewrite vyatta-op-quagga "show" to XML` +- {vytask}`T2512` `(feature): vyatta-op-quagga [show ip] to XML format` +- {vytask}`T1905` `(default): Update to Keepalived 2.0.19` +- {vytask}`T2669` `(bug): DHCP-server overlapping ranges.` + +## 2021-05-26 + +- {vytask}`T3558` `(default): autocomplete options for dhcp-interface is not showing for the static route command` +- {vytask}`T3540` `(bug): Keepalived memory utilisation issue when constantly getting its state in JSON format` +- {vytask}`T2807` `(feature): IPv6 Link-Local Address - Automatically generation/configuration on GRE Interfaces` + +## 2021-05-24 + +- {vytask}`T3575` `(bug): pseudo-ethernet: must check source-interface MTU` +- {vytask}`T3571` `(bug): Broken Show Tab Complete` +- {vytask}`T3576` `(bug): ISIS does not support IPV6` + +## 2021-05-23 + +- {vytask}`T3570` `(default): Prevent setting of a larger MTU on child interfaces` +- {vytask}`T3572` `(feature): Basic Drive Diagnostic Tools` + +## 2021-05-20 + +- {vytask}`T3554` `(feature): Add area-type stub for ospfv3` + +## 2021-05-19 + +- {vytask}`T3562` `(feature): Update Accel-PPP to a newer revision` +- {vytask}`T3559` `(feature): Add restart op-command for OpenConnect Server` + +## 2021-05-18 + +- {vytask}`T3525` `(default): VMWare resume script syntax errors` +- {vytask}`T2462` `(default): LLDP op-mode exception: IndexError: list index out of range` + +## 2021-05-15 + +- {vytask}`T3549` `(bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not correctly exported to dhcpdv6.conf when multiple name-server entries are present` +- {vytask}`T3532` `(bug): Not possible to change ethertype after interface creation` +- {vytask}`T3550` `(bug): Router-advert completion typo` +- {vytask}`T3547` `(feature): conntrackd: remove deprecated config options` +- {vytask}`T3535` `(feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor` +- {vytask}`T2049` `(feature): Update strongSwan cipher suites list for IPSec settings` + +## 2021-05-14 + +- {vytask}`T3346` `(bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node exists but there are no rules` +- {vytask}`T3248` `(default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3` +- {vytask}`T3426` `(default): add support for script arguments to vyos-configd` + +## 2021-05-13 + +- {vytask}`T3544` `(feature): DHCP server should validate configuration before applying it` +- {vytask}`T3543` `(feature): Support for setting lacp_rate on LACP bonded interfaces` + +## 2021-05-12 + +- {vytask}`T3302` `(default): Make vyos-configd relay stdout from scripts to the user's console` + +## 2021-05-11 + +- {vytask}`T3526` `(bug): Smoketest policy fail in CI` + +## 2021-05-10 + +- {vytask}`T3528` `(bug): Frr 7.5.1 uses 'seq' for community-lists` + +## 2021-05-08 + +- {vytask}`T3517` `(bug): FRR 7.5 bfd behavior for 1.3` + +## 2021-05-07 + +- {vytask}`T1171` `(bug): 1.2.0 epa2 - IPsec VPN initiation` + +## 2021-05-06 + +- {vytask}`T3519` `(bug): Cannot add / assign L2TPv3 to vrf` + +## 2021-05-01 + +- {vytask}`T3379` `(feature): Add global-parameters name-server for dhcpv6-server` +- {vytask}`T3491` `(default): Change Kernel HZ to 1000` + +## 2021-04-30 + +- {vytask}`T3170` `(default): Add a sanity check for empty node.def files` + +## 2021-04-29 + +- {vytask}`T3502` `(bug): "system ip multipath layer4-hashing" doesn't work` +- {vytask}`T3029` `(bug): Generated NGINX configuration is wrong for the redirection (http -> https)` +- {vytask}`T3156` `(feature): Add op and additional conf commands for ISIS` +- {vytask}`T2012` `(feature): Global PBR` +- {vytask}`T1314` `(feature): Allow BGP on unnumbered interfaces` + +## 2021-04-27 + +- {vytask}`T2946` `(bug): Calling 'stty_size' causes show interfaces API to fail` + +## 2021-04-25 + +- {vytask}`T3468` `(bug): Tunnel interfaces aren't suggested as being available for bridging (regression)` +- {vytask}`T1802` `(feature): Wireguard QR code in cli for mobile devices` + +## 2021-04-23 + +- {vytask}`T3290` `(bug): Disabling GRE conntrack module fails` + +## 2021-04-18 + +- {vytask}`T3481` `(default): Exclude tag node values from key mangling` +- {vytask}`T3475` `(bug): XML dictionary cache unable to process syntaxVersion elements` + +## 2021-04-15 + +- {vytask}`T3386` `(bug): PPPoE-server don't start with local authentication` + +## 2021-04-14 + +- {vytask}`T3055` `(bug): op-mode incorrect naming for ipsec policy-based tunnels` + +## 2021-04-12 + +- {vytask}`T3454` `(enhancment): dhclient reject option` + +## 2021-04-05 + +- {vytask}`T1612` `(default): dhcp-server time-offset fails to validate` +- {vytask}`T3438` `(bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf from the operating system` +- {vytask}`T3418` `(bug): BGP: system wide known interface can not be used as neighbor` + +## 2021-04-04 + +- {vytask}`T3457` `(feature): Output the "monitor log" command in a colorful way` + +## 2021-03-31 + +- {vytask}`T3445` `(bug): vyos-1x build include not all nodes` + +## 2021-03-25 + +- {vytask}`T2639` `(feature): sort output of show vpn ipsec sa` + +## 2021-03-22 + +- {vytask}`T3284` `(bug): merge/load fail silently if unable to resolve host` + +## 2021-03-21 + +- {vytask}`T3416` `(bug): NTP: when running inside a VRF op-mode commands do not work` + +## 2021-03-20 + +- {vytask}`T3392` `(bug): vrrp over dhcp default route bug (unexpected vrf)` +- {vytask}`T3373` `(feature): Upgrade to SaltStack version 3002.5` +- {vytask}`T3329` `(default): "system conntrack ignore" rules can no longer be created due to an iptables syntax change` +- {vytask}`T3300` `(feature): Add DHCP default route distance` +- {vytask}`T3306` `(feature): Extend set route-map aggregator as to 4 Bytes` + +## 2021-03-18 + +- {vytask}`T3411` `(default): Extend the redirect_stdout context manager in vyos-configd to redirect stdout from subprocesses` +- {vytask}`T3271` `(bug): qemu-kvm grub issue` + +## 2021-03-17 + +- {vytask}`T3413` `(bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP address string passed to inet_pton"` + +## 2021-03-14 + +- {vytask}`T2271` `(feature): OSPF: add per VRF instance support` +- {vytask}`T175` `(feature): Add source route option to VTI interfaces` + +## 2021-03-13 + +- {vytask}`T3406` `(bug): tunnel: interface no longer supports specifying encaplimit none - or migrator is missing` +- {vytask}`T3407` `(bug): console-server: do not allow to spawn a console-server session on serial port used by "system console"` + +## 2021-03-11 + +- {vytask}`T3399` `(bug): RPKI: dashes in hostnames are replaced with underscores when rendering the FRR config` +- {vytask}`T3305` `(bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot` +- {vytask}`T2927` `(bug): isc-dhcpd release and expiry events never execute` +- {vytask}`T899` `(bug): Tunnels cannot be moved from one bridge to another` +- {vytask}`T786` `(feature): new style xml and conf-mode scripts: posibillity to add tagNode value as parameter to conf-script` + +## 2021-03-09 + +- {vytask}`T3382` `(bug): Error creating Console Server` + +## 2021-03-08 + +- {vytask}`T3387` `(bug): Command "Monitor vpn ipsec" is not working` + +## 2021-03-07 + +- {vytask}`T3319` `(bug): VXLAN uses ttl 1 (auto) by default` +- {vytask}`T3391` `(feature): Add CLI support for specifying maximum-paths per address family ipv4 unicast and ipv6 unicast` +- {vytask}`T3211` `(feature): ability to redistribute ISIS into other routing protocols` + +## 2021-03-05 + +- {vytask}`T2659` `(feature): Add fastnetmon (DDoS detection) support` + +## 2021-03-04 + +- {vytask}`T2861` `(bug): route-map "set community additive" not working correctly` + +## 2021-03-03 + +- {vytask}`T2966` `(feature): tunnel: add new encapsulation types ip6tnl and ip6gretap` + +## 2021-03-01 + +- {vytask}`T3342` `(bug): On xen-netback interfaces must set "scattergather" offload before MTU>1500` + +## 2021-02-28 + +- {vytask}`T3370` `(bug): dhcp: Invalid domain name "private"` +- {vytask}`T3369` `(feature): VXLAN: add IPv6 underlay support` + +## 2021-02-27 + +- {vytask}`T2291` `(bug): Bad hostnames in /etc/hosts with static-mapping in dhcp server config` +- {vytask}`T3364` `(feature): tunnel: cleanup/rename CLI nodes` +- {vytask}`T3368` `(feature): macsec: add support for gcm-aes-256 cipher` +- {vytask}`T3366` `(bug): tunnel: can not change local / remote ip address for gre-bridge tunnel` +- {vytask}`T3173` `(feature): Need 'nopmtudisc' option for tunnel interface` + +## 2021-02-26 + +- {vytask}`T3357` `(default): HTTP-API redirect from http correct https port` + +## 2021-02-24 + +- {vytask}`T3303` `(feature): Change welcome message on boot` + +## 2021-02-21 + +- {vytask}`T3163` `(feature): ethernet ring-buffer can be set with an invalid value` + +## 2021-02-19 + +- {vytask}`T3326` `(bug): OSPFv3: Cannot add L2TPv3 interface` + +## 2021-02-18 + +- {vytask}`T3259` `(default): many dnat rules makes the vyos http api crash, even showConfig op timeouts` + +## 2021-02-17 + +- {vytask}`T3047` `(bug): OSPF : virtual-link and passive-interface default parameters does not work together` +- {vytask}`T3312` `(feature): SolarFlare NICs support` + +## 2021-02-16 + +- {vytask}`T3318` `(feature): Update Linux Kernel to v5.4.208 / 5.10.142` + +## 2021-02-14 + +- {vytask}`T2152` `(bug): ddclient has bug which prevents use_web from being used` +- {vytask}`T3308` `(feature): BGP: add gracefull shutdown support` + +## 2021-02-13 + +- {vytask}`T3028` `(feature): Create a default user when metadata is not available (for Cloud-init builds)` +- {vytask}`T2867` `(feature): Cleanup DataSourceOVF.py in the Cloud-init` +- {vytask}`T2726` `(feature): Allow to use all supported SSH key types in Cloud-init` +- {vytask}`T2403` `(feature): Full support for networking config in Cloud-init` +- {vytask}`T2387` `(feature): Create XML scheme for [conf_mode] BGP` +- {vytask}`T2174` `(feature): Rewrite protocol BGP to new XML/Python style` +- {vytask}`T1987` `(bug): A default route can be deleted by dhclient-script in some cases` +- {vytask}`T723` `(feature): Add support for first boot or installation time saved config modification` +- {vytask}`T1775` `(bug): Cloud-init not running userdata runcmd` +- {vytask}`T1389` `(feature): Add support for NoCloud cloud-init datasource` +- {vytask}`T1315` `(feature): Allow BGP to use address-family l2vpn evpn` + +## 2021-02-11 + +- {vytask}`T2638` `(default): FRR: New framework for configuring FRR` + +## 2021-02-08 + +- {vytask}`T3295` `(feature): Update Linux Kernel to v5.4.96 / 5.10.14` + +## 2021-02-07 + +- {vytask}`T3293` `(bug): RPKI migration script errors out after CLI rewrite` + +## 2021-02-06 + +- {vytask}`T3285` `(feature): Schedule reboots through systemd-shutdownd instead of atd` +- {vytask}`T661` `(feature): Show a warning if the router is going to reboot soon (due to "commit-confirm" command)` + +## 2021-02-05 + +- {vytask}`T2450` `(feature): Rewrite "protocols vrf" tree in XML and Python` +- {vytask}`T208` `(feature): Ability to ignore default-route from dhcpcd per interface` + +## 2021-02-03 + +- {vytask}`T3239` `(default): XML: override 'defaultValue' for mtu of certain interfaces; remove workarounds` +- {vytask}`T2910` `(feature): XML: generator should support override of variables` +- {vytask}`T2873` `(bug): "show nat destination translation address" doesn't filter at all` + +## 2021-02-02 + +- {vytask}`T3018` `(bug): Unclear behaviour when configuring vif and vif-s interfaces` +- {vytask}`T3255` `(default): Rewrite protocol RPKI to new XML/Python style` + +## 2021-02-01 + +- {vytask}`T3268` `(feature): Add VRF support to VIF-S interfaces` +- {vytask}`T3274` `(default): ask_yes_no() doesn't handle EOFError` + +## 2021-01-31 + +- {vytask}`T3276` `(feature): Update Linux Kernel to v5.4.94 / 5.10.12` + +## 2021-01-30 + +- {vytask}`T3269` `(bug): VIF-C interfaces don't verify configuration` +- {vytask}`T3240` `(feature): Support per-interface DHCPv6 DUIDs` +- {vytask}`T3273` `(default): PPPoE static default-routes deleted on interface down when not added by interface up` + +## 2021-01-29 + +- {vytask}`T3262` `(bug): DHCPv6 client runs when dhcpv6-options is configured without requesting an address or PD` +- {vytask}`T3261` `(bug): Does not possible to disable pppoe client interface.` + +## 2021-01-27 + +- {vytask}`T3257` `(feature): tcpdump supporting complete protocol` +- {vytask}`T3110` `(bug): Broken pipe in show interfaces` +- {vytask}`T651` `(enhancment): Split CI'ed, VyOS-specific packages and other packages into separate repos` +- {vytask}`T597` `(enhancment): Code testing on sonarcloud.com` +- {vytask}`T516` `(default): Make Python / XML code development more testable` +- {vytask}`T625` `(default): Lack of IKEv1 lifetime negotiation` +- {vytask}`T613` `(bug): Missing linux-kbuild` +- {vytask}`T505` `(bug): Hostapd cannot log` + +## 2021-01-26 + +- {vytask}`T3251` `(bug): PPPoE client trying to authorize with the wrong username` +- {vytask}`T2859` `(bug): show nat source translation - Errors out` + +## 2021-01-25 + +- {vytask}`T3249` `(feature): Support operation mode forwarding table output` + +## 2021-01-24 + +- {vytask}`T3230` `(bug): RPKI can't be deleted` +- {vytask}`T3243` `(feature): Update Linux Kernel to v5.4.92 / 5.10.10` + +## 2021-01-18 + +- {vytask}`T2761` `(feature): Extend "show vrrp" op-mode command with router priority` +- {vytask}`T2679` `(feature): VRRP with BFD Failure Detection` +- {vytask}`T3212` `(bug): SSH: configuration directory is not always created on boot` +- {vytask}`T3231` `(bug): "system option ctrl-alt-delete" has no effect` + +## 2021-01-17 + +- {vytask}`T3222` `(bug): Typo in BGP dampening description` +- {vytask}`T2944` `(bug): NTP by default listen on any address/interface` +- {vytask}`T3226` `(bug): Repair bridge smoke test damage` +- {vytask}`T2442` `(enhancment): Move application of STP settings for bridge members from interfaces-bridge.py to Interface.add_to_bridge()` +- {vytask}`T2381` `(bug): OpenVPN: openvpn-option parsed/rendered improperly` + +## 2021-01-16 + +- {vytask}`T3215` `(bug): Operational command "show ipv6 route" is broken` +- {vytask}`T3172` `(bug): Builds sometime after 2020-12-17 have broken routing after reboot` +- {vytask}`T3157` `(bug): salt-minion fails to start due to permission error accessing /root/.salt/minion.log` +- {vytask}`T3167` `(default): Recurring bugs in Intel NIC drivers` +- {vytask}`T3151` `(default): Decide on the final list of packages for 1.3` +- {vytask}`T3137` `(feature): Let VLAN aware bridge approach the behavior of professional equipment` +- {vytask}`T3223` `(feature): Update Linux Kernel to v5.4.89 / 5.10.7` + +## 2021-01-15 + +- {vytask}`T3210` `(feature): ISIS three-way-handshake` +- {vytask}`T3184` `(feature): Add correct desctiptions for BGP neighbors` +- {vytask}`T2850` `(feature): Add BGP template for FRR` + +## 2021-01-14 + +- {vytask}`T3218` `(feature): Replace Intel out-of-tree drivers with Linux Kernel stock drivers.` + +## 2021-01-13 + +- {vytask}`T3186` `(bug): NAT: Commit failed when applying negated(!) addresses` + +## 2021-01-12 + +- {vytask}`T3205` `(bug): Does not possible to configure tunnel mode gre-bridge` + +## 2021-01-11 + +- {vytask}`T3208` `(bug): Does not possible to change user password` +- {vytask}`T3198` `(bug): OSPF database filtering issue` +- {vytask}`T3206` `(bug): Unable to delete destination NAT rule` +- {vytask}`T3193` `(bug): DHCPv6 PD verification issues` +- {vytask}`T3201` `(bug): Operational command "show log all" is not working for RADIUS users` + +## 2021-01-10 + +- {vytask}`T3178` `(feature): Migrate vyatta-op-quagga to vyos-1x` + +## 2021-01-09 + +- {vytask}`T2467` `(bug): Restarting flow accounting fails with systemd error` +- {vytask}`T3199` `(feature): Update Linux Kernel to v5.4.88 / 5.10.6` + +## 2021-01-07 + +- {vytask}`T3192` `(feature): login: radius: add support for IPv6 RADIUS servers` + +## 2021-01-05 + +- {vytask}`T3169` `(enhancment): Reimplement smoke test of span (mirror)` +- {vytask}`T3161` `(default): Consider removing ConfigLoad.pm` +- {vytask}`T1398` `(default): Remove vyatta-config-migrate package` +- {vytask}`T805` `(enhancment): Drop config compatibility with Vyatta Core older than 6.5` + +## 2021-01-04 + +- {vytask}`T3185` `(bug): [conf-mode] Wrong CompletionHelp for Tunnel local-ip` +- {vytask}`T2601` `(bug): pppoe-server: Cannot disable CCP` + +## 2021-01-03 + +- {vytask}`T3180` `(bug): DHCP server raises NameError` + +## 2021-01-02 + +- {vytask}`T2321` `(feature): VRF support for SSH, NTP, SNMP service` +- {vytask}`T3177` `(bug): Rolling Release no longer reports VMware UUID` + +## 2021-01-01 + +- {vytask}`T3171` `(feature): Add CLI option to enable RPS (Receive Packet Steering)` + +## 2020-12-31 + +- {vytask}`T3162` `(bug): Wrong PPPoE server pado-delay parameter added to config` +- {vytask}`T3160` `(bug): PPPoE server called-sid option defined in wrong section` +- {vytask}`T3168` `(feature): Update Linux Kernel to v5.4.86` + +## 2020-12-29 + +- {vytask}`T3082` `(bug): multi_to_list must distinguish between values and defaults` +- {vytask}`T1466` `(feature): Add EAPOL login support` + +## 2020-12-28 + +- {vytask}`T1732` `(feature): Removing vyatta-webproxy module` +- {vytask}`T2666` `(feature): Packet Processing with eBPF and XDP` +- {vytask}`T2581` `(default): webproxy: implement proxy chaining` +- {vytask}`T563` `(feature): webproxy: migrate 'service webproxy' to get_config_dict()` + +## 2020-12-27 + +- {vytask}`T3150` `(bug): When configuring QoS, the setting procedure of port mirroring is wrong` + +## 2020-12-23 + +- {vytask}`T3143` `(bug): OpenVPN server: Push route config format is wrong` +- {vytask}`T3146` `(feature): Upgrade FRR from 7.4 -> 7.5 version incl. new libyang` +- {vytask}`T3145` `(feature): Update Linux Kernel to v5.4.85` +- {vytask}`T3147` `(feature): Upgrade to SaltStack version 3002.2` + +## 2020-12-22 + +- {vytask}`T3142` `(bug): OpenVPN op-command completion fails due to missing status file` +- {vytask}`T2940` `(feature): Update FRR to 7.4` +- {vytask}`T2573` `(bug): BFD op-mode commands are broken` +- {vytask}`T2495` `(feature): Add xml for ISIS [conf_mode]` +- {vytask}`T1316` `(feature): Support for IS-IS` + +## 2020-12-21 + +- {vytask}`T2619` `(bug): Bug: Changes in NAT or ZONES from 1.2 to 1.3` + +## 2020-12-20 + +- {vytask}`T3131` `(bug): Typo in ipsec preshared-secret help` +- {vytask}`T3134` `(bug): DHCPv6 DUID configuration node missing` +- {vytask}`T3140` `(feature): Relax "ethernet offload-options" CLI definition` +- {vytask}`T3132` `(feature): Enable egress flow accounting` + +## 2020-12-17 + +- {vytask}`T2810` `(default): Docs for vpn anyconnect-server` +- {vytask}`T2036` `(default): Open Connect VPN Server () support` + +## 2020-12-14 + +- {vytask}`T3128` `(bug): pppoe smoke test failed` +- {vytask}`T3129` `(feature): Update Linux Kernel to v5.4.83` +- {vytask}`T3089` `(feature): Migrate port mirroring to vyos-1x and support two-way traffic mirroring` +- {vytask}`T3130` `(feature): Replace vyos-netplug with upstream debian version` + +## 2020-12-13 + +- {vytask}`T3114` `(bug): When the bridge member is a non-ethernet interface, setting VLAN-aware bridge parameters fails` + +## 2020-12-11 + +- {vytask}`T3123` `(bug): Configuration of vti interface impossible` + +## 2020-12-10 + +- {vytask}`T3117` `(bug): OpenVPN config migration errors upgrading from 1.3-rolling-202010280217 to 1.3-rolling-202012060217` + +## 2020-12-09 + +- {vytask}`T3122` `(feature): Update Linux Kernel to v4.19.162` +- {vytask}`T3121` `(bug): get_config_dict() and key_mangling=('-', '_') Broke PowerDNS dns_forwarding config file` + +## 2020-12-08 + +- {vytask}`T2562` `(bug): VyOS can't be used as a DHCP server for a DHCP relay` + +## 2020-12-07 + +- {vytask}`T3120` `(bug): Python error when deleting nat rule` +- {vytask}`T3119` `(feature): migrate "system ip" to get_config_dict() and provide smoketest` + +## 2020-12-05 + +- {vytask}`T2744` `(bug): igmp-proxy issue: Address already in use` + +## 2020-12-04 + +- {vytask}`T3108` `(bug): Section config overlapped match with FRRConfig` +- {vytask}`T3112` `(feature): PPPoE IPv6: remove "enable" node` +- {vytask}`T3100` `(feature): Migrate DHCP/DHCPv6 server to get_config_dict()` + +## 2020-12-03 + +- {vytask}`T3105` `(bug): static-host-mapping writing in one line` +- {vytask}`T3107` `(feature): Update Linux Kernel to v4.19.161` +- {vytask}`T3104` `(bug): LLDP Traceback error` + +## 2020-12-01 + +- {vytask}`T3102` `(bug): Destination NAT fails to commit` +- {vytask}`T2713` `(bug): VyOS must not change permissions on files in /config/auth` + +## 2020-11-30 + +- {vytask}`T3091` `(feature): Add "tag" for static route` +- {vytask}`T1207` `(feature): DMVPN behind NAT` + +## 2020-11-29 + +- {vytask}`T3095` `(feature): Migrate dhcp-relay and dhcpv6-relay to get_config_dict()` + +## 2020-11-28 + +- {vytask}`T2890` `(bug): NAT error adding translation address range` +- {vytask}`T2868` `(bug): Tcp-mss option in policy calls kernel-panic` +- {vytask}`T3092` `(feature): nat: migrate to get_config_dict()` + +## 2020-11-27 + +- {vytask}`T2715` `(feature): Duplicate address detection option supporting ARP` +- {vytask}`T2714` `(feature): A collection of utilities supporting IPv6 or ipv4` +- {vytask}`T3088` `(feature): Migrate IGMP-Proxy over to get_config_dict() and add smoketests` + +## 2020-11-24 + +- {vytask}`T3087` `(feature): Update Linux Kernel to v4.19.160` + +## 2020-11-23 + +- {vytask}`T2177` `(default): Commit fails on adding disabled interface to bridge` +- {vytask}`T3066` `(bug): reboot in - Invalid time` +- {vytask}`T2802` `(bug): Tunnel interface does not apply EUI-64 IPv6 Address` +- {vytask}`T2359` `(bug): Adding IPIP6 tun interface to bridge [conf_mode] errors` +- {vytask}`T2357` `(bug): GRE-bridge conf_mode errors` +- {vytask}`T2259` `(feature): Support for bind vif-c interfaces into VRFs` +- {vytask}`T2205` `(bug): "set interface ethernet" fails on Hyper-V` +- {vytask}`T2182` `(bug): Failure to commit an IPv6 address on a tunnel interface` +- {vytask}`T2155` `(bug): Cannot set anything on Intel 82599ES 10-Gigabit SFI/SFP+` +- {vytask}`T2153` `(bug): traceroute circular reference` +- {vytask}`T3081` `(bug): get_config_dict() does not honor whitespaces in the CLI values field` +- {vytask}`T3080` `(bug): OpenVPN failing silently for a number of reasons in rolling post Nov/02` +- {vytask}`T3074` `(bug): OpenVPN site-to-site creates wrong peer address` +- {vytask}`T2542` `(bug): OpenVPN client tap interfaces not coming up` +- {vytask}`T3084` `(bug): wifi: TypeError on "show interfaces wireless info"` + +## 2020-11-21 + +- {vytask}`T3079` `(bug): Fix the problem that VLAN 1 will be deleted in VLAN-aware bridge` +- {vytask}`T3060` `(bug): OpenVPN virtual interface not coming up after upgrade` + +## 2020-11-20 + +- {vytask}`T3078` `(feature): CLI cleanup: rename "system options" -> "system option"` +- {vytask}`T2997` `(feature): DHCP: disallow/do-not-request certain options when requesting IP address from server` +- {vytask}`T3077` `(feature): WireGuard: automatically create link-local IPv6 adresses` +- {vytask}`T2550` `(default): OpenVPN: IPv4 not working in client mode` +- {vytask}`T3072` `(feature): Migrate tunnel interfaces to new get_config_dict() approach` +- {vytask}`T3065` `(feature): Add "interfaces wirelessmodem" IPv6 support` +- {vytask}`T3048` `(feature): Drop static smp-affinity for a more dynamic way using tuned` + +## 2020-11-19 + +- {vytask}`T3067` `(bug): Wireless interface can no longer be added to the bridge after bridge VLAN support` +- {vytask}`T3075` `(feature): Update Linux Kernel to v4.19.158` + +## 2020-11-16 + +- {vytask}`T3003` `(enhancment): Extend smoketest framework to allow loading an arbitrary config file` + +## 2020-11-15 + +- {vytask}`T3069` `(bug): OpenVPN routed networks not available` +- {vytask}`T3038` `(feature): Supporting AZERTY keyboards` +- {vytask}`T2993` `(bug): op-mode: lldp: show lldp neighbors - AttributeError: 'str' object has no attribute 'items'` + +## 2020-11-14 + +- {vytask}`T3041` `(bug): Intel QAT: vyos-1.3-rolling-202011020217-amd64 kernel panic during configure` + +## 2020-11-13 + +- {vytask}`T3063` `(feature): Add support for Huawei LTE Module ME909s-120` +- {vytask}`T3059` `(bug): L2TPv3 interface: Enforced to shutdown but no command to enable interface permanently` + +## 2020-11-12 + +- {vytask}`T3064` `(feature): Update Linux Kernel to v4.19.157` + +## 2020-11-10 + +- {vytask}`T2103` `(bug): Abnormal interface names if VIF present` + +## 2020-11-08 + +- {vytask}`T3050` `(bug): Broken address/subnet validation on NAT configuration` + +## 2020-11-07 + +- {vytask}`T2914` `(bug): OpenVPN: Fix for IPv4 remote-host hostname in client mode:` +- {vytask}`T2653` `(feature): "set interfaces" Python handler code improvements - next iteration` +- {vytask}`T311` `(feature): DHCP: set client-hostname via CLI` + +## 2020-11-06 + +- {vytask}`T3051` `(bug): OpenVPN: multiple client routes do not work in server mode` +- {vytask}`T3046` `(bug): openvpn directory is not auto-created` +- {vytask}`T3052` `(feature): Update Linux firmware files to 20201022 version` +- {vytask}`T2731` `(bug): "show interfaces" returns invalid state when link is down` + +## 2020-11-05 + +- {vytask}`T3049` `(feature): Update Linux Kernel to v4.19.155` +- {vytask}`T2994` `(feature): Migrate OpenVPN interfaces to get_config_dict() syntax` + +## 2020-11-03 + +- {vytask}`T3043` `(feature): Wireless: Refactor CLI` +- {vytask}`T3034` `(feature): Add WiFi WPA 3 support` +- {vytask}`T2967` `(bug): Duplicate IPv6 BFD peers created` +- {vytask}`T2483` `(bug): DHCP most likely not restarting pdns_recursor` + +## 2020-11-02 + +- {vytask}`T3024` `(bug): DHCPv6 PD configuration doesn't really render an expected behavior` + +## 2020-11-01 + +- {vytask}`T3036` `(feature): OpenVPN remote-address does not accept IPv6 address` +- {vytask}`T2193` `` (feature): Display disabled VRRP instances in a `show vrrp` output `` + +## 2020-10-30 + +- {vytask}`T2790` `(feature): Add ability to set ipv6 protocol route-map for OSPFv3` +- {vytask}`T3033` `(feature): Update Linux Kernel to v4.19.154` +- {vytask}`T2969` `(bug): OpenVPN: command_set on interface is not applied, if interface doesn't come up in commit` + +## 2020-10-28 + +- {vytask}`T2631` `(default): l2tp, sstp, pptp add option to disable radius accounting` +- {vytask}`T2630` `(feature): Allow Interface MTU over 9000` +- {vytask}`T3027` `(bug): Unable to update system Signature check FAILED` +- {vytask}`T2995` `(bug): Enhancements/bugfixes for vyos_dict_search()` +- {vytask}`T2968` `(feature): Add support for Intel Atom C2000 series QAT` + +## 2020-10-27 + +- {vytask}`T3026` `(default): qemu: update script for deprecated ssh_host_port_min/max` +- {vytask}`T2938` `(feature): Adding remote Syslog RFC5424 compatibility` +- {vytask}`T2924` `(bug): Using 'set src' in a route-map invalidates it as part of a subsequent boot-up` +- {vytask}`T2587` `(bug): Cannot enable the interface when the MTU is set to less than 1280` +- {vytask}`T2885` `(default): configd: print commit errors to config session terminal` +- {vytask}`T2808` `(default): Add smoketest to ensure script consistency with config daemon` +- {vytask}`T2582` `(default): Script daemon to offload processing during commit` +- {vytask}`T1721` `(bug): Recursive Next Hop not updated for static routes` + +## 2020-10-24 + +- {vytask}`T3007` `(default): HTTP-API should use config load script, not backend config load` +- {vytask}`T3009` `(bug): vpn l2tp remoteaccess require option broken` +- {vytask}`T3010` `(bug): ttl option of gre-bridge` +- {vytask}`T3005` `(bug): Intel: update out-of-tree drivers, i40e driver warning` +- {vytask}`T3004` `(feature): ConfigSession should (optionally) use config load script` +- {vytask}`T2723` `(feature): Support tcptraceroute` + +## 2020-10-22 + +- {vytask}`T2978` `(bug): IPoE service does not work on shared mode` +- {vytask}`T2906` `(bug): OpenVPN: tls-auth missing key direction` + +## 2020-10-21 + +- {vytask}`T2828` `(bug): BGP conf_mode error enforce-first-as` +- {vytask}`T2749` `(bug): Setting ethx configuration takes a long time` +- {vytask}`T2138` `(default): Can't load archived configs as they are gzipped` + +## 2020-10-20 + +- {vytask}`T2987` `(bug): VxLAN not working properly after upgrading to latest October build and with a new installation` +- {vytask}`T2989` `(default): MPLS documentation expansion` + +## 2020-10-19 + +- {vytask}`T1588` `(bug): VRRP failed to start if any of its interaces not exist` +- {vytask}`T1385` `(feature): Allow bonding interfaces to have pseudo-ethernet interfaces` +- {vytask}`T3000` `(bug): Mismatch between "prefix-length" and "preference" in dhcp6-server syntax` +- {vytask}`T2992` `(feature): Automatically verify sha256 checksum on ISO download` +- {vytask}`T752` `(feature): Add an option to disable IPv4 forwarding on specific interface only` + +## 2020-10-18 + +- {vytask}`T2965` `(feature): Brief BFD Peer Info` +- {vytask}`T2907` `(feature): OpenVPN: Option to disable encryption` +- {vytask}`T2985` `(feature): Add glue code to create bridge interface on demand` + +## 2020-10-17 + +- {vytask}`T2980` `(bug): FRR bfdd crash due to invalid length` +- {vytask}`T2991` `(feature): Update WireGuard to 1.0.20200908` +- {vytask}`T2990` `(feature): Update Linux Kernel to v4.19.152` +- {vytask}`T2981` `(feature): MPLS LDP neighbor session clear capability` +- {vytask}`T2792` `` (default): Failed to run `sudo make qemu` with vyos-build container due to the change of packer `` + +## 2020-10-13 + +- {vytask}`T2976` `(bug): Client IP pool does not work for PPPoE local users` + +## 2020-10-12 + +- {vytask}`T2951` `(bug): Cannot enable logging for monitor nat` +- {vytask}`T2782` `(bug): Changing timezone, does not restart rsyslog` + +## 2020-10-06 + +- {vytask}`T2957` `(bug): show openvpn not printing anything` + +## 2020-10-05 + +- {vytask}`T2963` `(bug): Wireless: WIFI is not password protected when security wpa mode is not defined but passphrase is` + +## 2020-10-04 + +- {vytask}`T2953` `(feature): Accel-PPP services CLI config cleanup (SSTP, L2TP, PPPoE, IPoE)` +- {vytask}`T2829` `(bug): PPPoE server: mppe setting is implemented as node instead of leafNode` +- {vytask}`T2960` `(feature): sstp: migrate to get_config_dict()` + +## 2020-10-03 + +- {vytask}`T2956` `(feature): Add support for list of defaultValues` +- {vytask}`T2955` `(feature): Update Linux Kernel to v4.19.149` + +## 2020-10-02 + +- {vytask}`T2952` `(bug): configd: timeout breaks synchronization of messages, causing freeze` + +## 2020-10-01 + +- {vytask}`T2945` `(bug): Interface removed from bridge on setting change` +- {vytask}`T2948` `(bug): NAT: OSError when configuring translation address range` +- {vytask}`T2936` `(feature): Migrate PPPoE server to get_config_dict() do reduce boilerplate code` + +## 2020-09-30 + +- {vytask}`T2939` `(bug): Wireguard Remove Peer Fails` + +## 2020-09-29 + +- {vytask}`T2919` `(feature): PPPoE server: Called-Station-Id attribute` +- {vytask}`T2918` `(feature): Accounting interim jitter for pppoe, l2tp, pptp, ipoe` +- {vytask}`T2917` `(feature): PPPoE server: Preallocate NAS-Port-Id` +- {vytask}`T2937` `(feature): Update Linux Kernel to v4.19.148` + +## 2020-09-27 + +- {vytask}`T2930` `(feature): Support configuration of MAC address for VXLAN and GENEVE tunnel` + +## 2020-09-26 + +- {vytask}`T2856` `` (bug): equuleus: `show version all` throws broken pipe exception on abort `` +- {vytask}`T2929` `(bug): Upgrading from 1.2 (crux) to 1.3 rolling causes vyos.configtree.ConfigTreeError for RADIUS settings` +- {vytask}`T2928` `(bug): MTU less then 1280 bytes and IPv6 will raise FileNotFoundError` +- {vytask}`T2926` `(bug): snmp.py missing an import` +- {vytask}`T2912` `(feature): When setting MTU check for hardware maximum supported MTU size` + +## 2020-09-25 + +- {vytask}`T2915` `(bug): Lost "proxy-arp-pvlan" option for vlan` +- {vytask}`T2925` `(feature): Update Linux Kernel to v4.19.147` +- {vytask}`T2921` `(feature): Migrate "service dns forwarding" to get_config_dict() for ease of source maintenance` + +## 2020-09-24 + +- {vytask}`T2896` `(bug): set ip route 0.0.0.0/0 dhcp-interface eth0` +- {vytask}`T2923` `(bug): Configuring DHCPv6-PD without a interface to delegate to raises TypeError` + +## 2020-09-23 + +- {vytask}`T2846` `(bug): ip route doesn't show longer-prefixes` + +## 2020-09-20 + +- {vytask}`T2904` `(feature): 802.1ad / Q-in-Q ethertype default not utilized` +- {vytask}`T2905` `(feature): Sync CLI nodes between PPPoE and WWAN interface` +- {vytask}`T2903` `(feature): Q-in-Q (802.1.ad) ethertype should be defined explicitly and not via its raw value` + +## 2020-09-19 + +- {vytask}`T2894` `(bug): bond: lacp: member interfaces get removed once bond interface has vlans configured` +- {vytask}`T2901` `(feature): Update Linux Kernel to v4.19.146` +- {vytask}`T2900` `(bug): DNS forwarding: invalid warning is shown for "system name-server" or "system name-servers-dhcp" even if present` + +## 2020-09-18 + +- {vytask}`T945` `(bug): Unable to change configuration after changing it from script (vbash + script-template)` + +## 2020-09-16 + +- {vytask}`T2886` `(bug): RADIUS authentication broken only returns operator level` +- {vytask}`T2887` `(bug): WiFi ht40+ channel width is not set in hostaptd.conf` + +## 2020-09-15 + +- {vytask}`T2515` `(bug): Ethernet interface is automatically disabled when removing it from bond` + +## 2020-09-14 + +- {vytask}`T2872` `(bug): "Show log" for nat and openvpn got intermixed` +- {vytask}`T2301` `(bug): Cannot delete PBR` +- {vytask}`T2880` `(feature): Update Linux Kernel to v4.19.145` +- {vytask}`T2879` `(feature): Cleanup 4.19.144 kernel configuration` + +## 2020-09-13 + +- {vytask}`T2858` `(feature): Rewrite dynamic dns client to get_config_dict()` +- {vytask}`T2857` `(feature): Cleanup Intel QAT configuration script` +- {vytask}`T2877` `(feature): LACP / bonding: support configuration of minimum number of links` + +## 2020-09-12 + +- {vytask}`T2863` `(default): Wireguard IPv6 Link-Local Addresses Are Not Unique` +- {vytask}`T2876` `(feature): Update Linux Kernel to v4.19.144` + +## 2020-09-10 + +- {vytask}`T2870` `(feature): Update Linux Kernel to v5.8.8` + +## 2020-09-09 + +- {vytask}`T2728` `(bug): Protocol option ignored for IPSec peers in transport mode` +- {vytask}`T1934` `(default): Change default hostname when deploy from OVA without params.` +- {vytask}`T1953` `(bug): DDNS service name validation rejects valid service names` + +## 2020-09-07 + +- {vytask}`T1729` `(default): PIM (Protocol Independent Multicast) implementation` + +## 2020-09-06 + +- {vytask}`T2860` `(bug): Update Accel-PPP to fix l2tp CVE` + +## 2020-09-02 + +- {vytask}`T2833` `(bug): RIP outgoing update filter list no longer operational` +- {vytask}`T2849` `(bug): vyos.xml.defaults should return a list on multi nodes, by default` + +## 2020-08-31 + +- {vytask}`T2636` `(bug): get_config_dict() shall always return a list on nodes` + +## 2020-08-30 + +- {vytask}`T2843` `(feature): Upgrade Linux Kernel to 5.8 series` +- {vytask}`T2814` `` (default): kernel 5.1+ : NAT : module `nft_chain_nat_ipv4` renamed `` +- {vytask}`T2839` `(feature): Upgrade WireGuard user-space tools and Kernel module` +- {vytask}`T2842` `(feature): Replace custom "wireguard, wireguard-tools" package with debian-backports version` + +## 2020-08-29 + +- {vytask}`T2836` `(default): show system integrity broken in 1.3` + +## 2020-08-28 + +- {vytask}`T2126` `(bug): show vpn ipsec sa IPSec - Process NOT Running` +- {vytask}`T2813` `(bug): NAT: possible to commit illegal source nat without translation` +- {vytask}`T1463` `` (bug): Missing command `show ip bgp scan` appears in command completion `` + +## 2020-08-27 + +- {vytask}`T2832` `(feature): Migrate vyos-smoketest content into vyos-1x` + +## 2020-08-26 + +- {vytask}`T2830` `(default): Migrate "service https" to use get_config_dict()` +- {vytask}`T2831` `(feature): Update Linux Kernel to v4.19.142` + +## 2020-08-25 + +- {vytask}`T2826` `(bug): frr: frr python lib error in replace_section` + +## 2020-08-24 + +- {vytask}`T2423` `(bug): Loadkey scp ssh key errors` + +## 2020-08-23 + +- {vytask}`T2811` `(bug): Cannot delete vpn anyconnect` +- {vytask}`T2823` `(bug): VXLAN has state A/D after configuration` +- {vytask}`T2812` `(default): Add basic smoketest for anyconnect` + +## 2020-08-22 + +- {vytask}`T2822` `(feature): Update Linux Kernel to v4.19.141` +- {vytask}`T2821` `(feature): Support DHCPv6-PD without "address dhcpv6"` +- {vytask}`T2677` `(feature): Proposal for clearer DHCPv6-PD configuration options` + +## 2020-08-20 + +- {vytask}`T2209` `(bug): Documentation has reference to the old 'user x level admin' option` +- {vytask}`T1665` `(default): prefix-list and prefix-list6 rules incorrectly accept a host address where prefix is required` +- {vytask}`T2815` `(default): Move certbot config directory under /config/auth` + +## 2020-08-19 + +- {vytask}`T2794` `(bug): op-mode: lldp: "show lldp neighbors" IndexError: list index out of range` +- {vytask}`T2791` `(feature): "monitor traceroute" has no explicit IPv4/IPv6 support` +- {vytask}`T1515` `(bug): FRR ospf6d crashes when performing: "show ipv6 ospfv3 database"` + +## 2020-08-16 + +- {vytask}`T2277` `(bug): dhclient-script-vyos does not support VRFs` +- {vytask}`T2090` `(default): Deleting 'service salt-minion' causes python TypeError` + +## 2020-08-15 + +- {vytask}`T2797` `(feature): Update Linux Kernel to v4.19.139` +- {vytask}`T2796` `(bug): PPPoE-Server: listen interface is mandatory but validation check is missing` + +## 2020-08-14 + +- {vytask}`T2795` `(bug): console server fails to commit` + +## 2020-08-12 + +- {vytask}`T2786` `(bug): OSPF Interface Cost` +- {vytask}`T2325` `(bug): NHRP op-mode errors with missing daemon socket` +- {vytask}`T2227` `(feature): MPLS documentation` +- {vytask}`T2767` `(bug): The interface cannot be disabled for network enabled configuration` +- {vytask}`T2316` `(bug): DHCP-server op-mode errors` + +## 2020-08-11 + +- {vytask}`T2779` `(bug): LLDP: "show lldp neighbors interface" does not yield any result` +- {vytask}`T2379` `(bug): DHCPv6 address for interface deletion triggers a script error` +- {vytask}`T2784` `(default): Remove unused arg from host_name.py functions verify and get_config` + +## 2020-08-10 + +- {vytask}`T2780` `(feature): Update Linux Kernel to v4.19.138` + +## 2020-08-08 + +- {vytask}`T2716` `(bug): Shaper-HFSC shapes but does not control latency correctly` +- {vytask}`T2497` `(default): Cache config string during commit` +- {vytask}`T2501` `(bug): Cannot recover from failed boot config load` +- {vytask}`T1974` `(feature): Allow route-map to set administrative distance` +- {vytask}`T1949` `(bug): Multihop IPv6 BFD is unconfigurable` + +## 2020-08-04 + +- {vytask}`T2758` `(bug): router-advert: 'infinity' is not a valid integer number` +- {vytask}`T2637` `(bug): Vlan is not removed from the system` +- {vytask}`T1287` `(bug): No DHCPv6 leases reported for "show dhcpv6 client leases"` + +## 2020-08-03 + +- {vytask}`T2241` `(default): Changing settings on an interface causes it to fall out of bridge` +- {vytask}`T2757` `(bug): "show system image version" contains additional new-line character breaking output` +- {vytask}`T1826` `(bug): Misleading message on "reboot at" command` +- {vytask}`T1511` `(default): Rewrite ethernet setup scripts to python` +- {vytask}`T1600` `(default): Convert 'ping' operation from vyatta-op to new syntax` +- {vytask}`T1486` `(bug): Unknown LLDP version reported to peers` +- {vytask}`T1414` `(enhancment): equuleus: buster: 10-unmountfs.chroot fail under apply` +- {vytask}`T1076` `(bug): SSH: make configuration (sshd_config) volatile and store it to /run` +- {vytask}`T2724` `(feature): Support for IPv6 Toolset` +- {vytask}`T2323` `(bug): LLDP: "show lldp neighbors detail" returns warnings when service is not configured` +- {vytask}`T1754` `(bug): DHCPv6 client is impossible to restart` + +## 2020-08-02 + +- {vytask}`T2756` `(feature): Accel-PPP: make RADIUS accounting port configurable` + +## 2020-08-01 + +- {vytask}`T2752` `(bug): Exception when configuring unavailable ethernet interface` +- {vytask}`T2751` `(feature): Update Linux Kernel to v4.19.136` +- {vytask}`T2753` `(feature): Rewrite "add system image" op mode commands in XML` +- {vytask}`T2690` `(feature): Add VRF support to the add system image command` + +## 2020-07-30 + +- {vytask}`T2746` `(feature): IPv6 link-local addresses not configured` +- {vytask}`T2678` `(bug): High RAM usage on SSH logins with lots of IPv6 routes in the routing table.` +- {vytask}`T2701` `` (bug): `vpn ipsec pfs enable` doesn't work with IKE groups `` +- {vytask}`T2745` `(feature): router-advert: migrate to get_config_dict()` + +## 2020-07-29 + +- {vytask}`T2743` `(feature): WireGuard: move key migration from config script to migration script` +- {vytask}`T2742` `(feature): mDNS repeater: migrate to get_config_dict()` + +## 2020-07-28 + +- {vytask}`T1117` `(feature): 'show ipv6 bgp route-map' missing` +- {vytask}`T928` `(feature): Add support for PIM (Protocol-Independent Multicast)` + +## 2020-07-27 + +- {vytask}`T2729` `(feature): Pseudo-ethernet replace fail message` +- {vytask}`T1249` `(feature): multiple PBR rules can set to a single interface` +- {vytask}`T1956` `(feature): PPPoE server: support PADO-delay` +- {vytask}`T1295` `(feature): FRR: update documentation` +- {vytask}`T1222` `(bug): OSPF routing problem - route looping` +- {vytask}`T1158` `(bug): Route-Map configuration dropped updating rc11 to epa2` +- {vytask}`T1130` `(bug): Deleting BGP communities from prefix does not work` +- {vytask}`T2067` `(feature): pppoe-server: Add possibility set multiple service-name` + +## 2020-07-26 + +- {vytask}`T2734` `(feature): WireGuard: fwmark CLI definition is inconsistent` +- {vytask}`T2733` `(feature): Support MTU configuration on pseudo ethernet devices` +- {vytask}`T2644` `(default): Bonding interfaces cannot be disabled` +- {vytask}`T2476` `(bug): Bond member description change leads to network outage` +- {vytask}`T2443` `(feature): NHRP: Add debugging information to syslog` +- {vytask}`T2021` `(bug): OSPFv3 doesn't support decimal area syntax` +- {vytask}`T1901` `(bug): Semicolon in values is interpreted as a part of the shell command by validators` +- {vytask}`T2000` `(bug): strongSwan does not install routes to table 220 in certain cases` +- {vytask}`T2091` `(bug): swanctl.conf file is not generated properly if more than one IPsec profile is used` +- {vytask}`T1983` `(feature): Expose route-map when BGP routes are programmed in to FIB` +- {vytask}`T1973` `(feature): Allow route-map to match on BGP local preference value` +- {vytask}`T1853` `(bug): wireguard - disable peer doesn't work` +- {vytask}`T1985` `(feature): pppoe: Enable ipv6 modules without configured ipv6 pools` + +## 2020-07-25 + +- {vytask}`T2730` `(feature): Update Linux Kernel to v4.19.134` +- {vytask}`T2106` `(bug): Wrong interface states after reboot` +- {vytask}`T1507` `(default): cli: logical redundancy with boolean type` + +## 2020-07-24 + +- {vytask}`T2097` `(bug): Problems when using as completion helper in op-mode` +- {vytask}`T2092` `(bug): dhcp-server rfc3442 static route should add default route` +- {vytask}`T1817` `(bug): BGP next-hop-self not working.` +- {vytask}`T1462` `(bug): Upgrade path errors 1.1.8 to 1.2.1-S2` +- {vytask}`T1372` `(bug): Diff functionality behaves incorrectly in some cases` +- {vytask}`T2073` `(feature): ipoe-server: reset op-mode command for sessions` +- {vytask}`T1715` `(bug): System DNS Server Order Incorrect` + +## 2020-07-23 + +- {vytask}`T2673` `(bug): After the bridge is configured with Mac, bridge is automatically disabled` +- {vytask}`T2626` `(bug): Changing pseudo-ethernet mode, throws CLI error` +- {vytask}`T2608` `(bug): delete pseudo-ethernet failed (another error type)` +- {vytask}`T2527` `(bug): bonding: the last slave interface is not deleted` +- {vytask}`T2358` `(bug): ip6ip6 bridge conf_mode errors` +- {vytask}`T2346` `(bug): Setting hostname yields temporary file error` +- {vytask}`T2330` `(bug): Vpn op-mode syntax` +- {vytask}`T2188` `(default): NTP op-mode commands don't work` + +## 2020-07-22 + +- {vytask}`T2718` `(bug): ntp.conf updated incorrectly` +- {vytask}`T2658` `(bug): Interface description comment display error` +- {vytask}`T2643` `(bug): show interfaces does not scale with terminal width` +- {vytask}`T2725` `(bug): Config fails to load if user has no password` +- {vytask}`T2707` `(default): Allow alternative initialization data for Config` + +## 2020-07-20 + +- {vytask}`T2709` `(bug): Destination NAT translation port without address fails to commit` +- {vytask}`T2519` `(bug): Broadcast address does not add automatically` + +## 2020-07-19 + +- {vytask}`T2708` `(bug): "show flow-accounting" should not display script's "usage" help` +- {vytask}`T2592` `(default): dhcp-relay discarding packets on valid interfaces` +- {vytask}`T2712` `(feature): udp-broadcast-relay: serivce no longer starts` +- {vytask}`T2706` `(feature): Support NDP protocol monitoring` + +## 2020-07-18 + +- {vytask}`T2704` `(bug): connect/disconnect Missing newline in op-mode tab completion helper` +- {vytask}`T2689` `(feature): Add helper functions to query changes between session and effective configs` +- {vytask}`T2585` `(bug): Unable to access the Internet after opening PPPoE on-demand dialing` + +## 2020-07-15 + +- {vytask}`T2675` `(bug): DNS service failed to start` +- {vytask}`T2596` `(feature): Allow specifying source IP for 'add system image'` + +## 2020-07-12 + +- {vytask}`T1575` `` (default): `show snmp mib ifmib` crashes with IndexError `` +- {vytask}`T2696` `(bug): Some bugfixes of vyatta-wanloadbalance` + +## 2020-07-11 + +- {vytask}`T2687` `(feature): SNMP: change logic on v3 password encryption` +- {vytask}`T2693` `(bug): Dhcp6c cannot be restarted after PPPoE link is reset` + +## 2020-07-08 + +- {vytask}`T2692` `(bug): Evaluate Setting Default Hash Policy to L3+L4` +- {vytask}`T2646` `(bug): Sysctl for IPv4 ECMP Hash Policy Not Set` + +## 2020-07-07 + +- {vytask}`T2691` `(bug): Upgrade from 1.2.5 to 1.3-rolling-202007040117 results in broken config due to case mismatch` +- {vytask}`T2389` `(bug): BGP community-list unknown command` +- {vytask}`T2686` `(bug): FRR: BGP: large-community configuration is not applied properly after upgrading FRR to 7.3.x series` + +## 2020-07-06 + +- {vytask}`T2680` `(bug): dhcp6c service cannot recover when it fails` + +## 2020-07-05 + +- {vytask}`T2684` `(feature): Update Linux Kernel to v4.19.131` +- {vytask}`T2685` `(feature): Update Accel-PPP to fix SSTP client issues` +- {vytask}`T2681` `(bug): PPPoE stops negotiating IPv6` + +## 2020-07-04 + +- {vytask}`T2682` `(bug): VRF aware services - connection no longer possible after system reboot` + +## 2020-07-03 + +- {vytask}`T2670` `(default): Remove dependency on show_config from get_config_dict` +- {vytask}`T2676` `(feature): NTP: migrate to get_config_dict() implementation` + +## 2020-07-02 + +- {vytask}`T2668` `(default): get_config_dict: add get_first_key arg to utility function get_sub_dict` + +## 2020-07-01 + +- {vytask}`T2662` `(default): get_config_dict includes node name as key only for tag and leaf nodes` +- {vytask}`T2667` `(feature): get_config_dict: Use utility function for non-empty path argument` + +## 2020-06-28 + +- {vytask}`T2660` `(bug): XML: Python default dictionary does not obey underscore (_) when flat is False` + +## 2020-06-27 + +- {vytask}`T2656` `(bug): XML: Python default dictionary returns wrong dictionary level(s)` + +## 2020-06-26 + +- {vytask}`T2642` `(bug): sshd fails to start due to configuration error` +- {vytask}`T2588` `(default): Add support for default values to the interface-definition format` +- {vytask}`T2622` `(bug): Pseudo-ethernet interface config disappears across versions` +- {vytask}`T2057` `(feature): Generalised Interface configuration` +- {vytask}`T2625` `(feature): Provide generic Library for package builds` + +## 2020-06-25 + +- {vytask}`T2487` `(bug): VRRP does not display info when group disabled` +- {vytask}`T2329` `(bug): Show remote config openvpn` +- {vytask}`T2165` `(bug): When trying to add route to ripng it complains that ip address should be IPv4 format` +- {vytask}`T2159` `(default): webproxy log read from wrong file` +- {vytask}`T2101` `(feature): Fix VXLAN config option parsing` +- {vytask}`T2062` `(bug): Wrong dhcp-server static route subnet bytes` +- {vytask}`T1986` `(bug): Python configuration manipulation library leaks open files` +- {vytask}`T1762` `(bug): VLAN interface configuration fails after internal representation of edit level was switched from a string to a list` +- {vytask}`T1538` `(bug): Update conntrack-sync packages to fix VRRP issues` +- {vytask}`T1808` `(feature): add package nftables` + +## 2020-06-24 + +- {vytask}`T2634` `(feature): remove autogeneration of interface "ip section" from vyatta-cfg-system` +- {vytask}`T2633` `(bug): Error with arp_accept on tun interface` +- {vytask}`T2595` `(feature): Update Linux Kernel to v4.19.128` +- {vytask}`T1938` `(bug): syslog doesn't start automatically` + +## 2020-06-23 + +- {vytask}`T2632` `(bug): WireGuard: Cannot use only one preshared-key for one peer` +- {vytask}`T1829` `(bug): Install Image script does not respect size of partition greater than 2G but less than disk size` +- {vytask}`T2635` `(feature): SSH: migrate to get_config_dict()` + +## 2020-06-22 + +- {vytask}`T2486` `(bug): DNS records set via 'system static-host-mapping' return NXDOMAIN from 'service dns forwarding' after a request to a forwarded zone` +- {vytask}`T2463` `(bug): DHCP-received nameserver not added to vyos-hostsd` +- {vytask}`T2534` `(bug): pdns-recursor override.conf error` +- {vytask}`T2054` `(bug): Changing "system name-server" doesn't update dns forwarding config, neither does "restart dns forwarding"` +- {vytask}`T2225` `(default): PIM/IGMP documentation` + +## 2020-06-21 + +- {vytask}`T2624` `(feature): Serial Console: fix migration script for configured powersave and no console` +- {vytask}`T2610` `(bug): default-lifetime is not reflected in the RA message` +- {vytask}`T2299` `(feature): login radius-server priority` +- {vytask}`T1739` `(bug): Serial interface seems not to be deleted properly` +- {vytask}`T480` `(bug): Error if no serial interface is present (/dev/ttyS0: not a tty)` + +## 2020-06-20 + +- {vytask}`T2621` `(bug): show interfaces repeats interface description if it is longer then an arbitrary number of characters` +- {vytask}`T2618` `(default): Conversion from 1.2 to 1.3 lost RADVD prefix autonomous-flag setting` + +## 2020-06-19 + +- {vytask}`T2589` `(bug): delete pseudo-ethernet failed` +- {vytask}`T2490` `(feature): Add serial (rs232) to ssh bridge service` + +## 2020-06-18 + +- {vytask}`T2614` `(default): Add an option to mangle dict keys to vyos.config.get_config_dict()` +- {vytask}`T2026` `(default): Make cli-shell-api correctly exit with non-zero code on failures` +- {vytask}`T1868` `(default): Add opportunity to get current values from API` + +## 2020-06-17 + +- {vytask}`T2478` `(feature): login radius: use NAS-IP-Address if defined source address` +- {vytask}`T2141` `(bug): Static ARP is not applied on boot` +- {vytask}`T2609` `(bug): router-advert: radvd does not start when lifetime is improperly configured` +- {vytask}`T1720` `(feature): support for more 'show ip route' commands` + +## 2020-06-16 + +- {vytask}`T2604` `(default): Remove use of is_tag in system-syslog.py` +- {vytask}`T2605` `(bug): SNMP service is not disabled by default` +- {vytask}`T2568` `(bug): Add some missing checks in config` +- {vytask}`T2156` `(default): PIM op-mode commands` + +## 2020-06-15 + +- {vytask}`T2600` `(bug): RADIUS system login configuration rendered wrongly` +- {vytask}`T2599` `(bug): "show interfaces" does not list VIF interfaces in ascending order` +- {vytask}`T2591` `(bug): show command has wrong interfaces ordering` +- {vytask}`T2576` `(bug): "show interfaces" does not return VTI` + +## 2020-06-14 + +- {vytask}`T2354` `(bug): Wireless conf_mode errors` +- {vytask}`T2593` `(bug): source NAT translation port can not be set when translation address is set to masquerade` +- {vytask}`T2594` `(default): Missing firmware for iwlwifi` + +## 2020-06-11 + +- {vytask}`T2578` `(bug): ipaddrcheck unaware of /31 host addresses - can no longer assign /31 mask to interface addresses` +- {vytask}`T2571` `(bug): NAT destination port with ! results in error` +- {vytask}`T2570` `(feature): Drop support for "system console device modem"` +- {vytask}`T2586` `(bug): WWAN default route is not installed into VRF` +- {vytask}`T2561` `(feature): Drop support for "system console netconsole"` +- {vytask}`T2569` `(feature): Migrate "set system console" to XML and Python representation` + +## 2020-06-10 + +- {vytask}`T2575` `(bug): pppoe-server: does not possibly assign IP address` +- {vytask}`T2565` `(bug): Cannot connect to l2tp server with radius auth` +- {vytask}`T2553` `(bug): set interface ethN vif-s nnnn does not commit` + +## 2020-06-08 + +- {vytask}`T2559` `(feature): Add operational mode command to retrieve hardware sensor data` + +## 2020-06-07 + +- {vytask}`T2529` `(feature): WWAN: migrate from ttyUSB device to new device in /dev/serial/by-bus` +- {vytask}`T2560` `(feature): New op-mode command to display information about USB interfaces` + +## 2020-06-05 + +- {vytask}`T2548` `(bug): Interfaces allowing inappropriate network addresses to be assigned` +- {vytask}`T1958` `(default): Include only firmware we actually need` + +## 2020-06-04 + +- {vytask}`T2514` `(enhancment): "mac" setting for bond members` + +## 2020-06-02 + +- {vytask}`T2129` `(feature): XML schema: tagNode not allowed on first level in new XML op-mode definition` +- {vytask}`T2545` `(feature): Show physical device offloading capabilities for specified ethernet interface` +- {vytask}`T2544` `(feature): Enable Kernel KONFIG_KALLSYMS` +- {vytask}`T2543` `(feature): Kernel: always build perf binary but ship as additional deb package to not bloat the image` +- {vytask}`T1096` `(bug): BGP process memory leak` + +## 2020-06-01 + +- {vytask}`T2535` `(feature): Update Intel QAT drivers to 1.7.l.4.9.0-00008` +- {vytask}`T2537` `(feature): Migrate "show log dns" from vyatta-op to vyos-1x` +- {vytask}`T2536` `(bug): "show log dns forwarding" still refers to dnsmasq` +- {vytask}`T2538` `(feature): Update Intel NIC drivers to recent release (preparation for Kernel >=5.4)` +- {vytask}`T2526` `(feature): Wake-On-Lan CLI implementation` + +## 2020-05-31 + +- {vytask}`T2532` `(feature): VRF aware OpenVPN` + +## 2020-05-30 + +- {vytask}`T2388` `(feature): template rendering should create folder and set permission` +- {vytask}`T2531` `(feature): Update Linux Kernel to v4.19.125` +- {vytask}`T2530` `(bug): Error creating VRF with a name of exactly 16 characters` + +## 2020-05-29 + +- {vytask}`T2528` `(bug): "update dns dynamic" throws FileNotFoundError excepton` + +## 2020-05-28 + +- {vytask}`T1291` `(default): Under certain conditions the VTI will stay forever down` + +## 2020-05-27 + +- {vytask}`T2395` `(feature): HTTP API move to flask/flask-restx as microframework` +- {vytask}`T1121` `(bug): Can't search for prefixes by community: Community malformed: AA:NN` + +## 2020-05-26 + +- {vytask}`T2520` `(bug): show conntrack fails with Perl error` +- {vytask}`T2502` `(bug): PPPoE default route not installed for IPv6 when "default-route auto"` +- {vytask}`T2458` `(feature): Update FRR to 7.3.1` +- {vytask}`T2506` `(feature): DHCPv6-PD add prefix hint CLI option` + +## 2020-05-25 + +- {vytask}`T2391` `(bug): pppoe-server session-control does not work` +- {vytask}`T2269` `(feature): SSTP specify tunnels names` +- {vytask}`T1137` `(bug): 'sh ip bgp sum' being truncated` + +## 2020-05-22 + +- {vytask}`T2491` `(feature): MACsec: create CLI for replay protection` +- {vytask}`T2489` `(feature): Add MACsec interfaces to "show interfaces" output` +- {vytask}`T2201` `(feature): Rewrite protocol BGP [op-mode] to new XML/Python style` +- {vytask}`T2492` `(feature): Do not set encrypted user password when it is not changed` +- {vytask}`T2496` `(feature): Set default to new syntax for config file component versions` +- {vytask}`T2493` `(feature): Update Linux Kernel to v4.19.124` +- {vytask}`T2380` `(bug): After PPPoE 0 is restarted, the default static route is lost` + +## 2020-05-21 + +- {vytask}`T1876` `(bug): IPSec VTI tunnels are deleted after rekey and dangling around as A/D` +- {vytask}`T2488` `(feature): Remove logfile for dialup interfaces like pppoe and wwan` +- {vytask}`T2475` `(bug): linting` +- {vytask}`T1820` `(bug): VRRP transition scripts for sync-groups are not supported in VyOS (anymore)` +- {vytask}`T2364` `(default): Add CLI command for mroute` +- {vytask}`T2023` `(feature): Add support for 802.1ae MACsec` + +## 2020-05-20 + +- {vytask}`T2480` `(bug): NAT: after rewrite commit tells that dnat IP address is not locally connected` + +## 2020-05-19 + +- {vytask}`T2481` `(feature): WireGuard: support tunnel via IPv6 underlay` +- {vytask}`T421` `(bug): Add Pv6 prefix delegation support` +- {vytask}`T815` `(feature): Add DHCPv6 server prefix-delegation support` + +## 2020-05-17 + +- {vytask}`T2471` `(feature): PPPoE server: always add AdvAutonomousFlag when IPv6 is configured` +- {vytask}`T2409` `(default): At boot, effective config should not be equal to current config` + +## 2020-05-16 + +- {vytask}`T2466` `(bug): live-build encounters apt dependency problem when building with local packages` +- {vytask}`T2470` `(feature): Update to PowerDNS recursor 4.3` +- {vytask}`T2469` `(feature): Update Linux Kernel to v4.19.123` +- {vytask}`T2198` `(default): Rewrite NAT in new XML/Python style` + +## 2020-05-15 + +- {vytask}`T2449` `(bug): 'ipv6 address autoconf' and 'address dhcpv6' don't work because interfaces have accept_ra=1 (they should have accept_ra=2 when forwarding=1)` + +## 2020-05-14 + +- {vytask}`T2456` `(bug): netflow source-ip cannot be configured` + +## 2020-05-13 + +- {vytask}`T2435` `(bug): Pseudo-ethernet Interfaces Broken` +- {vytask}`T2294` `(bug): ipoe-server broken (jinja2 template issue)` + +## 2020-05-12 + +- {vytask}`T2454` `(feature): Update Linux Kernel to v4.19.122` +- {vytask}`T2392` `(bug): SSTP with ipv6` + +## 2020-05-10 + +- {vytask}`T2445` `(bug): VRF route leaking for ipv4 not working` +- {vytask}`T2372` `(bug): VLAN: error on commit if main interface is disabled` +- {vytask}`T2439` `(bug): Configuration dependency problem, unable to load complex configuration after reboot` + +## 2020-05-09 + +- {vytask}`T2427` `(default): Interface addressing broken since fix for T2372 was merged` +- {vytask}`T2438` `(default): isc-dhcp-server(6).service reports startup success immediately even if dhcpd fails to start up` +- {vytask}`T2367` `(default): Flush addresses from bridge members` + +## 2020-05-08 + +- {vytask}`T2441` `(bug): TZ validator has a parse error` +- {vytask}`T2429` `(bug): Vyos cannot apply VLAN sub interface to bridge` + +## 2020-05-06 + +- {vytask}`T2402` `(bug): Live ISO should warn when configuring that changes won't persist` + +## 2020-05-05 + +- {vytask}`T1899` `(bug): Unionfs metadata folder is copied to the active configuration directory` + +## 2020-05-04 + +- {vytask}`T2412` `(bug): ping flood does not work as unprivileged user` +- {vytask}`T701` `(bug): LTE interface dosen't come up` +- {vytask}`T951` `(bug): command 'isolate-stations true/false' does not make any changes in the hostapd.conf` + +## 2020-05-03 + +- {vytask}`T2420` `(feature): Update Linux Kernel to v4.19.120` +- {vytask}`T2406` `(feature): DHCPv6 CLI improvements` +- {vytask}`T2421` `(feature): Update WireGuard to Debian release 1.0.20200429-2_bpo10+1` + +## 2020-05-02 + +- {vytask}`T2414` `(feature): Improve runtime from Python numeric validator` +- {vytask}`T2413` `(feature): Update Linux Kernel to v4.19.119` + +## 2020-05-01 + +- {vytask}`T2411` `(feature): op-mode: make "monitor traceroute" VRF aware` +- {vytask}`T2347` `(bug): During commit, any script output directed to stdout will contain path` +- {vytask}`T2239` `(default): build-vmware-image script ignores the predefined file path, uses the environment variable unconditionally.` + +## 2020-04-29 + +- {vytask}`T2399` `(bug): op-mode "dhcp client leases" does not return leases` +- {vytask}`T2398` `(bug): op-mode "dhcp client leases interface" completion helper misses interfaces` +- {vytask}`T2394` `(feature): dhcpv6 client does not start` +- {vytask}`T2393` `(feature): dhclient: migrate from SysVinit to systemd` +- {vytask}`T2268` `(bug): DHCPv6 is broken` + +## 2020-04-28 + +- {vytask}`T1227` `(bug): rip PW can't be set at interface config` + +## 2020-04-27 + +- {vytask}`T2373` `(feature): Required auth options for pppoe-server` +- {vytask}`T1381` `(feature): Enable DHCP option 121 processing` +- {vytask}`T2010` `(bug): Reboot at reports wrong time or missing timezone` + +## 2020-04-26 + +- {vytask}`T2386` `(bug): salt: upgrade to 2019.2 packages` +- {vytask}`T2385` `(bug): salt-minion: improve completion helpers` +- {vytask}`T2384` `(bug): salt-minion: log to syslog and remove custom logging option` +- {vytask}`T2383` `(feature): Update Linux Kernel to v4.19.118` +- {vytask}`T2382` `(bug): salt-minion: Throws KeyError on commit` +- {vytask}`T2350` `(bug): Interface geneve conf-mode error` + +## 2020-04-25 + +- {vytask}`T2304` `(feature): "system login" add RADIUS VRF support` +- {vytask}`T1842` `(bug): Equuleus: "reboot at 04:00" command not working` + +## 2020-04-24 + +- {vytask}`T2375` `(feature): WireGuard: throw exception if address and port are not given as both are mandatory` +- {vytask}`T2348` `(bug): On IPv6 address distribution and DHCPv6 bugs` + +## 2020-04-23 + +- {vytask}`T2369` `(feature): VRF: can not leak interface route from default VRf to any other VRF` +- {vytask}`T2368` `(bug): VRF: missing completion helper when leaking to default table` +- {vytask}`T2374` `(bug): Tunnel interface can not be disabled` +- {vytask}`T2362` `(default): IPv6 link-local addresses missing due to EUI64 address code, causing router-advert not to work` +- {vytask}`T2345` `(default): IPv6 router-advert not working` + +## 2020-04-22 + +- {vytask}`T2361` `(bug): Unable to delete VLAN vif interface` +- {vytask}`T2339` `(bug): OpenVPN: IPv4 no longer working after adding IPv6 support` +- {vytask}`T2331` `(bug): VRRP op-mode errors` +- {vytask}`T2320` `(bug): Wireguard creates non-existing interfaces in [op-mode].` +- {vytask}`T2096` `(feature): Provide "generate" and "show" commands via the http API` +- {vytask}`T2351` `(feature): Cleanup PPTP server implementation and CLI commands` + +## 2020-04-21 + +- {vytask}`T2341` `(bug): Pseudo-ethernet Interfaces Not Loaded on Boot` +- {vytask}`T2270` `(bug): using load with scp/sftp and a username and password does not work` +- {vytask}`T2255` `(bug): DNS forwarding op-mode error` +- {vytask}`T1907` `(bug): Traceback on a non-existent interface.` +- {vytask}`T2204` `(feature): Support tunnel source-interface` + +## 2020-04-20 + +- {vytask}`T2335` `(bug): Unable to assign IPv6 from ISP` +- {vytask}`T2317` `(bug): l2tp overwriting ipsec config files` +- {vytask}`T2292` `(bug): Ensure graceful shutdown of vyos-http-api` +- {vytask}`T2344` `(bug): PPPoE server client static IP assignment silently fails` + +## 2020-04-19 + +- {vytask}`T2337` `(default): hw-id gone missing from interfaces after upgrade to 1.3-rolling-202004191028` +- {vytask}`T2340` `(feature): Remove informational "sg" messages from syslog` +- {vytask}`T2338` `(bug): Can't delete static IPv6 route on vrf` +- {vytask}`T2336` `(bug): OpenVPN service fails to start` +- {vytask}`T2308` `(default): openvpn op-mode scripts broken after migrating to systemd service` +- {vytask}`T2185` `(default): Start daemons with systemd units instead of with start-stop-daemon` + +## 2020-04-18 + +- {vytask}`T2318` `(bug): dns-forwarding migration script breaks with invalid interface name` +- {vytask}`T2319` `(feature): Update Linux Kernel to v4.19.116` +- {vytask}`T2314` `(feature): Cleanup PPPoE server implementation and CLI commands` +- {vytask}`T2313` `(bug): Accel-PPP / PPPoEserver raises "Floating point exception" when not all limits are defined` +- {vytask}`T2312` `(feature): Use LED modules to enable more visible feedback on VyOS hardware chassis` +- {vytask}`T2306` `(feature): Add new cipher suites to the WiFi configuration` +- {vytask}`T2286` `(default): IPoE server vulnerability` +- {vytask}`T2224` `(feature): Update Linux Kernel to v4.19.114` +- {vytask}`T2110` `(feature): RADIUS: supply include file for radius config to have a uniform CLI` +- {vytask}`T2324` `(feature): Cleanup IPoE server implementation and CLI commands` + +## 2020-04-17 + +- {vytask}`T2275` `(bug): flow-accounting broken in rolling` +- {vytask}`T2256` `(feature): Accel-ppp op-mode syntax` + +## 2020-04-16 + +- {vytask}`T2295` `(bug): Passwords with Special Characters Broken` +- {vytask}`T2305` `(feature): Add release name to "show version" command` +- {vytask}`T2235` `(default): OpenVPN server client IP doesn't reserve that IP in the pool` +- {vytask}`T149` `(feature): IPv6 support in OpenVPN tunnel` + +## 2020-04-15 + +- {vytask}`T2293` `(bug): OpenVPN: UnboundLocalError after merging server_network PullRequest` +- {vytask}`T2298` `(bug): Errors PDNS with name-server set` + +## 2020-04-14 + +- {vytask}`T2213` `(bug): vyos-1x: WiFi mode ieee80211ac should also activate ieee80211n` + +## 2020-04-13 + +- {vytask}`T2283` `(default): openvpn not starting: ccd path in template not moved to /run/openvpn/ccd` +- {vytask}`T2236` `(bug): DMVPN broken after tunnel rewrite to XML/Python` +- {vytask}`T2284` `(default): Upgrade ddclient to 3.9.1 which also brings systemd files` +- {vytask}`T2282` `(feature): Clarify hw-id in ethernet and wireless interface nodes` +- {vytask}`T611` `` (feature): Static route syntax should reflect `ip` command routing capabilities, if possible. `` + +## 2020-04-12 + +- {vytask}`T2273` `(default): OpenVPN no longer starts in latest rolling, migrate to systemd` +- {vytask}`T2263` `(feature): Reset feature for SSTP sessions` +- {vytask}`T2262` `(bug): Broken reset commands for pptp and l2tp` +- {vytask}`T2031` `(bug): pseudo-ethernet link interface cannot be changed` + +## 2020-04-11 + +- {vytask}`T2264` `(feature): l2tp: cleanup CLI definition` +- {vytask}`T2233` `(bug): Typos in wlanX.cfg` +- {vytask}`T2238` `(bug): After re-writing list_interfaces.py to use Interfaces() pseudo-ethernet is missing` + +## 2020-04-10 + +- {vytask}`T2265` `(feature): DHCP to be an attribute of the class instead of a inheritance` +- {vytask}`T2261` `(bug): "client-config-dir" not being set for openvpn` +- {vytask}`T2248` `(bug): PPPoE Broken in Latest 1.3 Rolling (1.3-rolling-202004070629)` +- {vytask}`T1629` `(bug): IP addresses configured on vif-s interfaces are not added to the system` +- {vytask}`T2266` `(default): openvpn bridged client-server doesn't work (validation error)` +- {vytask}`T2253` `(default): Fix use of cmd in merge config and remote function helpers` + +## 2020-04-09 + +- {vytask}`T2260` `(feature): vxlan, pseudo-ethernet: convert link nodes to source-interface` +- {vytask}`T2172` `(feature): Enable conf VXLAN without remote address` +- {vytask}`T2237` `(bug): l2tp, pptp, pppoe wrong chap-secrets file` + +## 2020-04-08 + +- {vytask}`T2244` `(feature): WireGuard: cleanup Python implementation and reduce amount of boilerplate code` +- {vytask}`T2186` `(feature): Provide more information to the user when a traceback is reported to the user` +- {vytask}`T2246` `(bug): LLDP op-mode error` +- {vytask}`T2240` `(feature): Support for bind vif-c interfaces into VRFs` +- {vytask}`T2160` `(feature): Allow restricting HTTP API to specific virtual hosts` +- {vytask}`T2247` `(feature): WireGuard: add VRF support` + +## 2020-04-05 + +- {vytask}`T2212` `(bug): vyos-1x: WiFi card antenna count not set accordingly` +- {vytask}`T2230` `(feature): Split out inlined Jina2 template to data/templates folder` +- {vytask}`T2206` `(feature): Split WireGuard endpoint into proper host and port nodes` + +## 2020-04-04 + +- {vytask}`T2158` `(bug): Commit fails if ethernet interface doesn't support flow control (pause)` +- {vytask}`T2221` `(bug): Ability to remove a VRF that has a next-hop-vrf as target` +- {vytask}`T2211` `(bug): vyos-1x: VHT channel width not set accordingly` +- {vytask}`T2208` `(bug): vyos-1x: commit on interfaces wireless wlanX capabilities vht link-adaptation (both|unsolicited) fails` +- {vytask}`T2183` `(bug): A number of bugs with wireguard script due to interface rearrangement` +- {vytask}`T2104` `(default): ifconfig.py size` +- {vytask}`T2028` `(feature): Convert "interfaces tunnel" to new XML/Python representation` +- {vytask}`T2219` `(bug): VRF default route of PPPoE and WWAN interfaces do not get added into proper routing table` +- {vytask}`T2222` `(default): openvpn: requires "multihome" option to listen on all addresses with udp protocol` + +## 2020-04-02 + +- {vytask}`T2072` `(bug): Shell autocomplete of option (config node) with quoted value doesn't work` +- {vytask}`T1823` `(feature): l2tpv3 interface migration fails` +- {vytask}`T2202` `(feature): Update PowerDNS recursor to 4.2 series` +- {vytask}`T2200` `(feature): Add VRF support on wirelessmodem interfaces` + +## 2020-03-31 + +- {vytask}`T2166` `(bug): Broken proxy-arp on vif` +- {vytask}`T2180` `(bug): get_config_dict should be independent of CLI edit level` +- {vytask}`T2053` `(default): Update vyos-load-config.py for version string syntax change` +- {vytask}`T2052` `(default): Update vyos-merge-config.py for version string syntax change` +- {vytask}`T2144` `(default): vyos-build: docker: selection of text in the terminal still selects it in vim (mouse isn't completely disabled)` + +## 2020-03-30 + +- {vytask}`T2176` `(default): 'WiFiIf' object has no attribute 'set_state'` +- {vytask}`T2029` `(feature): Switch to new syntax for config file component versions` + +## 2020-03-29 + +- {vytask}`T2178` `(bug): VRF interface don't get removed when VRF is deleted` +- {vytask}`T2170` `(feature): Add ability to create static route from default to VRF` +- {vytask}`T1831` `(feature): Denest IPv6 router-advert from Interfaces to general service` + +## 2020-03-28 + +- {vytask}`T2167` `(bug): vyos.ifconfig.get_mac() broken` +- {vytask}`T2151` `(default): wireless: can't delete interface present in config but not present in system` +- {vytask}`T1988` `(feature): Migrate wirelessmodem to new XML/Python style interface` + +## 2020-03-27 + +- {vytask}`T2164` `(bug): Package libstrongswan-standard-plugins missing from image` +- {vytask}`T2105` `(bug): wireless: not possible to disabled wlan0` +- {vytask}`T2169` `(default): Remove redundant use of show_config in vyos-merge-config` + +## 2020-03-26 + +- {vytask}`T2162` `(default): migration script for router-advert sets link-mtu 0 on bridge interfaces` +- {vytask}`T1735` `(bug): Issue in "show vpn ipsec/ike sa" output with ipsec encryption algorithm aes128gcm128/aes256gcm128/chacha etc` + +## 2020-03-25 + +- {vytask}`T2148` `(default): openvpn: setting "server client" config without "server client ip" results in ValueError: '' does not appear to be an IPv4 or IPv6 address` +- {vytask}`T2146` `(default): openvpn: "delete server client" doesn't delete the corresponding ccd configs` + +## 2020-03-24 + +- {vytask}`T2157` `(default): Organize service https listen-address/listen-port/server-name under 'virtual-host' node` +- {vytask}`T1845` `(bug): syslog host no longer accepts a port` + +## 2020-03-22 + +- {vytask}`T2150` `(feature): SSTP ssl certificates can only be stored in /config/user-data/sstp` +- {vytask}`T2149` `(feature): Update Linux Kernel to v4.19.112` +- {vytask}`T476` `(enhancment): Update the base system to Debian 10 (Buster)` + +## 2020-03-21 + +- {vytask}`T2142` `(bug): vyos-build: Add required packages and step to build-GCE-image script` +- {vytask}`T1870` `(feature): Extend Pipeline scripts to support PullRequests` + +## 2020-03-20 + +- {vytask}`T2006` `(bug): SSTP RADIUS CLI accepts invalid values` +- {vytask}`T2140` `(default): openvpn: tls file check function checkCertHeader returns True even when no match is found` +- {vytask}`T2007` `(feature): SSTP accepts client MTU up to 16384 bytes` +- {vytask}`T2008` `(feature): Adjustment of SSTP CLI to be more consistent to the rest of VyOS` + +## 2020-03-19 + +- {vytask}`T2135` `(bug): Login banner missing spacing now` +- {vytask}`T2132` `(feature): Document kernel boot parameter 'vyos-config-debug'` +- {vytask}`T1744` `(default): Config load fails in ConfigTree with ValueError: Failed to parse config: lexing: empty token` + +## 2020-03-17 + +- {vytask}`T2134` `` (bug): VXLAN: `NameError: name 'config' is not defined` `` + +## 2020-03-16 + +- {vytask}`T2131` `(feature): Improve syslog remote host CLI definition` + +## 2020-03-15 + +- {vytask}`T2122` `(feature): Update Intel out-of-tree drivers to latest version(s)` +- {vytask}`T2121` `(feature): Update Linux Kernel to v4.19.109` +- {vytask}`T2119` `(bug): Error on boot when removing ethernet interface from VM` + +## 2020-03-14 + +- {vytask}`T834` `(feature): New L2TP server implementation based on accel-ppp` + +## 2020-03-13 + +- {vytask}`T1622` `(default): Add failsafe and back trace to boot config loader` + +## 2020-03-11 + +- {vytask}`T1961` `(bug): VXLAN - fails to commit due to non-existent variable, broken MTU` +- {vytask}`T2084` `(default): conntrack-tools package build error for current/equuleus` + +## 2020-03-10 + +- {vytask}`T1331` `(bug): DNS stops working` + +## 2020-03-09 + +- {vytask}`T2111` `(feature): VRF add route leaking support` +- {vytask}`T2109` `(bug): Ping by name broken in VyOS 1.3-rolling-202003080217` +- {vytask}`T2065` `(bug): VyOS 1.3 Don't set daemon in openvpn-{intf}.conf file` +- {vytask}`T31` `(feature): Add VRF support` + +## 2020-03-08 + +- {vytask}`T1954` `` (bug): Having `system login radius` configured causes exponentially long boot times `` +- {vytask}`T1760` `(bug): RADIUS shared secret is not redacted from "show configuration" op mode command` + +## 2020-03-07 + +- {vytask}`T2107` `(bug): Wireless interfaces do not work in station mode without security` + +## 2020-03-05 + +- {vytask}`T2074` `(bug): VyOS docker container: Cannot configure ethernet interface` + +## 2020-03-04 + +- {vytask}`T2098` `(bug): Wrong call to cli-shell-api in generated op-mode templates for path completion helper` + +## 2020-03-03 + +- {vytask}`T2095` `(bug): Copy command errors out` + +## 2020-03-01 + +- {vytask}`T2082` `(bug): WireGuard broken after merging T2057` +- {vytask}`T2089` `(feature): RADIUS: do not query servers when commit is running started from a non RADIUS user` +- {vytask}`T2086` `(feature): Move sudo session open/close log entries to auth.log` + +## 2020-02-29 + +- {vytask}`T2046` `(feature): allowing sub-classes of Interface to redefine how the interface is created` + +## 2020-02-28 + +- {vytask}`T2083` `(default): vyos-build: build-packages fails at mdns-repeater due to wrong branch` +- {vytask}`T2080` `(default): traffic-policy shaper error when setting bandwidth` + +## 2020-02-27 + +- {vytask}`T2075` `(feature): Add support for OpenVPN tls-crypt file option` +- {vytask}`T2068` `(feature): Update Linux Kernel to v4.19.105` +- {vytask}`T1703` `(default): Macvlan PPPoE support` +- {vytask}`T2078` `(feature): Kernel: remove unused RAID functions 5,6,10,jbod,dm` + +## 2020-02-25 + +- {vytask}`T2070` `(feature): Rewrite (dis-)connect op-mode commands in XML and Python` +- {vytask}`T2071` `(feature): Add possibility to temporary disable a RADIUS server used for system login` + +## 2020-02-23 + +- {vytask}`T2055` `(feature): Remove IPv6 router-advert options for PPPoE` +- {vytask}`T1318` `(feature): PPPoE client CLI redesign` + +## 2020-02-22 + +- {vytask}`T2063` `(feature): vyos-salt-minion package is missing from vyos-world` + +## 2020-02-20 + +- {vytask}`T1969` `(default): OSPF with WireGuard cause Route Inactive` + +## 2020-02-18 + +- {vytask}`T2034` `(default): Removal of interfaces loopback lo removed 127.0.0.1 and ::1` + +## 2020-02-17 + +- {vytask}`T2047` `(feature): Update Linux Kernel to v4.19.104` +- {vytask}`T2048` `(bug): ISO boot fails when wireless adapter is present` + +## 2020-02-16 + +- {vytask}`T2043` `(bug): Bond VLANs can't be extended on the fly` +- {vytask}`T2030` `(bug): Bond doesn't survive reboot` +- {vytask}`T1992` `(bug): Adding vlan on a bond resets all BGP connections on same bond` +- {vytask}`T1908` `(feature): Add zone option for Cloudflare DDNS` +- {vytask}`T1246` `(bug): VyOS 1.2.0 "openvpn-options" configuration does not allow quotes in values` + +## 2020-02-15 + +- {vytask}`T2042` `(bug): Error on reboot after deleting "service snmp" and not "service lldp snmp enable"` +- {vytask}`T2041` `(bug): Adding non existent bond interface raises exception` + +## 2020-02-14 + +- {vytask}`T2039` `(bug): Wrong system type displayed in show version` +- {vytask}`T2040` `(bug): vyos-http-api-server should reload Config in all routes` + +## 2020-02-13 + +- {vytask}`T2033` `(feature): Drop vyos-replace package` +- {vytask}`T1635` `(feature): Rewrite interface pseudo-ethernet in new XML/Python style` + +## 2020-02-10 + +- {vytask}`T2024` `(feature): Migrate "system login banner" to XML/Python` + +## 2020-02-09 + +- {vytask}`T2022` `(bug): When RADIUS config is active, local logins won't work` +- {vytask}`T2020` `(default): Unable to log in after upgrade to 1.3-rolling-202002080217` +- {vytask}`T1931` `(bug): Enabling SNMP commit error` + +## 2020-02-05 + +- {vytask}`T1948` `(bug): RADIUS login broken in 1.3` +- {vytask}`T1990` `(feature): Migrate "system login" to XML/Python representation` +- {vytask}`T1585` `(default): Add letsencrypt/certbot support for 'service https'` + +## 2020-02-04 + +- {vytask}`T1965` `(bug): VyOS-1.3: ping no longer supports specifying interface or source` + +## 2020-02-02 + +- {vytask}`T2011` `(feature): Update Linux Kernel to v4.19.101` +- {vytask}`T640` `(bug): Images no longer work when built without "recommended" packages` + +## 2020-02-01 + +- {vytask}`T2009` `(bug): Ethernet Interface always stays down` +- {vytask}`T1989` `(bug): conf.get_config_dict() throws exception` + +## 2020-01-31 + +- {vytask}`T1768` `(bug): PPtP - vyos.config rewrite` +- {vytask}`T2002` `(bug): VLAN interfaces try to be enabled even if parent interface is A/D` + +## 2020-01-30 + +- {vytask}`T1994` `(default): lldpd not bound to specified interfaces - Fix jinja template` +- {vytask}`T1896` `(enhancment): Remove LLDP-MED civic_based location information` +- {vytask}`T1724` `(feature): wireguard - add endpoint check in verify()` + +## 2020-01-29 + +- {vytask}`T1996` `(feature): Update Linux Kernel to 4.19.99` +- {vytask}`T1862` `(default): Use regex pattern \s+ to split strings on whitespace in Python 3.7` +- {vytask}`T1755` `(bug): Python KeyError exceptions raised with 'show vpn ipsec sa' command under use of certain IPSEC cipher suites` +- {vytask}`T1747` `(bug): L2TP breaks after upgrading to VyOS 1.2-rolling-201910180117 [issue report and proposed solution]` +- {vytask}`T1664` `(bug): Ipoe with bond per vlan don't work` +- {vytask}`T1895` `(feature): There is not restriction on selection of syslog facility` +- {vytask}`T1670` `(feature): OpenVPN option for tls-auth` + +## 2020-01-26 + +- {vytask}`T1937` `(bug): snmpd throwing a tremendous amount of errors` +- {vytask}`T1767` `(bug): IPoE - vyos.config rewrite` +- {vytask}`T1765` `(bug): wireguard - vyos.config rewrite` + +## 2020-01-24 + +- {vytask}`T1975` `(bug): OpenVPN tap devices won't come up automatically` + +## 2020-01-23 + +- {vytask}`T1766` `(bug): service-pppoe - vyos.config rewrite` + +## 2020-01-21 + +- {vytask}`T1784` `(bug): DMVPN with IPSec does not work in HUB mode` +- {vytask}`T1977` `(bug): webproxy error on fresh install` + +## 2020-01-18 + +- {vytask}`T1830` `(feature): 1.3-rolling boots to GRUB prompt post-install on UEFI systems` +- {vytask}`T1940` `(bug): EFI Fresh Install fails to boot, 4K Sector Drives Fail to boot EFI` + +## 2020-01-16 + +- {vytask}`T1880` `(default): "A stop job is running for live-tools - System Support Scripts" hangs, times out when shutting down equuleus live iso` + +## 2020-01-15 + +- {vytask}`T1959` `(bug): Error message when adding IPSec VPN` + +## 2020-01-09 + +- {vytask}`T1955` `(feature): snmp - cli config val_help missing` +- {vytask}`T1813` `(bug): error in generated /etc/hosts file` + +## 2020-01-08 + +- {vytask}`T1946` `(bug): Recovery ifname for PPtP remote-access` + +## 2020-01-03 + +- {vytask}`T1939` `(feature): Provide abstraction for interface "ip" options` + +## 2020-01-01 + +- {vytask}`T1779` `(bug): Tunnel interfaces aren't suggested as being available for bridging` + +## 2019-12-31 + +- {vytask}`T1654` `(bug): sFlow: multiple "sflow server" not work, and "disable-imt" could break configuration` +- {vytask}`T1923` `(feature): Migrate L2TPv3 interface to XML/Python` + +## 2019-12-30 + +- {vytask}`T1920` `(bug): beep: Error: Running under sudo, which is not supported for security reasons.` +- {vytask}`T1918` `(bug): l2tp / ipsec config broken in latest daily` +- {vytask}`T1897` `(bug): IPSec - 1.2 to 1.3 migration failed` +- {vytask}`T1921` `(bug): snmp: VyOS options no longer recognized` +- {vytask}`T1922` `(feature): Add VXLAN IPv6 support` +- {vytask}`T1919` `(feature): Migrate "system options" to XML/Python representation` + +## 2019-12-28 + +- {vytask}`T1916` `(feature): Update Linux Kernel to v4.19.91` +- {vytask}`T1915` `(bug): Remove "system ipv6 blacklist" option` +- {vytask}`T1912` `(feature): Migrate "system (ip|ipv6)" to XML/Python representation` + +## 2019-12-27 + +- {vytask}`T1910` `(bug): Invalid parmissions on latest 1.3 rolling ISO images` + +## 2019-12-26 + +- {vytask}`T1794` `(bug): Interface description can't contain a colon` +- {vytask}`T1906` `(feature): Migrate "system time-zone" configuration to XML/Python` + +## 2019-12-23 + +- {vytask}`T1898` `(enhancment): Support multiple IPv4/IPv6 LLDP management addresses` +- {vytask}`T1878` `(bug): accel-ppp: pppoe single-session option implementation` + +## 2019-12-22 + +- {vytask}`T393` `(enhancment): Migrate vyatta-lldpd to vyos-1x` + +## 2019-12-20 + +- {vytask}`T1892` `(default): vyos-build: Do not install recommends in docker image [enhancement]` +- {vytask}`T1411` `(enhancment): equuleus: buster: vyatta-ravpn: libfreeradius-client2 is missing in buster` + +## 2019-12-19 + +- {vytask}`T1873` `(default): DHCP server fails to start due to a change in isc-dhcp-server init scripts` + +## 2019-12-18 + +- {vytask}`T1889` `(bug): Error building docker build image` +- {vytask}`T1132` `(default): Build on Debian Buster` + +## 2019-12-17 + +- {vytask}`T1886` `(feature): Update Linux Kernel to v4.19.89` +- {vytask}`T1887` `(feature): Update WireGuard to Debian release 0.0.20191212-1` + +## 2019-12-13 + +- {vytask}`T1861` `(default): hosts lost after modified static-host-mapping` + +## 2019-12-10 + +- {vytask}`T1843` `(feature): Add GCC preprocessor support for XML files` + +## 2019-12-08 + +- {vytask}`T1566` `(feature): Extend L2TP/IPSec server with IPv6` + +## 2019-12-07 + +- {vytask}`T1714` `(bug): Disable DHCP Nameservers Not Working` + +## 2019-12-06 + +- {vytask}`T1860` `(feature): Update WireGuard to Debian release 0.0.20191127-2` +- {vytask}`T1859` `(feature): Update Linux Kernel to v4.19.88` +- {vytask}`T1854` `(bug): Dynamic DNS configuration cannot be deleted` +- {vytask}`T1849` `(bug): DHCPv6 client does not start` +- {vytask}`T1169` `(bug): LLDP potentially broken` +- {vytask}`T586` `(bug): Cannot add ethernet vif-s vif-c interface to bridge-group` + +## 2019-12-05 + +- {vytask}`T1847` `(bug): set_level incorrectly handles path given as empty string` + +## 2019-12-04 + +- {vytask}`T1787` `(default): Failed config migration from V1.2.3 to 1.2-rolling-201911030217` +- {vytask}`T1212` `(bug): IPSec Tunnel to Cisco ASA drops reliably after 4.2GB transferred` +- {vytask}`T1704` `(feature): OpenVPN - Add support for ncp-ciphers` + +## 2019-12-03 + +- {vytask}`T1782` `(bug): pppoe0: showing as "Coming up"` +- {vytask}`T1801` `(bug): Unescaped backslashes in config values cause configuration failure` + +## 2019-12-02 + +- {vytask}`T1840` `(bug): PPPoE doesn't not rename pppX to pppoeX` + +## 2019-11-25 + +- {vytask}`T1824` `(bug): Permission denied: '/opt/vyatta/etc/config/vyos-migrate.log'` + +## 2019-11-24 + +- {vytask}`T1673` `(bug): vif bridge-group not migrated to bridge member interface` +- {vytask}`T1799` `(feature): Add support for GENEVE (Generic Network Virtualization Encapsulation)` + +## 2019-11-23 + +- {vytask}`T1627` `(feature): Rewrite wireless interface in new style XML syntax` + +## 2019-11-21 + +- {vytask}`T1818` `(default): Print name of migration script on failure` +- {vytask}`T1814` `(default): Add log of migration scripts run during config migration` + +## 2019-11-14 + +- {vytask}`T1710` `(default): [equuleus] buster: add patch to fix live-build missing key error` +- {vytask}`T1804` `(default): Add python3-psutil to docker image` +- {vytask}`T1736` `(default): Decide on best practice for patching live-team packages for VyOS build system` +- {vytask}`T1424` `(default): Rewrite the config load script` + +## 2019-11-11 + +- {vytask}`T1793` `(feature): Editing description on an interface causes BGP sessions to reset on commit` + +## 2019-11-10 + +- {vytask}`T1791` `(feature): Update Linux Kernel to 4.19.82` + +## 2019-11-08 + +- {vytask}`T1789` `(bug): ddclient not working with generated RFC2136 / nsupdate config` + +## 2019-11-03 + +- {vytask}`T1777` `(bug): Bonding interface MAC address mismatch after reboot` +- {vytask}`T1752` `(bug): PPPoE does not automatically start on boot` + +## 2019-11-02 + +- {vytask}`T1783` `(bug): Interface can't unpin from bridge` + +## 2019-10-22 + +- {vytask}`T1756` `(feature): Modify output to be more useful - Wireguard` + +## 2019-10-21 + +- {vytask}`T1741` `(feature): Add system wide proxy setting` + +## 2019-10-19 + +- {vytask}`T1746` `(bug): 201910180117 fails startup with 'Permission Denied' errors` +- {vytask}`T1743` `(default): equuleus: remove references to SSH key type "rsa1" deprecated in Debian Buster` + +## 2019-10-18 + +- {vytask}`T1712` `(default): DHCP client sometimes doesn't start` +- {vytask}`T1604` `(enhancment): equuleus: buster: vbash: tab completion breaks` + +## 2019-10-11 + +- {vytask}`T1723` `(bug): wireguard - Interface wg01 could not be brought up in time` + +## 2019-10-09 + +- {vytask}`T1719` `(feature): ssh deprecated options` +- {vytask}`T1718` `(bug): ISO check in /opt/vyatta/sbin/install-image faulty` +- {vytask}`T1682` `(feature): Migrate to new Jenkins Pipeline script` + +## 2019-10-08 + +- {vytask}`T1717` `(bug): disable multiple daemons to autostart at boot` + +## 2019-10-06 + +- {vytask}`T1713` `(feature): Remove deprecated packages no longer required after migration to Accel-PPP` + +## 2019-10-03 + +- {vytask}`T1689` `(feature): "reset openvpn" op-mode command should terminate and restart OpenVPN process` + +## 2019-10-01 + +- {vytask}`T1706` `(bug): wireguard broken in latest rolling` + +## 2019-09-30 + +- {vytask}`T1688` `(feature): OpenVPN - Add new cipher aes-(128|192|256)-gcm` + +## 2019-09-28 + +- {vytask}`T1696` `(bug): NTP - Tests fail when building vyos-1x` +- {vytask}`T1512` `(bug): vyos 1.2 openvpn client names with spaces created incorrectly` + +## 2019-09-27 + +- {vytask}`T1681` `(feature): cleanup wireguard code since tagnodes are now visible` +- {vytask}`T1695` `(bug): Syntax error in interface-dummy.py` + +## 2019-09-26 + +- {vytask}`T1692` `(bug): ipoe-server verify function error` +- {vytask}`T1691` `(bug): OpenVPN - Commiting config when OpenVPN peer/server not available makes commit hang` +- {vytask}`T1690` `(feature): restart op-mode commands for 'service (pppoe|ipoe)-server'` + +## 2019-09-25 + +- {vytask}`T1672` `(bug): Wireguard keys not automatically moved` + +## 2019-09-23 + +- {vytask}`T1679` `(bug): during bootup: invalid literal for int() with base 10` +- {vytask}`T1680` `(feature): DHCP client does not release IP address on exit/deletion` + +## 2019-09-21 + +- {vytask}`T1676` `(default): [equuleus] buster: update GRUB boot parameters during upgrade` +- {vytask}`T1637` `(feature): Rewrite ethernet interface in new style XML syntax` +- {vytask}`T1675` `(feature): OpenVPN - Specify minimum TLS version` + +## 2019-09-20 + +- {vytask}`T1602` `(default): equuleus: buster: add live build apt options for choosing vyos packages` + +## 2019-09-19 + +- {vytask}`T1666` `(feature): Deleting a bond will place member interfaces into A/D state` + +## 2019-09-17 + +- {vytask}`T239` `(bug): Improve documentation for the firewall all-ping setting` + +## 2019-09-16 + +- {vytask}`T1040` `(default): rc.local is executed too early` + +## 2019-09-15 + +- {vytask}`T1662` `(default): openvpn: 'show openvpn client' error` +- {vytask}`T1661` `(default): openvpn: wrong checking for existence cert files` +- {vytask}`T1630` `(bug): OpenVPN after changing it from root to nobody (unprivileged user) cant add routes` + +## 2019-09-13 + +- {vytask}`T1660` `(bug): Bonding dont’t work on VyOS 1.2-rolling-201909120338` +- {vytask}`T1655` `(enhancment): equuleus: buster: arm: vyos-accel-ppp build failes because of filename hardcoded as x86_64 in debian/rules` + +## 2019-09-12 + +- {vytask}`T1572` `(feature): Wireguard keyPair per interface` +- {vytask}`T1545` `(bug): IPSEC vti issue` + +## 2019-09-10 + +- {vytask}`T1650` `(feature): implement wireguard default key removal` +- {vytask}`T1649` `(feature): feature documentation different keypairs per interface` +- {vytask}`T1648` `(feature): add cli command 'delete wireguard named-key '` + +## 2019-09-09 + +- {vytask}`T1639` `(bug): wireguard pubkey change error` + +## 2019-09-07 + +- {vytask}`T1640` `(feature): Update Linux Kernel to v4.19.70` + +## 2019-09-06 + +- {vytask}`T1624` `(bug): Failed to set up config session` +- {vytask}`T1636` `(feature): Rewrite VXLAN in new style XML/Python` +- {vytask}`T1479` `(bug): libvyosconfig error reporting doesn't include line numbers` +- {vytask}`T808` `(feature): replace lighthttpd with nginx` +- {vytask}`T1478` `(bug): libvyosconfig parser does not support escaped quotes inside single-quoted strings` + +## 2019-09-04 + +- {vytask}`T1632` `(bug): OpenVPN 'push' options with quotes` +- {vytask}`T1631` `(bug): Multiple push-route options cause error generating openvpn configuration` +- {vytask}`T1557` `(feature): Create generic abstraction for configuring interfaces e.g. IP address` +- {vytask}`T1628` `(feature): Adopt WireGuard configuration script to new vyos.ifconfig class` +- {vytask}`T1614` `(feature): Rewrite bonding interface in new style XML syntax` + +## 2019-09-02 + +- {vytask}`T1621` `(default): Rewrite the rest of trivial vyatta-op commands to new syntax` + +## 2019-08-31 + +- {vytask}`T1456` `(bug): Port group cannot be configured if the same port is configured as standalone and inside a range` + +## 2019-08-28 + +- {vytask}`T1615` `(feature): After migration to pyroute2 the address DHCP statement is no longer covered` + +## 2019-08-27 + +- {vytask}`T1617` `(default): OpenVPN push route failure` +- {vytask}`T1250` `(bug): FRR not setting default gateway from DHCP` + +## 2019-08-26 + +- {vytask}`T1591` `(bug): OpenVPN "run show openvpn client status" does not work` +- {vytask}`T1608` `(feature): bridge: Bridge adding non existing interfaces is allowed but does not work` +- {vytask}`T1548` `(feature): Rewrite OpenVPN interface/op-commands in new style XML/Python` +- {vytask}`T1607` `(default): Convert 'reset conntrack' and 'reset ip[v6] cache' operations from vyatta-op to new syntax` + +## 2019-08-25 + +- {vytask}`T1611` `(default): Migration to latest rolling fails with vyos.configtree.ConfigTreeError: Path [b'interfaces bridge br0 igmp-snooping querier'] doesn't exist` + +## 2019-08-23 + +- {vytask}`T1606` `(bug): Rolling release no longer boots after adding hostname daemon` + +## 2019-08-21 + +- {vytask}`T1601` `(feature): Rewrite loopback interface type with new style XML/Python interface` +- {vytask}`T1596` `(default): Convert 'telnet' and 'traceroute' vyatta-op commands to new syntax` + +## 2019-08-20 + +- {vytask}`T1595` `(feature): Migrate deprecated "service dns forwarding listen-on" to listen-address` + +## 2019-08-19 + +- {vytask}`T1580` `(feature): Rewrite dummy interface type with new style XML/Python interface` +- {vytask}`T1590` `(default): Convert 'show system' operations from vyatta-op to python/xml syntax` + +## 2019-08-17 + +- {vytask}`T1592` `(feature): Update Linux Kernel to v4.19.67` + +## 2019-08-15 + +- {vytask}`T1584` `(default): equuleus: buster: add consistent grub options for predictable interface names` + +## 2019-08-13 + +- {vytask}`T1556` `(feature): Rewrite Bridge in new style XML syntax` + +## 2019-08-09 + +- {vytask}`T1569` `(feature): interfaceconfig class documetation` + +## 2019-08-05 + +- {vytask}`T1562` `(feature): Change version scheme on current branch used for rolling releases` + +## 2019-08-04 + +- {vytask}`T1561` `(bug): VyOS rolling ISO cluttered with vyatta-ravpn Git Repo` + +## 2019-08-02 + +- {vytask}`T853` `(feature): Add SSTP server support` +- {vytask}`T742` `(feature): Replace poptop and xl2tpd with accel-ppp` + +## 2019-08-01 + +- {vytask}`T1544` `(feature): L2TP documentation` + +## 2019-07-31 + +- {vytask}`T1552` `(feature): accel-ppp: SSTP documentation` +- {vytask}`T1553` `(default): equuleus: buster: add 'noautologin' to boot parameters` + +## 2019-07-29 + +- {vytask}`T1532` `(default): [equuleus] buster: GPG error on vyos package repository` + +## 2019-07-28 + +- {vytask}`T1547` `(feature): accel-ppp/L2TP restructure CLI` +- {vytask}`T1546` `(bug): accel-ppp/L2TP radius-source address is not honored` + +## 2019-07-23 + +- {vytask}`T1533` `(bug): Rolling builds broken!` +- {vytask}`T1489` `(feature): Add vlan_mon usage at Accel` + +## 2019-07-22 + +- {vytask}`T1435` `(enhancment): Make ip-address [OPTIONAL] (in dhcp-server -> static-mapping) to cope with "unfriendly" client-hostnames of IoT-Devices` + +## 2019-07-21 + +- {vytask}`T823` `(feature): Rewrite DHCP op mode in the new style` + +## 2019-07-18 + +- {vytask}`T1497` `(bug): "set system name-server" generates invalid/incorrect resolv.conf` +- {vytask}`T533` `(feature): Support for PPPoE MTU greater than 1492` + +## 2019-07-08 + +- {vytask}`T1510` `(feature): [IPoE] vlan-mon option implementation` +- {vytask}`T1508` `(feature): [pppoe] migration script for service pppoe-server interface` +- {vytask}`T1494` `(feature): accel-ppp: IPoE update documentation` +- {vytask}`T989` `(feature): Add support for IPoE server` + +## 2019-07-03 + +- {vytask}`T1502` `(feature): Add build sanity checking tools to the dev builds` + +## 2019-07-02 + +- {vytask}`T1099` `(default): Openvpn: use config files instead of one long command.` +- {vytask}`T1495` `(feature): accel-ppp: IPoE implement IPv6 PD` + +## 2019-07-01 + +- {vytask}`T1498` `(bug): Nameservers are not propagated into resolv.conf` + +## 2019-06-24 + +- {vytask}`T1482` `(feature): Add OpenVPN SHA384 hashing algorithm` + +## 2019-06-23 + +- {vytask}`T1476` `(bug): Update PowerDNS recursor to 4.2 series` + +## 2019-06-22 + +- {vytask}`T1313` `(feature): Add support for reusable build flavours` +- {vytask}`T1202` `` (bug): Add `hvinfo` to the packages directory `` + +## 2019-06-20 + +- {vytask}`T1413` `(enhancment): equuleus: buster: vyos-xe-guest-utilities is not installable and breaks live-build` +- {vytask}`T1412` `(enhancment): equuleus: buster: vyos-netplug is not installable and breaks live-build` + +## 2019-06-19 + +- {vytask}`T1334` `(feature): Migration script runner rewrite` +- {vytask}`T1327` `(bug): Set the serial console speed to 115200 by default` + +## 2019-06-18 + +- {vytask}`T1451` `(bug): Intel e1000e driver missing in lates rolling release` + +## 2019-06-17 + +- {vytask}`T1408` `(feature): pppoe-server - implement local-ipv6 for pure IPv6 based deployments` + +## 2019-06-12 + +- {vytask}`T1397` `(default): Rewrite the config merge script` + +## 2019-06-05 + +- {vytask}`T1426` `(default): Update the script that checks conntrack hash-size on reboot` + +## 2019-06-03 + +- {vytask}`T1423` `(default): When merging remote config files, create known_hosts file if not present.` + +## 2019-05-28 + +- {vytask}`T1410` `(feature): Upgrade Linux Kernel to 4.19.46` + +## 2019-05-26 + +- {vytask}`T1404` `(feature): Update iproute2 package to 4.19` + +## 2019-05-24 + +- {vytask}`T1407` `(bug): pppoe IPv6 PD documention by practical example` + +## 2019-05-23 + +- {vytask}`T1402` `(feature): Update Linux Kernel to 4.19.45` + +## 2019-05-22 + +- {vytask}`T1399` `(bug): accel-ppp kernel modules missing in rolling build 20190522` +- {vytask}`T1393` `(bug): pppoe IPv6 pool doesn't work` + +## 2019-05-21 + +- {vytask}`T592` `` (bug): lldpcli: unknown command from argument 1: `#` `` + +## 2019-05-16 + +- {vytask}`T1267` `(feature): FRR: Add interface name for static routes` +- {vytask}`T1148` `(bug): epa2 BGP peers initiate before config is fully loaded, routes leak.` + +## 2019-05-06 + +- {vytask}`T1368` `(feature): Enable MPLS support in Linux Kernel` + +## 2019-05-04 + +- {vytask}`T1365` `(bug): Cannot configure syslog on 1.2.0-rolling+201904260337` + +## 2019-04-29 + +- {vytask}`T1352` `(feature): vyos-documentaion: accel-pppoe adding CIDR based IP pool option` + +## 2019-04-21 + +- {vytask}`T1348` `(feature): Upgrade WireGuard to 0.0.20190406-1` +- {vytask}`T1347` `(feature): Upgrade Linux Kernel to 4.19.36` + +## 2019-04-20 + +- {vytask}`T1344` `(feature): Unclutter "system login radius" configuration nodes` + +## 2019-04-19 + +- {vytask}`T1325` `(default): GRE tunnel to Cisco router fails in 1.2.0 - works in 1.1.8` + +## 2019-04-16 + +- {vytask}`T1184` `(feature): wireguard - extend documentation with the show interface wireguard commands` + +## 2019-04-15 + +- {vytask}`T1260` `(feature): VICI-based implementation of "run show vpn ipsec sa"` +- {vytask}`T1248` `(default): Add a function for copying nodes to the vyos.configtree library` + +## 2019-04-05 + +- {vytask}`T1324` `(feature): update documtation for 'set system login user level'` + +## 2019-04-04 + +- {vytask}`T1323` `(feature): migrate operator accounts to admin accounts and remove the option to setup an operator account` + +## 2019-03-20 + +- {vytask}`T405` `(feature): Add binaries for lcdproc` + +## 2019-03-12 + +- {vytask}`T1284` `(feature): accel-ppp: pptp implementation documention` +- {vytask}`T833` `(feature): New PPTP server implementation based on accel-ppp` + +## 2019-02-22 + +- {vytask}`T1257` `(bug): implement 'set system static-host-mapping' in host_name.py and remove old function calls` + +## 2019-02-21 + +- {vytask}`T1214` `` (bug): Add `ipaddrcheck` to the packages directory `` + +## 2019-02-10 + +- {vytask}`T1154` `(default): use of local cache to build iso` + +## 2019-02-09 + +- {vytask}`T1236` `(feature): Update Linux Kernel` diff --git a/docs/changelog/1.3.rst b/docs/changelog/1.3.rst deleted file mode 100644 index dc1b4620..00000000 --- a/docs/changelog/1.3.rst +++ /dev/null @@ -1,5978 +0,0 @@ -############ -1.3 Equuleus -############ - -.. - Please don't add anything by hand. - This file is managed by the script: - _ext/releasenotes.py - - -2024-04-25 -========== - -* :vytask:`T6249` ``(default): ISO builder fails because of changed buster-backport repository`` - - -2024-04-23 -========== - -* :vytask:`T6261` ``(default): Typo in op_mode connect_disconnect print statement for check_ppp_running`` - - -2024-04-17 -========== - -* :vytask:`T6243` ``(bug): Update vyos-http-api-tools for package idna security advisory`` - - -2024-04-12 -========== - -* :vytask:`T3437` ``(bug): BGP Confederation Addition Causes Error`` - - -2024-04-10 -========== - -* :vytask:`T6124` ``(bug): Docker equuleus build image doesn't build due to fpm`` - - -2024-04-08 -========== - -* :vytask:`T6196` ``(bug): Route-map and summary-only do not work in BGP aggregation at the same time`` - - -2024-04-07 -========== - -* :vytask:`T1244` ``(default): Support for StartupResync in conntrackd`` - - -2024-04-05 -========== - -* :vytask:`T2590` ``(bug): DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c`` - - -2024-04-04 -========== - -* :vytask:`T4146` ``(bug): Nginx should not listen on port 80`` -* :vytask:`T1976` ``(default): deleting address-family under neighbor will disable neighbor`` -* :vytask:`T5625` ``(default): "restart vpn" does not work if ipsec-interfaces is not set`` -* :vytask:`T3020` ``(bug): The "scp" example is wrong in the bash-completion for "set system config-management commit-archive location"`` -* :vytask:`T2250` ``(default): vyos-build "make iso" error if configure was ran outside of the docker container`` -* :vytask:`T2139` ``(default): openvpn: allow "dh-file none" to disable DH for ECDH keys`` -* :vytask:`T2014` ``(default): Use vendor specific NTP Pool hostname`` -* :vytask:`T1118` ``(bug): Obsolete "utc" option in time selector in firewall`` -* :vytask:`T948` ``(feature): integrate aws cloud watch scripts into AMI`` - - -2024-04-02 -========== - -* :vytask:`T6150` ``(bug): Impossible to set a static IP address via Radius in IPoE`` - - -2024-04-01 -========== - -* :vytask:`T6193` ``(bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP name-server option" for VLAN interfaces`` - - -2024-03-22 -========== - -* :vytask:`T6110` ``(bug): dhcp server - If failover is defined, range is required`` -* :vytask:`T5624` ``(default): Remove /etc/debian_version from the image`` - - -2024-03-11 -========== - -* :vytask:`T2998` ``(bug): SNMP v3 oid "exclude" option doesn't work`` -* :vytask:`T6096` ``(bug): Config commits are not synced properly because 00vyos-sync is deleted by vyos-router`` -* :vytask:`T6057` ``(feature): Add ability to disable syslog for conntrackd`` -* :vytask:`T5504` ``(feature): Keepalived VRRP ability to set more than one peer-address`` - - -2024-03-07 -========== - -* :vytask:`T3992` ``(bug): Traceback on adding interface to bridge with configured ip address`` - - -2024-03-06 -========== - -* :vytask:`T6088` ``(bug): Configuration corrupted after saving and powercut or force reboot`` - - -2024-02-16 -========== - -* :vytask:`T2113` ``(bug): OpenVPN Options error: you cannot use --verify-x509-name with --compat-names or --no-name-remapping`` -* :vytask:`T5418` ``(bug): PPPoE-Server Client IP pool Subnet`` - - -2024-02-15 -========== - -* :vytask:`T2612` ``(bug): HTTPS API, changing API key fails but goes through`` -* :vytask:`T656` ``(enhancment): Rewrite wirelessmodem in new style XML interface definition`` - - -2024-02-14 -========== - -* :vytask:`T2044` ``(bug): RPKI doesn't boot properly`` - - -2024-02-08 -========== - -* :vytask:`T6014` ``(feature): Bump keepalived version`` - - -2024-02-07 -========== - -* :vytask:`T6017` ``(bug): Update vyos-http-api-tools for security advisory`` - - -2024-02-02 -========== - -* :vytask:`T5914` ``(bug): CVE-2023-48795 - Terrapin vulnerability`` -* :vytask:`T5739` ``(bug): Password recovery does not work if public keys are configured`` - - -2024-02-01 -========== - -* :vytask:`T5967` ``(bug): Multi-hop BFD connections can't be established; please add minimum-ttl option.`` - - -2024-01-22 -========== - -* :vytask:`T4721` ``(feature): Static IPv6 Route Tags Missing`` - - -2024-01-20 -========== - -* :vytask:`T5187` ``(bug): Update Realtek r8152 driver`` -* :vytask:`T5182` ``(bug): Update Intel ice driver`` -* :vytask:`T5180` ``(bug): initramfs-tools ignores firmware from updates directory`` -* :vytask:`T4990` ``(bug): Commit results may not be properly saved if power is cut immediately after a successful commit`` -* :vytask:`T4039` ``(feature): Rsyslog to use 'protocol23format' for protocol UDP`` -* :vytask:`T3813` ``(bug): Some custom sysctl parameters can't be applied bug`` -* :vytask:`T2579` ``(feature): The root task for VRF features`` -* :vytask:`T2546` ``(feature): The root task for rewriting [op-mode] to XML`` -* :vytask:`T2452` ``(default): Serial console related issues`` - - -2024-01-19 -========== - -* :vytask:`T5543` ``(bug): Fix source address handling in static joins`` - - -2024-01-14 -========== - -* :vytask:`T5715` ``(bug): IPSec VPN: restart vpn is not working`` - - -2024-01-13 -========== - -* :vytask:`T5924` ``(bug): Build cannot pass the smoketest dialup-router-medium-vpn`` - - -2024-01-11 -========== - -* :vytask:`T5275` ``(default): Add op mode commands for exporting certificates to PEM files with correct headers`` -* :vytask:`T5274` ``(default): Add a deprecation warning for OpenVPN site-to-site with pre-shared secret`` -* :vytask:`T3191` ``(bug): PAM RADIUS freezing when accounting does not configured on RADIUS server`` - - -2024-01-10 -========== - -* :vytask:`T4646` ``(bug): USB serial output console does not work`` -* :vytask:`T4466` ``(bug): intel i225-v nic does not detect link after boot`` -* :vytask:`T4222` ``(feature): Support for TWAMP as round-trip metric`` -* :vytask:`T1369` ``(bug): GCP Networking Failure`` - - -2024-01-09 -========== - -* :vytask:`T3242` ``(bug): PPPoE Server overhead on virtual interfaces creation`` -* :vytask:`T2755` ``(default): Requirements for partial interface setup`` -* :vytask:`T2494` ``(bug): systemd dependencies issues`` -* :vytask:`T2343` ``(feature): Disable memory ballooning in VM templates`` -* :vytask:`T2254` ``(default): Provide more information on the build branch in the version data`` -* :vytask:`T2223` ``(feature): convert operational show interfaces to python/XML`` -* :vytask:`T1925` ``(bug): DMVPN is always listed as down in "show vpn ipsec sa"`` -* :vytask:`T1297` ``(feature): Add GARP settings to VRRP/keepalived`` - - -2024-01-08 -========== - -* :vytask:`T5318` ``(bug): Security Vulnerabilities for VyOS 1.3.3`` -* :vytask:`T3980` ``(bug): vrrp transition-script validator makes warning fatal and also causes a python NameError exception`` -* :vytask:`T2799` ``(feature): VyOS Certificates Manager`` - - -2023-12-29 -========== - -* :vytask:`T5852` ``(bug): Reboots fail with eapol WAN interface`` - - -2023-12-22 -========== - -* :vytask:`T4760` ``(bug): VyOS does not support running multiple instances of DHCPv6 clients`` - - -2023-12-21 -========== - -* :vytask:`T5714` ``(bug): IPSec VPN: op-mode: "show log vpn" does not show results`` -* :vytask:`T3039` ``(feature): Resize a root partition and filesystem automatically during deployment in virtual environments`` -* :vytask:`T2404` ``(bug): Cannot change MTU`` -* :vytask:`T2353` ``(bug): Interface [conf_mode] errors parent task`` -* :vytask:`T5796` ``(bug): Openconnect - HTTPS security headers are missing`` - - -2023-12-19 -========== - -* :vytask:`T2116` ``(feature): Processing configuration via Cloud-init User-Data`` - - -2023-12-18 -========== - -* :vytask:`T2191` ``(feature): Using tallow to block sshd probes`` - - -2023-12-15 -========== - -* :vytask:`T5824` ``(bug): busybox cannot connect some websites from initramfs`` - - -2023-12-12 -========== - -* :vytask:`T5817` ``(bug): Show openvpn server fails in some cases`` -* :vytask:`T5413` ``(default): Deny the opportunity to use one public/private key pair on both wireguard peers.`` - - -2023-11-30 -========== - -* :vytask:`T4601` ``(bug): dhcp : relay agent IP address issue.`` - - -2023-11-28 -========== - -* :vytask:`T5777` ``(bug): frr: backport and upstream recent bgpd daemon crashes`` - - -2023-11-27 -========== - -* :vytask:`T5763` ``(bug): Fix imprecise check for remote file name in vyos-load-config.py`` - - -2023-11-25 -========== - -* :vytask:`T5655` ``(bug): commit-archive: Ctrl+C should not eror out with stack trace, signal should be cought`` - - -2023-11-24 -========== - -* :vytask:`T5402` ``(bug): VRRP router with rfc3768-compatibility sends multiple ARP replies`` - - -2023-11-22 -========== - -* :vytask:`T5578` ``(bug): "ikev2-reauth" description contains outdated information`` - - -2023-11-15 -========== - -* :vytask:`T5661` ``(enhancment): Add show show ssh dynamic-protection attacker and show log ssh dynamic-protection`` -* :vytask:`T1276` ``(bug): dhcp relay + VLAN fails`` - - -2023-11-07 -========== - -* :vytask:`T5586` ``(feature): Disable by default SNMP for Keepalived VRRP`` - - -2023-11-06 -========== - -* :vytask:`T4269` ``(feature): node.def generator should automatically add default values`` - - -2023-10-26 -========== - -* :vytask:`T5684` ``(bug): services using VRF generates the error "Failed to load BPF prog: 'Operation not permitted'" when the system boots.`` -* :vytask:`T5594` ``(bug): VRRP - Error if using IPv6 Link Local as hello source address`` - - -2023-10-21 -========== - -* :vytask:`T5670` ``(bug): bridge: missing member interface validator`` -* :vytask:`T5191` ``(default): Replace underscores with hyphens in command-line options generated by vyos.opmode`` -* :vytask:`T4402` ``(bug): OpenVPN client-ip-pool option is broken`` -* :vytask:`T2719` ``(feature): Standardized op mode script structure`` - - -2023-10-19 -========== - -* :vytask:`T5669` ``(bug): VXLAN interface changing port does not work`` - - -2023-10-17 -========== - -* :vytask:`T5235` ``(bug): SSH keys with special characters cannot be applied via Cloud-init`` - - -2023-10-08 -========== - -* :vytask:`T5630` ``(feature): pppoe: allow to specify MRU in addition to already configurable MTU`` - - -2023-10-06 -========== - -* :vytask:`T5576` ``(feature): Add bgp remove-private-as all option`` - - -2023-10-04 -========== - -* :vytask:`T5632` ``(feature): Add jq package to parse JSON files`` - - -2023-09-25 -========== - -* :vytask:`T5533` ``(bug): Keepalived VRRP IPv6 group enters in FAULT state`` - - -2023-09-20 -========== - -* :vytask:`T5271` ``(default): Add support for peer-fingerprint to OpenVPN`` - - -2023-09-11 -========== - -* :vytask:`T5557` ``(bug): bgp: Use treat-as-withdraw for tunnel encapsulation attribute CVE-2023-38802`` -* :vytask:`T3424` ``(default): PPPoE IA-PD doesn't work in VRF`` - - -2023-09-10 -========== - -* :vytask:`T5555` ``(bug): Fix timezone migrator (system 13-to-14)`` -* :vytask:`T5545` ``(bug): sflow is not working`` - - -2023-09-08 -========== - -* :vytask:`T4426` ``(default): Add arpwatch to the image`` - - -2023-09-05 -========== - -* :vytask:`T5524` ``(feature): Add config directory to liveCD`` -* :vytask:`T2958` ``(bug): DHCP server doesn't work from a live CD`` -* :vytask:`T5428` ``(bug): dhcp: client renewal fails when running inside VRF`` - - -2023-09-04 -========== - -* :vytask:`T5506` ``(bug): Container bridge interfaces do not have a link-local address`` - - -2023-08-31 -========== - -* :vytask:`T5190` ``(feature): Cloud-Init cannot fetch Meta-data on machines where the main Ethernet interface is not eth0`` -* :vytask:`T5140` ``(bug): Firewall network-group problems`` -* :vytask:`T4895` ``(bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data`` -* :vytask:`T4874` ``(default): Add Warning message to Equuleus`` -* :vytask:`T4855` ``(bug): Trying to create more than one tunnel of the same type to the same address causes unhandled exception`` -* :vytask:`T4776` ``(bug): NVME storage is not detected properly during installation`` -* :vytask:`T3546` ``(feature): Add support for running scripts on PPPoE server session events`` -* :vytask:`T738` ``(feature): Add local-port and resolver port options for powerdns in CLI configuration tree`` - - -2023-08-30 -========== - -* :vytask:`T5221` ``(bug): BGP as-override behavior differs from new FRR and other vendors`` -* :vytask:`T4933` ``(default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a nondescript error`` -* :vytask:`T4790` ``(bug): RADIUS login does not work if sum of timeouts more than 50s`` -* :vytask:`T4475` ``(bug): route-map does not support ipv6 peer`` -* :vytask:`T4459` ``(bug): API service with VRF doesn't work in 1.3.1`` -* :vytask:`T4407` ``(bug): Network-config v2 is broken in Cloud-init 22.1 and VyOS 1.3`` -* :vytask:`T4113` ``(bug): Incorrect GRUB configuration parsing`` -* :vytask:`T1764` ``(bug): Use lists instead of whitespace-separated strings in vyos.config`` -* :vytask:`T4121` ``(bug): Nameservers from DHCP client cannot be used in specific cases`` -* :vytask:`T4151` ``(feature): IPV6 local PBR Support`` -* :vytask:`T4306` ``(default): Do not check for ditry repository when building release images`` - - -2023-08-29 -========== - -* :vytask:`T3940` ``(bug): DHCP client does not remove IP address when stopped by the 02-vyos-stopdhclient hook`` -* :vytask:`T3713` ``(default): Create a meta-package for user utilities`` -* :vytask:`T3339` ``(bug): Cloud-Init domain search setting not applied`` -* :vytask:`T2640` ``(feature): Running VyOS inside Docker containers`` -* :vytask:`T3577` ``(bug): Generating vpn x509 key pair fails with command not found`` - - -2023-08-28 -========== - -* :vytask:`T4745` ``(bug): CLI TAB issue with values with '-' at the beginning in conf mode`` -* :vytask:`T2611` ``(bug): Prefix list names are shared between ipv4 and ipv6`` -* :vytask:`T2296` ``(default): Upgrade WALinux to 2.2.41`` -* :vytask:`T2123` ``(default): Configure 3 NTP servers`` -* :vytask:`T469` ``(bug): Problem after commit with errors`` - - -2023-08-25 -========== - -* :vytask:`T4412` ``(bug): commit archive: reboot not working with sftp`` -* :vytask:`T3702` ``(feature): Policy: Allow routing by fwmark`` -* :vytask:`T3536` ``(default): Unable to list all available routes`` - - -2023-08-24 -========== - -* :vytask:`T5006` ``(bug): Http api segfault with concurrent requests`` -* :vytask:`T5305` ``(bug): REST API configure operation should not be defined as async`` - - -2023-08-23 -========== - -* :vytask:`T5387` ``(feature): dhcp6c: add a no release option`` - - -2023-08-20 -========== - -* :vytask:`T5470` ``(bug): wlan: can not disable interface if SSID is not configured`` - - -2023-08-17 -========== - -* :vytask:`T5486` ``(bug): Service dns dynamic cannot pass the smoketest`` -* :vytask:`T5223` ``(bug): tunnel key doesn't clear`` - - -2023-08-15 -========== - -* :vytask:`T5273` ``(default): Add op mode commands for displaying certificate details and fingerprints`` -* :vytask:`T5270` ``(default): Make OpenVPN `tls dh-params` optional`` - - -2023-08-10 -========== - -* :vytask:`T5329` ``(bug): Wireguard interface as GRE tunnel source causes configuration error on boot`` - - -2023-07-24 -========== - -* :vytask:`T5354` ``(feature): Add sshguard to protect against brut-forces for 1.3`` - - -2023-07-17 -========== - -* :vytask:`T2051` ``(bug): Throughput anomalies`` - - -2023-07-14 -========== - -* :vytask:`T305` ``(default): loadbalancing does not work with one pppoe connection and another connection of either dhcp or static`` - - -2023-07-13 -========== - -* :vytask:`T3045` ``(bug): Changes to Conntrack-Sync don't apply correctly (Mutlicast->UDP)`` -* :vytask:`T971` ``(bug): authentication public-keys options quoting issue`` - - -2023-07-12 -========== - -* :vytask:`T5009` ``(bug): op-mode command: restart dhcp relay-agent not working`` -* :vytask:`T4927` ``(bug): Need to change restart to reload-or-restart in Webproxy module`` -* :vytask:`T3835` ``(bug): vyos router 1.2.7 snmp Dos bug`` -* :vytask:`T4959` ``(feature): Add container registry authentication config for containers`` -* :vytask:`T425` ``(feature): AWS CloudWatch monitoring scripts`` - - -2023-07-11 -========== - -* :vytask:`T4862` ``(bug): webproxy domain-block does not work`` -* :vytask:`T4844` ``(bug): Incorrect permissions of the safeguard DB directory`` -* :vytask:`T4262` ``(bug): install image doesn't respect chosen root partition size`` -* :vytask:`T3810` ``(bug): webproxy squidguard rules don't work properly after rewriting to python.`` -* :vytask:`T1928` ``(bug): Is the 'Welcome to VyOS' message when using SSH an information leak?`` -* :vytask:`T4737` ``(bug): FRRouting/zebra 7.5.1 does not redistribute routes to other protocols`` -* :vytask:`T3852` ``(bug): DHCP client issue - interface has two dhclient processes when link is unpluged and then plug again`` -* :vytask:`T2118` ``(bug): Failure to boot after power outage due to dirty filesystem and no fsck in initramfs`` - - -2023-07-05 -========== - -* :vytask:`T5331` ``(bug): ath10k_pci not functioning`` - - -2023-06-30 -========== - -* :vytask:`T5315` ``(feature): vrrp: add support for version 3`` -* :vytask:`T5313` ``(bug): UDP broadcast relay - missing verify() that relay interfaces have an IP address assigned`` - - -2023-06-26 -========== - -* :vytask:`T5272` ``(default): Upgrade OpenVPN to 2.6 in Equuleus`` -* :vytask:`T5265` ``(bug): WAN load-balancing: missing completion helpers`` - - -2023-06-25 -========== - -* :vytask:`T5240` ``(bug): Service router-advert failed to start radvd with more then 3 name-servers`` - - -2023-06-21 -========== - -* :vytask:`T5280` ``(bug): Update Expired keys (2023-06-08) for PowerDNS`` - - -2023-06-13 -========== - -* :vytask:`T5213` ``(feature): Accel-ppp sending accounting interim updates acct-interim-interval option`` - - -2023-05-29 -========== - -* :vytask:`T5243` ``(bug): Default route is inactive if an interface has multiple ip addresses of the same subnet in 1.3.2 Equuleus`` - - -2023-05-19 -========== - -* :vytask:`T5186` ``(bug): QoS test cannot pass for 1.3`` - - -2023-05-12 -========== - -* :vytask:`T2769` ``(feature): Add VRF support for syslog`` - - -2023-05-08 -========== - -* :vytask:`T5212` ``(bug): snmp community name -error with special carracter`` - - -2023-04-27 -========== - -* :vytask:`T5175` ``(bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0`` -* :vytask:`T5176` ``(bug): http-api: update vyos-http-api-tools for FastAPI security vulnerability`` - - -2023-04-13 -========== - -* :vytask:`T5152` ``(bug): Telegraf agent hostname isn't qualified`` -* :vytask:`T4727` ``(feature): Add RADIUS rate limit support to PPTP server`` -* :vytask:`T4939` ``(bug): VRRP command no-preempt not work as expected`` -* :vytask:`T3608` ``(default): Standardize warnings from configure scripts`` - - -2023-04-05 -========== - -* :vytask:`T4975` ``(bug): CLI does not work after cutting off the power or reset`` -* :vytask:`T5136` ``(bug): Possible config corruption on upgrade`` - - -2023-04-01 -========== - -* :vytask:`T5047` ``(bug): Recreate only a specific container`` - - -2023-03-31 -========== - -* :vytask:`T5111` ``(bug): pppd-dns.service startup failed`` - - -2023-03-29 -========== - -* :vytask:`T5033` ``(bug): generate-public-key command fails for address with multiple public keys like GitHub`` -* :vytask:`T5097` ``(bug): the operational command "show interfaces ethernet ethx" doesn't reflect a call to 'clear counters'`` - - -2023-03-21 -========== - -* :vytask:`T5098` ``(feature): PPPoE client holdoff configuration`` - - -2023-03-19 -========== - -* :vytask:`T4925` ``(feature): Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2`` - - -2023-03-16 -========== - -* :vytask:`T3083` ``(feature): Add feature event-handler`` -* :vytask:`T2516` ``(bug): vyos-container: cannot configure ethernet interface`` - - -2023-03-09 -========== - -* :vytask:`T5066` ``(bug): Different GRE tunnel but same tunnel keys error`` - - -2023-03-08 -========== - -* :vytask:`T4381` ``(default): OpenVPN: Add "Tunnel IP" column in "show openvpn server" operational command`` -* :vytask:`T4872` ``(bug): Op-mode show openvpn misses a case when parsing for tunnel IP`` - - -2023-03-07 -========== - -* :vytask:`T2838` ``(bug): Ethernet device names changing, multiple hw-id being added`` -* :vytask:`T2649` ``(default): Ensure configration mode scripts conform to coding guidelines`` -* :vytask:`T4900` ``(default): Cache intermediary results of get_config_diff in Config instance`` - - -2023-03-03 -========== - -* :vytask:`T4625` ``(enhancment): Update ocserv to current revision (1.1.6)`` - - -2023-02-28 -========== - -* :vytask:`T4955` ``(bug): Openconnect radiusclient.conf generating with extra authserver`` -* :vytask:`T4219` ``(feature): support incoming-interface (iif) in local PBR`` - - -2023-02-25 -========== - -* :vytask:`T5008` ``(bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine`` -* :vytask:`T5007` ``(bug): Interface multicast setting is invalid`` -* :vytask:`T5017` ``(bug): Bug with validator interface-name`` -* :vytask:`T4992` ``(bug): Incorrect check is_local_address for bgp neighbor with option ip_nonlocal_bind set`` -* :vytask:`T4978` ``(bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.4-rolling-202302041536`` -* :vytask:`T4948` ``(feature): pppoe: add CLI option to allow definition of host-uniq flag`` - - -2023-02-22 -========== - -* :vytask:`T5011` ``(bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu check should be skipped`` - - -2023-02-18 -========== - -* :vytask:`T4743` ``(feature): Enable IPv6 address for Dynamic DNS`` - - -2023-02-16 -========== - -* :vytask:`T4971` ``(feature): Radius attribute "Framed-Pool" for PPPoE`` - - -2023-02-15 -========== - -* :vytask:`T4993` ``(bug): Can't delete conntrack ignore rule`` - - -2023-02-14 -========== - -* :vytask:`T4999` ``(feature): vyos.util backport dict_search_recursive`` -* :vytask:`T1993` ``(feature): Extended pppoe rate-limiter`` - - -2023-02-13 -========== - -* :vytask:`T4153` ``(bug): Monitor bandwidth-test initiate not working`` - - -2023-02-11 -========== - -* :vytask:`T2603` ``(feature): pppoe-server: reduce min MTU`` - - -2023-02-08 -========== - -* :vytask:`T1288` ``(feature): FRR: rewrite staticd backend (/opt/vyatta/share/vyatta-cfg/templates/protocols/static/*)`` - - -2023-02-07 -========== - -* :vytask:`T4117` ``(bug): Does not possible to configure PoD/CoA for L2TP vpn`` - - -2023-02-01 -========== - -* :vytask:`T4970` ``(default): pin OCaml pcre package to avoid JIT support`` - - -2023-01-30 -========== - -* :vytask:`T4954` ``(bug): DNS cannot be configured via Network-Config v1 received from ConfigDrive / Cloud-Init`` - - -2023-01-24 -========== - -* :vytask:`T4949` ``(feature): Backport "monitor log" and "show log" op-mode definitions from current to equuleus`` -* :vytask:`T4947` ``(feature): Support mounting container volumes as ro or rw`` - - -2023-01-23 -========== - -* :vytask:`T4798` ``(default): Migrate the file-exists validator away from Python`` -* :vytask:`T4683` ``(enhancment): Add kitty-terminfo package to build`` -* :vytask:`T4875` ``(default): Replace Python validator 'interface-name' to avoid Python startup cost`` -* :vytask:`T4664` ``(bug): Add validation to reject whitespace in tag node value names`` - - -2023-01-22 -========== - -* :vytask:`T4906` ``(bug): ipsec connections shows only one connection as up`` - - -2023-01-21 -========== - -* :vytask:`T4896` ``(bug): ospfv3: Fix broken not-advertise option`` -* :vytask:`T4799` ``(bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd`` - - -2023-01-17 -========== - -* :vytask:`T4902` ``(bug): snmpd: exclude container storage from monitoring`` - - -2023-01-15 -========== - -* :vytask:`T4832` ``(feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)`` -* :vytask:`T4918` ``(bug): Odd show interface behavior`` - - -2023-01-09 -========== - -* :vytask:`T4922` ``(feature): Add ssh-client source-interface CLI option`` - - -2023-01-07 -========== - -* :vytask:`T4884` ``(bug): Missing a community6 in snmpd config`` - - -2023-01-05 -========== - -* :vytask:`T3937` ``(default): Rewrite "show system memory" in Python to make it usable as a library function`` - - -2023-01-03 -========== - -* :vytask:`T4869` ``(bug): A network with `/32` or `/128` mask cannot be removed from a network-group`` - - -2022-12-31 -========== - -* :vytask:`T4898` ``(feature): Add mtu config option for dummy interfaces`` - - -2022-12-26 -========== - -* :vytask:`T4511` ``(bug): IPv6 DNS lookup`` -* :vytask:`T4809` ``(feature): radvd: Allow use of AdvRASrcAddress`` - - -2022-12-18 -========== - -* :vytask:`T4709` ``(bug): TCP MSS clamping broken in equuleus`` - - -2022-12-15 -========== - -* :vytask:`T4671` ``(bug): linux-firmware package is missing symlinks defined in WHENCE file`` - - -2022-12-04 -========== - -* :vytask:`T4825` ``(feature): interfaces veth/veth-pairs -standalone used`` - - -2022-12-02 -========== - -* :vytask:`T4122` ``(bug): interface ip address config missing after upgrade from 1.2.8 to 1.3.0 (when redirect is configured?)`` -* :vytask:`T1024` ``(feature): Policy Based Routing by DSCP`` - - -2022-11-23 -========== - -* :vytask:`T4793` ``(feature): Create warning message about disable-route-autoinstall when ipsec vti is used`` - - -2022-11-21 -========== - -* :vytask:`T4812` ``(feature): IPsec ability to show all configured connections`` - - -2022-11-06 -========== - -* :vytask:`T2913` ``(bug): Failure to install fpm while building builder docker image`` - - -2022-11-04 -========== - -* :vytask:`T2417` ``(feature): Python validator cleanup`` - - -2022-11-01 -========== - -* :vytask:`T4177` ``(bug): Strip-private doesn't work for service monitoring`` - - -2022-10-31 -========== - -* :vytask:`T1875` ``(feature): Add the ability to use network address as BGP neighbor (bgp listen range)`` -* :vytask:`T4785` ``(feature): snmp: Allow !, @, * and # in community name`` - - -2022-10-21 -========== - -* :vytask:`T2189` ``(bug): Adding a large port-range will take ~ 20 minutes to commit`` - - -2022-10-18 -========== - -* :vytask:`T4533` ``(bug): Radius clients don’t have simple permissions`` - - -2022-10-13 -========== - -* :vytask:`T4312` ``(bug): Telegraf configuration doesn't accept IPs for URL`` - - -2022-10-12 -========== - -* :vytask:`T4730` ``(bug): Conntrack-sync error - listen-address is not the correct type in config as it should be`` - - -2022-10-11 -========== - -* :vytask:`T4680` ``(bug): Telegraf prometheus-client listen-address invalid format`` - - -2022-10-04 -========== - -* :vytask:`T4702` ``(bug): Wireguard peers configuration is not synchronized with CLI`` -* :vytask:`T4652` ``(feature): Upgrade PowerDNS recursor to 4.7 series`` -* :vytask:`T4648` ``(default): PPPoE: Ignore default router from RA when PPPoE default-route is set to none`` -* :vytask:`T4582` ``(default): Router-advert: Preferred lifetime cannot equal valid lifetime in PIOs`` - - -2022-09-17 -========== - -* :vytask:`T4666` ``(bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584`` - - -2022-09-15 -========== - -* :vytask:`T4679` ``(bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address`` -* :vytask:`T4630` ``(bug): Prevent attempts to use the same interface as a source interface for pseudo-ethernet and MACsec at the same time`` - - -2022-09-12 -========== - -* :vytask:`T4647` ``(feature): Add Google Virtual NIC (gVNIC) support`` - - -2022-09-05 -========== - -* :vytask:`T4668` ``(bug): Adding/removing members from bond doesn't work/results in incorrect interface state`` -* :vytask:`T4628` ``(bug): ConfigTree() throws ValueError() if tagNode contains whitespaces`` - - -2022-08-29 -========== - -* :vytask:`T4653` ``(bug): Interface offload options are not applied correctly`` -* :vytask:`T4061` ``(default): Add util function to check for completion of boot config`` -* :vytask:`T4654` ``(bug): RPKI cache incorrect description`` -* :vytask:`T4572` ``(bug): Add an option to force interface MTU to the value received from DHCP`` - - -2022-08-26 -========== - -* :vytask:`T4642` ``(bug): proxy: hyphen not allowed in proxy URL`` - - -2022-08-23 -========== - -* :vytask:`T4618` ``(bug): Traffic policy not set on virtual interfaces`` -* :vytask:`T4538` ``(bug): Macsec does not work correctly when the interface status changes.`` - - -2022-08-22 -========== - -* :vytask:`T4629` ``(bug): Raised ConfigErrors contain dict instead of only the dict key`` -* :vytask:`T4632` ``(bug): VLAN-aware bridge not working`` - - -2022-08-19 -========== - -* :vytask:`T4616` ``(bug): openconnect: KeyError: 'local_users'`` -* :vytask:`T4614` ``(feature): OpenConnect split-dns directive`` - - -2022-08-16 -========== - -* :vytask:`T4592` ``(bug): macsec: can not create two interfaces using the same source-interface`` -* :vytask:`T4584` ``(bug): hostap: create custom package build`` -* :vytask:`T4537` ``(bug): MACsec not working with cipher gcm-aes-256`` - - -2022-08-15 -========== - -* :vytask:`T4565` ``(bug): vlan aware bridge not working with - Kernel: T3318: update Linux Kernel to v5.4.205 #249`` -* :vytask:`T4206` ``(bug): Policy Based Routing with DHCP Interface Issue`` -* :vytask:`T2763` ``(feature): New SNMP resource request - SNMP over TCP`` - - -2022-08-14 -========== - -* :vytask:`T4579` ``(bug): bridge: can not delete member interface CLI option when VLAN is enabled`` -* :vytask:`T4421` ``(default): Add support for floating point numbers in the numeric validator`` -* :vytask:`T4415` ``(bug): Include license/copyright files in the image but remove user documentation from /usr/share/doc to reduce its size`` -* :vytask:`T4313` ``(bug): "generate public-key-command" throws unhandled exceptions when it cannot retrieve the key`` -* :vytask:`T4082` ``(bug): Add op mode command to restart ldpd`` -* :vytask:`T3714` ``(bug): Some sysctl custom parameters disappear after reboot`` -* :vytask:`T4260` ``(bug): Extend vyos.configdict.node_changed() to support recursiveness`` -* :vytask:`T3785` ``(default): Add unicode support to configtree backend`` -* :vytask:`T3507` ``(bug): Bond with mode LACP show u/u in show interfaces even if peer is not configured`` - - -2022-08-11 -========== - -* :vytask:`T4476` ``(default): Next steps after installation is not communicated properly to new users`` - - -2022-08-02 -========== - -* :vytask:`T4515` ``(default): Reduce telegraf binary size`` - - -2022-07-30 -========== - -* :vytask:`T4575` ``(feature): vyos.utill add new wrapper "rc_cmd" to get the return code and output`` -* :vytask:`T4532` ``(bug): Flow-accounting IPv6 server/receiver bug`` - - -2022-07-27 -========== - -* :vytask:`T4571` ``(bug): Sflow with vrf configured does not use vrf to validate agent-address IP from vrf-configured interfaces`` - - -2022-07-18 -========== - -* :vytask:`T4228` ``(bug): bond: OS error thrown when two bonds use the same member`` -* :vytask:`T4534` ``(bug): bond: bridge: error out if member interface is assigned to a VRF instance`` -* :vytask:`T4525` ``(bug): Delete interface from VRF and add it to bonding error`` -* :vytask:`T4522` ``(feature): bond: add ability to specify mii monitor interval via CLI`` -* :vytask:`T4521` ``(bug): bond: ARP monitor interval is not configured despite set via CLI`` - - -2022-07-14 -========== - -* :vytask:`T4491` ``(bug): Use empty string for internal name of root node of config_tree`` - - -2022-07-13 -========== - -* :vytask:`T1375` ``(feature): Add clear dhcp server lease function`` - - -2022-07-12 -========== - -* :vytask:`T4527` ``(bug): Prevent to create VRF name default`` -* :vytask:`T4084` ``(default): Dehardcode the default login banner`` -* :vytask:`T3864` ``(enhancment): Add Edgecore build to VyOS 1.3 Equuleus`` - - -2022-07-09 -========== - -* :vytask:`T4507` ``(feature): IPoE-server add multiplier option for shaper`` -* :vytask:`T4468` ``(bug): web-proxy source group cannot start with a number bug`` -* :vytask:`T4373` ``(feature): PPPoE-server add multiplier option for shaper`` - - -2022-07-07 -========== - -* :vytask:`T4456` ``(bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many messages`` -* :vytask:`T4509` ``(feature): Feature Request: DNS64`` - - -2022-07-06 -========== - -* :vytask:`T4513` ``(bug): Webproxy monitor commands do not work`` - - -2022-07-05 -========== - -* :vytask:`T4510` ``(bug): set system static-host-mapping doesn't allow IPv4 and IPv6 for same name.`` -* :vytask:`T2654` ``(bug): Multiple names unable to be assigned to the same static mapping`` -* :vytask:`T2683` ``(default): no dual stack in system static-host-mapping host-name`` - - -2022-07-01 -========== - -* :vytask:`T4489` ``(bug): MPLS sysctl not persistent for tunnel interfaces`` - - -2022-06-20 -========== - -* :vytask:`T1856` ``(feature): Support configuring IPSec SA bytes`` - - -2022-06-16 -========== - -* :vytask:`T3866` ``(bug): Configs with DNS forwarding listening on OpenVPN interfaces or interfaces without a fixed address cannot be migrated to the new syntax`` - - -2022-06-15 -========== - -* :vytask:`T1890` ``(feature): Metatask: rewrite flow-accounting to XML and Python`` - - -2022-06-09 -========== - -* :vytask:`T2580` ``(feature): Support for ip pools for ippoe`` - - -2022-06-08 -========== - -* :vytask:`T4447` ``(bug): DHCPv6 prefix delegation `sla-id` limited to 128`` -* :vytask:`T4350` ``(bug): DMVPN opennhrp spokes dont work behind NAT`` - - -2022-05-30 -========== - -* :vytask:`T4315` ``(feature): Telegraf - Output to prometheus`` - - -2022-05-27 -========== - -* :vytask:`T4441` ``(bug): wwan: connection not possible after a change added after 1.3.1-S1 release`` - - -2022-05-26 -========== - -* :vytask:`T4442` ``(feature): HTTP API add action "reset"`` - - -2022-05-25 -========== - -* :vytask:`T2194` ``(default): "show firewall" garbled output`` - - -2022-05-19 -========== - -* :vytask:`T4430` ``(bug): Show firewall output with visual shift default rule`` - - -2022-05-16 -========== - -* :vytask:`T4377` ``(default): generate tech-support archive includes previous archives`` - - -2022-05-12 -========== - -* :vytask:`T4100` ``(feature): Firewall increase maximum number of rules`` - - -2022-05-11 -========== - -* :vytask:`T4405` ``(bug): DHCP client sometimes ignores `no-default-route` option of an interface`` - - -2022-05-10 -========== - -* :vytask:`T1972` ``(feature): Allow setting interface name for virtual_ipaddress in VRRP VRID`` - - -2022-05-07 -========== - -* :vytask:`T4361` ``(bug): `vyos.config.exists()` does not work for nodes with multiple values`` -* :vytask:`T4354` ``(bug): Slave interfaces fall out from bonding during configuration change`` - - -2022-05-03 -========== - -* :vytask:`T4395` ``(feature): Extend show vpn debug`` - - -2022-05-01 -========== - -* :vytask:`T4369` ``(bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node`` -* :vytask:`T4363` ``(bug): salt-minion: default mine_interval option is not set`` - - -2022-04-29 -========== - -* :vytask:`T4388` ``(bug): dhcp-server: missing constraint on tftp-server-name option`` -* :vytask:`T4366` ``(bug): geneve: interface is removed on changes to e.g. description`` - - -2022-04-26 -========== - -* :vytask:`T4235` ``(default): Add config tree diff algorithm`` - - -2022-04-19 -========== - -* :vytask:`T4344` ``(bug): DHCP statistics not matching, conf-mode generates incorrect pool name with dash`` -* :vytask:`T4268` ``(bug): Elevated LA while using VyOS monitoring feature`` - - -2022-04-08 -========== - -* :vytask:`T4331` ``(bug): IPv6 link local addresses are not configured when an interface is in a VRF`` -* :vytask:`T4339` ``(bug): wwan: tab-completion results in "No such file or directory" if there is no WWAN interface`` -* :vytask:`T4338` ``(bug): wwan: changing interface description should not trigger reconnect`` -* :vytask:`T4324` ``(bug): wwan: check alive script should only be run via cron if a wwan interface is configured at all`` - - -2022-04-07 -========== - -* :vytask:`T4330` ``(bug): MTU settings cannot be applied when IPv6 is disabled`` -* :vytask:`T4346` ``(feature): Deprecate "system ipv6 disable" option to disable address family within OS kernel`` -* :vytask:`T4337` ``(bug): isis: IETF SPF delay algorithm can not be configured - results in vyos.frr.CommitError`` -* :vytask:`T4319` ``(bug): The command "set system ipv6 disable" doesn't work as expected.`` -* :vytask:`T4341` ``(feature): login: disable user-account prior to deletion and wait until deletion is complete`` -* :vytask:`T4336` ``(feature): isis: add support for MD5 authentication password on a circuit`` - - -2022-04-06 -========== - -* :vytask:`T4308` ``(feature): Op-comm "Show log frr" to view specific protocol logs`` - - -2022-03-29 -========== - -* :vytask:`T3686` ``(bug): Bridging OpenVPN tap with no local-address breaks`` - - -2022-03-24 -========== - -* :vytask:`T4294` ``(bug): Adding a new openvpn-option does not restart the OpenVPN process`` -* :vytask:`T4230` ``(bug): OpenVPN server configuration deleted after reboot when using a VRRP virtual-address`` - - -2022-03-21 -========== - -* :vytask:`T4311` ``(bug): CVE-2021-4034: local privilege escalation in PolKit`` -* :vytask:`T4310` ``(bug): CVE-2022-0778: infinite loop in OpenSSL certificate parsing`` - - -2022-03-12 -========== - -* :vytask:`T4296` ``(bug): Interface config injected by Cloud-Init may interfere with VyOS native`` -* :vytask:`T4002` ``(default): firewall group network-group long names restriction incorrect behavior`` - - -2022-03-11 -========== - -* :vytask:`T4297` ``(bug): Interface configuration saving fails for ice/iavf based interfaces because they can't change speed/duplex settings`` - - -2022-03-05 -========== - -* :vytask:`T4259` ``(bug): The conntrackd daemon can be started wrongly`` - - -2022-02-28 -========== - -* :vytask:`T4273` ``(bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config`` -* :vytask:`T4115` ``(bug): reboot in not working as expected`` - - -2022-02-24 -========== - -* :vytask:`T4267` ``(bug): Error - Missing required "ip key" parameter`` - - -2022-02-23 -========== - -* :vytask:`T4264` ``(bug): vxlan: interface is destroyed and rebuild on description change`` -* :vytask:`T4263` ``(bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes`` - - -2022-02-21 -========== - -* :vytask:`T4120` ``(feature): [VXLAN] add ability to set multiple unicast-remotes`` - - -2022-02-20 -========== - -* :vytask:`T4261` ``(feature): MACsec: add DHCP client support`` -* :vytask:`T4203` ``(bug): Reconfigure DHCP client interface causes brief outages`` - - -2022-02-19 -========== - -* :vytask:`T4258` ``(bug): [DHCP-SERVER] error parameter on Failover`` - - -2022-02-17 -========== - -* :vytask:`T4241` ``(bug): ocserv openconnect looks broken in recent bulds of 1.3 Equuleus`` -* :vytask:`T4255` ``(bug): Unexpected print of dict bridge on delete`` -* :vytask:`T4240` ``(bug): Cannot add wlan0 to bridge via configure`` -* :vytask:`T4154` ``(bug): Error add second gre tunnel with the same source interface`` - - -2022-02-16 -========== - -* :vytask:`T4237` ``(bug): Conntrack-sync error - error adding listen-address command`` - - -2022-02-15 -========== - -* :vytask:`T4201` ``(bug): Firewall - ICMPv6 matches not working as expected on 1.3.0`` -* :vytask:`T3006` ``(bug): Accel-PPP & vlan-mon config get invalid VLAN`` -* :vytask:`T3494` ``(bug): DHCPv6 leases traceback when PD using`` - - -2022-02-13 -========== - -* :vytask:`T4242` ``(bug): ethernet speed/duplex can never be switched back to auto/auto`` -* :vytask:`T4191` ``(bug): Lost access to host after VRF re-creating`` - - -2022-02-11 -========== - -* :vytask:`T3872` ``(feature): Add configurable telegraf monitoring service`` -* :vytask:`T4234` ``(bug): Show firewall partly broken in 1.3.x`` - - -2022-02-10 -========== - -* :vytask:`T4165` ``(bug): Custom conntrack rules cannot be deleted`` - - -2022-02-08 -========== - -* :vytask:`T4227` ``(bug): Typo in help completion of hello-time option of bridge interface`` - - -2022-02-07 -========== - -* :vytask:`T4233` ``(bug): ssh: sync regex for allow/deny usernames to "system login"`` -* :vytask:`T4087` ``(feature): IPsec IKE-group proposals limit of 10 pieces`` - - -2022-02-05 -========== - -* :vytask:`T4226` ``(bug): VRRP transition-script does not work for groups name which contains -(minus) sign`` - - -2022-02-04 -========== - -* :vytask:`T4196` ``(bug): DHCP server client-prefix-length parameter results in non-functional leases`` - - -2022-02-03 -========== - -* :vytask:`T3643` ``(bug): show vpn ipsec sa doesn't show tunnels in "down" state`` - - -2022-02-01 -========== - -* :vytask:`T4198` ``(bug): Error shown on commit`` - - -2022-01-28 -========== - -* :vytask:`T4184` ``(bug): NTP allow-clients address doesn't work it allows to use ntp server for all addresses`` - - -2022-01-24 -========== - -* :vytask:`T4204` ``(feature): Update Accel-PPP to a newer revision`` - - -2022-01-17 -========== - -* :vytask:`T3164` ``(bug): console-server ssh does not work with RADIUS PAM auth`` - - -2022-01-15 -========== - -* :vytask:`T4183` ``(feature): IPv6 link-local address not accepted as wireguard peer`` -* :vytask:`T4110` ``(feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0`` - - -2022-01-12 -========== - -* :vytask:`T4168` ``(bug): IPsec VPN is impossible to restart when DMVPN is configured`` -* :vytask:`T4167` ``(bug): DMVPN apply wrong param on the first configuration`` -* :vytask:`T4152` ``(bug): NHRP shortcut-target holding-time does not work`` - - -2022-01-10 -========== - -* :vytask:`T3299` ``(bug): Allow the web proxy service to listen on all IP addresses`` -* :vytask:`T3115` ``(feature): Add support for firewall on L3 VIF bridge interface`` - - -2022-01-09 -========== - -* :vytask:`T3822` ``(bug): OpenVPN processes do not have permission to read key files generated with `run generate openvpn key``` -* :vytask:`T4142` ``(bug): Input ifbX interfaces not displayed in op-mode`` -* :vytask:`T3914` ``(bug): VRRP rfc3768-compatibility doesn't work with unicast peers`` - - -2022-01-07 -========== - -* :vytask:`T3924` ``(bug): VRRP stops working with VRF`` - - -2022-01-06 -========== - -* :vytask:`T4141` ``(bug): Set high-availability vrrp sync-group without members error`` - - -2022-01-03 -========== - -* :vytask:`T4065` ``(bug): IPSEC configuration error: connection to unix:///var/run/charon.ctl failed: No such file or directory`` -* :vytask:`T4052` ``(bug): Validator return traceback on VRRP configuration with the script path not in config dir`` -* :vytask:`T4128` ``(bug): keepalived: Upgrade package to add VRF support`` - - -2021-12-31 -========== - -* :vytask:`T4081` ``(bug): VRRP health-check script stops working when setting up a sync group`` - - -2021-12-29 -========== - -* :vytask:`T2922` ``(bug): The `vpn ipsec logging log-modes` miss the IPSec daemons state check`` -* :vytask:`T2695` ``(bug): Flow-accounting bug with subinterfaces`` -* :vytask:`T2400` ``(default): OpenVPN: dont restart server if no need`` -* :vytask:`T4086` ``(default): system login banner is not removed on deletion.`` - - -2021-12-28 -========== - -* :vytask:`T3380` ``(bug): "show vpn ike sa" does not display IPv6 peers`` -* :vytask:`T2933` ``(feature): VRRP add option virtual_ipaddress_excluded`` - - -2021-12-27 -========== - -* :vytask:`T2566` ``(bug): sstp not able to run tunnels ipv6 only`` -* :vytask:`T4093` ``(bug): SNMPv3 snmpd.conf generation bug`` -* :vytask:`T2764` ``(enhancment): Increase maximum number of NAT rules`` - - -2021-12-26 -========== - -* :vytask:`T4104` ``(bug): RAID1: "add raid md0 member sda1" does not restore boot sector`` - - -2021-12-25 -========== - -* :vytask:`T4101` ``(bug): commit-archive: Use of uninitialized value $source_address in concatenation`` -* :vytask:`T4055` ``(feature): Add VRF support for HTTP(S) API service`` - - -2021-12-24 -========== - -* :vytask:`T3854` ``(bug): Missing op-mode commands for conntrack-sync`` - - -2021-12-23 -========== - -* :vytask:`T4092` ``(bug): IKEv2 mobike commit failed with DMVPN nhrp`` -* :vytask:`T3354` ``(default): Convert strip-private script from Perl to Python`` - - -2021-12-22 -========== - -* :vytask:`T3356` ``(feature): Script for remote file transfers`` - - -2021-12-21 -========== - -* :vytask:`T4053` ``(bug): VRRP impossible to set scripts out of the /config directory`` -* :vytask:`T4013` ``(bug): Add pkg cloudwatch for AWS images`` -* :vytask:`T3913` ``(bug): VRF traffic fails after upgrade from 1.3.0-RC6 to 1.3.0-EPA1/2`` - - -2021-12-20 -========== - -* :vytask:`T4088` ``(default): Fix typo in login banner`` - - -2021-12-19 -========== - -* :vytask:`T3912` ``(default): Use a more informative default post-login banner`` - - -2021-12-17 -========== - -* :vytask:`T3176` ``(bug): Ordering of ports on EdgeCore SAF51015I is mixed up?`` -* :vytask:`T4059` ``(bug): VRRP sync-group transition script does not persist after reboot`` - - -2021-12-16 -========== - -* :vytask:`T4046` ``(feature): Sflow - Add Source address parameter`` -* :vytask:`T2615` ``(default): Provide an explicit option for server fingerprint in commit archive, and make insecure the default`` -* :vytask:`T4076` ``(enhancment): Allow setting CORS options in HTTP API`` -* :vytask:`T3378` ``(bug): commit-archive source-address broken for IPv6 addresses`` - - -2021-12-15 -========== - -* :vytask:`T4077` ``(bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"`` -* :vytask:`T4073` ``(bug): "show protocols bfd peer <>" shows incorrect peer information.`` - - -2021-12-14 -========== - -* :vytask:`T4071` ``(feature): Allow HTTP API to bind to unix domain socket`` - - -2021-12-12 -========== - -* :vytask:`T4036` ``(bug): VXLAN incorrect raiseError if set multicast network instead of singe address`` - - -2021-12-10 -========== - -* :vytask:`T4068` ``(feature): Python: ConfigError should insert line breaks into the error message`` - - -2021-12-09 -========== - -* :vytask:`T4033` ``(bug): VRRP - Error security when setting scripts`` -* :vytask:`T4064` ``(bug): IP address for vif is not removed from the system when deleted in configuration`` -* :vytask:`T4063` ``(bug): VRRP log error - /usr/libexec/vyos/vyos-vrrp-conntracksync.sh - No such file or directory`` -* :vytask:`T4060` ``(enhancment): Extend configquery for use before boot configuration is complete`` - - -2021-12-08 -========== - -* :vytask:`T4024` ``(bug): Access-lists and prefix-lists disappear when setting ldp hello-ipv4-interval`` - - -2021-12-07 -========== - -* :vytask:`T4041` ``(servicerequest): "transition-script" doesn't work on "sync-group"`` - - -2021-12-06 -========== - -* :vytask:`T4012` ``(feature): Add VRF support for TFTP`` - - -2021-12-05 -========== - -* :vytask:`T4034` ``(bug): "make xcp-ng-iso" still includes vyos-xe-guest-utilities`` -* :vytask:`T2076` ``(feature): RAID install: sfdisk change-id is deprecated in favor of --part-type`` -* :vytask:`T1126` ``(bug): Reusing a RAID from a BIOS install in an EFI install causes a failure to boot`` - - -2021-12-04 -========== - -* :vytask:`T4049` ``(feature): support command-style output with compare command`` -* :vytask:`T4047` ``(bug): Wrong regex validation in XML definitions`` -* :vytask:`T4045` ``(bug): Unable to "format disk like "`` - - -2021-12-02 -========== - -* :vytask:`T4035` ``(bug): Geneve interfaces aren't displayed by operational mode commands`` - - -2021-12-01 -========== - -* :vytask:`T3695` ``(bug): OpenConnect reports commit success when ocserv fails to start due to SSL cert/key file issues`` - - -2021-11-30 -========== - -* :vytask:`T3725` ``(feature): show configuration in json format`` - - -2021-11-29 -========== - -* :vytask:`T2661` ``(bug): SSTP wrong certificates check`` -* :vytask:`T3946` ``(enhancment): Automatically resize the root partition if the drive has extra space`` - - -2021-11-28 -========== - -* :vytask:`T3999` ``(bug): show lldp neighbor Traceback error`` - - -2021-11-26 -========== - -* :vytask:`T4019` ``(bug): Smoketests for SSTP and openconnect fails`` - - -2021-11-25 -========== - -* :vytask:`T4005` ``(feature): Feature Request: IPsec IKEv1 + IKEv2 for one peer`` - - -2021-11-24 -========== - -* :vytask:`T4015` ``(feature): Update Accel-PPP to a newer revision`` -* :vytask:`T1083` ``(feature): Implement persistent/random address and port mapping options for NAT rules`` - - -2021-11-23 -========== - -* :vytask:`T3990` ``(bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to files left behind in /var/tmp/frr/ after reboot)`` - - -2021-11-20 -========== - -* :vytask:`T4004` ``(bug): IPsec ike-group parameters are not saved correctly (after reboot)`` - - -2021-11-19 -========== - -* :vytask:`T4003` ``(bug): API for "show interfaces ethernet" does not include the interface description`` -* :vytask:`T4011` ``(bug): ethernet: deleting interface should place interface in admin down state`` - - -2021-11-18 -========== - -* :vytask:`T3995` ``(feature): OpenVPN: do not stop/start service on configuration change`` -* :vytask:`T4008` ``(feature): dhcp: change client retry interval form 300 -> 60 seconds`` -* :vytask:`T3795` ``(bug): WWAN: issues with non connected interface / no signal`` - - -2021-11-17 -========== - -* :vytask:`T3350` ``(bug): OpenVPN config file generation broken`` -* :vytask:`T3996` ``(bug): SNMP service error in log`` - - -2021-11-15 -========== - -* :vytask:`T3934` ``(bug): Openconnect VPN broken: ocserv-worker general protection fault on client connect`` -* :vytask:`T3724` ``(feature): Allow setting host-name in l2tp section of accel-ppp`` - - -2021-11-14 -========== - -* :vytask:`T3974` ``(bug): route-map commit fails if interface does not exist`` - - -2021-11-11 -========== - -* :vytask:`T1349` ``(bug): L2TP remote-access vpn terminated and not showing as connected`` -* :vytask:`T1058` ``(default): hw-id is ignored when naming interfaces`` -* :vytask:`T914` ``(feature): Extend list_interfaces.py to support multiple interface types`` -* :vytask:`T688` ``(enhancment): Move component versions used for config migration purposes into vyos-1x`` - - -2021-11-10 -========== - -* :vytask:`T3982` ``(bug): DHCP server commit fails if static-mapping contains + or .`` - - -2021-11-09 -========== - -* :vytask:`T3962` ``(bug): Image cannot be built without open-vm-tools`` -* :vytask:`T2088` ``(bug): Increased boot time from 1.2.4 -> 1.3 rolling by 100%`` -* :vytask:`T2136` ``(bug): XML command definition convertor doesn't disallow tag nodes with multi flag on`` - - -2021-11-07 -========== - -* :vytask:`T2874` ``(feature): Add MTU and TCP-MSS discovery tool`` -* :vytask:`T3626` ``(bug): Configuring and disabling DHCP Server`` - - -2021-11-06 -========== - -* :vytask:`T3971` ``(feature): Ability to build ISO images for XCP-NG hypervisor`` -* :vytask:`T3514` ``(bug): NIC flap at any interface change`` - - -2021-11-05 -========== - -* :vytask:`T3972` ``(bug): Removing vif-c interface raises KeyError`` - - -2021-11-04 -========== - -* :vytask:`T3964` ``(bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses`` - - -2021-11-03 -========== - -* :vytask:`T3610` ``(bug): DHCP-Server creation for not primary IP address fails`` - - -2021-11-01 -========== - -* :vytask:`T3846` ``(bug): dmvpn configuration not reapllied after "restart vpn"`` -* :vytask:`T3956` ``(bug): GRE tunnel - unable to move from source-interface to source-address, commit error`` - - -2021-10-31 -========== - -* :vytask:`T3945` ``(feature): Add route-map for bgp aggregate-address`` -* :vytask:`T3341` ``(bug): Wrong behavior of the "reset vpn ipsec-peer XXX tunnel XXX" command`` -* :vytask:`T3954` ``(bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated, config system error`` -* :vytask:`T3943` ``(bug): "netflow source-ip" prevents image upgrades if IP address does not exist locally`` - - -2021-10-29 -========== - -* :vytask:`T3942` ``(feature): Generate IPSec debug archive from op-mode`` - - -2021-10-28 -========== - -* :vytask:`T3941` ``(bug): "show vpn ipsec sa" shows established time of parent SA not child SA's`` - - -2021-10-27 -========== - -* :vytask:`T3944` ``(bug): VRRP fails over when adding new group to master`` - - -2021-10-25 -========== - -* :vytask:`T3935` ``(bug): Update from rc5 to EPA2 failed`` - - -2021-10-22 -========== - -* :vytask:`T3188` ``(bug): Tunnel local-ip to dhcp-interface Change Fails to Update`` - - -2021-10-21 -========== - -* :vytask:`T3920` ``(bug): dhclient exit hook script 01-vyos-cleanup causes too many arguments error`` -* :vytask:`T3926` ``(bug): strip-private does not sanitize "cisco-authentication" from NHRP configuration`` -* :vytask:`T3925` ``(feature): Tunnel: dhcp-interface not implemented - use source-interface instead`` -* :vytask:`T3927` ``(feature): Kernel: Enable kernel support for HW offload of the TLS protocol`` - - -2021-10-20 -========== - -* :vytask:`T3922` ``(bug): NHRP: delete fails`` -* :vytask:`T3918` ``(bug): DHCPv6 prefix delegation incorrect verify error`` -* :vytask:`T3921` ``(bug): tunnel: KeyError when using dhcp-interface`` - - -2021-10-19 -========== - -* :vytask:`T3396` ``(bug): syslog can't be configured with an ipv6 literal destination in 1.2.x`` -* :vytask:`T690` ``(feature): Allow OpenVPN servers to push routes with custom metric values`` - - -2021-10-17 -========== - -* :vytask:`T3786` ``(bug): GRE tunnel source address 0.0.0.0 error`` -* :vytask:`T3425` ``(bug): Scripts from the /config/scripts/ folder do not run on live system`` -* :vytask:`T3217` ``(default): Save FRR configuration on each commit`` -* :vytask:`T3076` ``(bug): Router reboot adds unwanted 'conntrack-sync mcast-group '225.0.0.50'' line to configuration`` -* :vytask:`T2800` ``(bug): Pseudo-Ethernet: source-interface must not be member of a bridge`` -* :vytask:`T3422` ``(bug): Dynamic DNS doesn't allow zone field with cloudflare protocol`` -* :vytask:`T3381` ``(bug): Change GRE tunnel failed`` -* :vytask:`T3254` ``(bug): Dynamic DNS status shows incorrect last update time`` -* :vytask:`T3253` ``(bug): rpki: multiple peers cannot be configured`` -* :vytask:`T3219` ``(default): Typo in openvpn server client config for IPv6 iroute`` -* :vytask:`T2100` ``(feature): BGP route adverisement wih checks rib`` -* :vytask:`T1663` ``(enhancment): T1656 equuleus: buster: arm64/aarch64: ipaddrcheck does not complete testing`` -* :vytask:`T1243` ``(bug): BGP local-as accept wrong values`` -* :vytask:`T770` ``(bug): Bonded interfaces get updated with incorrect hw-id in config.`` -* :vytask:`T697` ``(bug): Clean up and sanitize package dependencies`` -* :vytask:`T3837` ``(default): OpenConnect: Fix typo in help property`` -* :vytask:`T1440` ``(bug): Creating two DHCPv6 shared-network-names with the same subnet is allowed, causes dhcpd to fail to start.`` -* :vytask:`T578` ``(feature): Support Linux Container`` - - -2021-10-16 -========== - -* :vytask:`T3879` ``(bug): GPG key verification fails when upgrading from a 1.3 beta version`` -* :vytask:`T3851` ``(bug): Missing ospf and rip options for bridge vifs`` - - -2021-10-13 -========== - -* :vytask:`T3904` ``(bug): NTP pool associations silently fail`` -* :vytask:`T3277` ``(feature): DNS Forwarding - reverse zones`` - - -2021-10-11 -========== - -* :vytask:`T2607` ``(feature): Support for pppoe-server radius mode auth and config radius accouting port`` - - -2021-10-10 -========== - -* :vytask:`T3750` ``(bug): pdns-recursor 4.4 issue with dont-query and private DNS servers`` -* :vytask:`T3885` ``(default): dhcpv6-pd: randomly generated DUID is not persisted`` -* :vytask:`T3899` ``(enhancment): Add support for hd44780 LCD displays`` - - -2021-10-09 -========== - -* :vytask:`T3894` ``(bug): Tunnel Commit Failed if system does not have `eth0``` - - -2021-10-08 -========== - -* :vytask:`T3893` ``(bug): MGRE Tunnel commit crash If sit tunnel available`` - - -2021-10-04 -========== - -* :vytask:`T3888` ``(bug): Incorrect warning when poweroff command executed from configure mode.`` -* :vytask:`T3890` ``(feature): dhcp(v6): provide op-mode commands to retrieve both server and client logfiles`` -* :vytask:`T3889` ``(feature): Migrate to journalctl when reading daemon logs`` - - -2021-10-03 -========== - -* :vytask:`T3880` ``(bug): EFI boot shows error on display`` - - -2021-10-02 -========== - -* :vytask:`T3882` ``(feature): Upgrade PowerDNs recursor to 4.5 series`` -* :vytask:`T3883` ``(bug): VRF - Delette vrf config on interface`` - - -2021-10-01 -========== - -* :vytask:`T3877` ``(bug): VRRP always enabled rfc3768-compatibility even when not specified`` - - -2021-09-30 -========== - -* :vytask:`T3874` ``(bug): D-Link Ethernet Interface not working.`` - - -2021-09-27 -========== - -* :vytask:`T3858` ``(bug): Deleting OSPFv3 process yields: Unknown command: no router-id`` - - -2021-09-26 -========== - -* :vytask:`T3860` ``(bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64 addresses`` -* :vytask:`T3857` ``(feature): reboot: send wall message to all users for information`` -* :vytask:`T3867` ``(bug): vxlan: multicast group address is not validated`` -* :vytask:`T3859` ``(bug): Add "log-adjacency-changes" to ospfv3 process`` - - -2021-09-23 -========== - -* :vytask:`T3850` ``(bug): Dots are no longer allowed in SSH public key names`` - - -2021-09-21 -========== - -* :vytask:`T2602` ``(bug): pptp/sstp/l2tp add possibility enable or disable CCP`` - - -2021-09-19 -========== - -* :vytask:`T3841` ``(feature): dhcp-server: add ping-check option to CLI`` -* :vytask:`T2738` ``(bug): Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization`` -* :vytask:`T3842` ``(feature): Backport DHCP server improvements from VyOS 1.4 sagitta to 1.3 equuleus`` -* :vytask:`T3840` ``(feature): dns forwarding: Cache size should allow values > 10k`` -* :vytask:`T3672` ``(bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.conf configuration file output`` - - -2021-09-11 -========== - -* :vytask:`T3402` ``(feature): Add VyOS programming library for operational level commands`` - - -2021-09-10 -========== - -* :vytask:`T3802` ``(bug): Commit fails if ethernet interface doesn't support flow control`` -* :vytask:`T3819` ``(bug): Upgrade Salt Stack 3002.3 -> 3003 release train`` -* :vytask:`T3421` ``(bug): MTR/Traceroute broken in 1.3-beta`` -* :vytask:`T3820` ``(feature): PowerDNS recursor - update from 4.3 -> 4.4 to sync with current`` -* :vytask:`T1770` ``(bug): webproxy breaks commit and http access on routed client`` -* :vytask:`T915` ``(feature): MPLS Support`` - - -2021-09-09 -========== - -* :vytask:`T3816` ``(bug): Error after entering outbound-interface command in NAT`` -* :vytask:`T3814` ``(bug): wireguard: commit error showing incorrect peer name from the configured name`` -* :vytask:`T3805` ``(bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP interface`` - - -2021-09-07 -========== - -* :vytask:`T2322` ``(bug): CLI [op-mode] bugs. Root task`` -* :vytask:`T1894` ``(bug): FRR config not loaded after daemons segfault or restart`` -* :vytask:`T3807` ``(bug): Op Command "show interfaces wireguard" does not show the output`` -* :vytask:`T3808` ``(default): ipsec is mistakenly restarted after delete`` - - -2021-09-06 -========== - -* :vytask:`T3806` ``(bug): Don't set link local ipv6 address if MTU less then 1280`` -* :vytask:`T3803` ``(default): Add source-address option to the ping CLI`` -* :vytask:`T3431` ``(bug): Show version all bug`` -* :vytask:`T3362` ``(bug): 1.3 - RC1 ifb redirect failing to commit`` -* :vytask:`T3291` ``(bug): Fault on setting offload RPS with single-core CPU`` -* :vytask:`T2920` ``(bug): Commit crash when adding the second mGRE tunnel with the same key`` -* :vytask:`T2895` ``(bug): VPN IPsec "leftsubnet" declared 2 times`` -* :vytask:`T2019` ``(bug): LLDP wrong config generation for interface 'all'`` - - -2021-09-05 -========== - -* :vytask:`T3804` ``(feature): cli: Migrate and merge "system name-servers-dhcp" into "system name-server"`` - - -2021-09-04 -========== - -* :vytask:`T3697` ``(bug): Impossible to delete IPsec completely`` -* :vytask:`T3619` ``(bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage`` -* :vytask:`T1785` ``(bug): Deleting partitions on disks (Raid1) with default value 'no'`` - - -2021-09-03 -========== - -* :vytask:`T3788` ``(bug): Keys are not allowed with ipip and sit tunnels`` -* :vytask:`T3683` ``(bug): VXLAN not accept ipv6 and source-interface options and mtu bug`` -* :vytask:`T3634` ``(feature): Add op command option for ping for do not fragment bit to be set`` - - -2021-09-02 -========== - -* :vytask:`T3792` ``(bug): login: A hypen present in a username from "system login user" is replaced by an underscore`` -* :vytask:`T3790` ``(bug): Does not possible to configure PPTP static ip-address to users`` - - -2021-09-01 -========== - -* :vytask:`T2434` ``(bug): Duplicate Address Detection Breaks Interfaces`` - - -2021-08-31 -========== - -* :vytask:`T3789` ``(feature): Add custom validator for base64 encoded CLI data`` -* :vytask:`T3782` ``(default): Ingress Shaping with IFB No Longer Functional with 1.3`` - - -2021-08-30 -========== - -* :vytask:`T3777` ``(bug): adding IPv6 EUI64 address fails commit in 1.3.0-rc6`` -* :vytask:`T3768` ``(default): Remove early syntaxVersion implementation`` -* :vytask:`T2558` ``(feature): Add some CPU information to `show version` + fix broken hypervisor detection`` -* :vytask:`T2430` ``(default): cannot delete specific route static next-hop`` -* :vytask:`T1350` ``(bug): VRRP transition script will be executed once only`` -* :vytask:`T2941` ``(default): Using a non-ASCII character in the description field causes UnicodeDecodeError in configsource.py`` -* :vytask:`T3787` ``(bug): Remove deprecated UDP fragmentation offloading option`` -* :vytask:`T3677` ``(feature): "sipcalc" not included in 1.3`` - - -2021-08-29 -========== - -* :vytask:`T3708` ``(bug): isisd and gre-bridge commit error`` -* :vytask:`T3783` ``(bug): "set protocols isis spf-delay-ietf" is not working`` -* :vytask:`T2750` ``(default): Use m4 as a template processor`` - - -2021-08-27 -========== - -* :vytask:`T3182` ``(bug): Main blocker Task for FRR 7.4/7.5 series update`` -* :vytask:`T2108` ``(default): Use minisign/signify instead of GPG for release signing`` - - -2021-08-26 -========== - -* :vytask:`T3781` ``(bug): Revert the NAT implementation in 1.3 back to iptables`` -* :vytask:`T3776` ``(default): Rename FRR daemon restart op-mode commands`` -* :vytask:`T3779` ``(feature): Backport all 1.4 IS-IS features and configuration to 1.3 except VRF`` - - -2021-08-25 -========== - -* :vytask:`T3773` ``(bug): Delete the "show system integrity" command (to prepare for a re-implementation)`` -* :vytask:`T1514` ``(default): Add ability to restart frr processes`` - - -2021-08-24 -========== - -* :vytask:`T3772` ``(bug): VRRP virtual interfaces are not shown in show interfaces`` - - -2021-08-23 -========== - -* :vytask:`T2555` ``(bug): XML op-mode generation scripts silently discard XML nodes`` - - -2021-08-21 -========== - -* :vytask:`T3682` ``(bug): Remove running dhclient from ether-resume.py`` - - -2021-08-20 -========== - -* :vytask:`T1950` ``(default): Store VyOS configuration syntax version data in JSON file`` - - -2021-08-19 -========== - -* :vytask:`T2759` ``(bug): validate-value prints error messages from validators that fail even if overall validation succeeds`` -* :vytask:`T3234` ``(bug): multi_to_list fails in certain cases, with root cause an element redundancy in XML interface-definitions`` -* :vytask:`T3732` ``(feature): override-default helper should support adding defaultValues to default less nodes`` -* :vytask:`T1962` ``(default): Add syntax version to schema`` - - -2021-08-17 -========== - -* :vytask:`T2525` ``(bug): OSPFv3 missing route map, not establishing`` -* :vytask:`T508` ``(bug): ISC DHCP incorrect UDP checksum generation`` -* :vytask:`T1643` ``(bug): Deleting all firewall zones failed and locked out box`` -* :vytask:`T1550` ``(bug): Add support for Large BGP Community show commands`` - - -2021-08-16 -========== - -* :vytask:`T3738` ``(default): openvpn fails if server and authentication are configured`` -* :vytask:`T1594` ``(bug): l2tpv3 error on IPv6 local-ip`` - - -2021-08-15 -========== - -* :vytask:`T3756` ``(default): VyOS generates invalid QR code for wireguard clients`` - - -2021-08-14 -========== - -* :vytask:`T3745` ``(feature): op-mode IPSec show vpn ipse sa sorting`` -* :vytask:`T521` ``(bug): Network services may fail if vyatta-router.service startup takes longer than a few seconds`` - - -2021-08-13 -========== - -* :vytask:`T3740` ``(bug): HTTPs API breaks when the address is IPv6`` - - -2021-08-12 -========== - -* :vytask:`T3731` ``(bug): verify_accel_ppp_base_service return wrong config error for SSP`` -* :vytask:`T3405` ``(feature): PPPoE server unit-cache`` -* :vytask:`T2432` ``(default): dhcpd: Can't create new lease file: Permission denied`` -* :vytask:`T3746` ``(feature): Inform users logging into the system about a pending reboot`` -* :vytask:`T3744` ``(default): Dns forwarding statistics formatting missing a new line`` - - -2021-08-10 -========== - -* :vytask:`T3730` ``(bug): op-mode conntrack-sync miss some functions`` - - -2021-08-09 -========== - -* :vytask:`T1501` ``(bug): VPN Commit Errors`` - - -2021-08-08 -========== - -* :vytask:`T2027` ``(bug): get_config_dict is failing when the configuration section is empty/missing`` -* :vytask:`T169` ``(feature): Image install should put correct serial console device in created GRUB menu entry`` - - -2021-08-07 -========== - -* :vytask:`T548` ``(feature): BGP IPv6 multipath support`` - - -2021-08-06 -========== - -* :vytask:`T1153` ``(bug): VyOS 1.2.0RC10, RAID-1, fresh install, unable to save config`` - - -2021-08-05 -========== - -* :vytask:`T696` ``(feature): Rewrite conntrack sync to XML`` - - -2021-08-04 -========== - -* :vytask:`T3704` ``(feature): Add ability to interact with Areca RAID adapers`` -* :vytask:`T320` ``(default): OSPF does not redistribute connected routes associated with virtual tunnel interfaces`` - - -2021-08-02 -========== - -* :vytask:`T2623` ``(bug): Creating sit tunnel fails with “Can not set “local” for tunnel sit tun1 at tunnel creation”`` -* :vytask:`T2161` ``(default): snmpd cannot start if ipv6 disabled`` -* :vytask:`T3601` ``(default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.`` - - -2021-08-01 -========== - -* :vytask:`T3707` ``(bug): Ping incorrect ip host checks`` - - -2021-07-31 -========== - -* :vytask:`T3716` ``(feature): Linux kernel parameters ignore_routes_with_link_down- ignore disconnected routing connections`` -* :vytask:`T1626` ``(bug): BGP exchanges prefixes without specified address-family`` - - -2021-07-30 -========== - -* :vytask:`T1176` ``(default): FRR - BGP replicating routes`` -* :vytask:`T1123` ``(bug): Inconsistency in community-list naming validation`` - - -2021-07-29 -========== - -* :vytask:`T2931` ``(bug): Unicode decode error causes vyos.configd service to restart`` -* :vytask:`T2727` ``(bug): Add a dotted decimal value validator`` -* :vytask:`T2328` ``(default): dhcpv6 server not starting (disable check reversed?)`` -* :vytask:`T1758` ``(default): Switch vyos.config to libvyosconfig`` -* :vytask:`T954` ``(bug): Using the 10.255.255.0/24 subnet on other interfaces breaks L2TP/IPSec`` - - -2021-07-23 -========== - -* :vytask:`T3699` ``(bug): login: verify selected "system login user" name is not already used by the base system.`` - - -2021-07-21 -========== - -* :vytask:`T3689` ``(bug): static ipv6 route doesn't deleted in some cases`` -* :vytask:`T3685` ``(feature): IPv6 PBR doesn't allow setting of an egress interface`` - - -2021-07-20 -========== - -* :vytask:`T3691` ``(bug): GRETAP: key is not applied when interface is created`` - - -2021-07-13 -========== - -* :vytask:`T3679` ``(default): Point the unexpected exception message link to the new rolling release location`` - - -2021-07-11 -========== - -* :vytask:`T3665` ``(bug): Missing VRF support for VxLAN but already documented`` - - -2021-07-06 -========== - -* :vytask:`T3660` ``(feature): Conntrack-Sync configuration command to specify destination udp port for peer`` - - -2021-07-01 -========== - -* :vytask:`T3658` ``(feature): Add support for dhcpdv6 fixed-prefix6`` - - -2021-06-29 -========== - -* :vytask:`T3593` ``(bug): PPPoE server called-sid format does not work`` - - -2021-06-25 -========== - -* :vytask:`T3650` ``(bug): OpenVPN: Upgrade package to 2.5.1 before releasing VyOS 1.3.0`` -* :vytask:`T3649` ``(feature): Add bonding additional hash-policy`` - - -2021-06-24 -========== - -* :vytask:`T2722` ``(bug): get_config_dict() and key_mangling=('-', '_') will alter CLI data for tagNodes`` - - -2021-06-22 -========== - -* :vytask:`T3629` ``(bug): IPoE server shifting address in the range`` - - -2021-06-20 -========== - -* :vytask:`T3637` ``(bug): vrf: bind-to-all didn't work properly`` - - -2021-06-19 -========== - -* :vytask:`T3633` ``(feature): Add LRO offload for interface ethernet`` - - -2021-06-17 -========== - -* :vytask:`T3631` ``(feature): route-map: migrate "set extcommunity-rt" and "set extcommunity-soo" to "set extcommunity rt|soo" to match FRR syntax`` - - -2021-06-16 -========== - -* :vytask:`T2425` ``(feature): Rewrite all policy zebra filters to XML/Python style`` -* :vytask:`T3630` ``(feature): op-mode: add "show version kernel" command`` - - -2021-06-13 -========== - -* :vytask:`T3620` ``(feature): Rename WWAN interface from wirelessmodem to wwan to use QMI interface`` -* :vytask:`T3622` ``(feature): WWAN: add support for APN authentication`` -* :vytask:`T3621` ``(bug): PPPoE interface does not validate if password is supplied when username is set`` - - -2021-06-10 -========== - -* :vytask:`T3250` ``(bug): PPPoE server: wrong local usernames`` -* :vytask:`T3138` ``(bug): ddclient improperly updated when apply rfc2136 config`` -* :vytask:`T2645` ``(default): Editing route-map action requires adding a new rule`` - - -2021-06-09 -========== - -* :vytask:`T3602` ``(bug): Renaming BGP Peer Groups Leaves Router Broken`` -* :vytask:`T2916` ``(bug): A state of VTI interface in a configuration does not being processing properly`` - - -2021-06-08 -========== - -* :vytask:`T3605` ``(default): Allow to set prefer-global for ipv6-next-hop`` -* :vytask:`T3607` ``(feature): [route-map] set ipv6 next-hop prefer-global`` - - -2021-06-07 -========== - -* :vytask:`T3581` ``(bug): Incomplete command `show ipv6 ospfv3 linkstate``` -* :vytask:`T3516` ``(bug): FRR 7.5 adds a second route when you attempt to change a static route distance instead of overwriting the old route`` -* :vytask:`T3461` ``(bug): OpenConnect Server redundancy check`` -* :vytask:`T3455` ``(bug): system users can not be added in "edit"`` - - -2021-06-04 -========== - -* :vytask:`T3592` ``(feature): Set default TTL 64 for tunnels`` - - -2021-06-01 -========== - -* :vytask:`T406` ``(bug): VPN configuration error: IPv6 over IPv4 IPsec is not supported when using IPv6 ONLY tunnel.`` - - -2021-05-30 -========== - -* :vytask:`T1866` ``(bug): Commit archive over SFTP doesn't work with non-standard ports`` -* :vytask:`T3589` ``(feature): op-mode: support clearing out logfiles from CLI`` -* :vytask:`T3508` ``(bug): Check if there's enough drive space for an upgrade before downloading an image`` -* :vytask:`T1506` ``(enhancment): commit-archive scp/sftp public key authentication`` - - -2021-05-29 -========== - -* :vytask:`T3135` ``(bug): BFD configurations fail to be applied`` -* :vytask:`T3103` ``(default): Rewrite parts of vyos\frr.py for readability, logging and to fix mulitiline regex "bugs"`` -* :vytask:`T2739` ``(default): vyos-utils is not compiled with a Jenkins pipeline.`` -* :vytask:`T2451` ``(bug): Cannot use !tcp or !tcp_udp while adding firewall rule`` -* :vytask:`T2436` ``(default): equuleus: Testing: vyos-1x: syntax checking Python scripts in PR`` -* :vytask:`T2184` ``(bug): OpenVPN op_mode tools broken`` -* :vytask:`T1944` ``(bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure of Zebra`` - - -2021-05-28 -========== - -* :vytask:`T1579` ``(feature): Rewrite all interface types in new XML/Python style`` - - -2021-05-27 -========== - -* :vytask:`T2629` ``(bug): VXLAN interfaces don't actually allow you to configure most settings`` -* :vytask:`T2617` ``(feature): Rewrite vyatta-op-quagga "show" to XML`` -* :vytask:`T2512` ``(feature): vyatta-op-quagga [show ip] to XML format`` -* :vytask:`T1905` ``(default): Update to Keepalived 2.0.19`` -* :vytask:`T2669` ``(bug): DHCP-server overlapping ranges.`` - - -2021-05-26 -========== - -* :vytask:`T3558` ``(default): autocomplete options for dhcp-interface is not showing for the static route command`` -* :vytask:`T3540` ``(bug): Keepalived memory utilisation issue when constantly getting its state in JSON format`` -* :vytask:`T2807` ``(feature): IPv6 Link-Local Address - Automatically generation/configuration on GRE Interfaces`` - - -2021-05-24 -========== - -* :vytask:`T3575` ``(bug): pseudo-ethernet: must check source-interface MTU`` -* :vytask:`T3571` ``(bug): Broken Show Tab Complete`` -* :vytask:`T3576` ``(bug): ISIS does not support IPV6`` - - -2021-05-23 -========== - -* :vytask:`T3570` ``(default): Prevent setting of a larger MTU on child interfaces`` -* :vytask:`T3572` ``(feature): Basic Drive Diagnostic Tools`` - - -2021-05-20 -========== - -* :vytask:`T3554` ``(feature): Add area-type stub for ospfv3`` - - -2021-05-19 -========== - -* :vytask:`T3562` ``(feature): Update Accel-PPP to a newer revision`` -* :vytask:`T3559` ``(feature): Add restart op-command for OpenConnect Server`` - - -2021-05-18 -========== - -* :vytask:`T3525` ``(default): VMWare resume script syntax errors`` -* :vytask:`T2462` ``(default): LLDP op-mode exception: IndexError: list index out of range`` - - -2021-05-15 -========== - -* :vytask:`T3549` ``(bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not correctly exported to dhcpdv6.conf when multiple name-server entries are present`` -* :vytask:`T3532` ``(bug): Not possible to change ethertype after interface creation`` -* :vytask:`T3550` ``(bug): Router-advert completion typo`` -* :vytask:`T3547` ``(feature): conntrackd: remove deprecated config options`` -* :vytask:`T3535` ``(feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor`` -* :vytask:`T2049` ``(feature): Update strongSwan cipher suites list for IPSec settings`` - - -2021-05-14 -========== - -* :vytask:`T3346` ``(bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node exists but there are no rules`` -* :vytask:`T3248` ``(default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3`` -* :vytask:`T3426` ``(default): add support for script arguments to vyos-configd`` - - -2021-05-13 -========== - -* :vytask:`T3544` ``(feature): DHCP server should validate configuration before applying it`` -* :vytask:`T3543` ``(feature): Support for setting lacp_rate on LACP bonded interfaces`` - - -2021-05-12 -========== - -* :vytask:`T3302` ``(default): Make vyos-configd relay stdout from scripts to the user's console`` - - -2021-05-11 -========== - -* :vytask:`T3526` ``(bug): Smoketest policy fail in CI`` - - -2021-05-10 -========== - -* :vytask:`T3528` ``(bug): Frr 7.5.1 uses 'seq' for community-lists`` - - -2021-05-08 -========== - -* :vytask:`T3517` ``(bug): FRR 7.5 bfd behavior for 1.3`` - - -2021-05-07 -========== - -* :vytask:`T1171` ``(bug): 1.2.0 epa2 - IPsec VPN initiation`` - - -2021-05-06 -========== - -* :vytask:`T3519` ``(bug): Cannot add / assign L2TPv3 to vrf`` - - -2021-05-01 -========== - -* :vytask:`T3379` ``(feature): Add global-parameters name-server for dhcpv6-server`` -* :vytask:`T3491` ``(default): Change Kernel HZ to 1000`` - - -2021-04-30 -========== - -* :vytask:`T3170` ``(default): Add a sanity check for empty node.def files`` - - -2021-04-29 -========== - -* :vytask:`T3502` ``(bug): "system ip multipath layer4-hashing" doesn't work`` -* :vytask:`T3029` ``(bug): Generated NGINX configuration is wrong for the redirection (http -> https)`` -* :vytask:`T3156` ``(feature): Add op and additional conf commands for ISIS`` -* :vytask:`T2012` ``(feature): Global PBR`` -* :vytask:`T1314` ``(feature): Allow BGP on unnumbered interfaces`` - - -2021-04-27 -========== - -* :vytask:`T2946` ``(bug): Calling 'stty_size' causes show interfaces API to fail`` - - -2021-04-25 -========== - -* :vytask:`T3468` ``(bug): Tunnel interfaces aren't suggested as being available for bridging (regression)`` -* :vytask:`T1802` ``(feature): Wireguard QR code in cli for mobile devices`` - - -2021-04-23 -========== - -* :vytask:`T3290` ``(bug): Disabling GRE conntrack module fails`` - - -2021-04-18 -========== - -* :vytask:`T3481` ``(default): Exclude tag node values from key mangling`` -* :vytask:`T3475` ``(bug): XML dictionary cache unable to process syntaxVersion elements`` - - -2021-04-15 -========== - -* :vytask:`T3386` ``(bug): PPPoE-server don't start with local authentication`` - - -2021-04-14 -========== - -* :vytask:`T3055` ``(bug): op-mode incorrect naming for ipsec policy-based tunnels`` - - -2021-04-12 -========== - -* :vytask:`T3454` ``(enhancment): dhclient reject option`` - - -2021-04-05 -========== - -* :vytask:`T1612` ``(default): dhcp-server time-offset fails to validate`` -* :vytask:`T3438` ``(bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf from the operating system`` -* :vytask:`T3418` ``(bug): BGP: system wide known interface can not be used as neighbor`` - - -2021-04-04 -========== - -* :vytask:`T3457` ``(feature): Output the "monitor log" command in a colorful way`` - - -2021-03-31 -========== - -* :vytask:`T3445` ``(bug): vyos-1x build include not all nodes`` - - -2021-03-25 -========== - -* :vytask:`T2639` ``(feature): sort output of show vpn ipsec sa`` - - -2021-03-22 -========== - -* :vytask:`T3284` ``(bug): merge/load fail silently if unable to resolve host`` - - -2021-03-21 -========== - -* :vytask:`T3416` ``(bug): NTP: when running inside a VRF op-mode commands do not work`` - - -2021-03-20 -========== - -* :vytask:`T3392` ``(bug): vrrp over dhcp default route bug (unexpected vrf)`` -* :vytask:`T3373` ``(feature): Upgrade to SaltStack version 3002.5`` -* :vytask:`T3329` ``(default): "system conntrack ignore" rules can no longer be created due to an iptables syntax change`` -* :vytask:`T3300` ``(feature): Add DHCP default route distance`` -* :vytask:`T3306` ``(feature): Extend set route-map aggregator as to 4 Bytes`` - - -2021-03-18 -========== - -* :vytask:`T3411` ``(default): Extend the redirect_stdout context manager in vyos-configd to redirect stdout from subprocesses`` -* :vytask:`T3271` ``(bug): qemu-kvm grub issue`` - - -2021-03-17 -========== - -* :vytask:`T3413` ``(bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP address string passed to inet_pton"`` - - -2021-03-14 -========== - -* :vytask:`T2271` ``(feature): OSPF: add per VRF instance support`` -* :vytask:`T175` ``(feature): Add source route option to VTI interfaces`` - - -2021-03-13 -========== - -* :vytask:`T3406` ``(bug): tunnel: interface no longer supports specifying encaplimit none - or migrator is missing`` -* :vytask:`T3407` ``(bug): console-server: do not allow to spawn a console-server session on serial port used by "system console"`` - - -2021-03-11 -========== - -* :vytask:`T3399` ``(bug): RPKI: dashes in hostnames are replaced with underscores when rendering the FRR config`` -* :vytask:`T3305` ``(bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot`` -* :vytask:`T2927` ``(bug): isc-dhcpd release and expiry events never execute`` -* :vytask:`T899` ``(bug): Tunnels cannot be moved from one bridge to another`` -* :vytask:`T786` ``(feature): new style xml and conf-mode scripts: posibillity to add tagNode value as parameter to conf-script`` - - -2021-03-09 -========== - -* :vytask:`T3382` ``(bug): Error creating Console Server`` - - -2021-03-08 -========== - -* :vytask:`T3387` ``(bug): Command "Monitor vpn ipsec" is not working`` - - -2021-03-07 -========== - -* :vytask:`T3319` ``(bug): VXLAN uses ttl 1 (auto) by default`` -* :vytask:`T3391` ``(feature): Add CLI support for specifying maximum-paths per address family ipv4 unicast and ipv6 unicast`` -* :vytask:`T3211` ``(feature): ability to redistribute ISIS into other routing protocols`` - - -2021-03-05 -========== - -* :vytask:`T2659` ``(feature): Add fastnetmon (DDoS detection) support`` - - -2021-03-04 -========== - -* :vytask:`T2861` ``(bug): route-map "set community additive" not working correctly`` - - -2021-03-03 -========== - -* :vytask:`T2966` ``(feature): tunnel: add new encapsulation types ip6tnl and ip6gretap`` - - -2021-03-01 -========== - -* :vytask:`T3342` ``(bug): On xen-netback interfaces must set "scattergather" offload before MTU>1500`` - - -2021-02-28 -========== - -* :vytask:`T3370` ``(bug): dhcp: Invalid domain name "private"`` -* :vytask:`T3369` ``(feature): VXLAN: add IPv6 underlay support`` - - -2021-02-27 -========== - -* :vytask:`T2291` ``(bug): Bad hostnames in /etc/hosts with static-mapping in dhcp server config`` -* :vytask:`T3364` ``(feature): tunnel: cleanup/rename CLI nodes`` -* :vytask:`T3368` ``(feature): macsec: add support for gcm-aes-256 cipher`` -* :vytask:`T3366` ``(bug): tunnel: can not change local / remote ip address for gre-bridge tunnel`` -* :vytask:`T3173` ``(feature): Need 'nopmtudisc' option for tunnel interface`` - - -2021-02-26 -========== - -* :vytask:`T3357` ``(default): HTTP-API redirect from http correct https port`` - - -2021-02-24 -========== - -* :vytask:`T3303` ``(feature): Change welcome message on boot`` - - -2021-02-21 -========== - -* :vytask:`T3163` ``(feature): ethernet ring-buffer can be set with an invalid value`` - - -2021-02-19 -========== - -* :vytask:`T3326` ``(bug): OSPFv3: Cannot add L2TPv3 interface`` - - -2021-02-18 -========== - -* :vytask:`T3259` ``(default): many dnat rules makes the vyos http api crash, even showConfig op timeouts`` - - -2021-02-17 -========== - -* :vytask:`T3047` ``(bug): OSPF : virtual-link and passive-interface default parameters does not work together`` -* :vytask:`T3312` ``(feature): SolarFlare NICs support`` - - -2021-02-16 -========== - -* :vytask:`T3318` ``(feature): Update Linux Kernel to v5.4.208 / 5.10.142`` - - -2021-02-14 -========== - -* :vytask:`T2152` ``(bug): ddclient has bug which prevents use_web from being used`` -* :vytask:`T3308` ``(feature): BGP: add gracefull shutdown support`` - - -2021-02-13 -========== - -* :vytask:`T3028` ``(feature): Create a default user when metadata is not available (for Cloud-init builds)`` -* :vytask:`T2867` ``(feature): Cleanup DataSourceOVF.py in the Cloud-init`` -* :vytask:`T2726` ``(feature): Allow to use all supported SSH key types in Cloud-init`` -* :vytask:`T2403` ``(feature): Full support for networking config in Cloud-init`` -* :vytask:`T2387` ``(feature): Create XML scheme for [conf_mode] BGP`` -* :vytask:`T2174` ``(feature): Rewrite protocol BGP to new XML/Python style`` -* :vytask:`T1987` ``(bug): A default route can be deleted by dhclient-script in some cases`` -* :vytask:`T723` ``(feature): Add support for first boot or installation time saved config modification`` -* :vytask:`T1775` ``(bug): Cloud-init not running userdata runcmd`` -* :vytask:`T1389` ``(feature): Add support for NoCloud cloud-init datasource`` -* :vytask:`T1315` ``(feature): Allow BGP to use address-family l2vpn evpn`` - - -2021-02-11 -========== - -* :vytask:`T2638` ``(default): FRR: New framework for configuring FRR`` - - -2021-02-08 -========== - -* :vytask:`T3295` ``(feature): Update Linux Kernel to v5.4.96 / 5.10.14`` - - -2021-02-07 -========== - -* :vytask:`T3293` ``(bug): RPKI migration script errors out after CLI rewrite`` - - -2021-02-06 -========== - -* :vytask:`T3285` ``(feature): Schedule reboots through systemd-shutdownd instead of atd`` -* :vytask:`T661` ``(feature): Show a warning if the router is going to reboot soon (due to "commit-confirm" command)`` - - -2021-02-05 -========== - -* :vytask:`T2450` ``(feature): Rewrite "protocols vrf" tree in XML and Python`` -* :vytask:`T208` ``(feature): Ability to ignore default-route from dhcpcd per interface`` - - -2021-02-03 -========== - -* :vytask:`T3239` ``(default): XML: override 'defaultValue' for mtu of certain interfaces; remove workarounds`` -* :vytask:`T2910` ``(feature): XML: generator should support override of variables`` -* :vytask:`T2873` ``(bug): "show nat destination translation address" doesn't filter at all`` - - -2021-02-02 -========== - -* :vytask:`T3018` ``(bug): Unclear behaviour when configuring vif and vif-s interfaces`` -* :vytask:`T3255` ``(default): Rewrite protocol RPKI to new XML/Python style`` - - -2021-02-01 -========== - -* :vytask:`T3268` ``(feature): Add VRF support to VIF-S interfaces`` -* :vytask:`T3274` ``(default): ask_yes_no() doesn't handle EOFError`` - - -2021-01-31 -========== - -* :vytask:`T3276` ``(feature): Update Linux Kernel to v5.4.94 / 5.10.12`` - - -2021-01-30 -========== - -* :vytask:`T3269` ``(bug): VIF-C interfaces don't verify configuration`` -* :vytask:`T3240` ``(feature): Support per-interface DHCPv6 DUIDs`` -* :vytask:`T3273` ``(default): PPPoE static default-routes deleted on interface down when not added by interface up`` - - -2021-01-29 -========== - -* :vytask:`T3262` ``(bug): DHCPv6 client runs when dhcpv6-options is configured without requesting an address or PD`` -* :vytask:`T3261` ``(bug): Does not possible to disable pppoe client interface.`` - - -2021-01-27 -========== - -* :vytask:`T3257` ``(feature): tcpdump supporting complete protocol`` -* :vytask:`T3110` ``(bug): Broken pipe in show interfaces`` -* :vytask:`T651` ``(enhancment): Split CI'ed, VyOS-specific packages and other packages into separate repos`` -* :vytask:`T597` ``(enhancment): Code testing on sonarcloud.com`` -* :vytask:`T516` ``(default): Make Python / XML code development more testable`` -* :vytask:`T625` ``(default): Lack of IKEv1 lifetime negotiation`` -* :vytask:`T613` ``(bug): Missing linux-kbuild`` -* :vytask:`T505` ``(bug): Hostapd cannot log`` - - -2021-01-26 -========== - -* :vytask:`T3251` ``(bug): PPPoE client trying to authorize with the wrong username`` -* :vytask:`T2859` ``(bug): show nat source translation - Errors out`` - - -2021-01-25 -========== - -* :vytask:`T3249` ``(feature): Support operation mode forwarding table output`` - - -2021-01-24 -========== - -* :vytask:`T3230` ``(bug): RPKI can't be deleted`` -* :vytask:`T3243` ``(feature): Update Linux Kernel to v5.4.92 / 5.10.10`` - - -2021-01-18 -========== - -* :vytask:`T2761` ``(feature): Extend "show vrrp" op-mode command with router priority`` -* :vytask:`T2679` ``(feature): VRRP with BFD Failure Detection`` -* :vytask:`T3212` ``(bug): SSH: configuration directory is not always created on boot`` -* :vytask:`T3231` ``(bug): "system option ctrl-alt-delete" has no effect`` - - -2021-01-17 -========== - -* :vytask:`T3222` ``(bug): Typo in BGP dampening description`` -* :vytask:`T2944` ``(bug): NTP by default listen on any address/interface`` -* :vytask:`T3226` ``(bug): Repair bridge smoke test damage`` -* :vytask:`T2442` ``(enhancment): Move application of STP settings for bridge members from interfaces-bridge.py to Interface.add_to_bridge()`` -* :vytask:`T2381` ``(bug): OpenVPN: openvpn-option parsed/rendered improperly`` - - -2021-01-16 -========== - -* :vytask:`T3215` ``(bug): Operational command "show ipv6 route" is broken`` -* :vytask:`T3172` ``(bug): Builds sometime after 2020-12-17 have broken routing after reboot`` -* :vytask:`T3157` ``(bug): salt-minion fails to start due to permission error accessing /root/.salt/minion.log`` -* :vytask:`T3167` ``(default): Recurring bugs in Intel NIC drivers`` -* :vytask:`T3151` ``(default): Decide on the final list of packages for 1.3`` -* :vytask:`T3137` ``(feature): Let VLAN aware bridge approach the behavior of professional equipment`` -* :vytask:`T3223` ``(feature): Update Linux Kernel to v5.4.89 / 5.10.7`` - - -2021-01-15 -========== - -* :vytask:`T3210` ``(feature): ISIS three-way-handshake`` -* :vytask:`T3184` ``(feature): Add correct desctiptions for BGP neighbors`` -* :vytask:`T2850` ``(feature): Add BGP template for FRR`` - - -2021-01-14 -========== - -* :vytask:`T3218` ``(feature): Replace Intel out-of-tree drivers with Linux Kernel stock drivers.`` - - -2021-01-13 -========== - -* :vytask:`T3186` ``(bug): NAT: Commit failed when applying negated(!) addresses`` - - -2021-01-12 -========== - -* :vytask:`T3205` ``(bug): Does not possible to configure tunnel mode gre-bridge`` - - -2021-01-11 -========== - -* :vytask:`T3208` ``(bug): Does not possible to change user password`` -* :vytask:`T3198` ``(bug): OSPF database filtering issue`` -* :vytask:`T3206` ``(bug): Unable to delete destination NAT rule`` -* :vytask:`T3193` ``(bug): DHCPv6 PD verification issues`` -* :vytask:`T3201` ``(bug): Operational command "show log all" is not working for RADIUS users`` - - -2021-01-10 -========== - -* :vytask:`T3178` ``(feature): Migrate vyatta-op-quagga to vyos-1x`` - - -2021-01-09 -========== - -* :vytask:`T2467` ``(bug): Restarting flow accounting fails with systemd error`` -* :vytask:`T3199` ``(feature): Update Linux Kernel to v5.4.88 / 5.10.6`` - - -2021-01-07 -========== - -* :vytask:`T3192` ``(feature): login: radius: add support for IPv6 RADIUS servers`` - - -2021-01-05 -========== - -* :vytask:`T3169` ``(enhancment): Reimplement smoke test of span (mirror)`` -* :vytask:`T3161` ``(default): Consider removing ConfigLoad.pm`` -* :vytask:`T1398` ``(default): Remove vyatta-config-migrate package`` -* :vytask:`T805` ``(enhancment): Drop config compatibility with Vyatta Core older than 6.5`` - - -2021-01-04 -========== - -* :vytask:`T3185` ``(bug): [conf-mode] Wrong CompletionHelp for Tunnel local-ip`` -* :vytask:`T2601` ``(bug): pppoe-server: Cannot disable CCP`` - - -2021-01-03 -========== - -* :vytask:`T3180` ``(bug): DHCP server raises NameError`` - - -2021-01-02 -========== - -* :vytask:`T2321` ``(feature): VRF support for SSH, NTP, SNMP service`` -* :vytask:`T3177` ``(bug): Rolling Release no longer reports VMware UUID`` - - -2021-01-01 -========== - -* :vytask:`T3171` ``(feature): Add CLI option to enable RPS (Receive Packet Steering)`` - - -2020-12-31 -========== - -* :vytask:`T3162` ``(bug): Wrong PPPoE server pado-delay parameter added to config`` -* :vytask:`T3160` ``(bug): PPPoE server called-sid option defined in wrong section`` -* :vytask:`T3168` ``(feature): Update Linux Kernel to v5.4.86`` - - -2020-12-29 -========== - -* :vytask:`T3082` ``(bug): multi_to_list must distinguish between values and defaults`` -* :vytask:`T1466` ``(feature): Add EAPOL login support`` - - -2020-12-28 -========== - -* :vytask:`T1732` ``(feature): Removing vyatta-webproxy module`` -* :vytask:`T2666` ``(feature): Packet Processing with eBPF and XDP`` -* :vytask:`T2581` ``(default): webproxy: implement proxy chaining`` -* :vytask:`T563` ``(feature): webproxy: migrate 'service webproxy' to get_config_dict()`` - - -2020-12-27 -========== - -* :vytask:`T3150` ``(bug): When configuring QoS, the setting procedure of port mirroring is wrong`` - - -2020-12-23 -========== - -* :vytask:`T3143` ``(bug): OpenVPN server: Push route config format is wrong`` -* :vytask:`T3146` ``(feature): Upgrade FRR from 7.4 -> 7.5 version incl. new libyang`` -* :vytask:`T3145` ``(feature): Update Linux Kernel to v5.4.85`` -* :vytask:`T3147` ``(feature): Upgrade to SaltStack version 3002.2`` - - -2020-12-22 -========== - -* :vytask:`T3142` ``(bug): OpenVPN op-command completion fails due to missing status file`` -* :vytask:`T2940` ``(feature): Update FRR to 7.4`` -* :vytask:`T2573` ``(bug): BFD op-mode commands are broken`` -* :vytask:`T2495` ``(feature): Add xml for ISIS [conf_mode]`` -* :vytask:`T1316` ``(feature): Support for IS-IS`` - - -2020-12-21 -========== - -* :vytask:`T2619` ``(bug): Bug: Changes in NAT or ZONES from 1.2 to 1.3`` - - -2020-12-20 -========== - -* :vytask:`T3131` ``(bug): Typo in ipsec preshared-secret help`` -* :vytask:`T3134` ``(bug): DHCPv6 DUID configuration node missing`` -* :vytask:`T3140` ``(feature): Relax "ethernet offload-options" CLI definition`` -* :vytask:`T3132` ``(feature): Enable egress flow accounting`` - - -2020-12-17 -========== - -* :vytask:`T2810` ``(default): Docs for vpn anyconnect-server`` -* :vytask:`T2036` ``(default): Open Connect VPN Server () support`` - - -2020-12-14 -========== - -* :vytask:`T3128` ``(bug): pppoe smoke test failed`` -* :vytask:`T3129` ``(feature): Update Linux Kernel to v5.4.83`` -* :vytask:`T3089` ``(feature): Migrate port mirroring to vyos-1x and support two-way traffic mirroring`` -* :vytask:`T3130` ``(feature): Replace vyos-netplug with upstream debian version`` - - -2020-12-13 -========== - -* :vytask:`T3114` ``(bug): When the bridge member is a non-ethernet interface, setting VLAN-aware bridge parameters fails`` - - -2020-12-11 -========== - -* :vytask:`T3123` ``(bug): Configuration of vti interface impossible`` - - -2020-12-10 -========== - -* :vytask:`T3117` ``(bug): OpenVPN config migration errors upgrading from 1.3-rolling-202010280217 to 1.3-rolling-202012060217`` - - -2020-12-09 -========== - -* :vytask:`T3122` ``(feature): Update Linux Kernel to v4.19.162`` -* :vytask:`T3121` ``(bug): get_config_dict() and key_mangling=('-', '_') Broke PowerDNS dns_forwarding config file`` - - -2020-12-08 -========== - -* :vytask:`T2562` ``(bug): VyOS can't be used as a DHCP server for a DHCP relay`` - - -2020-12-07 -========== - -* :vytask:`T3120` ``(bug): Python error when deleting nat rule`` -* :vytask:`T3119` ``(feature): migrate "system ip" to get_config_dict() and provide smoketest`` - - -2020-12-05 -========== - -* :vytask:`T2744` ``(bug): igmp-proxy issue: Address already in use`` - - -2020-12-04 -========== - -* :vytask:`T3108` ``(bug): Section config overlapped match with FRRConfig`` -* :vytask:`T3112` ``(feature): PPPoE IPv6: remove "enable" node`` -* :vytask:`T3100` ``(feature): Migrate DHCP/DHCPv6 server to get_config_dict()`` - - -2020-12-03 -========== - -* :vytask:`T3105` ``(bug): static-host-mapping writing in one line`` -* :vytask:`T3107` ``(feature): Update Linux Kernel to v4.19.161`` -* :vytask:`T3104` ``(bug): LLDP Traceback error`` - - -2020-12-01 -========== - -* :vytask:`T3102` ``(bug): Destination NAT fails to commit`` -* :vytask:`T2713` ``(bug): VyOS must not change permissions on files in /config/auth`` - - -2020-11-30 -========== - -* :vytask:`T3091` ``(feature): Add "tag" for static route`` -* :vytask:`T1207` ``(feature): DMVPN behind NAT`` - - -2020-11-29 -========== - -* :vytask:`T3095` ``(feature): Migrate dhcp-relay and dhcpv6-relay to get_config_dict()`` - - -2020-11-28 -========== - -* :vytask:`T2890` ``(bug): NAT error adding translation address range`` -* :vytask:`T2868` ``(bug): Tcp-mss option in policy calls kernel-panic`` -* :vytask:`T3092` ``(feature): nat: migrate to get_config_dict()`` - - -2020-11-27 -========== - -* :vytask:`T2715` ``(feature): Duplicate address detection option supporting ARP`` -* :vytask:`T2714` ``(feature): A collection of utilities supporting IPv6 or ipv4`` -* :vytask:`T3088` ``(feature): Migrate IGMP-Proxy over to get_config_dict() and add smoketests`` - - -2020-11-24 -========== - -* :vytask:`T3087` ``(feature): Update Linux Kernel to v4.19.160`` - - -2020-11-23 -========== - -* :vytask:`T2177` ``(default): Commit fails on adding disabled interface to bridge`` -* :vytask:`T3066` ``(bug): reboot in - Invalid time`` -* :vytask:`T2802` ``(bug): Tunnel interface does not apply EUI-64 IPv6 Address`` -* :vytask:`T2359` ``(bug): Adding IPIP6 tun interface to bridge [conf_mode] errors`` -* :vytask:`T2357` ``(bug): GRE-bridge conf_mode errors`` -* :vytask:`T2259` ``(feature): Support for bind vif-c interfaces into VRFs`` -* :vytask:`T2205` ``(bug): "set interface ethernet" fails on Hyper-V`` -* :vytask:`T2182` ``(bug): Failure to commit an IPv6 address on a tunnel interface`` -* :vytask:`T2155` ``(bug): Cannot set anything on Intel 82599ES 10-Gigabit SFI/SFP+`` -* :vytask:`T2153` ``(bug): traceroute circular reference`` -* :vytask:`T3081` ``(bug): get_config_dict() does not honor whitespaces in the CLI values field`` -* :vytask:`T3080` ``(bug): OpenVPN failing silently for a number of reasons in rolling post Nov/02`` -* :vytask:`T3074` ``(bug): OpenVPN site-to-site creates wrong peer address`` -* :vytask:`T2542` ``(bug): OpenVPN client tap interfaces not coming up`` -* :vytask:`T3084` ``(bug): wifi: TypeError on "show interfaces wireless info"`` - - -2020-11-21 -========== - -* :vytask:`T3079` ``(bug): Fix the problem that VLAN 1 will be deleted in VLAN-aware bridge`` -* :vytask:`T3060` ``(bug): OpenVPN virtual interface not coming up after upgrade`` - - -2020-11-20 -========== - -* :vytask:`T3078` ``(feature): CLI cleanup: rename "system options" -> "system option"`` -* :vytask:`T2997` ``(feature): DHCP: disallow/do-not-request certain options when requesting IP address from server`` -* :vytask:`T3077` ``(feature): WireGuard: automatically create link-local IPv6 adresses`` -* :vytask:`T2550` ``(default): OpenVPN: IPv4 not working in client mode`` -* :vytask:`T3072` ``(feature): Migrate tunnel interfaces to new get_config_dict() approach`` -* :vytask:`T3065` ``(feature): Add "interfaces wirelessmodem" IPv6 support`` -* :vytask:`T3048` ``(feature): Drop static smp-affinity for a more dynamic way using tuned`` - - -2020-11-19 -========== - -* :vytask:`T3067` ``(bug): Wireless interface can no longer be added to the bridge after bridge VLAN support`` -* :vytask:`T3075` ``(feature): Update Linux Kernel to v4.19.158`` - - -2020-11-16 -========== - -* :vytask:`T3003` ``(enhancment): Extend smoketest framework to allow loading an arbitrary config file`` - - -2020-11-15 -========== - -* :vytask:`T3069` ``(bug): OpenVPN routed networks not available`` -* :vytask:`T3038` ``(feature): Supporting AZERTY keyboards`` -* :vytask:`T2993` ``(bug): op-mode: lldp: show lldp neighbors - AttributeError: 'str' object has no attribute 'items'`` - - -2020-11-14 -========== - -* :vytask:`T3041` ``(bug): Intel QAT: vyos-1.3-rolling-202011020217-amd64 kernel panic during configure`` - - -2020-11-13 -========== - -* :vytask:`T3063` ``(feature): Add support for Huawei LTE Module ME909s-120`` -* :vytask:`T3059` ``(bug): L2TPv3 interface: Enforced to shutdown but no command to enable interface permanently`` - - -2020-11-12 -========== - -* :vytask:`T3064` ``(feature): Update Linux Kernel to v4.19.157`` - - -2020-11-10 -========== - -* :vytask:`T2103` ``(bug): Abnormal interface names if VIF present`` - - -2020-11-08 -========== - -* :vytask:`T3050` ``(bug): Broken address/subnet validation on NAT configuration`` - - -2020-11-07 -========== - -* :vytask:`T2914` ``(bug): OpenVPN: Fix for IPv4 remote-host hostname in client mode:`` -* :vytask:`T2653` ``(feature): "set interfaces" Python handler code improvements - next iteration`` -* :vytask:`T311` ``(feature): DHCP: set client-hostname via CLI`` - - -2020-11-06 -========== - -* :vytask:`T3051` ``(bug): OpenVPN: multiple client routes do not work in server mode`` -* :vytask:`T3046` ``(bug): openvpn directory is not auto-created`` -* :vytask:`T3052` ``(feature): Update Linux firmware files to 20201022 version`` -* :vytask:`T2731` ``(bug): "show interfaces" returns invalid state when link is down`` - - -2020-11-05 -========== - -* :vytask:`T3049` ``(feature): Update Linux Kernel to v4.19.155`` -* :vytask:`T2994` ``(feature): Migrate OpenVPN interfaces to get_config_dict() syntax`` - - -2020-11-03 -========== - -* :vytask:`T3043` ``(feature): Wireless: Refactor CLI`` -* :vytask:`T3034` ``(feature): Add WiFi WPA 3 support`` -* :vytask:`T2967` ``(bug): Duplicate IPv6 BFD peers created`` -* :vytask:`T2483` ``(bug): DHCP most likely not restarting pdns_recursor`` - - -2020-11-02 -========== - -* :vytask:`T3024` ``(bug): DHCPv6 PD configuration doesn't really render an expected behavior`` - - -2020-11-01 -========== - -* :vytask:`T3036` ``(feature): OpenVPN remote-address does not accept IPv6 address`` -* :vytask:`T2193` ``(feature): Display disabled VRRP instances in a `show vrrp` output`` - - -2020-10-30 -========== - -* :vytask:`T2790` ``(feature): Add ability to set ipv6 protocol route-map for OSPFv3`` -* :vytask:`T3033` ``(feature): Update Linux Kernel to v4.19.154`` -* :vytask:`T2969` ``(bug): OpenVPN: command_set on interface is not applied, if interface doesn't come up in commit`` - - -2020-10-28 -========== - -* :vytask:`T2631` ``(default): l2tp, sstp, pptp add option to disable radius accounting`` -* :vytask:`T2630` ``(feature): Allow Interface MTU over 9000`` -* :vytask:`T3027` ``(bug): Unable to update system Signature check FAILED`` -* :vytask:`T2995` ``(bug): Enhancements/bugfixes for vyos_dict_search()`` -* :vytask:`T2968` ``(feature): Add support for Intel Atom C2000 series QAT`` - - -2020-10-27 -========== - -* :vytask:`T3026` ``(default): qemu: update script for deprecated ssh_host_port_min/max`` -* :vytask:`T2938` ``(feature): Adding remote Syslog RFC5424 compatibility`` -* :vytask:`T2924` ``(bug): Using 'set src' in a route-map invalidates it as part of a subsequent boot-up`` -* :vytask:`T2587` ``(bug): Cannot enable the interface when the MTU is set to less than 1280`` -* :vytask:`T2885` ``(default): configd: print commit errors to config session terminal`` -* :vytask:`T2808` ``(default): Add smoketest to ensure script consistency with config daemon`` -* :vytask:`T2582` ``(default): Script daemon to offload processing during commit`` -* :vytask:`T1721` ``(bug): Recursive Next Hop not updated for static routes`` - - -2020-10-24 -========== - -* :vytask:`T3007` ``(default): HTTP-API should use config load script, not backend config load`` -* :vytask:`T3009` ``(bug): vpn l2tp remoteaccess require option broken`` -* :vytask:`T3010` ``(bug): ttl option of gre-bridge`` -* :vytask:`T3005` ``(bug): Intel: update out-of-tree drivers, i40e driver warning`` -* :vytask:`T3004` ``(feature): ConfigSession should (optionally) use config load script`` -* :vytask:`T2723` ``(feature): Support tcptraceroute`` - - -2020-10-22 -========== - -* :vytask:`T2978` ``(bug): IPoE service does not work on shared mode`` -* :vytask:`T2906` ``(bug): OpenVPN: tls-auth missing key direction`` - - -2020-10-21 -========== - -* :vytask:`T2828` ``(bug): BGP conf_mode error enforce-first-as`` -* :vytask:`T2749` ``(bug): Setting ethx configuration takes a long time`` -* :vytask:`T2138` ``(default): Can't load archived configs as they are gzipped`` - - -2020-10-20 -========== - -* :vytask:`T2987` ``(bug): VxLAN not working properly after upgrading to latest October build and with a new installation`` -* :vytask:`T2989` ``(default): MPLS documentation expansion`` - - -2020-10-19 -========== - -* :vytask:`T1588` ``(bug): VRRP failed to start if any of its interaces not exist`` -* :vytask:`T1385` ``(feature): Allow bonding interfaces to have pseudo-ethernet interfaces`` -* :vytask:`T3000` ``(bug): Mismatch between "prefix-length" and "preference" in dhcp6-server syntax`` -* :vytask:`T2992` ``(feature): Automatically verify sha256 checksum on ISO download`` -* :vytask:`T752` ``(feature): Add an option to disable IPv4 forwarding on specific interface only`` - - -2020-10-18 -========== - -* :vytask:`T2965` ``(feature): Brief BFD Peer Info`` -* :vytask:`T2907` ``(feature): OpenVPN: Option to disable encryption`` -* :vytask:`T2985` ``(feature): Add glue code to create bridge interface on demand`` - - -2020-10-17 -========== - -* :vytask:`T2980` ``(bug): FRR bfdd crash due to invalid length`` -* :vytask:`T2991` ``(feature): Update WireGuard to 1.0.20200908`` -* :vytask:`T2990` ``(feature): Update Linux Kernel to v4.19.152`` -* :vytask:`T2981` ``(feature): MPLS LDP neighbor session clear capability`` -* :vytask:`T2792` ``(default): Failed to run `sudo make qemu` with vyos-build container due to the change of packer`` - - -2020-10-13 -========== - -* :vytask:`T2976` ``(bug): Client IP pool does not work for PPPoE local users`` - - -2020-10-12 -========== - -* :vytask:`T2951` ``(bug): Cannot enable logging for monitor nat`` -* :vytask:`T2782` ``(bug): Changing timezone, does not restart rsyslog`` - - -2020-10-06 -========== - -* :vytask:`T2957` ``(bug): show openvpn not printing anything`` - - -2020-10-05 -========== - -* :vytask:`T2963` ``(bug): Wireless: WIFI is not password protected when security wpa mode is not defined but passphrase is`` - - -2020-10-04 -========== - -* :vytask:`T2953` ``(feature): Accel-PPP services CLI config cleanup (SSTP, L2TP, PPPoE, IPoE)`` -* :vytask:`T2829` ``(bug): PPPoE server: mppe setting is implemented as node instead of leafNode`` -* :vytask:`T2960` ``(feature): sstp: migrate to get_config_dict()`` - - -2020-10-03 -========== - -* :vytask:`T2956` ``(feature): Add support for list of defaultValues`` -* :vytask:`T2955` ``(feature): Update Linux Kernel to v4.19.149`` - - -2020-10-02 -========== - -* :vytask:`T2952` ``(bug): configd: timeout breaks synchronization of messages, causing freeze`` - - -2020-10-01 -========== - -* :vytask:`T2945` ``(bug): Interface removed from bridge on setting change`` -* :vytask:`T2948` ``(bug): NAT: OSError when configuring translation address range`` -* :vytask:`T2936` ``(feature): Migrate PPPoE server to get_config_dict() do reduce boilerplate code`` - - -2020-09-30 -========== - -* :vytask:`T2939` ``(bug): Wireguard Remove Peer Fails`` - - -2020-09-29 -========== - -* :vytask:`T2919` ``(feature): PPPoE server: Called-Station-Id attribute`` -* :vytask:`T2918` ``(feature): Accounting interim jitter for pppoe, l2tp, pptp, ipoe`` -* :vytask:`T2917` ``(feature): PPPoE server: Preallocate NAS-Port-Id`` -* :vytask:`T2937` ``(feature): Update Linux Kernel to v4.19.148`` - - -2020-09-27 -========== - -* :vytask:`T2930` ``(feature): Support configuration of MAC address for VXLAN and GENEVE tunnel`` - - -2020-09-26 -========== - -* :vytask:`T2856` ``(bug): equuleus: `show version all` throws broken pipe exception on abort`` -* :vytask:`T2929` ``(bug): Upgrading from 1.2 (crux) to 1.3 rolling causes vyos.configtree.ConfigTreeError for RADIUS settings`` -* :vytask:`T2928` ``(bug): MTU less then 1280 bytes and IPv6 will raise FileNotFoundError`` -* :vytask:`T2926` ``(bug): snmp.py missing an import`` -* :vytask:`T2912` ``(feature): When setting MTU check for hardware maximum supported MTU size`` - - -2020-09-25 -========== - -* :vytask:`T2915` ``(bug): Lost "proxy-arp-pvlan" option for vlan`` -* :vytask:`T2925` ``(feature): Update Linux Kernel to v4.19.147`` -* :vytask:`T2921` ``(feature): Migrate "service dns forwarding" to get_config_dict() for ease of source maintenance`` - - -2020-09-24 -========== - -* :vytask:`T2896` ``(bug): set ip route 0.0.0.0/0 dhcp-interface eth0`` -* :vytask:`T2923` ``(bug): Configuring DHCPv6-PD without a interface to delegate to raises TypeError`` - - -2020-09-23 -========== - -* :vytask:`T2846` ``(bug): ip route doesn't show longer-prefixes`` - - -2020-09-20 -========== - -* :vytask:`T2904` ``(feature): 802.1ad / Q-in-Q ethertype default not utilized`` -* :vytask:`T2905` ``(feature): Sync CLI nodes between PPPoE and WWAN interface`` -* :vytask:`T2903` ``(feature): Q-in-Q (802.1.ad) ethertype should be defined explicitly and not via its raw value`` - - -2020-09-19 -========== - -* :vytask:`T2894` ``(bug): bond: lacp: member interfaces get removed once bond interface has vlans configured`` -* :vytask:`T2901` ``(feature): Update Linux Kernel to v4.19.146`` -* :vytask:`T2900` ``(bug): DNS forwarding: invalid warning is shown for "system name-server" or "system name-servers-dhcp" even if present`` - - -2020-09-18 -========== - -* :vytask:`T945` ``(bug): Unable to change configuration after changing it from script (vbash + script-template)`` - - -2020-09-16 -========== - -* :vytask:`T2886` ``(bug): RADIUS authentication broken only returns operator level`` -* :vytask:`T2887` ``(bug): WiFi ht40+ channel width is not set in hostaptd.conf`` - - -2020-09-15 -========== - -* :vytask:`T2515` ``(bug): Ethernet interface is automatically disabled when removing it from bond`` - - -2020-09-14 -========== - -* :vytask:`T2872` ``(bug): "Show log" for nat and openvpn got intermixed`` -* :vytask:`T2301` ``(bug): Cannot delete PBR`` -* :vytask:`T2880` ``(feature): Update Linux Kernel to v4.19.145`` -* :vytask:`T2879` ``(feature): Cleanup 4.19.144 kernel configuration`` - - -2020-09-13 -========== - -* :vytask:`T2858` ``(feature): Rewrite dynamic dns client to get_config_dict()`` -* :vytask:`T2857` ``(feature): Cleanup Intel QAT configuration script`` -* :vytask:`T2877` ``(feature): LACP / bonding: support configuration of minimum number of links`` - - -2020-09-12 -========== - -* :vytask:`T2863` ``(default): Wireguard IPv6 Link-Local Addresses Are Not Unique`` -* :vytask:`T2876` ``(feature): Update Linux Kernel to v4.19.144`` - - -2020-09-10 -========== - -* :vytask:`T2870` ``(feature): Update Linux Kernel to v5.8.8`` - - -2020-09-09 -========== - -* :vytask:`T2728` ``(bug): Protocol option ignored for IPSec peers in transport mode`` -* :vytask:`T1934` ``(default): Change default hostname when deploy from OVA without params.`` -* :vytask:`T1953` ``(bug): DDNS service name validation rejects valid service names`` - - -2020-09-07 -========== - -* :vytask:`T1729` ``(default): PIM (Protocol Independent Multicast) implementation`` - - -2020-09-06 -========== - -* :vytask:`T2860` ``(bug): Update Accel-PPP to fix l2tp CVE`` - - -2020-09-02 -========== - -* :vytask:`T2833` ``(bug): RIP outgoing update filter list no longer operational`` -* :vytask:`T2849` ``(bug): vyos.xml.defaults should return a list on multi nodes, by default`` - - -2020-08-31 -========== - -* :vytask:`T2636` ``(bug): get_config_dict() shall always return a list on nodes`` - - -2020-08-30 -========== - -* :vytask:`T2843` ``(feature): Upgrade Linux Kernel to 5.8 series`` -* :vytask:`T2814` ``(default): kernel 5.1+ : NAT : module `nft_chain_nat_ipv4` renamed`` -* :vytask:`T2839` ``(feature): Upgrade WireGuard user-space tools and Kernel module`` -* :vytask:`T2842` ``(feature): Replace custom "wireguard, wireguard-tools" package with debian-backports version`` - - -2020-08-29 -========== - -* :vytask:`T2836` ``(default): show system integrity broken in 1.3`` - - -2020-08-28 -========== - -* :vytask:`T2126` ``(bug): show vpn ipsec sa IPSec - Process NOT Running`` -* :vytask:`T2813` ``(bug): NAT: possible to commit illegal source nat without translation`` -* :vytask:`T1463` ``(bug): Missing command `show ip bgp scan` appears in command completion`` - - -2020-08-27 -========== - -* :vytask:`T2832` ``(feature): Migrate vyos-smoketest content into vyos-1x`` - - -2020-08-26 -========== - -* :vytask:`T2830` ``(default): Migrate "service https" to use get_config_dict()`` -* :vytask:`T2831` ``(feature): Update Linux Kernel to v4.19.142`` - - -2020-08-25 -========== - -* :vytask:`T2826` ``(bug): frr: frr python lib error in replace_section`` - - -2020-08-24 -========== - -* :vytask:`T2423` ``(bug): Loadkey scp ssh key errors`` - - -2020-08-23 -========== - -* :vytask:`T2811` ``(bug): Cannot delete vpn anyconnect`` -* :vytask:`T2823` ``(bug): VXLAN has state A/D after configuration`` -* :vytask:`T2812` ``(default): Add basic smoketest for anyconnect`` - - -2020-08-22 -========== - -* :vytask:`T2822` ``(feature): Update Linux Kernel to v4.19.141`` -* :vytask:`T2821` ``(feature): Support DHCPv6-PD without "address dhcpv6"`` -* :vytask:`T2677` ``(feature): Proposal for clearer DHCPv6-PD configuration options`` - - -2020-08-20 -========== - -* :vytask:`T2209` ``(bug): Documentation has reference to the old 'user x level admin' option`` -* :vytask:`T1665` ``(default): prefix-list and prefix-list6 rules incorrectly accept a host address where prefix is required`` -* :vytask:`T2815` ``(default): Move certbot config directory under /config/auth`` - - -2020-08-19 -========== - -* :vytask:`T2794` ``(bug): op-mode: lldp: "show lldp neighbors" IndexError: list index out of range`` -* :vytask:`T2791` ``(feature): "monitor traceroute" has no explicit IPv4/IPv6 support`` -* :vytask:`T1515` ``(bug): FRR ospf6d crashes when performing: "show ipv6 ospfv3 database"`` - - -2020-08-16 -========== - -* :vytask:`T2277` ``(bug): dhclient-script-vyos does not support VRFs`` -* :vytask:`T2090` ``(default): Deleting 'service salt-minion' causes python TypeError`` - - -2020-08-15 -========== - -* :vytask:`T2797` ``(feature): Update Linux Kernel to v4.19.139`` -* :vytask:`T2796` ``(bug): PPPoE-Server: listen interface is mandatory but validation check is missing`` - - -2020-08-14 -========== - -* :vytask:`T2795` ``(bug): console server fails to commit`` - - -2020-08-12 -========== - -* :vytask:`T2786` ``(bug): OSPF Interface Cost`` -* :vytask:`T2325` ``(bug): NHRP op-mode errors with missing daemon socket`` -* :vytask:`T2227` ``(feature): MPLS documentation`` -* :vytask:`T2767` ``(bug): The interface cannot be disabled for network enabled configuration`` -* :vytask:`T2316` ``(bug): DHCP-server op-mode errors`` - - -2020-08-11 -========== - -* :vytask:`T2779` ``(bug): LLDP: "show lldp neighbors interface" does not yield any result`` -* :vytask:`T2379` ``(bug): DHCPv6 address for interface deletion triggers a script error`` -* :vytask:`T2784` ``(default): Remove unused arg from host_name.py functions verify and get_config`` - - -2020-08-10 -========== - -* :vytask:`T2780` ``(feature): Update Linux Kernel to v4.19.138`` - - -2020-08-08 -========== - -* :vytask:`T2716` ``(bug): Shaper-HFSC shapes but does not control latency correctly`` -* :vytask:`T2497` ``(default): Cache config string during commit`` -* :vytask:`T2501` ``(bug): Cannot recover from failed boot config load`` -* :vytask:`T1974` ``(feature): Allow route-map to set administrative distance`` -* :vytask:`T1949` ``(bug): Multihop IPv6 BFD is unconfigurable`` - - -2020-08-04 -========== - -* :vytask:`T2758` ``(bug): router-advert: 'infinity' is not a valid integer number`` -* :vytask:`T2637` ``(bug): Vlan is not removed from the system`` -* :vytask:`T1287` ``(bug): No DHCPv6 leases reported for "show dhcpv6 client leases"`` - - -2020-08-03 -========== - -* :vytask:`T2241` ``(default): Changing settings on an interface causes it to fall out of bridge`` -* :vytask:`T2757` ``(bug): "show system image version" contains additional new-line character breaking output`` -* :vytask:`T1826` ``(bug): Misleading message on "reboot at" command`` -* :vytask:`T1511` ``(default): Rewrite ethernet setup scripts to python`` -* :vytask:`T1600` ``(default): Convert 'ping' operation from vyatta-op to new syntax`` -* :vytask:`T1486` ``(bug): Unknown LLDP version reported to peers`` -* :vytask:`T1414` ``(enhancment): equuleus: buster: 10-unmountfs.chroot fail under apply`` -* :vytask:`T1076` ``(bug): SSH: make configuration (sshd_config) volatile and store it to /run`` -* :vytask:`T2724` ``(feature): Support for IPv6 Toolset`` -* :vytask:`T2323` ``(bug): LLDP: "show lldp neighbors detail" returns warnings when service is not configured`` -* :vytask:`T1754` ``(bug): DHCPv6 client is impossible to restart`` - - -2020-08-02 -========== - -* :vytask:`T2756` ``(feature): Accel-PPP: make RADIUS accounting port configurable`` - - -2020-08-01 -========== - -* :vytask:`T2752` ``(bug): Exception when configuring unavailable ethernet interface`` -* :vytask:`T2751` ``(feature): Update Linux Kernel to v4.19.136`` -* :vytask:`T2753` ``(feature): Rewrite "add system image" op mode commands in XML`` -* :vytask:`T2690` ``(feature): Add VRF support to the add system image command`` - - -2020-07-30 -========== - -* :vytask:`T2746` ``(feature): IPv6 link-local addresses not configured`` -* :vytask:`T2678` ``(bug): High RAM usage on SSH logins with lots of IPv6 routes in the routing table.`` -* :vytask:`T2701` ``(bug): `vpn ipsec pfs enable` doesn't work with IKE groups`` -* :vytask:`T2745` ``(feature): router-advert: migrate to get_config_dict()`` - - -2020-07-29 -========== - -* :vytask:`T2743` ``(feature): WireGuard: move key migration from config script to migration script`` -* :vytask:`T2742` ``(feature): mDNS repeater: migrate to get_config_dict()`` - - -2020-07-28 -========== - -* :vytask:`T1117` ``(feature): 'show ipv6 bgp route-map' missing`` -* :vytask:`T928` ``(feature): Add support for PIM (Protocol-Independent Multicast)`` - - -2020-07-27 -========== - -* :vytask:`T2729` ``(feature): Pseudo-ethernet replace fail message`` -* :vytask:`T1249` ``(feature): multiple PBR rules can set to a single interface`` -* :vytask:`T1956` ``(feature): PPPoE server: support PADO-delay`` -* :vytask:`T1295` ``(feature): FRR: update documentation`` -* :vytask:`T1222` ``(bug): OSPF routing problem - route looping`` -* :vytask:`T1158` ``(bug): Route-Map configuration dropped updating rc11 to epa2`` -* :vytask:`T1130` ``(bug): Deleting BGP communities from prefix does not work`` -* :vytask:`T2067` ``(feature): pppoe-server: Add possibility set multiple service-name`` - - -2020-07-26 -========== - -* :vytask:`T2734` ``(feature): WireGuard: fwmark CLI definition is inconsistent`` -* :vytask:`T2733` ``(feature): Support MTU configuration on pseudo ethernet devices`` -* :vytask:`T2644` ``(default): Bonding interfaces cannot be disabled`` -* :vytask:`T2476` ``(bug): Bond member description change leads to network outage`` -* :vytask:`T2443` ``(feature): NHRP: Add debugging information to syslog`` -* :vytask:`T2021` ``(bug): OSPFv3 doesn't support decimal area syntax`` -* :vytask:`T1901` ``(bug): Semicolon in values is interpreted as a part of the shell command by validators`` -* :vytask:`T2000` ``(bug): strongSwan does not install routes to table 220 in certain cases`` -* :vytask:`T2091` ``(bug): swanctl.conf file is not generated properly if more than one IPsec profile is used`` -* :vytask:`T1983` ``(feature): Expose route-map when BGP routes are programmed in to FIB`` -* :vytask:`T1973` ``(feature): Allow route-map to match on BGP local preference value`` -* :vytask:`T1853` ``(bug): wireguard - disable peer doesn't work`` -* :vytask:`T1985` ``(feature): pppoe: Enable ipv6 modules without configured ipv6 pools`` - - -2020-07-25 -========== - -* :vytask:`T2730` ``(feature): Update Linux Kernel to v4.19.134`` -* :vytask:`T2106` ``(bug): Wrong interface states after reboot`` -* :vytask:`T1507` ``(default): cli: logical redundancy with boolean type`` - - -2020-07-24 -========== - -* :vytask:`T2097` ``(bug): Problems when using as completion helper in op-mode`` -* :vytask:`T2092` ``(bug): dhcp-server rfc3442 static route should add default route`` -* :vytask:`T1817` ``(bug): BGP next-hop-self not working.`` -* :vytask:`T1462` ``(bug): Upgrade path errors 1.1.8 to 1.2.1-S2`` -* :vytask:`T1372` ``(bug): Diff functionality behaves incorrectly in some cases`` -* :vytask:`T2073` ``(feature): ipoe-server: reset op-mode command for sessions`` -* :vytask:`T1715` ``(bug): System DNS Server Order Incorrect`` - - -2020-07-23 -========== - -* :vytask:`T2673` ``(bug): After the bridge is configured with Mac, bridge is automatically disabled`` -* :vytask:`T2626` ``(bug): Changing pseudo-ethernet mode, throws CLI error`` -* :vytask:`T2608` ``(bug): delete pseudo-ethernet failed (another error type)`` -* :vytask:`T2527` ``(bug): bonding: the last slave interface is not deleted`` -* :vytask:`T2358` ``(bug): ip6ip6 bridge conf_mode errors`` -* :vytask:`T2346` ``(bug): Setting hostname yields temporary file error`` -* :vytask:`T2330` ``(bug): Vpn op-mode syntax`` -* :vytask:`T2188` ``(default): NTP op-mode commands don't work`` - - -2020-07-22 -========== - -* :vytask:`T2718` ``(bug): ntp.conf updated incorrectly`` -* :vytask:`T2658` ``(bug): Interface description comment display error`` -* :vytask:`T2643` ``(bug): show interfaces does not scale with terminal width`` -* :vytask:`T2725` ``(bug): Config fails to load if user has no password`` -* :vytask:`T2707` ``(default): Allow alternative initialization data for Config`` - - -2020-07-20 -========== - -* :vytask:`T2709` ``(bug): Destination NAT translation port without address fails to commit`` -* :vytask:`T2519` ``(bug): Broadcast address does not add automatically`` - - -2020-07-19 -========== - -* :vytask:`T2708` ``(bug): "show flow-accounting" should not display script's "usage" help`` -* :vytask:`T2592` ``(default): dhcp-relay discarding packets on valid interfaces`` -* :vytask:`T2712` ``(feature): udp-broadcast-relay: serivce no longer starts`` -* :vytask:`T2706` ``(feature): Support NDP protocol monitoring`` - - -2020-07-18 -========== - -* :vytask:`T2704` ``(bug): connect/disconnect Missing newline in op-mode tab completion helper`` -* :vytask:`T2689` ``(feature): Add helper functions to query changes between session and effective configs`` -* :vytask:`T2585` ``(bug): Unable to access the Internet after opening PPPoE on-demand dialing`` - - -2020-07-15 -========== - -* :vytask:`T2675` ``(bug): DNS service failed to start`` -* :vytask:`T2596` ``(feature): Allow specifying source IP for 'add system image'`` - - -2020-07-12 -========== - -* :vytask:`T1575` ``(default): `show snmp mib ifmib` crashes with IndexError`` -* :vytask:`T2696` ``(bug): Some bugfixes of vyatta-wanloadbalance`` - - -2020-07-11 -========== - -* :vytask:`T2687` ``(feature): SNMP: change logic on v3 password encryption`` -* :vytask:`T2693` ``(bug): Dhcp6c cannot be restarted after PPPoE link is reset`` - - -2020-07-08 -========== - -* :vytask:`T2692` ``(bug): Evaluate Setting Default Hash Policy to L3+L4`` -* :vytask:`T2646` ``(bug): Sysctl for IPv4 ECMP Hash Policy Not Set`` - - -2020-07-07 -========== - -* :vytask:`T2691` ``(bug): Upgrade from 1.2.5 to 1.3-rolling-202007040117 results in broken config due to case mismatch`` -* :vytask:`T2389` ``(bug): BGP community-list unknown command`` -* :vytask:`T2686` ``(bug): FRR: BGP: large-community configuration is not applied properly after upgrading FRR to 7.3.x series`` - - -2020-07-06 -========== - -* :vytask:`T2680` ``(bug): dhcp6c service cannot recover when it fails`` - - -2020-07-05 -========== - -* :vytask:`T2684` ``(feature): Update Linux Kernel to v4.19.131`` -* :vytask:`T2685` ``(feature): Update Accel-PPP to fix SSTP client issues`` -* :vytask:`T2681` ``(bug): PPPoE stops negotiating IPv6`` - - -2020-07-04 -========== - -* :vytask:`T2682` ``(bug): VRF aware services - connection no longer possible after system reboot`` - - -2020-07-03 -========== - -* :vytask:`T2670` ``(default): Remove dependency on show_config from get_config_dict`` -* :vytask:`T2676` ``(feature): NTP: migrate to get_config_dict() implementation`` - - -2020-07-02 -========== - -* :vytask:`T2668` ``(default): get_config_dict: add get_first_key arg to utility function get_sub_dict`` - - -2020-07-01 -========== - -* :vytask:`T2662` ``(default): get_config_dict includes node name as key only for tag and leaf nodes`` -* :vytask:`T2667` ``(feature): get_config_dict: Use utility function for non-empty path argument`` - - -2020-06-28 -========== - -* :vytask:`T2660` ``(bug): XML: Python default dictionary does not obey underscore (_) when flat is False`` - - -2020-06-27 -========== - -* :vytask:`T2656` ``(bug): XML: Python default dictionary returns wrong dictionary level(s)`` - - -2020-06-26 -========== - -* :vytask:`T2642` ``(bug): sshd fails to start due to configuration error`` -* :vytask:`T2588` ``(default): Add support for default values to the interface-definition format`` -* :vytask:`T2622` ``(bug): Pseudo-ethernet interface config disappears across versions`` -* :vytask:`T2057` ``(feature): Generalised Interface configuration`` -* :vytask:`T2625` ``(feature): Provide generic Library for package builds`` - - -2020-06-25 -========== - -* :vytask:`T2487` ``(bug): VRRP does not display info when group disabled`` -* :vytask:`T2329` ``(bug): Show remote config openvpn`` -* :vytask:`T2165` ``(bug): When trying to add route to ripng it complains that ip address should be IPv4 format`` -* :vytask:`T2159` ``(default): webproxy log read from wrong file`` -* :vytask:`T2101` ``(feature): Fix VXLAN config option parsing`` -* :vytask:`T2062` ``(bug): Wrong dhcp-server static route subnet bytes`` -* :vytask:`T1986` ``(bug): Python configuration manipulation library leaks open files`` -* :vytask:`T1762` ``(bug): VLAN interface configuration fails after internal representation of edit level was switched from a string to a list`` -* :vytask:`T1538` ``(bug): Update conntrack-sync packages to fix VRRP issues`` -* :vytask:`T1808` ``(feature): add package nftables`` - - -2020-06-24 -========== - -* :vytask:`T2634` ``(feature): remove autogeneration of interface "ip section" from vyatta-cfg-system`` -* :vytask:`T2633` ``(bug): Error with arp_accept on tun interface`` -* :vytask:`T2595` ``(feature): Update Linux Kernel to v4.19.128`` -* :vytask:`T1938` ``(bug): syslog doesn't start automatically`` - - -2020-06-23 -========== - -* :vytask:`T2632` ``(bug): WireGuard: Cannot use only one preshared-key for one peer`` -* :vytask:`T1829` ``(bug): Install Image script does not respect size of partition greater than 2G but less than disk size`` -* :vytask:`T2635` ``(feature): SSH: migrate to get_config_dict()`` - - -2020-06-22 -========== - -* :vytask:`T2486` ``(bug): DNS records set via 'system static-host-mapping' return NXDOMAIN from 'service dns forwarding' after a request to a forwarded zone`` -* :vytask:`T2463` ``(bug): DHCP-received nameserver not added to vyos-hostsd`` -* :vytask:`T2534` ``(bug): pdns-recursor override.conf error`` -* :vytask:`T2054` ``(bug): Changing "system name-server" doesn't update dns forwarding config, neither does "restart dns forwarding"`` -* :vytask:`T2225` ``(default): PIM/IGMP documentation`` - - -2020-06-21 -========== - -* :vytask:`T2624` ``(feature): Serial Console: fix migration script for configured powersave and no console`` -* :vytask:`T2610` ``(bug): default-lifetime is not reflected in the RA message`` -* :vytask:`T2299` ``(feature): login radius-server priority`` -* :vytask:`T1739` ``(bug): Serial interface seems not to be deleted properly`` -* :vytask:`T480` ``(bug): Error if no serial interface is present (/dev/ttyS0: not a tty)`` - - -2020-06-20 -========== - -* :vytask:`T2621` ``(bug): show interfaces repeats interface description if it is longer then an arbitrary number of characters`` -* :vytask:`T2618` ``(default): Conversion from 1.2 to 1.3 lost RADVD prefix autonomous-flag setting`` - - -2020-06-19 -========== - -* :vytask:`T2589` ``(bug): delete pseudo-ethernet failed`` -* :vytask:`T2490` ``(feature): Add serial (rs232) to ssh bridge service`` - - -2020-06-18 -========== - -* :vytask:`T2614` ``(default): Add an option to mangle dict keys to vyos.config.get_config_dict()`` -* :vytask:`T2026` ``(default): Make cli-shell-api correctly exit with non-zero code on failures`` -* :vytask:`T1868` ``(default): Add opportunity to get current values from API`` - - -2020-06-17 -========== - -* :vytask:`T2478` ``(feature): login radius: use NAS-IP-Address if defined source address`` -* :vytask:`T2141` ``(bug): Static ARP is not applied on boot`` -* :vytask:`T2609` ``(bug): router-advert: radvd does not start when lifetime is improperly configured`` -* :vytask:`T1720` ``(feature): support for more 'show ip route' commands`` - - -2020-06-16 -========== - -* :vytask:`T2604` ``(default): Remove use of is_tag in system-syslog.py`` -* :vytask:`T2605` ``(bug): SNMP service is not disabled by default`` -* :vytask:`T2568` ``(bug): Add some missing checks in config`` -* :vytask:`T2156` ``(default): PIM op-mode commands`` - - -2020-06-15 -========== - -* :vytask:`T2600` ``(bug): RADIUS system login configuration rendered wrongly`` -* :vytask:`T2599` ``(bug): "show interfaces" does not list VIF interfaces in ascending order`` -* :vytask:`T2591` ``(bug): show command has wrong interfaces ordering`` -* :vytask:`T2576` ``(bug): "show interfaces" does not return VTI`` - - -2020-06-14 -========== - -* :vytask:`T2354` ``(bug): Wireless conf_mode errors`` -* :vytask:`T2593` ``(bug): source NAT translation port can not be set when translation address is set to masquerade`` -* :vytask:`T2594` ``(default): Missing firmware for iwlwifi`` - - -2020-06-11 -========== - -* :vytask:`T2578` ``(bug): ipaddrcheck unaware of /31 host addresses - can no longer assign /31 mask to interface addresses`` -* :vytask:`T2571` ``(bug): NAT destination port with ! results in error`` -* :vytask:`T2570` ``(feature): Drop support for "system console device modem"`` -* :vytask:`T2586` ``(bug): WWAN default route is not installed into VRF`` -* :vytask:`T2561` ``(feature): Drop support for "system console netconsole"`` -* :vytask:`T2569` ``(feature): Migrate "set system console" to XML and Python representation`` - - -2020-06-10 -========== - -* :vytask:`T2575` ``(bug): pppoe-server: does not possibly assign IP address`` -* :vytask:`T2565` ``(bug): Cannot connect to l2tp server with radius auth`` -* :vytask:`T2553` ``(bug): set interface ethN vif-s nnnn does not commit`` - - -2020-06-08 -========== - -* :vytask:`T2559` ``(feature): Add operational mode command to retrieve hardware sensor data`` - - -2020-06-07 -========== - -* :vytask:`T2529` ``(feature): WWAN: migrate from ttyUSB device to new device in /dev/serial/by-bus`` -* :vytask:`T2560` ``(feature): New op-mode command to display information about USB interfaces`` - - -2020-06-05 -========== - -* :vytask:`T2548` ``(bug): Interfaces allowing inappropriate network addresses to be assigned`` -* :vytask:`T1958` ``(default): Include only firmware we actually need`` - - -2020-06-04 -========== - -* :vytask:`T2514` ``(enhancment): "mac" setting for bond members`` - - -2020-06-02 -========== - -* :vytask:`T2129` ``(feature): XML schema: tagNode not allowed on first level in new XML op-mode definition`` -* :vytask:`T2545` ``(feature): Show physical device offloading capabilities for specified ethernet interface`` -* :vytask:`T2544` ``(feature): Enable Kernel KONFIG_KALLSYMS`` -* :vytask:`T2543` ``(feature): Kernel: always build perf binary but ship as additional deb package to not bloat the image`` -* :vytask:`T1096` ``(bug): BGP process memory leak`` - - -2020-06-01 -========== - -* :vytask:`T2535` ``(feature): Update Intel QAT drivers to 1.7.l.4.9.0-00008`` -* :vytask:`T2537` ``(feature): Migrate "show log dns" from vyatta-op to vyos-1x`` -* :vytask:`T2536` ``(bug): "show log dns forwarding" still refers to dnsmasq`` -* :vytask:`T2538` ``(feature): Update Intel NIC drivers to recent release (preparation for Kernel >=5.4)`` -* :vytask:`T2526` ``(feature): Wake-On-Lan CLI implementation`` - - -2020-05-31 -========== - -* :vytask:`T2532` ``(feature): VRF aware OpenVPN`` - - -2020-05-30 -========== - -* :vytask:`T2388` ``(feature): template rendering should create folder and set permission`` -* :vytask:`T2531` ``(feature): Update Linux Kernel to v4.19.125`` -* :vytask:`T2530` ``(bug): Error creating VRF with a name of exactly 16 characters`` - - -2020-05-29 -========== - -* :vytask:`T2528` ``(bug): "update dns dynamic" throws FileNotFoundError excepton`` - - -2020-05-28 -========== - -* :vytask:`T1291` ``(default): Under certain conditions the VTI will stay forever down`` - - -2020-05-27 -========== - -* :vytask:`T2395` ``(feature): HTTP API move to flask/flask-restx as microframework`` -* :vytask:`T1121` ``(bug): Can't search for prefixes by community: Community malformed: AA:NN`` - - -2020-05-26 -========== - -* :vytask:`T2520` ``(bug): show conntrack fails with Perl error`` -* :vytask:`T2502` ``(bug): PPPoE default route not installed for IPv6 when "default-route auto"`` -* :vytask:`T2458` ``(feature): Update FRR to 7.3.1`` -* :vytask:`T2506` ``(feature): DHCPv6-PD add prefix hint CLI option`` - - -2020-05-25 -========== - -* :vytask:`T2391` ``(bug): pppoe-server session-control does not work`` -* :vytask:`T2269` ``(feature): SSTP specify tunnels names`` -* :vytask:`T1137` ``(bug): 'sh ip bgp sum' being truncated`` - - -2020-05-22 -========== - -* :vytask:`T2491` ``(feature): MACsec: create CLI for replay protection`` -* :vytask:`T2489` ``(feature): Add MACsec interfaces to "show interfaces" output`` -* :vytask:`T2201` ``(feature): Rewrite protocol BGP [op-mode] to new XML/Python style`` -* :vytask:`T2492` ``(feature): Do not set encrypted user password when it is not changed`` -* :vytask:`T2496` ``(feature): Set default to new syntax for config file component versions`` -* :vytask:`T2493` ``(feature): Update Linux Kernel to v4.19.124`` -* :vytask:`T2380` ``(bug): After PPPoE 0 is restarted, the default static route is lost`` - - -2020-05-21 -========== - -* :vytask:`T1876` ``(bug): IPSec VTI tunnels are deleted after rekey and dangling around as A/D`` -* :vytask:`T2488` ``(feature): Remove logfile for dialup interfaces like pppoe and wwan`` -* :vytask:`T2475` ``(bug): linting`` -* :vytask:`T1820` ``(bug): VRRP transition scripts for sync-groups are not supported in VyOS (anymore)`` -* :vytask:`T2364` ``(default): Add CLI command for mroute`` -* :vytask:`T2023` ``(feature): Add support for 802.1ae MACsec`` - - -2020-05-20 -========== - -* :vytask:`T2480` ``(bug): NAT: after rewrite commit tells that dnat IP address is not locally connected`` - - -2020-05-19 -========== - -* :vytask:`T2481` ``(feature): WireGuard: support tunnel via IPv6 underlay`` -* :vytask:`T421` ``(bug): Add Pv6 prefix delegation support`` -* :vytask:`T815` ``(feature): Add DHCPv6 server prefix-delegation support`` - - -2020-05-17 -========== - -* :vytask:`T2471` ``(feature): PPPoE server: always add AdvAutonomousFlag when IPv6 is configured`` -* :vytask:`T2409` ``(default): At boot, effective config should not be equal to current config`` - - -2020-05-16 -========== - -* :vytask:`T2466` ``(bug): live-build encounters apt dependency problem when building with local packages`` -* :vytask:`T2470` ``(feature): Update to PowerDNS recursor 4.3`` -* :vytask:`T2469` ``(feature): Update Linux Kernel to v4.19.123`` -* :vytask:`T2198` ``(default): Rewrite NAT in new XML/Python style`` - - -2020-05-15 -========== - -* :vytask:`T2449` ``(bug): 'ipv6 address autoconf' and 'address dhcpv6' don't work because interfaces have accept_ra=1 (they should have accept_ra=2 when forwarding=1)`` - - -2020-05-14 -========== - -* :vytask:`T2456` ``(bug): netflow source-ip cannot be configured`` - - -2020-05-13 -========== - -* :vytask:`T2435` ``(bug): Pseudo-ethernet Interfaces Broken`` -* :vytask:`T2294` ``(bug): ipoe-server broken (jinja2 template issue)`` - - -2020-05-12 -========== - -* :vytask:`T2454` ``(feature): Update Linux Kernel to v4.19.122`` -* :vytask:`T2392` ``(bug): SSTP with ipv6`` - - -2020-05-10 -========== - -* :vytask:`T2445` ``(bug): VRF route leaking for ipv4 not working`` -* :vytask:`T2372` ``(bug): VLAN: error on commit if main interface is disabled`` -* :vytask:`T2439` ``(bug): Configuration dependency problem, unable to load complex configuration after reboot`` - - -2020-05-09 -========== - -* :vytask:`T2427` ``(default): Interface addressing broken since fix for T2372 was merged`` -* :vytask:`T2438` ``(default): isc-dhcp-server(6).service reports startup success immediately even if dhcpd fails to start up`` -* :vytask:`T2367` ``(default): Flush addresses from bridge members`` - - -2020-05-08 -========== - -* :vytask:`T2441` ``(bug): TZ validator has a parse error`` -* :vytask:`T2429` ``(bug): Vyos cannot apply VLAN sub interface to bridge`` - - -2020-05-06 -========== - -* :vytask:`T2402` ``(bug): Live ISO should warn when configuring that changes won't persist`` - - -2020-05-05 -========== - -* :vytask:`T1899` ``(bug): Unionfs metadata folder is copied to the active configuration directory`` - - -2020-05-04 -========== - -* :vytask:`T2412` ``(bug): ping flood does not work as unprivileged user`` -* :vytask:`T701` ``(bug): LTE interface dosen't come up`` -* :vytask:`T951` ``(bug): command 'isolate-stations true/false' does not make any changes in the hostapd.conf`` - - -2020-05-03 -========== - -* :vytask:`T2420` ``(feature): Update Linux Kernel to v4.19.120`` -* :vytask:`T2406` ``(feature): DHCPv6 CLI improvements`` -* :vytask:`T2421` ``(feature): Update WireGuard to Debian release 1.0.20200429-2_bpo10+1`` - - -2020-05-02 -========== - -* :vytask:`T2414` ``(feature): Improve runtime from Python numeric validator`` -* :vytask:`T2413` ``(feature): Update Linux Kernel to v4.19.119`` - - -2020-05-01 -========== - -* :vytask:`T2411` ``(feature): op-mode: make "monitor traceroute" VRF aware`` -* :vytask:`T2347` ``(bug): During commit, any script output directed to stdout will contain path`` -* :vytask:`T2239` ``(default): build-vmware-image script ignores the predefined file path, uses the environment variable unconditionally.`` - - -2020-04-29 -========== - -* :vytask:`T2399` ``(bug): op-mode "dhcp client leases" does not return leases`` -* :vytask:`T2398` ``(bug): op-mode "dhcp client leases interface" completion helper misses interfaces`` -* :vytask:`T2394` ``(feature): dhcpv6 client does not start`` -* :vytask:`T2393` ``(feature): dhclient: migrate from SysVinit to systemd`` -* :vytask:`T2268` ``(bug): DHCPv6 is broken`` - - -2020-04-28 -========== - -* :vytask:`T1227` ``(bug): rip PW can't be set at interface config`` - - -2020-04-27 -========== - -* :vytask:`T2373` ``(feature): Required auth options for pppoe-server`` -* :vytask:`T1381` ``(feature): Enable DHCP option 121 processing`` -* :vytask:`T2010` ``(bug): Reboot at reports wrong time or missing timezone`` - - -2020-04-26 -========== - -* :vytask:`T2386` ``(bug): salt: upgrade to 2019.2 packages`` -* :vytask:`T2385` ``(bug): salt-minion: improve completion helpers`` -* :vytask:`T2384` ``(bug): salt-minion: log to syslog and remove custom logging option`` -* :vytask:`T2383` ``(feature): Update Linux Kernel to v4.19.118`` -* :vytask:`T2382` ``(bug): salt-minion: Throws KeyError on commit`` -* :vytask:`T2350` ``(bug): Interface geneve conf-mode error`` - - -2020-04-25 -========== - -* :vytask:`T2304` ``(feature): "system login" add RADIUS VRF support`` -* :vytask:`T1842` ``(bug): Equuleus: "reboot at 04:00" command not working`` - - -2020-04-24 -========== - -* :vytask:`T2375` ``(feature): WireGuard: throw exception if address and port are not given as both are mandatory`` -* :vytask:`T2348` ``(bug): On IPv6 address distribution and DHCPv6 bugs`` - - -2020-04-23 -========== - -* :vytask:`T2369` ``(feature): VRF: can not leak interface route from default VRf to any other VRF`` -* :vytask:`T2368` ``(bug): VRF: missing completion helper when leaking to default table`` -* :vytask:`T2374` ``(bug): Tunnel interface can not be disabled`` -* :vytask:`T2362` ``(default): IPv6 link-local addresses missing due to EUI64 address code, causing router-advert not to work`` -* :vytask:`T2345` ``(default): IPv6 router-advert not working`` - - -2020-04-22 -========== - -* :vytask:`T2361` ``(bug): Unable to delete VLAN vif interface`` -* :vytask:`T2339` ``(bug): OpenVPN: IPv4 no longer working after adding IPv6 support`` -* :vytask:`T2331` ``(bug): VRRP op-mode errors`` -* :vytask:`T2320` ``(bug): Wireguard creates non-existing interfaces in [op-mode].`` -* :vytask:`T2096` ``(feature): Provide "generate" and "show" commands via the http API`` -* :vytask:`T2351` ``(feature): Cleanup PPTP server implementation and CLI commands`` - - -2020-04-21 -========== - -* :vytask:`T2341` ``(bug): Pseudo-ethernet Interfaces Not Loaded on Boot`` -* :vytask:`T2270` ``(bug): using load with scp/sftp and a username and password does not work`` -* :vytask:`T2255` ``(bug): DNS forwarding op-mode error`` -* :vytask:`T1907` ``(bug): Traceback on a non-existent interface.`` -* :vytask:`T2204` ``(feature): Support tunnel source-interface`` - - -2020-04-20 -========== - -* :vytask:`T2335` ``(bug): Unable to assign IPv6 from ISP`` -* :vytask:`T2317` ``(bug): l2tp overwriting ipsec config files`` -* :vytask:`T2292` ``(bug): Ensure graceful shutdown of vyos-http-api`` -* :vytask:`T2344` ``(bug): PPPoE server client static IP assignment silently fails`` - - -2020-04-19 -========== - -* :vytask:`T2337` ``(default): hw-id gone missing from interfaces after upgrade to 1.3-rolling-202004191028`` -* :vytask:`T2340` ``(feature): Remove informational "sg" messages from syslog`` -* :vytask:`T2338` ``(bug): Can't delete static IPv6 route on vrf`` -* :vytask:`T2336` ``(bug): OpenVPN service fails to start`` -* :vytask:`T2308` ``(default): openvpn op-mode scripts broken after migrating to systemd service`` -* :vytask:`T2185` ``(default): Start daemons with systemd units instead of with start-stop-daemon`` - - -2020-04-18 -========== - -* :vytask:`T2318` ``(bug): dns-forwarding migration script breaks with invalid interface name`` -* :vytask:`T2319` ``(feature): Update Linux Kernel to v4.19.116`` -* :vytask:`T2314` ``(feature): Cleanup PPPoE server implementation and CLI commands`` -* :vytask:`T2313` ``(bug): Accel-PPP / PPPoEserver raises "Floating point exception" when not all limits are defined`` -* :vytask:`T2312` ``(feature): Use LED modules to enable more visible feedback on VyOS hardware chassis`` -* :vytask:`T2306` ``(feature): Add new cipher suites to the WiFi configuration`` -* :vytask:`T2286` ``(default): IPoE server vulnerability`` -* :vytask:`T2224` ``(feature): Update Linux Kernel to v4.19.114`` -* :vytask:`T2110` ``(feature): RADIUS: supply include file for radius config to have a uniform CLI`` -* :vytask:`T2324` ``(feature): Cleanup IPoE server implementation and CLI commands`` - - -2020-04-17 -========== - -* :vytask:`T2275` ``(bug): flow-accounting broken in rolling`` -* :vytask:`T2256` ``(feature): Accel-ppp op-mode syntax`` - - -2020-04-16 -========== - -* :vytask:`T2295` ``(bug): Passwords with Special Characters Broken`` -* :vytask:`T2305` ``(feature): Add release name to "show version" command`` -* :vytask:`T2235` ``(default): OpenVPN server client IP doesn't reserve that IP in the pool`` -* :vytask:`T149` ``(feature): IPv6 support in OpenVPN tunnel`` - - -2020-04-15 -========== - -* :vytask:`T2293` ``(bug): OpenVPN: UnboundLocalError after merging server_network PullRequest`` -* :vytask:`T2298` ``(bug): Errors PDNS with name-server set`` - - -2020-04-14 -========== - -* :vytask:`T2213` ``(bug): vyos-1x: WiFi mode ieee80211ac should also activate ieee80211n`` - - -2020-04-13 -========== - -* :vytask:`T2283` ``(default): openvpn not starting: ccd path in template not moved to /run/openvpn/ccd`` -* :vytask:`T2236` ``(bug): DMVPN broken after tunnel rewrite to XML/Python`` -* :vytask:`T2284` ``(default): Upgrade ddclient to 3.9.1 which also brings systemd files`` -* :vytask:`T2282` ``(feature): Clarify hw-id in ethernet and wireless interface nodes`` -* :vytask:`T611` ``(feature): Static route syntax should reflect `ip` command routing capabilities, if possible.`` - - -2020-04-12 -========== - -* :vytask:`T2273` ``(default): OpenVPN no longer starts in latest rolling, migrate to systemd`` -* :vytask:`T2263` ``(feature): Reset feature for SSTP sessions`` -* :vytask:`T2262` ``(bug): Broken reset commands for pptp and l2tp`` -* :vytask:`T2031` ``(bug): pseudo-ethernet link interface cannot be changed`` - - -2020-04-11 -========== - -* :vytask:`T2264` ``(feature): l2tp: cleanup CLI definition`` -* :vytask:`T2233` ``(bug): Typos in wlanX.cfg`` -* :vytask:`T2238` ``(bug): After re-writing list_interfaces.py to use Interfaces() pseudo-ethernet is missing`` - - -2020-04-10 -========== - -* :vytask:`T2265` ``(feature): DHCP to be an attribute of the class instead of a inheritance`` -* :vytask:`T2261` ``(bug): "client-config-dir" not being set for openvpn`` -* :vytask:`T2248` ``(bug): PPPoE Broken in Latest 1.3 Rolling (1.3-rolling-202004070629)`` -* :vytask:`T1629` ``(bug): IP addresses configured on vif-s interfaces are not added to the system`` -* :vytask:`T2266` ``(default): openvpn bridged client-server doesn't work (validation error)`` -* :vytask:`T2253` ``(default): Fix use of cmd in merge config and remote function helpers`` - - -2020-04-09 -========== - -* :vytask:`T2260` ``(feature): vxlan, pseudo-ethernet: convert link nodes to source-interface`` -* :vytask:`T2172` ``(feature): Enable conf VXLAN without remote address`` -* :vytask:`T2237` ``(bug): l2tp, pptp, pppoe wrong chap-secrets file`` - - -2020-04-08 -========== - -* :vytask:`T2244` ``(feature): WireGuard: cleanup Python implementation and reduce amount of boilerplate code`` -* :vytask:`T2186` ``(feature): Provide more information to the user when a traceback is reported to the user`` -* :vytask:`T2246` ``(bug): LLDP op-mode error`` -* :vytask:`T2240` ``(feature): Support for bind vif-c interfaces into VRFs`` -* :vytask:`T2160` ``(feature): Allow restricting HTTP API to specific virtual hosts`` -* :vytask:`T2247` ``(feature): WireGuard: add VRF support`` - - -2020-04-05 -========== - -* :vytask:`T2212` ``(bug): vyos-1x: WiFi card antenna count not set accordingly`` -* :vytask:`T2230` ``(feature): Split out inlined Jina2 template to data/templates folder`` -* :vytask:`T2206` ``(feature): Split WireGuard endpoint into proper host and port nodes`` - - -2020-04-04 -========== - -* :vytask:`T2158` ``(bug): Commit fails if ethernet interface doesn't support flow control (pause)`` -* :vytask:`T2221` ``(bug): Ability to remove a VRF that has a next-hop-vrf as target`` -* :vytask:`T2211` ``(bug): vyos-1x: VHT channel width not set accordingly`` -* :vytask:`T2208` ``(bug): vyos-1x: commit on interfaces wireless wlanX capabilities vht link-adaptation (both|unsolicited) fails`` -* :vytask:`T2183` ``(bug): A number of bugs with wireguard script due to interface rearrangement`` -* :vytask:`T2104` ``(default): ifconfig.py size`` -* :vytask:`T2028` ``(feature): Convert "interfaces tunnel" to new XML/Python representation`` -* :vytask:`T2219` ``(bug): VRF default route of PPPoE and WWAN interfaces do not get added into proper routing table`` -* :vytask:`T2222` ``(default): openvpn: requires "multihome" option to listen on all addresses with udp protocol`` - - -2020-04-02 -========== - -* :vytask:`T2072` ``(bug): Shell autocomplete of option (config node) with quoted value doesn't work`` -* :vytask:`T1823` ``(feature): l2tpv3 interface migration fails`` -* :vytask:`T2202` ``(feature): Update PowerDNS recursor to 4.2 series`` -* :vytask:`T2200` ``(feature): Add VRF support on wirelessmodem interfaces`` - - -2020-03-31 -========== - -* :vytask:`T2166` ``(bug): Broken proxy-arp on vif`` -* :vytask:`T2180` ``(bug): get_config_dict should be independent of CLI edit level`` -* :vytask:`T2053` ``(default): Update vyos-load-config.py for version string syntax change`` -* :vytask:`T2052` ``(default): Update vyos-merge-config.py for version string syntax change`` -* :vytask:`T2144` ``(default): vyos-build: docker: selection of text in the terminal still selects it in vim (mouse isn't completely disabled)`` - - -2020-03-30 -========== - -* :vytask:`T2176` ``(default): 'WiFiIf' object has no attribute 'set_state'`` -* :vytask:`T2029` ``(feature): Switch to new syntax for config file component versions`` - - -2020-03-29 -========== - -* :vytask:`T2178` ``(bug): VRF interface don't get removed when VRF is deleted`` -* :vytask:`T2170` ``(feature): Add ability to create static route from default to VRF`` -* :vytask:`T1831` ``(feature): Denest IPv6 router-advert from Interfaces to general service`` - - -2020-03-28 -========== - -* :vytask:`T2167` ``(bug): vyos.ifconfig.get_mac() broken`` -* :vytask:`T2151` ``(default): wireless: can't delete interface present in config but not present in system`` -* :vytask:`T1988` ``(feature): Migrate wirelessmodem to new XML/Python style interface`` - - -2020-03-27 -========== - -* :vytask:`T2164` ``(bug): Package libstrongswan-standard-plugins missing from image`` -* :vytask:`T2105` ``(bug): wireless: not possible to disabled wlan0`` -* :vytask:`T2169` ``(default): Remove redundant use of show_config in vyos-merge-config`` - - -2020-03-26 -========== - -* :vytask:`T2162` ``(default): migration script for router-advert sets link-mtu 0 on bridge interfaces`` -* :vytask:`T1735` ``(bug): Issue in "show vpn ipsec/ike sa" output with ipsec encryption algorithm aes128gcm128/aes256gcm128/chacha etc`` - - -2020-03-25 -========== - -* :vytask:`T2148` ``(default): openvpn: setting "server client" config without "server client ip" results in ValueError: '' does not appear to be an IPv4 or IPv6 address`` -* :vytask:`T2146` ``(default): openvpn: "delete server client" doesn't delete the corresponding ccd configs`` - - -2020-03-24 -========== - -* :vytask:`T2157` ``(default): Organize service https listen-address/listen-port/server-name under 'virtual-host' node`` -* :vytask:`T1845` ``(bug): syslog host no longer accepts a port`` - - -2020-03-22 -========== - -* :vytask:`T2150` ``(feature): SSTP ssl certificates can only be stored in /config/user-data/sstp`` -* :vytask:`T2149` ``(feature): Update Linux Kernel to v4.19.112`` -* :vytask:`T476` ``(enhancment): Update the base system to Debian 10 (Buster)`` - - -2020-03-21 -========== - -* :vytask:`T2142` ``(bug): vyos-build: Add required packages and step to build-GCE-image script`` -* :vytask:`T1870` ``(feature): Extend Pipeline scripts to support PullRequests`` - - -2020-03-20 -========== - -* :vytask:`T2006` ``(bug): SSTP RADIUS CLI accepts invalid values`` -* :vytask:`T2140` ``(default): openvpn: tls file check function checkCertHeader returns True even when no match is found`` -* :vytask:`T2007` ``(feature): SSTP accepts client MTU up to 16384 bytes`` -* :vytask:`T2008` ``(feature): Adjustment of SSTP CLI to be more consistent to the rest of VyOS`` - - -2020-03-19 -========== - -* :vytask:`T2135` ``(bug): Login banner missing spacing now`` -* :vytask:`T2132` ``(feature): Document kernel boot parameter 'vyos-config-debug'`` -* :vytask:`T1744` ``(default): Config load fails in ConfigTree with ValueError: Failed to parse config: lexing: empty token`` - - -2020-03-17 -========== - -* :vytask:`T2134` ``(bug): VXLAN: `NameError: name 'config' is not defined``` - - -2020-03-16 -========== - -* :vytask:`T2131` ``(feature): Improve syslog remote host CLI definition`` - - -2020-03-15 -========== - -* :vytask:`T2122` ``(feature): Update Intel out-of-tree drivers to latest version(s)`` -* :vytask:`T2121` ``(feature): Update Linux Kernel to v4.19.109`` -* :vytask:`T2119` ``(bug): Error on boot when removing ethernet interface from VM`` - - -2020-03-14 -========== - -* :vytask:`T834` ``(feature): New L2TP server implementation based on accel-ppp`` - - -2020-03-13 -========== - -* :vytask:`T1622` ``(default): Add failsafe and back trace to boot config loader`` - - -2020-03-11 -========== - -* :vytask:`T1961` ``(bug): VXLAN - fails to commit due to non-existent variable, broken MTU`` -* :vytask:`T2084` ``(default): conntrack-tools package build error for current/equuleus`` - - -2020-03-10 -========== - -* :vytask:`T1331` ``(bug): DNS stops working`` - - -2020-03-09 -========== - -* :vytask:`T2111` ``(feature): VRF add route leaking support`` -* :vytask:`T2109` ``(bug): Ping by name broken in VyOS 1.3-rolling-202003080217`` -* :vytask:`T2065` ``(bug): VyOS 1.3 Don't set daemon in openvpn-{intf}.conf file`` -* :vytask:`T31` ``(feature): Add VRF support`` - - -2020-03-08 -========== - -* :vytask:`T1954` ``(bug): Having `system login radius` configured causes exponentially long boot times`` -* :vytask:`T1760` ``(bug): RADIUS shared secret is not redacted from "show configuration" op mode command`` - - -2020-03-07 -========== - -* :vytask:`T2107` ``(bug): Wireless interfaces do not work in station mode without security`` - - -2020-03-05 -========== - -* :vytask:`T2074` ``(bug): VyOS docker container: Cannot configure ethernet interface`` - - -2020-03-04 -========== - -* :vytask:`T2098` ``(bug): Wrong call to cli-shell-api in generated op-mode templates for path completion helper`` - - -2020-03-03 -========== - -* :vytask:`T2095` ``(bug): Copy command errors out`` - - -2020-03-01 -========== - -* :vytask:`T2082` ``(bug): WireGuard broken after merging T2057`` -* :vytask:`T2089` ``(feature): RADIUS: do not query servers when commit is running started from a non RADIUS user`` -* :vytask:`T2086` ``(feature): Move sudo session open/close log entries to auth.log`` - - -2020-02-29 -========== - -* :vytask:`T2046` ``(feature): allowing sub-classes of Interface to redefine how the interface is created`` - - -2020-02-28 -========== - -* :vytask:`T2083` ``(default): vyos-build: build-packages fails at mdns-repeater due to wrong branch`` -* :vytask:`T2080` ``(default): traffic-policy shaper error when setting bandwidth`` - - -2020-02-27 -========== - -* :vytask:`T2075` ``(feature): Add support for OpenVPN tls-crypt file option`` -* :vytask:`T2068` ``(feature): Update Linux Kernel to v4.19.105`` -* :vytask:`T1703` ``(default): Macvlan PPPoE support`` -* :vytask:`T2078` ``(feature): Kernel: remove unused RAID functions 5,6,10,jbod,dm`` - - -2020-02-25 -========== - -* :vytask:`T2070` ``(feature): Rewrite (dis-)connect op-mode commands in XML and Python`` -* :vytask:`T2071` ``(feature): Add possibility to temporary disable a RADIUS server used for system login`` - - -2020-02-23 -========== - -* :vytask:`T2055` ``(feature): Remove IPv6 router-advert options for PPPoE`` -* :vytask:`T1318` ``(feature): PPPoE client CLI redesign`` - - -2020-02-22 -========== - -* :vytask:`T2063` ``(feature): vyos-salt-minion package is missing from vyos-world`` - - -2020-02-20 -========== - -* :vytask:`T1969` ``(default): OSPF with WireGuard cause Route Inactive`` - - -2020-02-18 -========== - -* :vytask:`T2034` ``(default): Removal of interfaces loopback lo removed 127.0.0.1 and ::1`` - - -2020-02-17 -========== - -* :vytask:`T2047` ``(feature): Update Linux Kernel to v4.19.104`` -* :vytask:`T2048` ``(bug): ISO boot fails when wireless adapter is present`` - - -2020-02-16 -========== - -* :vytask:`T2043` ``(bug): Bond VLANs can't be extended on the fly`` -* :vytask:`T2030` ``(bug): Bond doesn't survive reboot`` -* :vytask:`T1992` ``(bug): Adding vlan on a bond resets all BGP connections on same bond`` -* :vytask:`T1908` ``(feature): Add zone option for Cloudflare DDNS`` -* :vytask:`T1246` ``(bug): VyOS 1.2.0 "openvpn-options" configuration does not allow quotes in values`` - - -2020-02-15 -========== - -* :vytask:`T2042` ``(bug): Error on reboot after deleting "service snmp" and not "service lldp snmp enable"`` -* :vytask:`T2041` ``(bug): Adding non existent bond interface raises exception`` - - -2020-02-14 -========== - -* :vytask:`T2039` ``(bug): Wrong system type displayed in show version`` -* :vytask:`T2040` ``(bug): vyos-http-api-server should reload Config in all routes`` - - -2020-02-13 -========== - -* :vytask:`T2033` ``(feature): Drop vyos-replace package`` -* :vytask:`T1635` ``(feature): Rewrite interface pseudo-ethernet in new XML/Python style`` - - -2020-02-10 -========== - -* :vytask:`T2024` ``(feature): Migrate "system login banner" to XML/Python`` - - -2020-02-09 -========== - -* :vytask:`T2022` ``(bug): When RADIUS config is active, local logins won't work`` -* :vytask:`T2020` ``(default): Unable to log in after upgrade to 1.3-rolling-202002080217`` -* :vytask:`T1931` ``(bug): Enabling SNMP commit error`` - - -2020-02-05 -========== - -* :vytask:`T1948` ``(bug): RADIUS login broken in 1.3`` -* :vytask:`T1990` ``(feature): Migrate "system login" to XML/Python representation`` -* :vytask:`T1585` ``(default): Add letsencrypt/certbot support for 'service https'`` - - -2020-02-04 -========== - -* :vytask:`T1965` ``(bug): VyOS-1.3: ping no longer supports specifying interface or source`` - - -2020-02-02 -========== - -* :vytask:`T2011` ``(feature): Update Linux Kernel to v4.19.101`` -* :vytask:`T640` ``(bug): Images no longer work when built without "recommended" packages`` - - -2020-02-01 -========== - -* :vytask:`T2009` ``(bug): Ethernet Interface always stays down`` -* :vytask:`T1989` ``(bug): conf.get_config_dict() throws exception`` - - -2020-01-31 -========== - -* :vytask:`T1768` ``(bug): PPtP - vyos.config rewrite`` -* :vytask:`T2002` ``(bug): VLAN interfaces try to be enabled even if parent interface is A/D`` - - -2020-01-30 -========== - -* :vytask:`T1994` ``(default): lldpd not bound to specified interfaces - Fix jinja template`` -* :vytask:`T1896` ``(enhancment): Remove LLDP-MED civic_based location information`` -* :vytask:`T1724` ``(feature): wireguard - add endpoint check in verify()`` - - -2020-01-29 -========== - -* :vytask:`T1996` ``(feature): Update Linux Kernel to 4.19.99`` -* :vytask:`T1862` ``(default): Use regex pattern \s+ to split strings on whitespace in Python 3.7`` -* :vytask:`T1755` ``(bug): Python KeyError exceptions raised with 'show vpn ipsec sa' command under use of certain IPSEC cipher suites`` -* :vytask:`T1747` ``(bug): L2TP breaks after upgrading to VyOS 1.2-rolling-201910180117 [issue report and proposed solution]`` -* :vytask:`T1664` ``(bug): Ipoe with bond per vlan don't work`` -* :vytask:`T1895` ``(feature): There is not restriction on selection of syslog facility`` -* :vytask:`T1670` ``(feature): OpenVPN option for tls-auth`` - - -2020-01-26 -========== - -* :vytask:`T1937` ``(bug): snmpd throwing a tremendous amount of errors`` -* :vytask:`T1767` ``(bug): IPoE - vyos.config rewrite`` -* :vytask:`T1765` ``(bug): wireguard - vyos.config rewrite`` - - -2020-01-24 -========== - -* :vytask:`T1975` ``(bug): OpenVPN tap devices won't come up automatically`` - - -2020-01-23 -========== - -* :vytask:`T1766` ``(bug): service-pppoe - vyos.config rewrite`` - - -2020-01-21 -========== - -* :vytask:`T1784` ``(bug): DMVPN with IPSec does not work in HUB mode`` -* :vytask:`T1977` ``(bug): webproxy error on fresh install`` - - -2020-01-18 -========== - -* :vytask:`T1830` ``(feature): 1.3-rolling boots to GRUB prompt post-install on UEFI systems`` -* :vytask:`T1940` ``(bug): EFI Fresh Install fails to boot, 4K Sector Drives Fail to boot EFI`` - - -2020-01-16 -========== - -* :vytask:`T1880` ``(default): "A stop job is running for live-tools - System Support Scripts" hangs, times out when shutting down equuleus live iso`` - - -2020-01-15 -========== - -* :vytask:`T1959` ``(bug): Error message when adding IPSec VPN`` - - -2020-01-09 -========== - -* :vytask:`T1955` ``(feature): snmp - cli config val_help missing`` -* :vytask:`T1813` ``(bug): error in generated /etc/hosts file`` - - -2020-01-08 -========== - -* :vytask:`T1946` ``(bug): Recovery ifname for PPtP remote-access`` - - -2020-01-03 -========== - -* :vytask:`T1939` ``(feature): Provide abstraction for interface "ip" options`` - - -2020-01-01 -========== - -* :vytask:`T1779` ``(bug): Tunnel interfaces aren't suggested as being available for bridging`` - - -2019-12-31 -========== - -* :vytask:`T1654` ``(bug): sFlow: multiple "sflow server" not work, and "disable-imt" could break configuration`` -* :vytask:`T1923` ``(feature): Migrate L2TPv3 interface to XML/Python`` - - -2019-12-30 -========== - -* :vytask:`T1920` ``(bug): beep: Error: Running under sudo, which is not supported for security reasons.`` -* :vytask:`T1918` ``(bug): l2tp / ipsec config broken in latest daily`` -* :vytask:`T1897` ``(bug): IPSec - 1.2 to 1.3 migration failed`` -* :vytask:`T1921` ``(bug): snmp: VyOS options no longer recognized`` -* :vytask:`T1922` ``(feature): Add VXLAN IPv6 support`` -* :vytask:`T1919` ``(feature): Migrate "system options" to XML/Python representation`` - - -2019-12-28 -========== - -* :vytask:`T1916` ``(feature): Update Linux Kernel to v4.19.91`` -* :vytask:`T1915` ``(bug): Remove "system ipv6 blacklist" option`` -* :vytask:`T1912` ``(feature): Migrate "system (ip|ipv6)" to XML/Python representation`` - - -2019-12-27 -========== - -* :vytask:`T1910` ``(bug): Invalid parmissions on latest 1.3 rolling ISO images`` - - -2019-12-26 -========== - -* :vytask:`T1794` ``(bug): Interface description can't contain a colon`` -* :vytask:`T1906` ``(feature): Migrate "system time-zone" configuration to XML/Python`` - - -2019-12-23 -========== - -* :vytask:`T1898` ``(enhancment): Support multiple IPv4/IPv6 LLDP management addresses`` -* :vytask:`T1878` ``(bug): accel-ppp: pppoe single-session option implementation`` - - -2019-12-22 -========== - -* :vytask:`T393` ``(enhancment): Migrate vyatta-lldpd to vyos-1x`` - - -2019-12-20 -========== - -* :vytask:`T1892` ``(default): vyos-build: Do not install recommends in docker image [enhancement]`` -* :vytask:`T1411` ``(enhancment): equuleus: buster: vyatta-ravpn: libfreeradius-client2 is missing in buster`` - - -2019-12-19 -========== - -* :vytask:`T1873` ``(default): DHCP server fails to start due to a change in isc-dhcp-server init scripts`` - - -2019-12-18 -========== - -* :vytask:`T1889` ``(bug): Error building docker build image`` -* :vytask:`T1132` ``(default): Build on Debian Buster`` - - -2019-12-17 -========== - -* :vytask:`T1886` ``(feature): Update Linux Kernel to v4.19.89`` -* :vytask:`T1887` ``(feature): Update WireGuard to Debian release 0.0.20191212-1`` - - -2019-12-13 -========== - -* :vytask:`T1861` ``(default): hosts lost after modified static-host-mapping`` - - -2019-12-10 -========== - -* :vytask:`T1843` ``(feature): Add GCC preprocessor support for XML files`` - - -2019-12-08 -========== - -* :vytask:`T1566` ``(feature): Extend L2TP/IPSec server with IPv6`` - - -2019-12-07 -========== - -* :vytask:`T1714` ``(bug): Disable DHCP Nameservers Not Working`` - - -2019-12-06 -========== - -* :vytask:`T1860` ``(feature): Update WireGuard to Debian release 0.0.20191127-2`` -* :vytask:`T1859` ``(feature): Update Linux Kernel to v4.19.88`` -* :vytask:`T1854` ``(bug): Dynamic DNS configuration cannot be deleted`` -* :vytask:`T1849` ``(bug): DHCPv6 client does not start`` -* :vytask:`T1169` ``(bug): LLDP potentially broken`` -* :vytask:`T586` ``(bug): Cannot add ethernet vif-s vif-c interface to bridge-group`` - - -2019-12-05 -========== - -* :vytask:`T1847` ``(bug): set_level incorrectly handles path given as empty string`` - - -2019-12-04 -========== - -* :vytask:`T1787` ``(default): Failed config migration from V1.2.3 to 1.2-rolling-201911030217`` -* :vytask:`T1212` ``(bug): IPSec Tunnel to Cisco ASA drops reliably after 4.2GB transferred`` -* :vytask:`T1704` ``(feature): OpenVPN - Add support for ncp-ciphers`` - - -2019-12-03 -========== - -* :vytask:`T1782` ``(bug): pppoe0: showing as "Coming up"`` -* :vytask:`T1801` ``(bug): Unescaped backslashes in config values cause configuration failure`` - - -2019-12-02 -========== - -* :vytask:`T1840` ``(bug): PPPoE doesn't not rename pppX to pppoeX`` - - -2019-11-25 -========== - -* :vytask:`T1824` ``(bug): Permission denied: '/opt/vyatta/etc/config/vyos-migrate.log'`` - - -2019-11-24 -========== - -* :vytask:`T1673` ``(bug): vif bridge-group not migrated to bridge member interface`` -* :vytask:`T1799` ``(feature): Add support for GENEVE (Generic Network Virtualization Encapsulation)`` - - -2019-11-23 -========== - -* :vytask:`T1627` ``(feature): Rewrite wireless interface in new style XML syntax`` - - -2019-11-21 -========== - -* :vytask:`T1818` ``(default): Print name of migration script on failure`` -* :vytask:`T1814` ``(default): Add log of migration scripts run during config migration`` - - -2019-11-14 -========== - -* :vytask:`T1710` ``(default): [equuleus] buster: add patch to fix live-build missing key error`` -* :vytask:`T1804` ``(default): Add python3-psutil to docker image`` -* :vytask:`T1736` ``(default): Decide on best practice for patching live-team packages for VyOS build system`` -* :vytask:`T1424` ``(default): Rewrite the config load script`` - - -2019-11-11 -========== - -* :vytask:`T1793` ``(feature): Editing description on an interface causes BGP sessions to reset on commit`` - - -2019-11-10 -========== - -* :vytask:`T1791` ``(feature): Update Linux Kernel to 4.19.82`` - - -2019-11-08 -========== - -* :vytask:`T1789` ``(bug): ddclient not working with generated RFC2136 / nsupdate config`` - - -2019-11-03 -========== - -* :vytask:`T1777` ``(bug): Bonding interface MAC address mismatch after reboot`` -* :vytask:`T1752` ``(bug): PPPoE does not automatically start on boot`` - - -2019-11-02 -========== - -* :vytask:`T1783` ``(bug): Interface can't unpin from bridge`` - - -2019-10-22 -========== - -* :vytask:`T1756` ``(feature): Modify output to be more useful - Wireguard`` - - -2019-10-21 -========== - -* :vytask:`T1741` ``(feature): Add system wide proxy setting`` - - -2019-10-19 -========== - -* :vytask:`T1746` ``(bug): 201910180117 fails startup with 'Permission Denied' errors`` -* :vytask:`T1743` ``(default): equuleus: remove references to SSH key type "rsa1" deprecated in Debian Buster`` - - -2019-10-18 -========== - -* :vytask:`T1712` ``(default): DHCP client sometimes doesn't start`` -* :vytask:`T1604` ``(enhancment): equuleus: buster: vbash: tab completion breaks`` - - -2019-10-11 -========== - -* :vytask:`T1723` ``(bug): wireguard - Interface wg01 could not be brought up in time`` - - -2019-10-09 -========== - -* :vytask:`T1719` ``(feature): ssh deprecated options`` -* :vytask:`T1718` ``(bug): ISO check in /opt/vyatta/sbin/install-image faulty`` -* :vytask:`T1682` ``(feature): Migrate to new Jenkins Pipeline script`` - - -2019-10-08 -========== - -* :vytask:`T1717` ``(bug): disable multiple daemons to autostart at boot`` - - -2019-10-06 -========== - -* :vytask:`T1713` ``(feature): Remove deprecated packages no longer required after migration to Accel-PPP`` - - -2019-10-03 -========== - -* :vytask:`T1689` ``(feature): "reset openvpn" op-mode command should terminate and restart OpenVPN process`` - - -2019-10-01 -========== - -* :vytask:`T1706` ``(bug): wireguard broken in latest rolling`` - - -2019-09-30 -========== - -* :vytask:`T1688` ``(feature): OpenVPN - Add new cipher aes-(128|192|256)-gcm`` - - -2019-09-28 -========== - -* :vytask:`T1696` ``(bug): NTP - Tests fail when building vyos-1x`` -* :vytask:`T1512` ``(bug): vyos 1.2 openvpn client names with spaces created incorrectly`` - - -2019-09-27 -========== - -* :vytask:`T1681` ``(feature): cleanup wireguard code since tagnodes are now visible`` -* :vytask:`T1695` ``(bug): Syntax error in interface-dummy.py`` - - -2019-09-26 -========== - -* :vytask:`T1692` ``(bug): ipoe-server verify function error`` -* :vytask:`T1691` ``(bug): OpenVPN - Commiting config when OpenVPN peer/server not available makes commit hang`` -* :vytask:`T1690` ``(feature): restart op-mode commands for 'service (pppoe|ipoe)-server'`` - - -2019-09-25 -========== - -* :vytask:`T1672` ``(bug): Wireguard keys not automatically moved`` - - -2019-09-23 -========== - -* :vytask:`T1679` ``(bug): during bootup: invalid literal for int() with base 10`` -* :vytask:`T1680` ``(feature): DHCP client does not release IP address on exit/deletion`` - - -2019-09-21 -========== - -* :vytask:`T1676` ``(default): [equuleus] buster: update GRUB boot parameters during upgrade`` -* :vytask:`T1637` ``(feature): Rewrite ethernet interface in new style XML syntax`` -* :vytask:`T1675` ``(feature): OpenVPN - Specify minimum TLS version`` - - -2019-09-20 -========== - -* :vytask:`T1602` ``(default): equuleus: buster: add live build apt options for choosing vyos packages`` - - -2019-09-19 -========== - -* :vytask:`T1666` ``(feature): Deleting a bond will place member interfaces into A/D state`` - - -2019-09-17 -========== - -* :vytask:`T239` ``(bug): Improve documentation for the firewall all-ping setting`` - - -2019-09-16 -========== - -* :vytask:`T1040` ``(default): rc.local is executed too early`` - - -2019-09-15 -========== - -* :vytask:`T1662` ``(default): openvpn: 'show openvpn client' error`` -* :vytask:`T1661` ``(default): openvpn: wrong checking for existence cert files`` -* :vytask:`T1630` ``(bug): OpenVPN after changing it from root to nobody (unprivileged user) cant add routes`` - - -2019-09-13 -========== - -* :vytask:`T1660` ``(bug): Bonding dont’t work on VyOS 1.2-rolling-201909120338`` -* :vytask:`T1655` ``(enhancment): equuleus: buster: arm: vyos-accel-ppp build failes because of filename hardcoded as x86_64 in debian/rules`` - - -2019-09-12 -========== - -* :vytask:`T1572` ``(feature): Wireguard keyPair per interface`` -* :vytask:`T1545` ``(bug): IPSEC vti issue`` - - -2019-09-10 -========== - -* :vytask:`T1650` ``(feature): implement wireguard default key removal`` -* :vytask:`T1649` ``(feature): feature documentation different keypairs per interface`` -* :vytask:`T1648` ``(feature): add cli command 'delete wireguard named-key '`` - - -2019-09-09 -========== - -* :vytask:`T1639` ``(bug): wireguard pubkey change error`` - - -2019-09-07 -========== - -* :vytask:`T1640` ``(feature): Update Linux Kernel to v4.19.70`` - - -2019-09-06 -========== - -* :vytask:`T1624` ``(bug): Failed to set up config session`` -* :vytask:`T1636` ``(feature): Rewrite VXLAN in new style XML/Python`` -* :vytask:`T1479` ``(bug): libvyosconfig error reporting doesn't include line numbers`` -* :vytask:`T808` ``(feature): replace lighthttpd with nginx`` -* :vytask:`T1478` ``(bug): libvyosconfig parser does not support escaped quotes inside single-quoted strings`` - - -2019-09-04 -========== - -* :vytask:`T1632` ``(bug): OpenVPN 'push' options with quotes`` -* :vytask:`T1631` ``(bug): Multiple push-route options cause error generating openvpn configuration`` -* :vytask:`T1557` ``(feature): Create generic abstraction for configuring interfaces e.g. IP address`` -* :vytask:`T1628` ``(feature): Adopt WireGuard configuration script to new vyos.ifconfig class`` -* :vytask:`T1614` ``(feature): Rewrite bonding interface in new style XML syntax`` - - -2019-09-02 -========== - -* :vytask:`T1621` ``(default): Rewrite the rest of trivial vyatta-op commands to new syntax`` - - -2019-08-31 -========== - -* :vytask:`T1456` ``(bug): Port group cannot be configured if the same port is configured as standalone and inside a range`` - - -2019-08-28 -========== - -* :vytask:`T1615` ``(feature): After migration to pyroute2 the address DHCP statement is no longer covered`` - - -2019-08-27 -========== - -* :vytask:`T1617` ``(default): OpenVPN push route failure`` -* :vytask:`T1250` ``(bug): FRR not setting default gateway from DHCP`` - - -2019-08-26 -========== - -* :vytask:`T1591` ``(bug): OpenVPN "run show openvpn client status" does not work`` -* :vytask:`T1608` ``(feature): bridge: Bridge adding non existing interfaces is allowed but does not work`` -* :vytask:`T1548` ``(feature): Rewrite OpenVPN interface/op-commands in new style XML/Python`` -* :vytask:`T1607` ``(default): Convert 'reset conntrack' and 'reset ip[v6] cache' operations from vyatta-op to new syntax`` - - -2019-08-25 -========== - -* :vytask:`T1611` ``(default): Migration to latest rolling fails with vyos.configtree.ConfigTreeError: Path [b'interfaces bridge br0 igmp-snooping querier'] doesn't exist`` - - -2019-08-23 -========== - -* :vytask:`T1606` ``(bug): Rolling release no longer boots after adding hostname daemon`` - - -2019-08-21 -========== - -* :vytask:`T1601` ``(feature): Rewrite loopback interface type with new style XML/Python interface`` -* :vytask:`T1596` ``(default): Convert 'telnet' and 'traceroute' vyatta-op commands to new syntax`` - - -2019-08-20 -========== - -* :vytask:`T1595` ``(feature): Migrate deprecated "service dns forwarding listen-on" to listen-address`` - - -2019-08-19 -========== - -* :vytask:`T1580` ``(feature): Rewrite dummy interface type with new style XML/Python interface`` -* :vytask:`T1590` ``(default): Convert 'show system' operations from vyatta-op to python/xml syntax`` - - -2019-08-17 -========== - -* :vytask:`T1592` ``(feature): Update Linux Kernel to v4.19.67`` - - -2019-08-15 -========== - -* :vytask:`T1584` ``(default): equuleus: buster: add consistent grub options for predictable interface names`` - - -2019-08-13 -========== - -* :vytask:`T1556` ``(feature): Rewrite Bridge in new style XML syntax`` - - -2019-08-09 -========== - -* :vytask:`T1569` ``(feature): interfaceconfig class documetation`` - - -2019-08-05 -========== - -* :vytask:`T1562` ``(feature): Change version scheme on current branch used for rolling releases`` - - -2019-08-04 -========== - -* :vytask:`T1561` ``(bug): VyOS rolling ISO cluttered with vyatta-ravpn Git Repo`` - - -2019-08-02 -========== - -* :vytask:`T853` ``(feature): Add SSTP server support`` -* :vytask:`T742` ``(feature): Replace poptop and xl2tpd with accel-ppp`` - - -2019-08-01 -========== - -* :vytask:`T1544` ``(feature): L2TP documentation`` - - -2019-07-31 -========== - -* :vytask:`T1552` ``(feature): accel-ppp: SSTP documentation`` -* :vytask:`T1553` ``(default): equuleus: buster: add 'noautologin' to boot parameters`` - - -2019-07-29 -========== - -* :vytask:`T1532` ``(default): [equuleus] buster: GPG error on vyos package repository`` - - -2019-07-28 -========== - -* :vytask:`T1547` ``(feature): accel-ppp/L2TP restructure CLI`` -* :vytask:`T1546` ``(bug): accel-ppp/L2TP radius-source address is not honored`` - - -2019-07-23 -========== - -* :vytask:`T1533` ``(bug): Rolling builds broken!`` -* :vytask:`T1489` ``(feature): Add vlan_mon usage at Accel`` - - -2019-07-22 -========== - -* :vytask:`T1435` ``(enhancment): Make ip-address [OPTIONAL] (in dhcp-server -> static-mapping) to cope with "unfriendly" client-hostnames of IoT-Devices`` - - -2019-07-21 -========== - -* :vytask:`T823` ``(feature): Rewrite DHCP op mode in the new style`` - - -2019-07-18 -========== - -* :vytask:`T1497` ``(bug): "set system name-server" generates invalid/incorrect resolv.conf`` -* :vytask:`T533` ``(feature): Support for PPPoE MTU greater than 1492`` - - -2019-07-08 -========== - -* :vytask:`T1510` ``(feature): [IPoE] vlan-mon option implementation`` -* :vytask:`T1508` ``(feature): [pppoe] migration script for service pppoe-server interface`` -* :vytask:`T1494` ``(feature): accel-ppp: IPoE update documentation`` -* :vytask:`T989` ``(feature): Add support for IPoE server`` - - -2019-07-03 -========== - -* :vytask:`T1502` ``(feature): Add build sanity checking tools to the dev builds`` - - -2019-07-02 -========== - -* :vytask:`T1099` ``(default): Openvpn: use config files instead of one long command.`` -* :vytask:`T1495` ``(feature): accel-ppp: IPoE implement IPv6 PD`` - - -2019-07-01 -========== - -* :vytask:`T1498` ``(bug): Nameservers are not propagated into resolv.conf`` - - -2019-06-24 -========== - -* :vytask:`T1482` ``(feature): Add OpenVPN SHA384 hashing algorithm`` - - -2019-06-23 -========== - -* :vytask:`T1476` ``(bug): Update PowerDNS recursor to 4.2 series`` - - -2019-06-22 -========== - -* :vytask:`T1313` ``(feature): Add support for reusable build flavours`` -* :vytask:`T1202` ``(bug): Add `hvinfo` to the packages directory`` - - -2019-06-20 -========== - -* :vytask:`T1413` ``(enhancment): equuleus: buster: vyos-xe-guest-utilities is not installable and breaks live-build`` -* :vytask:`T1412` ``(enhancment): equuleus: buster: vyos-netplug is not installable and breaks live-build`` - - -2019-06-19 -========== - -* :vytask:`T1334` ``(feature): Migration script runner rewrite`` -* :vytask:`T1327` ``(bug): Set the serial console speed to 115200 by default`` - - -2019-06-18 -========== - -* :vytask:`T1451` ``(bug): Intel e1000e driver missing in lates rolling release`` - - -2019-06-17 -========== - -* :vytask:`T1408` ``(feature): pppoe-server - implement local-ipv6 for pure IPv6 based deployments`` - - -2019-06-12 -========== - -* :vytask:`T1397` ``(default): Rewrite the config merge script`` - - -2019-06-05 -========== - -* :vytask:`T1426` ``(default): Update the script that checks conntrack hash-size on reboot`` - - -2019-06-03 -========== - -* :vytask:`T1423` ``(default): When merging remote config files, create known_hosts file if not present.`` - - -2019-05-28 -========== - -* :vytask:`T1410` ``(feature): Upgrade Linux Kernel to 4.19.46`` - - -2019-05-26 -========== - -* :vytask:`T1404` ``(feature): Update iproute2 package to 4.19`` - - -2019-05-24 -========== - -* :vytask:`T1407` ``(bug): pppoe IPv6 PD documention by practical example`` - - -2019-05-23 -========== - -* :vytask:`T1402` ``(feature): Update Linux Kernel to 4.19.45`` - - -2019-05-22 -========== - -* :vytask:`T1399` ``(bug): accel-ppp kernel modules missing in rolling build 20190522`` -* :vytask:`T1393` ``(bug): pppoe IPv6 pool doesn't work`` - - -2019-05-21 -========== - -* :vytask:`T592` ``(bug): lldpcli: unknown command from argument 1: `#``` - - -2019-05-16 -========== - -* :vytask:`T1267` ``(feature): FRR: Add interface name for static routes`` -* :vytask:`T1148` ``(bug): epa2 BGP peers initiate before config is fully loaded, routes leak.`` - - -2019-05-06 -========== - -* :vytask:`T1368` ``(feature): Enable MPLS support in Linux Kernel`` - - -2019-05-04 -========== - -* :vytask:`T1365` ``(bug): Cannot configure syslog on 1.2.0-rolling+201904260337`` - - -2019-04-29 -========== - -* :vytask:`T1352` ``(feature): vyos-documentaion: accel-pppoe adding CIDR based IP pool option`` - - -2019-04-21 -========== - -* :vytask:`T1348` ``(feature): Upgrade WireGuard to 0.0.20190406-1`` -* :vytask:`T1347` ``(feature): Upgrade Linux Kernel to 4.19.36`` - - -2019-04-20 -========== - -* :vytask:`T1344` ``(feature): Unclutter "system login radius" configuration nodes`` - - -2019-04-19 -========== - -* :vytask:`T1325` ``(default): GRE tunnel to Cisco router fails in 1.2.0 - works in 1.1.8`` - - -2019-04-16 -========== - -* :vytask:`T1184` ``(feature): wireguard - extend documentation with the show interface wireguard commands`` - - -2019-04-15 -========== - -* :vytask:`T1260` ``(feature): VICI-based implementation of "run show vpn ipsec sa"`` -* :vytask:`T1248` ``(default): Add a function for copying nodes to the vyos.configtree library`` - - -2019-04-05 -========== - -* :vytask:`T1324` ``(feature): update documtation for 'set system login user level'`` - - -2019-04-04 -========== - -* :vytask:`T1323` ``(feature): migrate operator accounts to admin accounts and remove the option to setup an operator account`` - - -2019-03-20 -========== - -* :vytask:`T405` ``(feature): Add binaries for lcdproc`` - - -2019-03-12 -========== - -* :vytask:`T1284` ``(feature): accel-ppp: pptp implementation documention`` -* :vytask:`T833` ``(feature): New PPTP server implementation based on accel-ppp`` - - -2019-02-22 -========== - -* :vytask:`T1257` ``(bug): implement 'set system static-host-mapping' in host_name.py and remove old function calls`` - - -2019-02-21 -========== - -* :vytask:`T1214` ``(bug): Add `ipaddrcheck` to the packages directory`` - - -2019-02-10 -========== - -* :vytask:`T1154` ``(default): use of local cache to build iso`` - - -2019-02-09 -========== - -* :vytask:`T1236` ``(feature): Update Linux Kernel`` diff --git a/docs/changelog/1.4.md b/docs/changelog/1.4.md new file mode 100644 index 00000000..cd50127e --- /dev/null +++ b/docs/changelog/1.4.md @@ -0,0 +1,4457 @@ +# 1.4 Sagitta + +% Please don't add anything by hand. +% This file is managed by the script: +% _ext/releasenotes.py + +## 2024-04-25 + +- {vytask}`T6263` `(bug): Multicast: Could not commit multicast config with multicast join group using source-address` +- {vytask}`T5833` `(bug): Not all AFIs compatible with VRF` + +## 2024-04-24 + +- {vytask}`T6255` `(bug): Static table description should not contain white-space` +- {vytask}`T6226` `` (feature): add HAPROXY `tcp-request content accept` related block to load-balancing reverse proxy config `` +- {vytask}`T6109` `(bug): remote syslog do not get all the logs` +- {vytask}`T6217` `(feature): VRRP contrack-sync script change name of the logger` +- {vytask}`T6244` `(feature): Spacing of "Show System Uptime" hard to parse` + +## 2024-04-23 + +- {vytask}`T6260` `(bug): image-tools: remove failed image directory if 'No space left on device' error` +- {vytask}`T6261` `(default): Typo in op_mode connect_disconnect print statement for check_ppp_running` +- {vytask}`T6237` `(feature): IPSec remote access VPN: ability to set EAP ID of clients` + +## 2024-04-22 + +- {vytask}`T5996` `(bug): unescape backslashes for config save, compare commands` +- {vytask}`T6103` `(bug): DHCP-server bootfile-name double slash syntax weird behaviour` +- {vytask}`T6080` `(default): Default NTP server settings` +- {vytask}`T5986` `(bug): Container: Error on commit when environment variable value contains \n line break` + +## 2024-04-21 + +- {vytask}`T6191` `(bug): Policy Route TCP-MSS Behavior Different from 1.3.x` +- {vytask}`T5535` `(feature): disable-directed-broadcast should be moved to firewall global-options` + +## 2024-04-20 + +- {vytask}`T6252` `(bug): gre tunnel - doesn't allow configure jumbo frame more than 8024` + +## 2024-04-19 + +- {vytask}`T6221` `(bug): Enabling VRF breaks connectivity` +- {vytask}`T6035` `(bug): QoS policy shaper queue-type random-detect requires limit avpkt` +- {vytask}`T6246` `(feature): Enable basic haproxy http-check configuration options` +- {vytask}`T6242` `(feature): Loadbalancer reverse-proxy: SSL backend skip CA certificate verification` + +## 2024-04-17 + +- {vytask}`T6168` `(bug): add system image does not set default boot to current console type in compatibility mode` +- {vytask}`T6243` `(bug): Update vyos-http-api-tools for package idna security advisory` +- {vytask}`T6154` `(enhancment): Installer should ask for password twice` +- {vytask}`T5966` `(default): Adjust dynamic dns configuration address subpath to be more intuitive and other op-mode adjustments` +- {vytask}`T5723` `(default): mdns repeater: Always reload systemd daemon before applying changes` +- {vytask}`T5722` `(bug): Failing to add route in failover if gateway not in the same interface network` +- {vytask}`T5612` `(default): Miscellaneous improvements and fixes for dynamic DNS configuration` +- {vytask}`T5574` `(default): Support per-service cache management for dynamic dns providers` +- {vytask}`T5360` `(bug): ddclient generating abuse` + +## 2024-04-15 + +- {vytask}`T6100` `(bug): NAT config migration error in 1.4.0-epa1 if invalid address/network defined in 1.3.6 version` +- {vytask}`T5734` `(bug): OpenVPN server dh-params that are not in PKI error` + +## 2024-04-14 + +- {vytask}`T6210` `(feature): Add container ability to configure capability sys-nice` + +## 2024-04-13 + +- {vytask}`T6173` `(bug): Build Causes Errors When "--version" Contains Slashes ("/")` +- {vytask}`T2518` `(feature): Support NAT for ipv6(NPT)` +- {vytask}`T6238` `(default): vyos-build Check pull request title requires the python script` +- {vytask}`T6235` `(default): Git check PR status: conflicts and resolution` + +## 2024-04-12 + +- {vytask}`T5872` `(default): ipsec remote access VPN: support dhcp-interface` +- {vytask}`T6216` `(bug): Upgrade error from 1.3 to 1.4 - Firewall using character '+'` +- {vytask}`T6214` `(bug): Error when using some constraints` +- {vytask}`T6213` `(bug): Firewall group constraints` +- {vytask}`T6148` `(bug): Reset vpn ipsec command breaks tunnel and does not reset SAs that are down` +- {vytask}`T1487` `(default): DNS (pdns_recursor) stats logs not saved to disk` +- {vytask}`T6222` `(bug): VRRP rfc3768-compatibility not working correctly when resulting interface name is over 15 characters` +- {vytask}`T6218` `(bug): Container network interface in VRF fails to generate IPv6 link-local address` +- {vytask}`T5959` `(default): Streamline dns forwarding service` +- {vytask}`T5846` `(default): Refactor and simplify DUID definition in conf-mode` +- {vytask}`T5631` `(feature): Ability to export the current configuration in JSON format` +- {vytask}`T5615` `(default): Narrow down spurious name conflict with mdns` +- {vytask}`T5530` `(default): Add LFA to IS-IS` +- {vytask}`T5195` `(default): Break up the vyos.util module` +- {vytask}`T5124` `(bug): Python3 deprecation distutils.version import LooseVersion` +- {vytask}`T1871` `(feature): add MTU option when configure limiter traffic-policy` +- {vytask}`T874` `(feature): Support for Two Factor Authentication for CLI access via Google Authenticator/OTP` +- {vytask}`T6204` `(default): Remove shebang lines from Python modules` +- {vytask}`T6166` `(bug): Tech support generation error for custom output location` +- {vytask}`T6062` `(feature): container: add support for image manipulation based on tag name` +- {vytask}`T5877` `(default): Reduce unnecessary nesting in system domain-search path and improve smoketest` +- {vytask}`T5871` `(default): ipsec remote access VPN: specify "cacerts" to disambiguate mulitple remote access configurations` +- {vytask}`T5870` `(default): ipsec remote access VPN: add x509 ("pubkey") authentication` +- {vytask}`T5772` `(default): Require HTTPS API server configurations to include at least one key if key-based auth is used` +- {vytask}`T5447` `(feature): Allow static MACsec keys with peers` +- {vytask}`T4221` `(default): Add a template filter for converting scalars to single-item lists` +- {vytask}`T3766` `(feature): containers: Expanding options for networking and building containers` + +## 2024-04-11 + +- {vytask}`T4516` `(feature): Rewrite system image manipulation tools in Python` +- {vytask}`T4548` `(feature): GRUB loader configuration rework` +- {vytask}`T3774` `(bug): atop logs are not limited in size` +- {vytask}`T3574` `(default): Add constraintGroup for combining validators with logical AND` +- {vytask}`T3474` `(default): Revisit storing syntax version of interface definitions in XML file` +- {vytask}`T160` `(feature): Support NAT64` +- {vytask}`T6228` `(bug): Cleanup of not existing units` + +## 2024-04-10 + +- {vytask}`T6207` `(bug): image-tools: restore ability to copy config.boot.default on image install` +- {vytask}`T5750` `(bug): Upgrade from 1.3.4 to 1.4 Rolling fails QoS` +- {vytask}`T5858` `(bug): Show conntrack statistics formatting is all over the place` +- {vytask}`T4734` `(feature): Feature Request: openvpn: add OTP 2FA support` + +## 2024-04-09 + +- {vytask}`T3409` `(feature): Add back TCP-MSS Clamp to PMTU` +- {vytask}`T6121` `(feature): Extend service config-sync for sections vpn, policy, vrf` + +## 2024-04-08 + +- {vytask}`T6197` `(bug): IPoE-server interface client-subnet looks broken or works with the wrong logic` +- {vytask}`T6196` `(bug): Route-map and summary-only do not work in BGP aggregation at the same time` +- {vytask}`T6068` `(feature): dhcp server: allow switching between load-balanced and hotspare mode` + +## 2024-04-07 + +- {vytask}`T6205` `(bug): ipoe: error in migration script logic while renaming mac-address to mac node` +- {vytask}`T6039` `(bug): cloud-init DNS search-domain causes configuration migration/validation error` +- {vytask}`T5862` `(bug): Default MTU is not acceptable in some environments` +- {vytask}`T6208` `(feature): container: rename "cap-add" CLI node to "capability"` +- {vytask}`T6188` `(feature): Add Firewall Rule Description to "show firewall" commands` +- {vytask}`T1244` `(default): Support for StartupResync in conntrackd` + +## 2024-04-06 + +- {vytask}`T6203` `(enhancment): Remove obsoleted xml lib` +- {vytask}`T6202` `(bug): Multi-Protocol BGP is broken by 6PE patch in upstream FRR 9.1` + +## 2024-04-05 + +- {vytask}`T6089` `(bug): [1.3.6->1.4.0-epa1 Migration] "ospf passive-interface default" incorrectly added` +- {vytask}`T2590` `(bug): DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c` +- {vytask}`T6199` `(feature): spring cleaning - drop unused Python imports` + +## 2024-04-04 + +- {vytask}`T6119` `(default): Use a compliant TOML parser` +- {vytask}`T6171` `(feature): dhcp server fail-over - Rename fail-over node` +- {vytask}`T6115` `(bug): Build from Git tags fail` +- {vytask}`T5122` `(feature): Move "archive-areas" to defaults.toml to support "non-free-firmware" repository` +- {vytask}`T5121` `(bug): Incorrect "architecture" config loaded` +- {vytask}`T4951` `(default): Add an op mode exception for cases when operations fail due to insufficient system resources` +- {vytask}`T4883` `(default): Add a description field for routing tables` +- {vytask}`T4796` `(bug): build-vyos-image ignores multiple options` +- {vytask}`T4795` `(feature): Cleanup custom python validators` +- {vytask}`T4761` `(default): Add a generic URL validator` +- {vytask}`T3843` `(bug): l2tp configuration not cleared after delete` +- {vytask}`T3681` `(default): The VMware Tools resume script did not run successfully in this virtual machine.` +- {vytask}`T1991` `(feature): Rework time services` +- {vytask}`T5711` `(default): Put the version data file inside the ISO image` +- {vytask}`T5672` `(default): Remove the old-style command definition importer` +- {vytask}`T5639` `(default): Group vyos-1x dependencies by their VyOS components and specify their purpose` +- {vytask}`T5638` `(default): Add support for requiring numeric values to be ranges rather than single numbers` +- {vytask}`T5634` `(default): Remove support for Blowfish and DES from OpenVPN` +- {vytask}`T5605` `(default): Do not generate keysize option in OpenVPN configs` +- {vytask}`T5582` `(default): Add a command to force NTP sync` +- {vytask}`T5449` `(default): Add options for TCP MSS probing` +- {vytask}`T4440` `(default): Add OCI compliant image labels to vyos-build and vyos containers` +- {vytask}`T671` `(enhancment): Identify and remove dead code` +- {vytask}`T5109` `(feature): Improve OCaml XML validator` +- {vytask}`T1449` `(feature): Add opportunity to include custom default configs (few) at building` + +## 2024-04-03 + +- {vytask}`T6198` `(feature): configverify: add common helper for PKI certificate validation` +- {vytask}`T6192` `(feature): Multi VRF support for SSH` + +## 2024-04-02 + +- {vytask}`T6167` `(bug): VNI not set on VRF after reboot` +- {vytask}`T6151` `(default): BGP VRF - Route-leaking not work when the next-hop is a recursive route.` +- {vytask}`T6033` `(bug): hsflowd fails to start when using a tunnel interface` + +## 2024-04-01 + +- {vytask}`T6195` `(feature): dropbear: package upgrade 2022.83-1 -> 2022.83-1+deb12u1` +- {vytask}`T6193` `(bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP name-server option" for VLAN interfaces` +- {vytask}`T6178` `(bug): Reverse-proxy should check that certificate exists during commit` + +## 2024-03-31 + +- {vytask}`T6186` `(bug): Fix regression in 'set system image default-boot'` +- {vytask}`T5832` `(feature): Keepalived: Allow using the 'dev' statement on excluded-addresses` + +## 2024-03-28 + +- {vytask}`T6147` `(bug): Conntrack not working as expected with global state-policy` +- {vytask}`T6175` `(bug): op-mode: "renew dhcp interface " does not check if it's an actual DHCP interface` + +## 2024-03-26 + +- {vytask}`T6066` `(bug): Setting same network in different ospf area will raise exception` + +## 2024-03-25 + +- {vytask}`T6145` `(bug): Service config-sync does not rely on priorities but must` + +## 2024-03-24 + +- {vytask}`T6161` `(feature): Output container images as JSON` +- {vytask}`T6165` `(bug): grub: vyos-grub-update failed to start on "slow" systems` +- {vytask}`T6085` `(bug): VTI interfaces are in UP state by default` +- {vytask}`T6152` `(bug): Kernel panic for ZimaBoard 232` + +## 2024-03-23 + +- {vytask}`T6160` `(bug): isis: NameError: name 'process' is not defined` +- {vytask}`T6131` `(bug): Disabling openvpn interface(s) causes OSPF to fail to load on reboot` +- {vytask}`T4022` `(feature): Add package nat-rtsp-dkms` + +## 2024-03-22 + +- {vytask}`T6136` `(bug): Configuring a dynamic address group, config script did not check whether the group was created` +- {vytask}`T6130` `(bug): [1.3.6->1.4.0-epa2 Migration] BGP "set community" missing` +- {vytask}`T6090` `(bug): [1.3.6->1.4.0-epa1 Migration] policy route fails due tcp flag case sensitivity` +- {vytask}`T6155` `(default): ixgbe: failed to initialize because an unsupported SFP+ module type was detected.` +- {vytask}`T6125` `(feature): Support 802.1ad (0x88a8) vlan filtering for bridge` +- {vytask}`T5624` `(default): Remove /etc/debian_version from the image` + +## 2024-03-21 + +- {vytask}`T6143` `(feature): Increase configuration timeout range for service config-sync` + +## 2024-03-20 + +- {vytask}`T6133` `(feature): Add domain-name to commit-archive` +- {vytask}`T6129` `(feature): bgp: add route-map option "as-path exclude all"` + +## 2024-03-19 + +- {vytask}`T6127` `(bug): Ability to view logs for rules with Offload not functional` +- {vytask}`T6138` `(bug): Conntrack table op-mode fails with flowtable offload entries` + +## 2024-03-15 + +- {vytask}`T6118` `(feature): radvd: RFC8781: add nat64prefix support` + +## 2024-03-12 + +- {vytask}`T6020` `(bug): VRRP health-check script is not applied correctly in keepalived.conf` +- {vytask}`T5646` `(bug): QoS policy limiter broken if class without match` +- {vytask}`T2433` `(feature): Improve CLI value validator performance` +- {vytask}`T1436` `(bug): Config entries with default values do not correctly show as changed` + +## 2024-03-11 + +- {vytask}`T6098` `(bug): Description doesnt seem to allow for non international characters` +- {vytask}`T6070` `(bug): bnx2x NIC causes a commit error due to incorrect implementation of EEE status reading` +- {vytask}`T2998` `(bug): SNMP v3 oid "exclude" option doesn't work` +- {vytask}`T6107` `(bug): Nginx does not allow big config queries for configure endpoint API` +- {vytask}`T6096` `(bug): Config commits are not synced properly because 00vyos-sync is deleted by vyos-router` +- {vytask}`T6093` `(bug): Incorrect dhcp-options vendor-class-id regex` +- {vytask}`T6083` `(feature): ethtool: move string parsing to JSON parsing` +- {vytask}`T6069` `(bug): HTTP API segfault during concurrent configuration requests` +- {vytask}`T6057` `(feature): Add ability to disable syslog for conntrackd` +- {vytask}`T5504` `(feature): Keepalived VRRP ability to set more than one peer-address` +- {vytask}`T5717` `(feature): ospfv3 - add allow to set metric-type to ospf redistribution while frr docs says its possible.` +- {vytask}`T6071` `(bug): firewall: CLI description limit of 256 characters cause config upgrade issues` + +## 2024-03-08 + +- {vytask}`T6086` `(bug): NAT does not work with network-groups` +- {vytask}`T6094` `(bug): Destination Nat not Making Firewall Rules` +- {vytask}`T6061` `(bug): connection-status nat destination firewall filter not working in 1.4.0-epa1` +- {vytask}`T6075` `(bug): Applying firewall rules with a non-existent interface group` + +## 2024-03-07 + +- {vytask}`T6104` `(bug): Regression in commit-archive for non-interactive configuration` +- {vytask}`T6084` `(bug): OpenNHRP DMVPN configuration file clean after reboot if we have any IPSec configuration` +- {vytask}`T5348` `(bug): Service config-sync can freeze the secondary router if it has commit-archive location` +- {vytask}`T6073` `(bug): Conntrack/NAT not being disabled when VRFs are defined` +- {vytask}`T6095` `(default): Tab completion for "set interfaces wireless wlan0 country-code" incorrect country "uk"` + +## 2024-03-06 + +- {vytask}`T6079` `(bug): dhcp: migration fails for duplicate static-mapping` + +## 2024-03-05 + +- {vytask}`T5903` `(bug): NHRP don´t start on reboot from version 1.5-rolling-202401010026` +- {vytask}`T2447` `(feature): Additional Boot Argument Configuration to limit CPU C-States` + +## 2024-03-04 + +- {vytask}`T6054` `(bug): load-balancing wan - doesn't configure a list of ports` +- {vytask}`T6087` `(feature): ospfv3: add support to redistribute IS-IS routes` + +## 2024-03-02 + +- {vytask}`T6081` `(bug): QoS policy shaper target and interval wrong calcuations` + +## 2024-02-29 + +- {vytask}`T6078` `(feature): Update ethtool to 6.6` +- {vytask}`T6077` `(feature): banner: implement ASCII contest winner default logo` +- {vytask}`T6074` `(feature): container: do not allow deleting images which have a container running` + +## 2024-02-28 + +- {vytask}`T6055` `(bug): PKI error: "failed to install x value" when executed the command from conf mode` +- {vytask}`T4270` `(bug): dns forwarding - When "ignore-hosts-file" is unset, local hostname of router resolves to 127.0.1.1` + +## 2024-02-27 + +- {vytask}`T6065` `(bug): Duplicate lines in build-vyos-image script cause sagitta build to fail` +- {vytask}`T5080` `(bug): Conntrack enabled by default` + +## 2024-02-26 + +- {vytask}`T6064` `(bug): Can not build VyOS if repository it not cloned to a branch` +- {vytask}`T5754` `(default): Update to StrongSwan 5.9.11` + +## 2024-02-25 + +- {vytask}`T6060` `(feature): op-mode: container: support removing all container images at once` + +## 2024-02-24 + +- {vytask}`T5909` `(bug): Container registry with authentication prevents config load (section container) after reboot` + +## 2024-02-23 + +- {vytask}`T5376` `(bug): Conntrack FTP helper does not work properly` +- {vytask}`T970` `(feature): Hostname Support in NAT and Firewall Rules` +- {vytask}`T4940` `(feature): Interface debugging` + +## 2024-02-22 + +- {vytask}`T6048` `(bug): Exception in event handler script` +- {vytask}`T3902` `(bug): Firewall does not load on boot, address-group not found, even though it exists` + +## 2024-02-21 + +- {vytask}`T6050` `(bug): Wrong scripting commands descriptions in accel-ppp services` + +## 2024-02-19 + +- {vytask}`T5971` `(default): Create the same view of ppp section for all accel-ppp services` +- {vytask}`T6029` `(default): Rewrite Accel-PPP services to an identical feature set` +- {vytask}`T3722` `(bug): op-mode IPSec show vpn ike sa always shows L-TIME 0` + +## 2024-02-18 + +- {vytask}`T6043` `(bug): VxLAN and bridge error bug` +- {vytask}`T6041` `(bug): image-tools: install fails from PXE boot into live iso due to restrictive logic` + +## 2024-02-17 + +- {vytask}`T5972` `(feature): login: add possibility to disable individual local user accounts` + +## 2024-02-16 + +- {vytask}`T6009` `(bug): Firewall - Time not working properly when not using UTC` +- {vytask}`T6005` `(bug): Error on adding a wireguard interface to OSPFv3` +- {vytask}`T2113` `(bug): OpenVPN Options error: you cannot use --verify-x509-name with --compat-names or --no-name-remapping` +- {vytask}`T6019` `(feature): Bump nftables and libnftnl version` +- {vytask}`T3471` `(bug): DHCP hook is not able to detect all running DHCP instances` +- {vytask}`T6015` `(default): "journalctl_charon" file does not contain data in the generated "ipsec debug-archive" file` +- {vytask}`T6001` `(default): Add option to enable resolve-via-default` +- {vytask}`T5965` `(bug): WWAN modems using raw-ip do not work with dhclient/dhcp6c` +- {vytask}`T5418` `(bug): PPPoE-Server Client IP pool Subnet` +- {vytask}`T5245` `(bug): Wireless interfaces do not get IPv6 link-local address assigned` + +## 2024-02-15 + +- {vytask}`T5977` `(bug): nftables: Operation not supported when using match-ipsec in outbound firewall` +- {vytask}`T2612` `(bug): HTTPS API, changing API key fails but goes through` +- {vytask}`T5989` `(bug): IP subnets not usable in UPnP ACLs` +- {vytask}`T5890` `(default): OTP key generation is broken` +- {vytask}`T5719` `(default): mdns repeater: Add op-mode commands` +- {vytask}`T4839` `(feature): Dynamic Firewall groups` +- {vytask}`T4801` `(feature): Support for building AWS-ready ISO` +- {vytask}`T3993` `(enhancment): Extend HTTP API GraphQL support` +- {vytask}`T3991` `(bug): PKI operational command return traceback` +- {vytask}`T3780` `(bug): VTI not being brought down when tunnel is down` +- {vytask}`T3001` `(feature): Disable spectre mitigation patches from CLI` +- {vytask}`T562` `(feature): PDNS: Add support for authoritative dns server` +- {vytask}`T71` `(feature): Add virtual IP and route installation policy options for IPsec` +- {vytask}`T5496` `` (default): `show firewall` error `` +- {vytask}`T4038` `` (default): Rewrite `vyatta-image-tools.pl` in Python `` +- {vytask}`T4997` `(default): Add DHCP client user hooks dir` +- {vytask}`T775` `(feature): Config Sync between two VyOS routers` +- {vytask}`T381` `(feature): config nodes for EasyRSA CAs` +- {vytask}`T118` `(feature): Native Zabbix Support` + +## 2024-02-14 + +- {vytask}`T6034` `(feature): rpki: move file based SSH keys for authentication to PKI subsystem` +- {vytask}`T5981` `(bug): IPsec site-to-site migrated PKI ca certificates are created with an '@'` +- {vytask}`T5930` `(bug): vrf - route-leak not work using route-target both command.` +- {vytask}`T5709` `(bug): IPoE-server fails if next pool mentioned but not defined` +- {vytask}`T4119` `(bug): Issue with l2tp remote-access ipv6 configuration` +- {vytask}`T2044` `(bug): RPKI doesn't boot properly` +- {vytask}`T6032` `(feature): bgp: add EVPN MAC-VRF Site-of-Origin support` +- {vytask}`T5960` `(default): Rewriting authentication section in accel-ppp services` + +## 2024-02-13 + +- {vytask}`T5928` `(bug): Configuration fails to load on boot if offloading has VLAN interfaces defined` +- {vytask}`T5482` `(bug): Chrony NTP Server Fails To Sync Time` +- {vytask}`T5064` `(bug): Value validation for domain-groups seems to be broken` + +## 2024-02-12 + +- {vytask}`T6010` `(bug): Support setting multiple values in BGP path-attribute` +- {vytask}`T6004` `(bug): RPKI is not configured` +- {vytask}`T5952` `(default): DHCP allow same MAC Address on same subnet` +- {vytask}`T5849` `(feature): Add SRv6 route commands` + +## 2024-02-10 + +- {vytask}`T6023` `(bug): rpki: add support for CLI knobs expire-interval and retry-interval` +- {vytask}`T1090` `(default): Webproxy overhaul` + +## 2024-02-09 + +- {vytask}`T6028` `(bug): QoS policy shaper wrong class_id_max and default_minor_id` +- {vytask}`T6026` `(bug): QoS hide attempts to delete qdisc from devices` +- {vytask}`T5788` `(feature): frr: update to 9.1 release` +- {vytask}`T5703` `(bug): QoS config on pppoe interface resets back to fq_codel after tunnel reboots` +- {vytask}`T5685` `(feature): Keepalived VRRP prefix is not necessary for the virtual address` + +## 2024-02-08 + +- {vytask}`T6014` `(feature): Bump keepalived version` +- {vytask}`T5910` `(bug): Grub problem(?) Serial Console no longer working` +- {vytask}`T6021` `(bug): QoS r2q wrong calculation` + +## 2024-02-07 + +- {vytask}`T6017` `(bug): Update vyos-http-api-tools for security advisory` +- {vytask}`T6016` `(bug): Resolve intermittent failures in cleanup function after failed image install` +- {vytask}`T6024` `(feature): bgp: add additional missing FRR features` +- {vytask}`T6011` `(feature): rpki: known-hosts-file is no longer supported by FRR CLI - remove VyOS CLI node` +- {vytask}`T5998` `(feature): replay_window setting under vpn in config` + +## 2024-02-06 + +- {vytask}`T6018` `(default): smoketest: updating http-api framework requires a pause before test` +- {vytask}`T5921` `(bug): Trying to commit an OpenConnect configuration without any local users results in an exception` +- {vytask}`T5687` `(feature): Implement ECS settings for PowerDNS recursor` + +## 2024-02-05 + +- {vytask}`T5974` `(bug): QoS policy shaper is currently miscalculating bandwidth and ceil values for the default class` +- {vytask}`T5865` `(feature): Rewrite ipv6 pool section to ipv6 named pools in Accel-ppp services` + +## 2024-02-02 + +- {vytask}`T5739` `(bug): Password recovery does not work if public keys are configured` +- {vytask}`T5955` `(feature): Rootless containers/set uid/gid for container` +- {vytask}`T5941` `(bug): [1.3.5 -> 1.4.0-RC1 Migration] Orphaned Configuration Nodes Cause Issues` +- {vytask}`T6003` `(feature): Add 'show rpki as-number' and 'show rpki prefix'` +- {vytask}`T5848` `(feature): Add triple-isolate flow isolation option to CAKE QoS policy` + +## 2024-02-01 + +- {vytask}`T5995` `(bug): Kernel NIC-drivers for Huawei NICs are not properly enabled` +- {vytask}`T5978` `(bug): ethernet: hw-tc-offload does not actually get enabled on the NIC` +- {vytask}`T5979` `(enhancment): Add configurable kernel boot parameters` +- {vytask}`T5973` `(bug): vrf: RTNETLINK answers: File exists` +- {vytask}`T5967` `(bug): Multi-hop BFD connections can't be established; please add minimum-ttl option.` +- {vytask}`T5619` `(default): Update the Intel ixgbe driver due to issues with Intel X533` + +## 2024-01-31 + +- {vytask}`T6000` `(bug): [1.3.x -> 1.5.x] migrating threw exception in /opt/vyatta/etc/config-migrate/migrate/https/5-to-6, performed workaround` +- {vytask}`T5999` `(bug): load-balancing reverse-proxy can't configure root as a redirect` + +## 2024-01-30 + +- {vytask}`T5980` `(feature): Add image-tools support for configurable kernel boot options` + +## 2024-01-29 + +- {vytask}`T5988` `(bug): image-tools: a check of valid image name is missing from 'add image'` +- {vytask}`T5994` `(bug): Fix typo in 'remote' module preventing 'add system image' via ftp` + +## 2024-01-26 + +- {vytask}`T5957` `(bug): Firewall fails to delete inbound-interface name` +- {vytask}`T5779` `(bug): custom conntrack timeout rule not applicable` +- {vytask}`T5984` `(feature): Add user util numactl` + +## 2024-01-25 + +- {vytask}`T5983` `(bug): image-tools: minor regression in pruning version files in compatibility mode` +- {vytask}`T5927` `` (bug): QoS policy shaper-hfsc class does not have a `bandwidth` node but requires one in the check `` +- {vytask}`T5834` `(bug): Rename 'enable-default-log' to 'default-log'` + +## 2024-01-22 + +- {vytask}`T5968` `(feature): hsflowd: add VRF support` +- {vytask}`T5975` `(bug): GraphQL expects script otp.py that does not exists in 1.4` +- {vytask}`T5961` `(bug): QoS policy shaper vif with ceiling fails on commit` +- {vytask}`T5958` `(bug): QoS policy shaper-hfsc is not implemented` +- {vytask}`T5160` `(feature): Firewall refactor` +- {vytask}`T5969` `(feature): op-mode: list multicast group membership` + +## 2024-01-21 + +- {vytask}`T5799` `(bug): vyos unbootable after 1.4-rolling-202308240020 to 1.5-rolling-202312010026 upgrade` +- {vytask}`T5787` `(bug): dhcp-server allows duplicate static-mapping for the same IP address` +- {vytask}`T5692` `(enhancment): NTP leap smear` +- {vytask}`T5954` `(feature): Enable nvme_hwmon and drivetemp in KERNEL` + +## 2024-01-20 + +- {vytask}`T5915` `(bug): Firewall zone - Re add op-mode commands` +- {vytask}`T5805` `(bug): Missed per-interface statistic in telegraf` +- {vytask}`T5724` `(feature): About dhcp client hooks` +- {vytask}`T5577` `(bug): Optimize PAM configs for RADIUS/TACACS+` +- {vytask}`T5550` `(bug): Source validation on interface does not work properly` +- {vytask}`T5267` `(bug): Another corruption on upgrade` +- {vytask}`T5239` `(bug): frr 'hostname' missing or incorrect, and domain-name missing totally` +- {vytask}`T5219` `(bug): ddclient: Cloudflare doesn't require login` +- {vytask}`T5217` `(feature): Add firewall SYNPROXY` +- {vytask}`T5203` `(feature): load-balancing wan add systemd unit instead of old vyatta-wanloadbalance.init` +- {vytask}`T5199` `(bug): Salt-minion cannot connect to server in python 3.10 and up` +- {vytask}`T5138` `(feature): Add patch to accel-ppp build L2TP LNS use Calling-Number as RADIUS Calling-Station-ID` +- {vytask}`T5054` `(bug): ipsec: "show vpn ipsec remote-access" does not list active connections` +- {vytask}`T5053` `(bug): Vyatta-cfg Post-Removal Hook Tries to Disable Deleted Service` +- {vytask}`T5035` `(feature): Add more actions to policy route rule` +- {vytask}`T4990` `(bug): Commit results may not be properly saved if power is cut immediately after a successful commit` +- {vytask}`T4988` `(default): Expose time and size conversion functions as Jinja2 filters` +- {vytask}`T4986` `(feature): Ability to filter traffic originating from the router itself via firewall` +- {vytask}`T4963` `(default): vyos.ethtool: improve/fix driver name detection` +- {vytask}`T4935` `(bug): ospfv3: "not-advertise" and "advertise" conflict` +- {vytask}`T4897` `` (bug): Setting 'source-address' or `source-interface` on existing vxlan interface doesn't work `` +- {vytask}`T4888` `(default): Rewrite the conntrack sync script using vyos.opmode` +- {vytask}`T4863` `(feature): need an option for route policy to apply to dynamic interfaces l2tp*/ipoe*/pppoe* (for TCP MSS setting)` +- {vytask}`T4817` `(feature): Please add support for RFC 9234` +- {vytask}`T4765` `(default): Normalize field names in op mode JSON outputs` +- {vytask}`T4751` `(enhancment): Feature Request: system login: 2FA OTP key generator in VyOS CLI` +- {vytask}`T4726` `(default): Add completion and validation for the accel-ppp RADIUS vendor option` +- {vytask}`T4722` `(default): Improve abbreviation/acronym consistency` +- {vytask}`T4172` `(feature): Patch ndppd to not read route table if there are no auto prefixes` +- {vytask}`T4085` `(feature): Rewrite L2TP/PPTP/SSTP/PPPoE services to get_config_dict` +- {vytask}`T4031` `(feature): Ability to configure DMVPN in vrf` +- {vytask}`T4030` `(bug): SR-IOV and interface renaming bug` +- {vytask}`T4014` `(feature): Add “command” and “arg” configuration options for containers` +- {vytask}`T3965` `(default): arm: Extend configure scripts to allow for arm builds` +- {vytask}`T3813` `(bug): Some custom sysctl parameters can't be applied bug` +- {vytask}`T3778` `(bug): Abnormal network communication and settings` +- {vytask}`T3591` `(bug): OpenVPN with/without VRF not working (NordVPN)` +- {vytask}`T3372` `(feature): Support public HTTPS repos in live-build` +- {vytask}`T5963` `(bug): QoS policy shaper rate calculations could be wrong for some ethernet devices` +- {vytask}`T5962` `(feature): QoS policy set default speed to 100mbit or 1gbit instead of 10mbit` +- {vytask}`T5697` `(bug): event-handler keep failing` +- {vytask}`T4779` `(default): Make raw op mode command outputs use bytes for data amount values` + +## 2024-01-19 + +- {vytask}`T5897` `(bug): VyOS with Cloud-init and VRF stucks at reboot/shutdown process` +- {vytask}`T5554` `(bug): Disable sudo for PAM RADIUS` +- {vytask}`T4754` `(default): Improvement: system login: show configured 2FA OTP key` +- {vytask}`T5857` `(bug): show interfaces wireless info` +- {vytask}`T5841` `(default): Remove old ssh-session-cleanup.service` +- {vytask}`T5543` `(bug): Fix source address handling in static joins` +- {vytask}`T5884` `(default): Minor description fix (op-mode: generate wireguard)` +- {vytask}`T5781` `(default): Add ability to add additional minisign keys` + +## 2024-01-18 + +- {vytask}`T5863` `(bug): Failure to Load Config on Recent 1.5 Versions` +- {vytask}`T4638` `(bug): Deleting a parent interface does not delete its underlying VLAN interfaces` +- {vytask}`T5953` `` (default): Rename 'close_action' value from `hold` to `trap` in IPSEC IKE `` +- {vytask}`T905` `(bug): The command show remote-config does not work for remote-platform openvpn` + +## 2024-01-17 + +- {vytask}`T5923` `(bug): Config mode system_console.py is not aware of revised GRUB file structure` +- {vytask}`T4658` `` (feature): Rename DPD action `hold` to `trap` `` +- {vytask}`T5932` `(bug): 1.4-rolling-202304120317 to 1.4.0-rc1: dynamic dns migration fail` + +## 2024-01-16 + +- {vytask}`T5951` `(bug): [1.4.0-RC2] show hardware dmi Operational Mode Command Broken` +- {vytask}`T5937` `(bug): [1.3.5 -> 1.4.0-RC1 Migration] IPv6 BGP Neighbor Peer Groups Missing / Not Migrated` +- {vytask}`T5889` `(bug): Migration NAT 5-to-6 bug` +- {vytask}`T5859` `(bug): Invalid format of pool range in accel-ppp services` +- {vytask}`T5842` `(feature): Rewrite PPTP service to get_config_dict` +- {vytask}`T5801` `(feature): Rewrite L2TP service to get_config_dict` +- {vytask}`T5688` `(default): Create the same view of pool configuration for all accel-ppp services` + +## 2024-01-15 + +- {vytask}`T5944` `(bug): "reboot in 1" not working` +- {vytask}`T5936` `(bug): [1.3.5 -> 1.4.0-RC1 Migration] OSPF Passive Interface Configuration Not Working Correctly` +- {vytask}`T5247` `(bug): the bug of the command "show interfaces system"` +- {vytask}`T5901` `(bug): Cloud-init and DHCP exit hook errors` +- {vytask}`T4856` `(bug): DHCP-client exit hook for IPsec is incorrect` +- {vytask}`T2556` `(bug): "show interfaces vrrp" does not return any interface` + +## 2024-01-14 + +- {vytask}`T4428` `(feature): Update ddclient to newer version` + +## 2024-01-12 + +- {vytask}`T5925` `(feature): Containers change systemd KillMode` +- {vytask}`T5920` `(bug): Quick Start documentation contains error` +- {vytask}`T5919` `(bug): Firewall - opmode for ipv6` +- {vytask}`T5306` `(default): bgp config migration failed with v6only option configured with peer-group` +- {vytask}`T3429` `(bug): Hyper-V integration services not working on VyOS 1.4 (sagitta/current)` + +## 2024-01-11 + +- {vytask}`T5896` `(bug): Config Error on Boot with Podman and Firewall` +- {vytask}`T5532` `(bug): After add system image the boot stuck and works again after the second reboot` +- {vytask}`T5512` `(bug): build linux-firmware script cannot expand asterisks if firmware name is a glob string` +- {vytask}`T5379` `(bug): show system updates doesnt seem to be working` +- {vytask}`T5275` `(default): Add op mode commands for exporting certificates to PEM files with correct headers` +- {vytask}`T5274` `(default): Add a deprecation warning for OpenVPN site-to-site with pre-shared secret` +- {vytask}`T5262` `(default): Warn the user about unsaved config on reboot/shutdown attempts` +- {vytask}`T5257` `(feature): Cannont assign netflow source ip to ip in non default VRF` +- {vytask}`T5026` `(feature): Python3 modules crypt and spwd are deprecated` +- {vytask}`T5814` `(bug): VyOS 1.3 to 1.4 LTS Firewall ruleset migration script breaks configuration` +- {vytask}`T4610` `(bug): Firewall with 20K entries cannot load after reboot` +- {vytask}`T3191` `(bug): PAM RADIUS freezing when accounting does not configured on RADIUS server` +- {vytask}`T5917` `(feature): Restore annotations of (running)/(default boot) in select image list` +- {vytask}`T5916` `(default): Added segment routing check for index size and SRGB size` +- {vytask}`T5913` `(feature): Allow for Peer-Groups in ipv4-labeled-unicast SAFI` + +## 2024-01-10 + +- {vytask}`T5918` `` (bug): Verification problem for `set vpn ipsec interface` `` +- {vytask}`T5911` `(bug): pki: service update ignored if certificate name contains a hyphen (-)` +- {vytask}`T5886` `(feature): Add support for ACME protocol (LetsEncrypt)` +- {vytask}`T5766` `(bug): http: rewrite conf-mode script to get_config_dict()` +- {vytask}`T5144` `(default): Modernize dynamic dns operation` +- {vytask}`T4689` `(feature): Support RFS(Receive Flow Steering)` +- {vytask}`T4659` `(feature): Use vtysh to display bridge and some interface parameter information` +- {vytask}`T4646` `(bug): USB serial output console does not work` +- {vytask}`T4577` `(bug): WWAN commit failed which simple config` +- {vytask}`T4502` `(feature): Consider implementing (NAT/other) flow table offload` +- {vytask}`T4446` `(default): Unified CLI for displaying neithbors (ARP, IP, and NDP)` +- {vytask}`T4427` `(default): Remove the vyos-utils package list from vyos-build` +- {vytask}`T4300` `(feature): Extend list of supported interfaces for Cloud-init Network Configuration` +- {vytask}`T4250` `(bug): Organize logrotate settings to avoid duplicates` +- {vytask}`T4236` `(feature): Generate ovpn openvpn client configuration files` +- {vytask}`T4222` `(feature): Support for TWAMP as round-trip metric` +- {vytask}`T3833` `(bug): Cloud-init not finding data source in OpenStack` +- {vytask}`T5902` `(bug): http: remove virtual-host configuration in webserver` +- {vytask}`T3499` `(bug): Podman is not compatible with nat rules` +- {vytask}`T3430` `(bug): Cloud-init failing with “Unable to render networking” on VyOS 1.3` +- {vytask}`T3011` `(bug): router becomes unreachable for few minutes when vti interfaces goes down` +- {vytask}`T5791` `(default): Update dynamic dns configuration path to be consistent with other areas of VyOS` +- {vytask}`T5708` `(default): Additional dynamic dns improvements to align with ddclient 3.11.1 release` +- {vytask}`T5573` `(bug): Fix ddclient cache entries` +- {vytask}`T5012` `(feature): Control network configuration from Cloud-Init config` +- {vytask}`T3116` `(feature): Support back-end L4 level load balancing` +- {vytask}`T5614` `(default): Add conntrack helper matching on firewall` +- {vytask}`T4782` `(enhancment): Allow multiple CA certificates (on e.g. EAPoL)` +- {vytask}`T2199` `(default): Rewrite firewall in new XML/Python style` + +## 2024-01-09 + +- {vytask}`T5898` `(bug): Replace partprobe with partx due to unable to install VyOS` +- {vytask}`T5838` `(feature): Add Infiniband kernel modules` +- {vytask}`T5785` `(bug): API output of show container image broken` +- {vytask}`T5410` `` (feature): Improve `utils.convert.convert_data()` to process all stdtypes `` +- {vytask}`T5269` `(default): OpenVPN non-TLS site-to-site mode deprecation` +- {vytask}`T5249` `(feature): Add rollback-soft feature to rollback without a reboot` +- {vytask}`T4944` `(default): Prevent op mode functions from returning bare literals in raw output` +- {vytask}`T4910` `(default): Rewrite the remote access VPN op mode in the new style` +- {vytask}`T4470` `(feature): Rewrite load-balancing wan to XML/Python` +- {vytask}`T3763` `(bug): wireguard checks if port already binding` +- {vytask}`T3489` `(bug): NUMA has been disabled for the past few years and no-one has noticed` +- {vytask}`T3476` `(feature): Update availability check` +- {vytask}`T2845` `(bug): BGP conf_mode unable to delete configuration with peer-group` +- {vytask}`T2844` `(bug): BGP conf_mode errors disable-send-community` +- {vytask}`T2755` `(default): Requirements for partial interface setup` +- {vytask}`T2721` `(enhancment): Set FQ-CoDel as the default queueing mechanism for every class in Shaper` +- {vytask}`T2511` `(feature): Migrate vyatta-op-quagga to new XML format` +- {vytask}`T2302` `(default): Convert configuration scripts from executables to modules and use a script runner` +- {vytask}`T2281` `(feature): DHCP and Static IPs on Same Interface` +- {vytask}`T2216` `(default): Containerized third-party applications for VyOS` +- {vytask}`T2171` `(feature): Unify creation and manipulation of interfaces` +- {vytask}`T1759` `(feature): Replacing Vyatta::Interface perl` +- {vytask}`T2408` `(enhancment): DHCP Relay upstream and downstream interfaces` +- {vytask}`T1297` `(feature): Add GARP settings to VRRP/keepalived` + +## 2024-01-08 + +- {vytask}`T5888` `(bug): Firewall upgrade fails because of icmpv6` +- {vytask}`T5844` `(bug): HTTPS API doesn't start without configured keys even when GraphQL authentication type is set to token` +- {vytask}`T5664` `(bug): 1.4 user has no permissions?` +- {vytask}`T5215` `(default): Add a built-in ICMP health check for VRRP groups` +- {vytask}`T5045` `(bug): BFD is not starting after upgrade to 1.4-rolling-202302150317` +- {vytask}`T4193` `(default): Add support for transparent firewall` +- {vytask}`T3754` `(default): Make config scripts more testable` +- {vytask}`T3663` `(default): Use inotify file watching where applicable` +- {vytask}`T3480` `(bug): Does not possible to change console baud-rate` +- {vytask}`T2897` `(default): Remove cluster command` +- {vytask}`T5904` `(feature): op-mode: add "show ipv6 route vrf " command` + +## 2024-01-07 + +- {vytask}`T5891` `(bug): OpenVPN IPv6 config issue with 1.4-rc1` +- {vytask}`T5887` `(feature): Upgrade Linux Kernel to 6.6.y (2023 LTS edition)` + +## 2024-01-06 + +- {vytask}`T3670` `(feature): Option to disable HTTP port 80 redirect` + +## 2024-01-05 + +- {vytask}`T3642` `(feature): PKI configuration` +- {vytask}`T5894` `(feature): Extend get_config_dict() with additional parameter with_pki that defaults to False` + +## 2024-01-04 + +- {vytask}`T4072` `(feature): Feature Request: Firewall on bridge interfaces` +- {vytask}`T3459` `(default): Inform the user when unable to install outdated image` + +## 2024-01-03 + +- {vytask}`T5880` `(bug): verify_source_interface should not allow dynamic interfaces like ppp, l2tp, ipoe or sstpc client interfaces` +- {vytask}`T5879` `(bug): tunnel: sourceing from dynamic pppoe0 interface will fail on reboots` +- {vytask}`T4500` `(bug): Missing firewall logs` + +## 2024-01-02 + +- {vytask}`T5885` `(default): image-tools: relax restriction on image-name length from 32 to 64` + +## 2024-01-01 + +- {vytask}`T5883` `(bug): Preserve file ownership in /config subdirs on add system image` +- {vytask}`T5474` `(feature): Establish common file name pattern for XML conf mode commands` + +## 2023-12-30 + +- {vytask}`T5875` `(bug): login: removing and re-adding a user keeps the home directory but UID will change, thus SSH keys no longer work` +- {vytask}`T5653` `(feature): Command to display fingerprint` + +## 2023-12-29 + +- {vytask}`T5829` `(bug): Can't Add IPv6 Address to Containers` +- {vytask}`T5852` `(bug): Reboots fail with eapol WAN interface` +- {vytask}`T5869` `(bug): vyos.template.first_host_address() does not honor RFC4291 section 2.6.1` + +## 2023-12-28 + +- {vytask}`T4163` `(feature): [BMP-BGP] Routing monitoring feature` +- {vytask}`T5867` `(feature): Upgrade podman to Debian Trixie version 4.7.x` +- {vytask}`T5866` `(feature): Add op-mode command to restart IPv6 RA daemon` +- {vytask}`T5861` `(bug): Flavor build system fails with third-party packages` +- {vytask}`T5854` `(feature): Extend override-default script to allow embedded defaultValue settings` +- {vytask}`T5792` `(default): Upgrade ddclient 3.11.2 release` + +## 2023-12-25 + +- {vytask}`T5855` `` (feature): Migrate "set service lldp snmp enable" -> `set service lldp snmp" `` +- {vytask}`T5837` `(bug): vyos.configdict.node_changed does not return keys per adding` +- {vytask}`T5856` `(bug): SNMP service removal fails` + +## 2023-12-24 + +- {vytask}`T5853` `(default): Typo interfaces-virtual-ethernet.xml.in` + +## 2023-12-22 + +- {vytask}`T5804` `(bug): SNAT "any" interface error` +- {vytask}`T4760` `(bug): VyOS does not support running multiple instances of DHCPv6 clients` + +## 2023-12-21 + +- {vytask}`T5778` `(bug): The show dhcp server leases operation mode command does not work as expected` +- {vytask}`T5775` `(default): Migrated Firewall Global State Policy ineffective on latest firewall zone config` +- {vytask}`T5637` `(bug): Firewall default-action log` +- {vytask}`T5796` `(bug): Openconnect - HTTPS security headers are missing` +- {vytask}`T3580` `(feature): Refactoring firewall ipv6 rule icmpv6` +- {vytask}`T2898` `(feature): Support NDP proxy` +- {vytask}`T2229` `(feature): PPPOE Default Queue type selection` + +## 2023-12-20 + +- {vytask}`T5823` `(feature): Protocol BGP add default values for config dictionary` +- {vytask}`T5798` `(enhancment): reverse-proxy load-balancing service should support multiple certificates for frontend` + +## 2023-12-19 + +- {vytask}`T5828` `(default): Fix GRUB installation on arm64` + +## 2023-12-18 + +- {vytask}`T5751` `(feature): Adjust new image tools for non-interactive use` +- {vytask}`T5831` `(feature): show system image should reverse order by addition date` +- {vytask}`T5825` `(bug): image-tools: restore authentication on 'add system image'` +- {vytask}`T5821` `(bug): image-tools: restore vrf-aware 'add system image'` +- {vytask}`T5819` `(bug): Don't echo password on install image` +- {vytask}`T5806` `(bug): Clear old raid data on new install image` +- {vytask}`T5789` `(bug): image-tools should copy ssh host keys on image update` +- {vytask}`T5758` `(default): Restore scanning configs when live installing` + +## 2023-12-15 + +- {vytask}`T5824` `(bug): busybox cannot connect some websites from initramfs` +- {vytask}`T5803` `(default): git/github: Adjust configuration for safe and baseline defaults` + +## 2023-12-14 + +- {vytask}`T5773` `(bug): Unable to load config via HTTP` +- {vytask}`T5816` `(bug): BGP Large Community List Validation Broken` +- {vytask}`T5812` `(bug): rollback check max revision number does not work` +- {vytask}`T5749` `(feature): Show MAC address VRF and MTU by default for "show interfaces"` +- {vytask}`T5774` `(bug): commit-archive to FTP server broken after update (VyOS 1.5-rolling)` +- {vytask}`T5826` `(default): Add dmicode as an explicit dependency` +- {vytask}`T5793` `(default): mdns-repeater: Cleanup avahi-daemon configuration in /etc` + +## 2023-12-13 + +- {vytask}`T591` `(feature): Support SRv6` + +## 2023-12-12 + +- {vytask}`T4704` `(feature): Allow to set metric (MED) to rtt with rtt,+rtt or -rtt` +- {vytask}`T5815` `(enhancment): Add load_config module` +- {vytask}`T5413` `(default): Deny the opportunity to use one public/private key pair on both wireguard peers.` + +## 2023-12-11 + +- {vytask}`T5741` `(bug): WAN Load Balancing failover route tables aren't created` + +## 2023-12-10 + +- {vytask}`T5658` `(default): Add VRF support for mtr` + +## 2023-12-09 + +- {vytask}`T5808` `(bug): op-mode: ipv6 ospfv3 graceful-restart description contains incorrect info` +- {vytask}`T5802` `(bug): ping (ip or hostname) interface produces error` +- {vytask}`T5747` `(feature): op-mode add MAC VRF and MTU for show interfaces summary` +- {vytask}`T3983` `(bug): show pki certificate Doesnt show x509 certificates` + +## 2023-12-08 + +- {vytask}`T5782` `(enhancment): Use a single config mode script for https and http-api` +- {vytask}`T5768` `(enhancment): Remove auxiliary http-api.conf for simplification of http-api config mode script` +- {vytask}`T5809` `(default): Enable GRUB support for gzip compressed kernels` + +## 2023-12-04 + +- {vytask}`T5769` `(bug): VTI tunnels lose their v6 Link Local addresses when set down/up` + +## 2023-12-03 + +- {vytask}`T5753` `(feature): Add VXLAN vnifilter support` +- {vytask}`T5759` `(feature): Change VXLAN default MTU to 1500 bytes` + +## 2023-11-30 + +- {vytask}`T4601` `(bug): dhcp : relay agent IP address issue.` + +## 2023-11-28 + +- {vytask}`T4276` `(bug): IPsec peers dh-group negotiation issue with pfs enabled and multiple proposals configured with IKEv1` + +## 2023-11-27 + +- {vytask}`T5763` `(bug): Fix imprecise check for remote file name in vyos-load-config.py` +- {vytask}`T5783` `(feature): frr: smoketests must notice any daemon crash` + +## 2023-11-26 + +- {vytask}`T5760` `(feature): DHCP client custom dhcp-options` +- {vytask}`T2405` `(feature): archive to GIT or other platform` + +## 2023-11-25 + +- {vytask}`T5655` `(bug): commit-archive: Ctrl+C should not eror out with stack trace, signal should be cought` +- {vytask}`T4946` `(default): Rewrite "add system image" in the new op-mode` +- {vytask}`T4454` `` (default): `install-image` should check free storage `` + +## 2023-11-24 + +- {vytask}`T5776` `(feature): Enable VFIO support` +- {vytask}`T5402` `(bug): VRRP router with rfc3768-compatibility sends multiple ARP replies` +- {vytask}`T3895` `(default): VYOS firewall rules do not adhere to time schedule unless placed in UTC mode.` + +## 2023-11-23 + +- {vytask}`T4891` `(bug): BFD flapping loop` +- {vytask}`T4867` `(bug): "show bgp neighbors ... advertised-routes" and some other commands fail for IPv4 neighbors` + +## 2023-11-22 + +- {vytask}`T5767` `(feature): Add reboot and poweroff the system via API` +- {vytask}`T5729` `(bug): Firewall, nat and policy route - Switch to valueless` +- {vytask}`T5681` `(feature): Interface match - Simplified and unified cli` +- {vytask}`T4877` `(bug): Need verification in using import vrf and import vpn, export vpn commands` +- {vytask}`T4021` `(bug): Long commit time on bridge interface with 1-4094 allowed VLAN tags` +- {vytask}`T5338` `(feature): Add 'mpls bgp forwarding' feature` +- {vytask}`T3818` `(bug): BGP export route-map only works after bgpd restart` +- {vytask}`T5590` `(default): Firewall "log enable" logs every packet` +- {vytask}`T5426` `(default): Add exceptions in vici functions calls` + +## 2023-11-21 + +- {vytask}`T5762` `(bug): http: api: smoketests fail as they can not establish IPv6 connection to uvicorn backend server` + +## 2023-11-20 + +- {vytask}`T2816` `(default): Rewrite IPsec scripts with the new XML/Python approach` + +## 2023-11-18 + +- {vytask}`T1354` `(feature): Add support for VLAN-Aware bridges` + +## 2023-11-16 + +- {vytask}`T5726` `(bug): HTTPS API image cannot be updated` +- {vytask}`T5738` `(feature): Extend XML building blocks` +- {vytask}`T5736` `(feature): igmp: migrate "protocols igmp" to "protocols pim"` +- {vytask}`T5733` `(feature): pim(6): rewrite FRR PIM daemon configuration to get_config_dict() and add missing IGMP features` +- {vytask}`T5689` `(default): FRR 9.0.1 in VyOS current segfaults on show rpki prefix $prefix` +- {vytask}`T5595` `(feature): Multicast - PIM bfd feature enable` +- {vytask}`T3638` `(bug): Passwords With Dollar Sign Set Incorrectly` + +## 2023-11-15 + +- {vytask}`T5695` `(feature): Build FRR with LUA scripts --enable-scripting option` +- {vytask}`T5665` `(bug): radius user not working` +- {vytask}`T5728` `(bug): Improve compatibility between OpenVPN on VyOS 1.5 and OpenVPN Connect Client` +- {vytask}`T5732` `(bug): generate firewall rule-resequence drops geoip country-code from output` +- {vytask}`T5661` `(enhancment): Add show show ssh dynamic-protection attacker and show log ssh dynamic-protection` +- {vytask}`T1276` `(bug): dhcp relay + VLAN fails` + +## 2023-11-13 + +- {vytask}`T5698` `(feature): EVPN ESI Multihoming` +- {vytask}`T5563` `(bug): container: Container environment variable cannot be set` +- {vytask}`T5706` `(bug): Systemd-udevd high CPU utilization for multiple dynamic ppp/l2tp/ipoe interfaces` + +## 2023-11-10 + +- {vytask}`T5727` `(bug): validator: Use native URL validator instead of regex-based validator` + +## 2023-11-08 + +- {vytask}`T5720` `(bug): PPPoE-server adding new interface does not work` +- {vytask}`T5716` `(bug): PPPoE-server shaper template bug down-limiter option does not rely on fwmark` +- {vytask}`T5702` `(feature): Add ability to set include_ifmib_iface_prefix and ifmib_max_num_ifaces for SNMP` +- {vytask}`T5648` `(bug): ldpd neighbour template errors` +- {vytask}`T5564` `(bug): Both show firewall group and show firewall summary fails` +- {vytask}`T5559` `(feature): Selective proxy-arp/proxy-ndp when doing SNAT/DNAT` +- {vytask}`T5541` `(bug): Zone-Based Firewalling in VyOS Sagitta 1.4` +- {vytask}`T5513` `(bug): Anomalies in show firewall command after refactoring` +- {vytask}`T4864` `` (bug): `show firewall` command errors `` + +## 2023-11-07 + +- {vytask}`T5586` `(feature): Disable by default SNMP for Keepalived VRRP` + +## 2023-11-06 + +- {vytask}`T5705` `(bug): rsyslog - Not working when using facility=all` +- {vytask}`T5704` `(feature): PPPoE-server add max-starting option` +- {vytask}`T5707` `(bug): Wireguard peer public key update leaves redundant peers and breaks connectivity` +- {vytask}`T4269` `(feature): node.def generator should automatically add default values` + +## 2023-11-05 + +- {vytask}`T4020` `(feature): Add ability to control FRR daemons options` + +## 2023-11-03 + +- {vytask}`T5700` `(bug): Monitoring telegraf deprecated plugins inputs outputs` +- {vytask}`T5018` `(bug): Redirect to IFB removed after change in qos policy` + +## 2023-11-02 + +- {vytask}`T5701` `(feature): Update telegraf package` + +## 2023-11-01 + +- {vytask}`T5690` `(bug): Change to definition of environment variable 'vyos_rootfs_dir' is incorrect` + +## 2023-10-31 + +- {vytask}`T5699` `(feature): vxlan: migrate "external" CLI know to "parameters external"` +- {vytask}`T5668` `(feature): Disable VXLAN bridge learning and enable neigh_suppress when using EVPN` + +## 2023-10-27 + +- {vytask}`T5652` `(bug): Config migrate to image upgrade does not properly generate home directory` +- {vytask}`T4057` `(bug): Commit time for deleting sflow configuration ~1.5 min` + +## 2023-10-26 + +- {vytask}`T5683` `(bug): reverse-proxy pki filenames mismatch` +- {vytask}`T4903` `(bug): conntrack ignore does not suppotr IPv6 addresses` +- {vytask}`T4309` `(feature): Support network/address-groups and ipv6-network/ipv6-address-groups in conntrack ignore` +- {vytask}`T5606` `(feature): IPSec VPN: Allow multiple CAs certificates` +- {vytask}`T5650` `(default): Progressbars suffer from staircasing effect` +- {vytask}`T5568` `(default): Install image from live ISO always defaults boot to KVM entry` +- {vytask}`T3509` `(default): No BCP38 for IPv6 on VyOS` + +## 2023-10-23 + +- {vytask}`T5299` `(bug): QoS shaper ceiling does not work` +- {vytask}`T5667` `(feature): BGP label-unicast - enable ecmp` +- {vytask}`T5337` `(bug): MPLS/BGP: Route leak does not happen from the VPNv4 table to specific vrf` + +## 2023-10-22 + +- {vytask}`T5254` `(bug): Modification of any interface setting sets MTU back to default when MTU has been inherited from a bond` +- {vytask}`T5671` `(feature): vxlan: change port to IANA assigned default port` + +## 2023-10-21 + +- {vytask}`T5670` `(bug): bridge: missing member interface validator` +- {vytask}`T5617` `(feature): Add an option to exclude single values to the numeric validator` +- {vytask}`T5414` `(bug): dhcp-server does not allow valid bootfile-names` +- {vytask}`T5261` `(feature): Add AWS gateway load-balanceing tunnel handler (gwlbtun)` +- {vytask}`T5260` `(bug): Python3 module crypt is deprecated` +- {vytask}`T5191` `(default): Replace underscores with hyphens in command-line options generated by vyos.opmode` +- {vytask}`T5172` `(default): Set Python3 version dependency for vyos-1x to 3.10` +- {vytask}`T4956` `(default): 'show hardware cpu' issue on arm64` +- {vytask}`T4837` `(default): Expose "show ip route summary" in the op mode API` +- {vytask}`T4770` `(feature): Rewrite OpenVPN op-mode to vyos.opmode format` +- {vytask}`T4657` `` (bug): op-mode scripts with type hints in `return` do not work `` +- {vytask}`T4604` `(bug): bgpd eats huge amount of memory (about 500Megs a day)` +- {vytask}`T4432` `(default): Display load average normalized according to the number of CPU cores` +- {vytask}`T4416` `(default): Convert 'traceroute' operation to the new syntax and expand available options using python` +- {vytask}`T4402` `(bug): OpenVPN client-ip-pool option is broken` +- {vytask}`T3433` `(default): A review of the use of racist language in VyOS` +- {vytask}`T2719` `(feature): Standardized op mode script structure` + +## 2023-10-20 + +- {vytask}`T5233` `(bug): Op-mode flow-accounting netflow with disable-imt errors` +- {vytask}`T5232` `(bug): Flow-accounting uacctd.service cannot restart correctly` + +## 2023-10-19 + +- {vytask}`T4913` `(default): Rewrite the wireless op mode in the new style` + +## 2023-10-18 + +- {vytask}`T5642` `(bug): op cmd: generate tech-support archive: does not work` +- {vytask}`T5521` `(bug): Home owner directory changed to vyos for the user after reboot` + +## 2023-10-17 + +- {vytask}`T5662` `(bug): Fix indexing error in configdep script organization` +- {vytask}`T5235` `(bug): SSH keys with special characters cannot be applied via Cloud-init` + +## 2023-10-16 + +- {vytask}`T5165` `(feature): Policy local-route ability set protocol and port` + +## 2023-10-14 + +- {vytask}`T5629` `(bug): Policy local-route bug after migration to destination node address` + +## 2023-10-13 + +- {vytask}`T5227` `(feature): mDNS reflector should allow additional domains to browse and allow filtering services` +- {vytask}`T5166` `(feature): Remove local minisign package from build repo for 1.4` +- {vytask}`T5118` `(bug): Cleanup vestigial ntp completion script` +- {vytask}`T5115` `(default): Support custom port for name servers for forwarding zones` +- {vytask}`T5113` `(default): PDNS: Support custom port for DNS forwarders` +- {vytask}`T5112` `(feature): Enable support for Network Time Security (NTS) for chrony` +- {vytask}`T5143` `(enhancment): Apply constraint on powerdns forward-zones configuration` + +## 2023-10-12 + +- {vytask}`T5649` `(bug): vyos-1x should generate XML cache after building command templates for less cryptic error on typo` + +## 2023-10-10 + +- {vytask}`T5489` `(feature): Change to BBR as TCP congestion control, or at least make it an config option` +- {vytask}`T5479` `(bug): Helper leftovers found in nftables (firewall) even with all helpers disabled` +- {vytask}`T5436` `(bug): vyos-preconfig-bootup.script is missing` +- {vytask}`T5014` `(feature): Destination NAT - Add Load Balancing capabilities` + +## 2023-10-08 + +- {vytask}`T5630` `(feature): pppoe: allow to specify MRU in addition to already configurable MTU` + +## 2023-10-06 + +- {vytask}`T5096` `(feature): Change 'accept' firewall rule action from 'return' to 'accept'` +- {vytask}`T5576` `(feature): Add bgp remove-private-as all option` +- {vytask}`T3506` `(default): Migrate loadkey command to op-mode` + +## 2023-10-05 + +- {vytask}`T4320` `(default): Remove legacy version files in vyatta-cfg-system/cfg-version` + +## 2023-10-04 + +- {vytask}`T5632` `(feature): Add jq package to parse JSON files` +- {vytask}`T3655` `(bug): NAT Problem with VRF` +- {vytask}`T5585` `(bug): Fix file access mode for dynamic dns configuration` + +## 2023-10-03 + +- {vytask}`T5618` `(bug): Flow-accounting crushes when IMT is enabled` +- {vytask}`T5561` `(feature): NAT - Inbound or outbound interface should not be mandatory` +- {vytask}`T5553` `(feature): Firewall - Add action continue` +- {vytask}`T5250` `(bug): Firewall - show firewall group` +- {vytask}`T4383` `(bug): Flow Accounting returns permission error and fails to start` +- {vytask}`T5626` `(feature): Only select required Kernel CGROUP controllers` +- {vytask}`T5628` `(feature): op-mode: login: DeprecationWarning: 'spwd'` + +## 2023-10-01 + +- {vytask}`T936` `(feature): Reimplementation of tech-support diagnostic file generation` + +## 2023-09-30 + +- {vytask}`T5048` `(bug): QoS doesn't work correctly root task` +- {vytask}`T4989` `(bug): QoS Policy Limiter - classes for marked traffic do not work` + +## 2023-09-28 + +- {vytask}`T5596` `(feature): bgp: add new features from FRR 9` +- {vytask}`T5412` `(feature): Add support for extending config-mode dependencies in supplemental package` + +## 2023-09-26 + +- {vytask}`T5480` `(bug): Ability to disable SNMP for VRRP keepalived service` + +## 2023-09-25 + +- {vytask}`T5533` `(bug): Keepalived VRRP IPv6 group enters in FAULT state` + +## 2023-09-24 + +- {vytask}`T5511` `(feature): Cleanup of unused directories (and files) in order to shrink image-size` + +## 2023-09-23 + +- {vytask}`T5518` `(default): Add MLD protocol support` + +## 2023-09-22 + +- {vytask}`T5602` `(feature): For reverse-proxy type of load-balancing feature, support "backup" option in backends configuration` +- {vytask}`T5609` `(enhancment): Add util to get drive device name from id` +- {vytask}`T5608` `(enhancment): Rewrite add/delete raid member to Python and remove from vyatta-op` +- {vytask}`T5607` `(bug): Adjust RAID smoketest for non-deterministic SCSI device probing` + +## 2023-09-20 + +- {vytask}`T5588` `(bug): Add kernel conntrack_bridge module` +- {vytask}`T5271` `(default): Add support for peer-fingerprint to OpenVPN` +- {vytask}`T5241` `(feature): Support veth interfaces to working with netns` +- {vytask}`T5238` `(default): interface virtual-etherne - error when it doesn't use a peer` +- {vytask}`T5592` `(feature): salt: upgrade minion to 3005.2` + +## 2023-09-19 + +- {vytask}`T5597` `(feature): isis: add new features from FRR 9.` +- {vytask}`T4284` `(feature): QoS: rewrite to XML and Python` + +## 2023-09-18 + +- {vytask}`T5419` `(feature): Software/Hardware fastpath with nftables flowtable` + +## 2023-09-15 + +- {vytask}`T5581` `(feature): Add "show ip nht" op-mode command (IPv4 nexthop tracking table)` + +## 2023-09-11 + +- {vytask}`T5567` `(bug): vyos-1x: webproxy: maximum-object-size allowed ranges not in sync with Equuleus` +- {vytask}`T5551` `(bug): Missing check for boot_configuration_complete raises error in vyos-save-config.py` +- {vytask}`T5353` `(bug): config-mgmt: normalize archive updates and commit log entries` +- {vytask}`T3424` `(default): PPPoE IA-PD doesn't work in VRF` +- {vytask}`T2773` `(feature): EIGRP support for VRF` + +## 2023-09-10 + +- {vytask}`T5565` `(bug): Builds as vyos-999-timestamp instead of vyos-1.4-rolling-timestamp` +- {vytask}`T5555` `(bug): Fix timezone migrator (system 13-to-14)` +- {vytask}`T5529` `(bug): Missing symbolic link in linux-firmware package.` + +## 2023-09-09 + +- {vytask}`T5540` `(bug): vyos-1x: Wrong VHT configuration for WiFi 802.11ac` +- {vytask}`T5423` `(bug): ipsec: no output for op-cmd "show vpn ike secrets"` +- {vytask}`T3700` `(feature): Support VLAN tunnel mapping of VLAN aware bridges` + +## 2023-09-08 + +- {vytask}`T5502` `(bug): Firewall - wrong parser for inbound and/or outbound interface` +- {vytask}`T5460` `(feature): Firewall - remove config-trap` +- {vytask}`T5450` `(feature): Firewall interface group - Allow inverted matcher` +- {vytask}`T4426` `(default): Add arpwatch to the image` +- {vytask}`T4356` `(bug): DHCP v6 client only supports single interface configuration` + +## 2023-09-07 + +- {vytask}`T5510` `(feature): Shrink imagesize and improve read performance by changing mksquashfs syntax` + +## 2023-09-06 + +- {vytask}`T5542` `(bug): ipoe-server: external-dhcp(dhcp-relay) not woking / not implemented` +- {vytask}`T5548` `(bug): HAProxy renders timeouts incorrectly` +- {vytask}`T5544` `(feature): Allow CAP_SYS_MODULE to be set on containers` + +## 2023-09-05 + +- {vytask}`T5524` `(feature): Add config directory to liveCD` +- {vytask}`T5519` `` (bug): Function `call` sometimes hangs `` +- {vytask}`T5508` `(bug): Configuration Migration Fails to New Netfilter Firewall Syntax` +- {vytask}`T5495` `(feature): Enable snmp module also for frr/ldpd` +- {vytask}`T2958` `(bug): DHCP server doesn't work from a live CD` +- {vytask}`T5428` `(bug): dhcp: client renewal fails when running inside VRF` + +## 2023-09-04 + +- {vytask}`T5536` `(bug): show dhcp client leases caues No module named 'vyos.validate'` +- {vytask}`T5506` `(bug): Container bridge interfaces do not have a link-local address` + +## 2023-09-03 + +- {vytask}`T5538` `(bug): Change order within variable lb_config_tmpl to fit order of manpage and fix some typos` +- {vytask}`T4612` `(feature): Support arbitrary netmasks in firewall rules` + +## 2023-08-31 + +- {vytask}`T5190` `(feature): Cloud-Init cannot fetch Meta-data on machines where the main Ethernet interface is not eth0` +- {vytask}`T4895` `(bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data` +- {vytask}`T4776` `(bug): NVME storage is not detected properly during installation` +- {vytask}`T5531` `(feature): Containers add label option` +- {vytask}`T5525` `(default): Change dev.packages.vyos.net repo to rolling-packages.vyos.net vyos-build:current uses` + +## 2023-08-30 + +- {vytask}`T4933` `(default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a nondescript error` +- {vytask}`T4790` `(bug): RADIUS login does not work if sum of timeouts more than 50s` +- {vytask}`T4113` `(bug): Incorrect GRUB configuration parsing` +- {vytask}`T5520` `(bug): Likely source of corruption on system update exposed by change in coreutils for Bookworm` +- {vytask}`T4151` `(feature): IPV6 local PBR Support` +- {vytask}`T4485` `(default): OpenVPN: Allow multiple CAs certificates` + +## 2023-08-29 + +- {vytask}`T3940` `(bug): DHCP client does not remove IP address when stopped by the 02-vyos-stopdhclient hook` +- {vytask}`T3713` `(default): Create a meta-package for user utilities` +- {vytask}`T3339` `(bug): Cloud-Init domain search setting not applied` +- {vytask}`T3577` `(bug): Generating vpn x509 key pair fails with command not found` + +## 2023-08-28 + +- {vytask}`T4745` `(bug): CLI TAB issue with values with '-' at the beginning in conf mode` +- {vytask}`T5472` `(bug): NAT redirect should not require port` + +## 2023-08-27 + +- {vytask}`T4759` `(bug): domain-group on policy route not working` +- {vytask}`T1097` `(feature): Make firewall groups work everywhere that's appropropriate` + +## 2023-08-26 + +- {vytask}`T5039` `(bug): Can't add new local user` +- {vytask}`T5023` `(bug): PKI commit fails to update dependents` +- {vytask}`T4512` `(feature): enable-default-log on zone-policy` +- {vytask}`T5003` `(default): Upgrade base system to Debian 12 "Bookworm"` + +## 2023-08-25 + +- {vytask}`T5468` `(feature): Remove unused manpages to free up space` +- {vytask}`T5463` `(feature): Containers allow publish IPv6 address port` +- {vytask}`T4412` `(bug): commit archive: reboot not working with sftp` +- {vytask}`T3702` `(feature): Policy: Allow routing by fwmark` +- {vytask}`T3536` `(default): Unable to list all available routes` + +## 2023-08-24 + +- {vytask}`T5448` `(feature): Add service zabbix-agent` +- {vytask}`T5006` `(bug): Http api segfault with concurrent requests` +- {vytask}`T5505` `(feature): system: zebra route-map is not removed from FRR` +- {vytask}`T5305` `(bug): REST API configure operation should not be defined as async` +- {vytask}`T4292` `(feature): Rewrite vyatta-save-config.pl to Python` + +## 2023-08-23 + +- {vytask}`T5478` `(bug): Cannot configure resolver-cache options for firewall` +- {vytask}`T5466` `(feature): L3VPN - label allocation mode` +- {vytask}`T5453` `(bug): Fix nat66 - broken after load-balance was introduced in nat` +- {vytask}`T5446` `(bug): bgp: validity check for bestpath med option` +- {vytask}`T5500` `(feature): Minor fixes to configtree render` +- {vytask}`T5469` `(default): Incorrect dependency set in the openvpn-dco package when building VyOS for arm64` +- {vytask}`T5387` `(feature): dhcp6c: add a no release option` +- {vytask}`T5491` `(feature): Hostapd - AP-Mode - allow white-/blacklisting of Clients` +- {vytask}`T4889` `(default): Add nftables NAT REDIRECT [to localhost] to CLI` + +## 2023-08-22 + +- {vytask}`T5407` `(bug): Static routes pointed to container networks fail to persist after reboot` + +## 2023-08-20 + +- {vytask}`T5470` `(bug): wlan: can not disable interface if SSID is not configured` + +## 2023-08-18 + +- {vytask}`T5488` `(bug): System conntrack ignore does not take any effect` + +## 2023-08-17 + +- {vytask}`T4202` `(bug): NFT: Zone policies fail to apply when "l2tp+" is in the interface list` +- {vytask}`T5409` `(feature): Add 'set interfaces wireguard wgX threaded'` +- {vytask}`T5476` `(feature): netplug: replace Perl helper scripts with a Python equivalent` +- {vytask}`T5223` `(bug): tunnel key doesn't clear` +- {vytask}`T5490` `(feature): login: add missing regex for home direcotry and radius server key` + +## 2023-08-16 + +- {vytask}`T5483` `(bug): Residual dhcp-server test file causing zabbix-agent smoketest to fail` + +## 2023-08-15 + +- {vytask}`T5293` `(feature): Support for Floating Rules (Global Firewall-Rules that are automatically applied before all other Zone Rules)` +- {vytask}`T5273` `(default): Add op mode commands for displaying certificate details and fingerprints` +- {vytask}`T5270` `` (default): Make OpenVPN `tls dh-params` optional `` + +## 2023-08-14 + +- {vytask}`T5477` `(bug): op-mode pki.py should use Config for defaults` +- {vytask}`T5461` `(feature): Improve rootfs directory variable` +- {vytask}`T5457` `(feature): Add environmental variable pointing to current rootfs directory` +- {vytask}`T5440` `(bug): Restore pre/postconfig scripts if user deleted them` + +## 2023-08-12 + +- {vytask}`T5467` `(bug): ospf(v3): removing an interface from the OSPF process does not clear FRR configuration` + +## 2023-08-11 + +- {vytask}`T5465` `(feature): adjust-mss: config migration fails if applied to a VLAN or Q-in-Q interface` +- {vytask}`T2665` `(bug): vyos.xml.defaults for tag nodes` +- {vytask}`T5434` `(enhancment): Replace remaining calls of vyos.xml library` +- {vytask}`T5319` `(enhancment): Remove remaining workarounds for incorrect defaults` +- {vytask}`T5464` `(feature): ipv6: add support for per-interface dad (duplicate address detection) setting` + +## 2023-08-10 + +- {vytask}`T5416` `(bug): Ignoring "ipsec match-none" for firewall` +- {vytask}`T5329` `(bug): Wireguard interface as GRE tunnel source causes configuration error on boot` + +## 2023-08-09 + +- {vytask}`T5452` `(bug): Uncaught error in generate_cache during vyos-1x build` +- {vytask}`T5443` `(enhancment): Add merge_defaults as Config method` +- {vytask}`T5435` `(enhancment): Expose utility function for default values at path` + +## 2023-08-07 + +- {vytask}`T5406` `(bug): "update webproxy blacklists" fails when vrf is being configured` +- {vytask}`T5302` `(bug): QoS class with multiple matches generates one filter rule but expects several rules` +- {vytask}`T5266` `(bug): QoS- HTB error when match with a dscp parameter for queue-type 'priority'` +- {vytask}`T5071` `(bug): QOS-Rewrite: DSCP match missing` + +## 2023-08-06 + +- {vytask}`T5420` `(feature): nftables - upgrade to latest 1.0.8` +- {vytask}`T5445` `(feature): dyndns: add possibility to specify update interval (timeout)` + +## 2023-08-05 + +- {vytask}`T5291` `(bug): vyatta-cfg-cmd-wrapper missing ${vyos_libexec_dir} variable` +- {vytask}`T5290` `(bug): Failing commits for SR-IOV interfaces using ixgbevf driver due to change speed/duplex settings` +- {vytask}`T5439` `(bug): Upgrade to FRR version 9.0 added new daemons which must be adjusted` + +## 2023-08-04 + +- {vytask}`T5427` `(bug): Change migration script len arguments checking` + +## 2023-08-03 + +- {vytask}`T5301` `(bug): NTP: chrony only allows one bind address` +- {vytask}`T5154` `(bug): Chrony - multiple listen addresses` + +## 2023-08-02 + +- {vytask}`T5374` `(feature): Ability to set 24-hour time format` +- {vytask}`T5350` `(bug): Confusing warning message when committing VRRP config` +- {vytask}`T5430` `(bug): bridge: vxlan interfaces are not listed as bridgable in completion helpers` +- {vytask}`T5429` `(bug): vxlan: source-interface is not honored and throws config error` +- {vytask}`T5415` `(feature): Upgrade FRR to version 9.0` +- {vytask}`T5422` `(feature): Support LXD Agent` + +## 2023-08-01 + +- {vytask}`T5399` `(bug): "show ntp" fails when vrf is being configured` +- {vytask}`T5346` `(bug): MPLS sysctl not persistent for L2TP interfaces` +- {vytask}`T5343` `(feature): BGP peer group VPNv4 & VPNv6 Address Family Support` +- {vytask}`T5339` `(feature): Geneve interface - option to use IPv4 as inner protocol` +- {vytask}`T5335` `(bug): ISIS: error when loading config from file` + +## 2023-07-31 + +- {vytask}`T5421` `(feature): Add arg to completion helper 'list_interfaces' to filter out vlan subinterfaces` + +## 2023-07-29 + +- {vytask}`T5403` `(feature): Add support for extending xml cache` + +## 2023-07-28 + +- {vytask}`T4602` `` (bug): DHCP `ping-check` enabled by default `` +- {vytask}`T5411` `(feature): Remove old background monitoring implementation` +- {vytask}`T5317` `(enhancment): configtree: remove mutable references` +- {vytask}`T5316` `(enhancment): configtree: use a single pass of the diff algorithm` + +## 2023-07-27 + +- {vytask}`T5368` `(feature): FastNetmon service ids ddos-protection add support sflow mode` + +## 2023-07-26 + +- {vytask}`T5398` `(bug): FRR mangles container network interface names` +- {vytask}`T5365` `(bug): Container systemd units require authentication` +- {vytask}`T4974` `(feature): OpenVPN- Data Channel Offload(DCO)` + +## 2023-07-25 + +- {vytask}`T5377` `(feature): ospf: add graceful restart FRR feature (RFC 3623)` + +## 2023-07-21 + +- {vytask}`T5373` `(bug): LLDP seems to be running even if its disabled on all interfaces` +- {vytask}`T5328` `(default): bgp: Incorrect warning showed for address-family configured with neighbor as interface` +- {vytask}`T5363` `(bug): Bash history file does not exists after reboot and ony other file in home directory` +- {vytask}`T5385` `(bug): reference_tree: catch parse error on non-transcluded files` +- {vytask}`T5361` `(bug): "monitor log" behaves like "show log"` + +## 2023-07-20 + +- {vytask}`T5362` `` (bug): `set high-availability vrrp global-parameters version 3` seems to have no effect `` +- {vytask}`T5355` `(bug): IPSec: OP cmd : "show vpn ike sa" does not show output` +- {vytask}`T5330` `(enhancment): Keep track of source of config dict value when merging defaults` +- {vytask}`T4497` `(feature): ping cannot force ipv4 or ipv6` +- {vytask}`T4288` `(bug): IPsec tunnel will break when ESP timeout` + +## 2023-07-19 + +- {vytask}`T5340` `(bug): SNMP and VRF` +- {vytask}`T5059` `(feature): add 'disable' option to DHCP relay config` + +## 2023-07-17 + +- {vytask}`T2051` `(bug): Throughput anomalies` + +## 2023-07-16 + +- {vytask}`T141` `(feature): TACACS+ Support` + +## 2023-07-15 + +- {vytask}`T5341` `(feature): Improve CLI for high-availability virtual-server to work with multiple ports` + +## 2023-07-14 + +- {vytask}`T5358` `(bug): 99-ipsec-dhclient-hook prevents DHCP stateless routes from being installed in VRF table` +- {vytask}`T4376` `(bug): DNAT with multiwan and policy routing, incoming connections only work on primary interface` +- {vytask}`T305` `(default): loadbalancing does not work with one pppoe connection and another connection of either dhcp or static` + +## 2023-07-13 + +- {vytask}`T4713` `(bug): vyos@vyos:~$ show nat destination rules | doesn't work` +- {vytask}`T2315` `(feature): Ability to have right address-family for BGP peers.` + +## 2023-07-12 + +- {vytask}`T5347` `(bug): Compare commit revision bug` +- {vytask}`T5161` `(default): BFD Static Route Monitoring` +- {vytask}`T5105` `(bug): DHCP Server - Wrong error message` +- {vytask}`T4927` `(bug): Need to change restart to reload-or-restart in Webproxy module` +- {vytask}`T3835` `(bug): vyos router 1.2.7 snmp Dos bug` +- {vytask}`T5352` `(default): Fix missing dependency for netavark` +- {vytask}`T4959` `(feature): Add container registry authentication config for containers` + +## 2023-07-11 + +- {vytask}`T5314` `(bug): QOS Default classes are not configured with correct qdisc` +- {vytask}`T4862` `(bug): webproxy domain-block does not work` +- {vytask}`T4844` `(bug): Incorrect permissions of the safeguard DB directory` +- {vytask}`T4815` `(bug): Fix various name server config issues` +- {vytask}`T4810` `(bug): Op-mode show/monitor log pppoe interface does not show any logs` +- {vytask}`T4758` `(feature): Rewrite show dhcp server to vyos.opmode format` +- {vytask}`T4262` `(bug): install image doesn't respect chosen root partition size` +- {vytask}`T3810` `(bug): webproxy squidguard rules don't work properly after rewriting to python.` +- {vytask}`T1928` `(bug): Is the 'Welcome to VyOS' message when using SSH an information leak?` +- {vytask}`T1877` `(default): Feature Request: Allow NAT to use network and address groups` +- {vytask}`T4813` `(feature): L3VPN over GRE Tunnels` +- {vytask}`T4943` `(bug): Radius SSH login displays "permission denied" on 1.4 rolling release` +- {vytask}`T4542` `(default): route-map: "match prefix-len" incorrect behavior` +- {vytask}`T4392` `(default): Multiline login banner text reports error on commit` + +## 2023-07-10 + +- {vytask}`T5345` `(bug): Error incorrectly raised in revised multi_to_list when tag node value name == tag node name` +- {vytask}`T3578` `(bug): Prefix-List(6) update cause empty prefix-list(6)` +- {vytask}`T762` `(feature): Include rulseset in firewall` + +## 2023-07-06 + +- {vytask}`T5336` `(feature): Add Swedish keyboard-layout` + +## 2023-07-04 + +- {vytask}`T5333` `(bug): Policy base routing PBR generetes incorrect rules with name POSTROUTING` +- {vytask}`T5081` `(feature): ISIS and OSPF syncronization with IGP-LDP sync` + +## 2023-07-03 + +- {vytask}`T5295` `(bug): QoS shaper incorrect rate limit the traffic` +- {vytask}`T5334` `(feature): ospf: add support for External Route Summarisation Type-5 and Type-7` + +## 2023-07-02 + +- {vytask}`T5332` `(bug): Show policy route not working when no interface is configured` + +## 2023-07-01 + +- {vytask}`T5304` `(feature): Containers add bind-propagation option rshared` +- {vytask}`T5296` `(bug): QoS class cannot calculate correctly the default bandwidth auto` +- {vytask}`T5210` `(bug): IPSec cosmetic bug for Warning vti inrerface` +- {vytask}`T5277` `(bug): Dhcpv6-relay does not start on boot` + +## 2023-06-30 + +- {vytask}`T5315` `(feature): vrrp: add support for version 3` +- {vytask}`T5283` `(bug): IPoE server assigns network address` +- {vytask}`T5313` `(bug): UDP broadcast relay - missing verify() that relay interfaces have an IP address assigned` + +## 2023-06-29 + +- {vytask}`T5320` `(enhancment): Add warning when entering config mode after a boot configuration error` + +## 2023-06-28 + +- {vytask}`T1237` `(feature): Static Route Path Monitoring, failover` + +## 2023-06-26 + +- {vytask}`T5159` `(bug): DHCPv6-server leases op-command shows warning message even if configured` + +## 2023-06-25 + +- {vytask}`T5240` `(bug): Service router-advert failed to start radvd with more then 3 name-servers` +- {vytask}`T5312` `(bug): Nonescaped special character in help text` + +## 2023-06-24 + +- {vytask}`T5303` `(bug): Rsyslog.service is not working` +- {vytask}`T5298` `(bug): Add RFKILL support into kernel.` +- {vytask}`T5308` `(enhancment): Remove workarounds for incorrect defaults in get_interface_dict` +- {vytask}`T5228` `(enhancment): Simplify get_config_dict and add argument with_defaults` +- {vytask}`T5310` `(bug): Need some help troubleshooting NIC detection.` + +## 2023-06-22 + +- {vytask}`T5297` `(default): Utility function to check if config under node has been changed between revisions` + +## 2023-06-20 + +- {vytask}`T5300` `(bug): verification of port availability can return false negative on boot` +- {vytask}`T5248` `(feature): Ability to load config via API in JSON format` + +## 2023-06-19 + +- {vytask}`T5281` `(feature): Add kernel options for vhost-net` +- {vytask}`T5072` `(default): QOS-Rewrite: protocol name used literally` +- {vytask}`T4969` `(bug): QoS Policy - Unable to set class match mark number` + +## 2023-06-18 + +- {vytask}`T5256` `(bug): QoS expects protocol number but not protocol name` + +## 2023-06-13 + +- {vytask}`T5258` `(bug): git Actions use ubuntu-22.04 instead of deprecated ubuntu-18.04 for PR conflicts checker` +- {vytask}`T5222` `(feature): Add load-balancing reverse-proxy based on haproxy` +- {vytask}`T5213` `(feature): Accel-ppp sending accounting interim updates acct-interim-interval option` +- {vytask}`T5171` `(feature): Use XML for conf-mode "load-balancing wan" instead of legacy templates` + +## 2023-06-12 + +- {vytask}`T5282` `(bug): Poweroff now does not work` +- {vytask}`T5264` `(feature): Add Mellanox Technologies firmware flash module mlxfw to kernel` +- {vytask}`T5286` `(feature): Remove XDP support` + +## 2023-06-10 + +- {vytask}`T5231` `(feature): Add op-mode for load-balancing reverse-proxy` + +## 2023-06-09 + +- {vytask}`T5253` `(bug): MPLS config removed at boot when wireguard interfaces present` + +## 2023-06-05 + +- {vytask}`T5259` `(bug): Openconnect cannot pass migration 1-to-2` + +## 2023-06-02 + +- {vytask}`T5252` `(bug): Route distinguisher and route targets changing upon adding interface to new VRF` +- {vytask}`T5251` `(bug): Uncaught errors for functions delete/delete_value in Python module configtree.py` + +## 2023-06-01 + +- {vytask}`T5127` `(bug): VPNv4/VPNv6 routes are not reinstalled following link flap` + +## 2023-05-28 + +- {vytask}`T5244` `(feature): dropbear: update to 2022.83` +- {vytask}`T5242` `(feature): interfaces: smoketest: automatically detect "capabilities"` +- {vytask}`T5234` `(feature): Add bash identifier for given VRF instance` + +## 2023-05-25 + +- {vytask}`T5237` `(feature): interfaces virtual-ethernet - Extend capabilitys of Vlans/QinQ` +- {vytask}`T4686` `(feature): Provides support for veth` + +## 2023-05-24 + +- {vytask}`T4605` `(feature): Firewall change default table names` +- {vytask}`T4550` `(feature): router-advert: Add deprecate-prefix & decrement-lifetimes options` + +## 2023-05-23 + +- {vytask}`T4916` `(feature): Rewrite IPsec authentication` + +## 2023-05-22 + +- {vytask}`T5214` `(bug): PPPoE-server incorrect warning if a named pool is defined` +- {vytask}`T4977` `(feature): Babel routing protocol support` + +## 2023-05-21 + +- {vytask}`T4733` `(default): Feature Request: dhcp server: add VRF support` +- {vytask}`T5218` `(enhancment): Revise vyos xml lib for bug fixes and extensions` + +## 2023-05-17 + +- {vytask}`T5226` `(default): Deduplicate and standardize validators and constraints for hostname and IP address` +- {vytask}`T5225` `(bug): BGP allowas-in unusable` +- {vytask}`T5208` `(bug): Failed to start nvmf-autoconnect.service during the boot` + +## 2023-05-16 + +- {vytask}`T5194` `(default): Add reference tree to vyos1x-config` + +## 2023-05-15 + +- {vytask}`T3896` `(feature): Extend ocserv support to allow for per-group configs` + +## 2023-05-12 + +- {vytask}`T2778` `(feature): Migrate "system syslog" to get_config_dict() to support new features` +- {vytask}`T2769` `(feature): Add VRF support for syslog` + +## 2023-05-10 + +- {vytask}`T5209` `(bug): dhclient load-balancing exit hook 04-dhcp-wanlb returned non-zero exit status` +- {vytask}`T5065` `` (bug): Mixing `destination port xxx` and `destination group port-group yyy` in firewall rules doesn't work, but can be commited `` +- {vytask}`T5060` `(feature): add a VRRP 'maintenance mode'` + +## 2023-05-09 + +- {vytask}`T5202` `(bug): After removal load-balancing a pid remained which used in dhclient-exit-hooks` + +## 2023-05-06 + +- {vytask}`T5206` `(bug): ethtool.py:Ethtool.__init__ has always true conditional due to typo` + +## 2023-05-05 + +- {vytask}`T5082` `(feature): container: switch to netavark network stack` + +## 2023-05-04 + +- {vytask}`T5193` `(feature): Ability to specify NS records to specify NS servers for subdomains` +- {vytask}`T3891` `(bug): X550-T2/Possibly other X550/X540 cards no link on VyOS` +- {vytask}`T5010` `(bug): bgp: EVPN route-target not honored` +- {vytask}`T5196` `(feature): wwan: op-mode should inform user if there is no WWAN interface` + +## 2023-05-03 + +- {vytask}`T5163` `(feature): Policy route-map add match source-protocol` + +## 2023-05-02 + +- {vytask}`T5042` `(bug): Command 'show vpn ipsec remote-access' does not work` + +## 2023-04-27 + +- {vytask}`T5185` `(bug): Static IPv6 route with blackhole fails` +- {vytask}`T5175` `(bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0` +- {vytask}`T5183` `(bug): IPv6 route6 problem` +- {vytask}`T5181` `(bug): Wrong dependencies or priorities for zebra vni vrf interfaces and bgpd` +- {vytask}`T5128` `(feature): Policy route - Allow wildcard interfaces` +- {vytask}`T5055` `(feature): Firewall - Add packet type matcher (pkttype)` +- {vytask}`T5050` `(feature): Firewall - Add options for logging packets` +- {vytask}`T5037` `(feature): Firewall - Add queue action` +- {vytask}`T5176` `(bug): http-api: update vyos-http-api-tools for FastAPI security vulnerability` +- {vytask}`T5174` `(bug): vrf: ensure no duplicate VNIs can be created` +- {vytask}`T5123` `(default): Display route originator in show ospf table command` + +## 2023-04-25 + +- {vytask}`T5179` `(bug): multi nodes defined in XML are not properly represented as list in get_config_dict()` + +## 2023-04-17 + +- {vytask}`T5052` `(bug): Error displaying dhcpv6 prefix delegation leases` +- {vytask}`T5150` `(feature): Rework CLI definitions to apply route-maps between routing daemons and zebra/kernel` +- {vytask}`T3734` `(bug): Move EVPN VRF up in FRR config` + +## 2023-04-13 + +- {vytask}`T5152` `(bug): Telegraf agent hostname isn't qualified` +- {vytask}`T4727` `(feature): Add RADIUS rate limit support to PPTP server` +- {vytask}`T4939` `(bug): VRRP command no-preempt not work as expected` +- {vytask}`T4791` `(default): Consistent normalization of 'raw' output of op-mode scripts for CLI and API` +- {vytask}`T3608` `(default): Standardize warnings from configure scripts` + +## 2023-04-11 + +- {vytask}`T4924` `(bug): Systemctl strongswan.service for some reason is not disabled` +- {vytask}`T4197` `(bug): Vyos arm64-latest build issue with telegraf pkg` +- {vytask}`T4051` `(bug): Connected routes strange / not working` + +## 2023-04-10 + +- {vytask}`T5151` `(bug): EAP-TLS TLSv1.0/1.1 regression after T5003` +- {vytask}`T5148` `(bug): OpenVPN cannot start due to could not load plugin shared object /openvpn-otp.so` +- {vytask}`T5110` `(bug): Show frr op-mode vtysh_pam: Failed in account validation` +- {vytask}`T5078` `(feature): VyOS BGP does not support 'show bgp neighbors $NB filtered-routes'` +- {vytask}`T5070` `(feature): show bgp nexthop unavailable in VRF` +- {vytask}`T5061` `(bug): All containers restart on config change` + +## 2023-04-07 + +- {vytask}`T5149` `(bug): op-mode openvpn should not raise error in case interface is disabled` + +## 2023-04-06 + +- {vytask}`T5147` `(bug): Can't Commit with Container Network` +- {vytask}`T5142` `(feature): One of the requirements is to use a system auditing tool to monitor and log all security-relevant events.` +- {vytask}`T5125` `(feature): Add op-mode commands for hsflowd based sflow` + +## 2023-04-05 + +- {vytask}`T5145` `(feature): Add maxsyslogins maximum number of all logins on system` +- {vytask}`T5135` `(default): Rewrite opennhrp script using vyos.ipsec library` +- {vytask}`T4975` `(bug): CLI does not work after cutting off the power or reset` +- {vytask}`T5136` `(bug): Possible config corruption on upgrade` + +## 2023-04-04 + +- {vytask}`T5141` `(feature): Add numbers for dhclient-exit-hooks.d to enforce script order execution` +- {vytask}`T5093` `(bug): Command 'reset vpn ipsec-profile' doesn't work` +- {vytask}`T4362` `(bug): Wan Load Balancing - Can't create routing tables` + +## 2023-04-03 + +- {vytask}`T5139` `(feature): IKE life-time should start from 0 for disable rekey` +- {vytask}`T4173` `(bug): Wan Load Balancing - Error on firewall NAT rules` + +## 2023-04-02 + +- {vytask}`T5134` `(feature): Try if netavark networks can be moved to a VRF instance` + +## 2023-04-01 + +- {vytask}`T5047` `(bug): Recreate only a specific container` +- {vytask}`T5132` `(default): Operational command "show isis vrf XXX route | neighbord" aren't working` + +## 2023-03-31 + +- {vytask}`T5129` `(feature): Add AWS build flavour` +- {vytask}`T5126` `(feature): http-api: add 'allow-client' to restrict IP address of client connections` + +## 2023-03-30 + +- {vytask}`T5130` `(bug): op-mode: drop remaining reference to obsoleted 'show_interfaces.py'` +- {vytask}`T4866` `(feature): Rewrite show_interfaces to standardized form` +- {vytask}`T366` `(bug): SNMP Query for BGP Tunnels Returns IPv4 Tunnels Only` + +## 2023-03-29 + +- {vytask}`T5100` `(feature): Update FRR to 8.5` +- {vytask}`T5094` `(bug): FRR systemd logs unknow key LimitNOFILESoft` +- {vytask}`T5085` `(bug): ospfv3 route-map not applied in FRR configuration` +- {vytask}`T5056` `(bug): IPoE server vlan-mon is not working` +- {vytask}`T5033` `(bug): generate-public-key command fails for address with multiple public keys like GitHub` +- {vytask}`T4876` `(bug): mpls - LSP broken on FRR 8.4.1` +- {vytask}`T5097` `(bug): the operational command "show interfaces ethernet ethx" doesn't reflect a call to 'clear counters'` +- {vytask}`T5089` `(enhancment): Add unit test of config_diff` +- {vytask}`T5088` `(enhancment): Add lexicographical-numeric compare function for vytree/configtree` +- {vytask}`T5087` `(enhancment): Add support for lexical ordering of nodes in config_tree` +- {vytask}`T4885` `(feature): Rewrite 'clear interfaces counters' from Perl to Python` +- {vytask}`T4846` `(bug): L3VPN- network command doesn't install direct connected prefix` + +## 2023-03-28 + +- {vytask}`T5043` `(feature): Need to create reset command for IKEv2 remote-access vpn connections` + +## 2023-03-27 + +- {vytask}`T5099` `(feature): IPoE server add option 'next-pool' for named ip pools` +- {vytask}`T5106` `(feature): Extend generation of API client requests to configsession native functions and composite requests` +- {vytask}`T5104` `(bug): DHCP default route issues with static routes in VRFs` +- {vytask}`T5079` `(feature): xml: schema extension to support defaultValues on tagNodes` +- {vytask}`T5114` `(feature): bgp: implement new CLI commands introduced in FRR 8.5` + +## 2023-03-23 + +- {vytask}`T5108` `(feature): Get rate limit for L2TP/PPTP/SSTP/IPoE in raw format` +- {vytask}`T5086` `(feature): Integrate hsflowd for sflow accounting` +- {vytask}`T5107` `(bug): Raise error in op-mode dns.py instead of calling exit` + +## 2023-03-22 + +- {vytask}`T5068` `(feature): Generate op-mode API client requests along with schema generation` + +## 2023-03-21 + +- {vytask}`T5098` `(feature): PPPoE client holdoff configuration` +- {vytask}`T3694` `(bug): Static routes not installed into kernel nor frr` +- {vytask}`T5102` `(feature): ospf: "redistribute babel" is always set` + +## 2023-03-20 + +- {vytask}`T5057` `(bug): IPoE server incorrect interface regex` +- {vytask}`T5095` `(feature): Return list instead of dict for 'raw' output of op-mode openvpn` + +## 2023-03-19 + +- {vytask}`T4925` `(feature): Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2` + +## 2023-03-17 + +- {vytask}`T5092` `(bug): IPoE-server named pool must not rely on the authentication type` +- {vytask}`T5091` `(bug): IPoE server with RADIUS authentication does not verify radius configuration` + +## 2023-03-16 + +- {vytask}`T5073` `(bug): IPoE-server interface option failed to parse` +- {vytask}`T5063` `(bug): IPoE-server ethX vlan must not be used with client-subnet` +- {vytask}`T5058` `(feature): Extend template filter range_to_regex` +- {vytask}`T3083` `(feature): Add feature event-handler` +- {vytask}`T2516` `(bug): vyos-container: cannot configure ethernet interface` + +## 2023-03-13 + +- {vytask}`T5074` `(bug): Show IPSEC SA failed if remote access IKEv2 vpn is used.` +- {vytask}`T4973` `(bug): show dhcp server leases error for lease time 4294967295` + +## 2023-03-11 + +- {vytask}`T5076` `(feature): CI/CD: Docker container is bloated by legacy and conflicting dependencies` + +## 2023-03-09 + +- {vytask}`T5066` `(bug): Different GRE tunnel but same tunnel keys error` +- {vytask}`T4952` `(feature): Improve interface completion helper CLI experience` + +## 2023-03-08 + +- {vytask}`T4381` `(default): OpenVPN: Add "Tunnel IP" column in "show openvpn server" operational command` +- {vytask}`T4872` `(bug): Op-mode show openvpn misses a case when parsing for tunnel IP` + +## 2023-03-07 + +- {vytask}`T2838` `(bug): Ethernet device names changing, multiple hw-id being added` +- {vytask}`T5051` `(feature): Use Literal types to provide op-mode CLI choices and API enums` +- {vytask}`T4900` `(default): Cache intermediary results of get_config_diff in Config instance` + +## 2023-03-05 + +- {vytask}`T5040` `(default): Generate API GraphQL schema on installation, rather than dynamically` + +## 2023-03-03 + +- {vytask}`T4625` `(enhancment): Update ocserv to current revision (1.1.6)` + +## 2023-03-02 + +- {vytask}`T4967` `(feature): Ability to set hostname for the container` + +## 2023-03-01 + +- {vytask}`T5015` `(bug): Invalid format character error at hfsc class settings help text` + +## 2023-02-28 + +- {vytask}`T5029` `(feature): Nginx change default root directory and fix regex` +- {vytask}`T5025` `(bug): Time-zone validation failed` +- {vytask}`T4955` `(bug): Openconnect radiusclient.conf generating with extra authserver` +- {vytask}`T4843` `(feature): Command-line arguments in container config` +- {vytask}`T4219` `(feature): support incoming-interface (iif) in local PBR` +- {vytask}`T3903` `(bug): Containers: after command "reboot" the host system will reboot after 1.5 minutes` + +## 2023-02-27 + +- {vytask}`T5028` `(feature): Add package exfatprogs to VyOS` +- {vytask}`T4985` `(bug): reset vpn ipsec-peer command with peer name does not work` + +## 2023-02-26 + +- {vytask}`T4979` `(feature): Add API request 'show_user_info' for UI` + +## 2023-02-25 + +- {vytask}`T5008` `(bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine` +- {vytask}`T5007` `(bug): Interface multicast setting is invalid` +- {vytask}`T5027` `(bug): OpenVPN options and site-to-site cannot pass smoketest` +- {vytask}`T4978` `(bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.4-rolling-202302041536` +- {vytask}`T5034` `(bug): Migrate multicast CLI node to valueLess` +- {vytask}`T4948` `(feature): pppoe: add CLI option to allow definition of host-uniq flag` + +## 2023-02-24 + +- {vytask}`T5030` `(bug): HTTPS-API delete key without id error` + +## 2023-02-23 + +- {vytask}`T5013` `(feature): Extend accelppp.py op-mode to get subnet start stop info from config` +- {vytask}`T5002` `(feature): Add uk (United Kingdom) keymap` + +## 2023-02-22 + +- {vytask}`T5024` `(bug): check-qemu-install VM is not shutdown the first time` +- {vytask}`T5011` `(bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu check should be skipped` + +## 2023-02-21 + +- {vytask}`T5021` `(bug): IPsec SA is closed before negotiating a new one or it is negotiated on every second if big life-time is set in swanctl.conf` +- {vytask}`T5020` `(feature): Extend openvpn.py op-mode to get a list of configured clients` + +## 2023-02-20 + +- {vytask}`T5005` `(feature): Skip user authentication for PPPoE Server with noauth option` + +## 2023-02-16 + +- {vytask}`T4971` `(feature): Radius attribute "Framed-Pool" for PPPoE` + +## 2023-02-15 + +- {vytask}`T4991` `(bug): Restore path level information to compare output` + +## 2023-02-14 + +- {vytask}`T4968` `(bug): VPN IPsec check dpd and close action for empty values` +- {vytask}`T1993` `(feature): Extended pppoe rate-limiter` + +## 2023-02-13 + +- {vytask}`T4905` `(feature): Convert show nhrp tunnel to tabulate format` +- {vytask}`T4153` `(bug): Monitor bandwidth-test initiate not working` + +## 2023-02-12 + +- {vytask}`T4998` `(bug): pppoe username validation too restrictive (regression)` + +## 2023-02-11 + +- {vytask}`T2603` `(feature): pppoe-server: reduce min MTU` + +## 2023-02-10 + +- {vytask}`T4857` `(feature): SNMP - Implement FRR SNMP recommendations` +- {vytask}`T4995` `(feature): pppoe, wwan and sstp-client - rename user -> username on authentication` + +## 2023-02-07 + +- {vytask}`T4980` `(bug): chrony not listening as a server` +- {vytask}`T4868` `(bug): L2TP ppp-options ipv6 does not work without ipv6 pool but should` +- {vytask}`T4117` `(bug): Does not possible to configure PoD/CoA for L2TP vpn` + +## 2023-02-01 + +- {vytask}`T4970` `(default): pin OCaml pcre package to avoid JIT support` + +## 2023-01-31 + +- {vytask}`T4964` `(bug): FRR bgp address-family l2vpn-evpn route-target export/import not working` +- {vytask}`T4780` `(feature): Firewall - Add interface group` +- {vytask}`T4157` `(default): Add jinja2 to pip test requirements` + +## 2023-01-30 + +- {vytask}`T4958` `(feature): Add OpenConnect RADIUS Accounting support` +- {vytask}`T4954` `(bug): DNS cannot be configured via Network-Config v1 received from ConfigDrive / Cloud-Init` +- {vytask}`T4118` `(default): IPsec syntax overhaul` + +## 2023-01-29 + +- {vytask}`T4965` `(default): empty description in firewall group causes configuration error on migration` + +## 2023-01-28 + +- {vytask}`T4961` `(bug): Uncaught configtree error allows ntp migration 1-to-2 to fail silentlly on config.boot.default` + +## 2023-01-27 + +- {vytask}`T4960` `` (bug): Bugs in `cc_vyos.py` code (Cloud-Init) `` + +## 2023-01-26 + +- {vytask}`T4886` `(feature): Firewall and Policy - Add connection mark` +- {vytask}`T4957` `(bug): config-mgmt should not attempt to archive config at boot` +- {vytask}`T4962` `(bug): Fix typo in regex in vyos.config_mgmt compare function` +- {vytask}`T4912` `(default): Rewrite the IGMP op mode in the new style` + +## 2023-01-25 + +- {vytask}`T4941` `(bug): Accel-ppp IPoE incompatibility with kernel 6.1` + +## 2023-01-24 + +- {vytask}`T4947` `(feature): Support mounting container volumes as ro or rw` + +## 2023-01-23 + +- {vytask}`T4798` `(default): Migrate the file-exists validator away from Python` +- {vytask}`T4683` `(enhancment): Add kitty-terminfo package to build` +- {vytask}`T4953` `(bug): Remove convert_kwargs_to_snake_case decorator in dynamic generation of GraphQL resolvers` +- {vytask}`T4875` `(default): Replace Python validator 'interface-name' to avoid Python startup cost` +- {vytask}`T4664` `(bug): Add validation to reject whitespace in tag node value names` + +## 2023-01-22 + +- {vytask}`T4906` `(bug): ipsec connections shows only one connection as up` + +## 2023-01-21 + +- {vytask}`T4799` `(bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd` +- {vytask}`T4878` `(bug): Any interface bonding changes cause interface flapping` +- {vytask}`T4387` `(default): Create additional smoketests for multiwan PBR & load-balanced configurations` + +## 2023-01-20 + +- {vytask}`T4551` `(bug): IPsec rekeying collisions bug` +- {vytask}`T4942` `(feature): Rewrite vyatta-config-mgmt to Python/XML` + +## 2023-01-17 + +- {vytask}`T4938` `(bug): Interface input ifb does not work` +- {vytask}`T4902` `(bug): snmpd: exclude container storage from monitoring` +- {vytask}`T4140` `(bug): Lack of SNMP IANA mibs` + +## 2023-01-15 + +- {vytask}`T4832` `(feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)` +- {vytask}`T4937` `(feature): ocserv: upgrade package to version 1.1.6` +- {vytask}`T4918` `(bug): Odd show interface behavior` +- {vytask}`T3008` `(feature): Migrate from ntpd to chronyd` + +## 2023-01-13 + +- {vytask}`T4911` `(default): Rewrite the LLDP op mode in the new format` +- {vytask}`T4928` `(feature): Upgrade Linux Kernel to 6.1.y (2022 LTS edition)` + +## 2023-01-12 + +- {vytask}`T4934` `(bug): ospf: Fix inter-area route summarization` +- {vytask}`T4929` `(feature): Update Intel QAT drivers to 4.20.0-00001` + +## 2023-01-10 + +- {vytask}`T4880` `(feature): Expose 'add/delete container image' in HTTP-API` + +## 2023-01-09 + +- {vytask}`T4922` `(feature): Add ssh-client source-interface CLI option` +- {vytask}`T4524` `(bug): Squid webproxy not working properly` + +## 2023-01-08 + +- {vytask}`T4920` `` (bug): ospf: Fix `passive-interface default` option `` + +## 2023-01-07 + +- {vytask}`T4884` `(bug): Missing a community6 in snmpd config` + +## 2023-01-05 + +- {vytask}`T4904` `(feature): Allow multiple ports for high-availability virtual-server` +- {vytask}`T4789` `(feature): Ability to get L2TP/PPTP/SSTP sessions info in a machine readable format` +- {vytask}`T3937` `(default): Rewrite "show system memory" in Python to make it usable as a library function` + +## 2023-01-04 + +- {vytask}`T4848` `(bug): Minor bug in OpenConnect server with default route` +- {vytask}`T4656` `(feature): Support the listen-host config field of openconnect server` + +## 2023-01-03 + +- {vytask}`T4907` `(bug): nat source translations couldn't show metrics` + +## 2023-01-02 + +- {vytask}`T4893` `(feature): l2tp add ppp-options IPv6 interface identifier` +- {vytask}`T4717` `(feature): Connect to console server by name` +- {vytask}`T725` `(feature): Cake and FQ-PIE` + +## 2022-12-31 + +- {vytask}`T4898` `(feature): Add mtu config option for dummy interfaces` + +## 2022-12-30 + +- {vytask}`T4834` `(bug): Limit container network name to 15 characters` +- {vytask}`T4901` `(bug): Update Podman to v4.3.1` +- {vytask}`T4899` `(bug): Podman systemd services not being installed correctly` + +## 2022-12-28 + +- {vytask}`T4593` `(feature): Upgrade strongswan to 5.9.8` + +## 2022-12-26 + +- {vytask}`T4511` `(bug): IPv6 DNS lookup` +- {vytask}`T4809` `(feature): radvd: Allow use of AdvRASrcAddress` + +## 2022-12-25 + +- {vytask}`T3579` `(feature): Rewrite vyatta-conntrack in new XML and Python flavour` + +## 2022-12-24 + +- {vytask}`T4890` `(bug): show conntrack table ipv4 fail` +- {vytask}`T4879` `(bug): IPSec migration failed with missing remote-id` +- {vytask}`T4870` `(feature): Containers switch to using overlay driver for podman storage` + +## 2022-12-23 + +- {vytask}`T4792` `(feature): Add SSTP VPN client` + +## 2022-12-21 + +- {vytask}`T4887` `(bug): Schema generation from op-mode functions should set default 'false' on boolean arguments` + +## 2022-12-18 + +- {vytask}`T4882` `(bug): Missing ICMPv6 type names in firewall configuration` + +## 2022-12-15 + +- {vytask}`T4671` `(bug): linux-firmware package is missing symlinks defined in WHENCE file` + +## 2022-12-14 + +- {vytask}`T4881` `(bug): Return opmode.Error on openconnect.py show_sessions` + +## 2022-12-12 + +- {vytask}`T4861` `(feature): Openconnect restart on adding users - Aborts all active connections` + +## 2022-12-09 + +- {vytask}`T4865` `(bug): container impossible to generate local image from a file if it requires install some pkgs` + +## 2022-12-05 + +- {vytask}`T4860` `(bug): Openconnect server incorrect unconfigured check` +- {vytask}`T4804` `(bug): PPPoE server incorrect unconfigured check` +- {vytask}`T4854` `(feature): BGP-route reflector allows to apply route-maps` + +## 2022-12-04 + +- {vytask}`T4825` `(feature): interfaces veth/veth-pairs -standalone used` +- {vytask}`T4805` `(bug): PPPoE server does not restart service if pool was changed` + +## 2022-12-02 + +- {vytask}`T4830` `(bug): nat66 - Error in port translation rules` +- {vytask}`T4859` `(bug): Correct calling of config mode script dependencies from http-api.py` +- {vytask}`T4820` `(enhancment): Support for inter-config-mode script dependencies` +- {vytask}`T4858` `(bug): L3VPN- Route Distinguisher notations` +- {vytask}`T1024` `(feature): Policy Based Routing by DSCP` + +## 2022-12-01 + +- {vytask}`T4841` `(feature): add fan control` +- {vytask}`T4847` `(bug): Correct calling of config mode script dependencies from pki.py` + +## 2022-11-29 + +- {vytask}`T4842` `(bug): Routing config broken if mpls config exists` +- {vytask}`T4845` `(default): Add smoketest to detect cycles in config-mode script dependency calls` + +## 2022-11-27 + +- {vytask}`T4739` `(feature): ISIS and OSPF segment routing being refactored` + +## 2022-11-24 + +- {vytask}`T4794` `(bug): show firewall name - Can't use .items() on a list` +- {vytask}`T4714` `(feature): Delete unused ipset from the filecaps` +- {vytask}`T3541` `(bug): Route Map large community set additive is missing` + +## 2022-11-23 + +- {vytask}`T4836` `(feature): Kernel: enable new features like switchdev, ESP in TCP and HSR` +- {vytask}`T4835` `(bug): SNMPD configuration incorrect for IPv6` +- {vytask}`T4819` `(feature): Allow printing Warning messages in multiple lines with \n` +- {vytask}`T4807` `(feature): Need to fix traceroute help completion` +- {vytask}`T4660` `(feature): Reorganize route map set community CLI` +- {vytask}`T4526` `(bug): keepalived-fifo.py unable to load config` +- {vytask}`T4793` `(feature): Create warning message about disable-route-autoinstall when ipsec vti is used` +- {vytask}`T4492` `(bug): Incorrect list of neighbors in help for "show bgp vrf VRF neighbors"` +- {vytask}`T4496` `(feature): ping vrf help does not list VRFs` + +## 2022-11-22 + +- {vytask}`T4823` `(bug): swanctl.conf is broken when ipsec site-to-site peer set.` +- {vytask}`T4706` `(bug): NAT and NAT66 issues` +- {vytask}`T4670` `(feature): policy route - Update matching criteria` + +## 2022-11-21 + +- {vytask}`T4812` `(feature): IPsec ability to show all configured connections` +- {vytask}`T4829` `(default): Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional` + +## 2022-11-20 + +- {vytask}`T4827` `(bug): route-map issues , not load configuration FRR` + +## 2022-11-19 + +- {vytask}`T4826` `(bug): Wrong key type is used for SSH SK public keys` +- {vytask}`T4720` `(feature): Ability to configure SSH HostKeyAlgorithms` +- {vytask}`T4828` `(default): Raise appropriate op-mode errors in ipsec.py 'reset_peer'` + +## 2022-11-18 + +- {vytask}`T4821` `(bug): Correct calling of config mode script dependencies from firewall.py` + +## 2022-11-17 + +- {vytask}`T4750` `(feature): Support of higher level SSH keys (sk-ssh-ed25519)` + +## 2022-11-15 + +- {vytask}`T4808` `(feature): Add details of configtree operations to migration log` + +## 2022-11-12 + +- {vytask}`T4814` `(bug): Regression in bundled powerdns version` + +## 2022-11-09 + +- {vytask}`T4800` `(bug): undefined var includes_chroot_dir in build-vyos-image` + +## 2022-11-08 + +- {vytask}`T4771` `(feature): Rewrite protocol BGP op-mode to vyos.opmode format` +- {vytask}`T4806` `(default): Update FRR to 8.4 in 1.4 version` + +## 2022-11-06 + +- {vytask}`T4803` `(bug): The header 'Authorization' needs to be explictly allowed in http-api CORS middleware` + +## 2022-11-05 + +- {vytask}`T4802` `(feature): Ability to define per container shared-memory size` + +## 2022-11-01 + +- {vytask}`T4764` `(bug): NAT tables vyos_nat and vyos_static_nat not deleting after deleting nat` +- {vytask}`T4177` `(bug): Strip-private doesn't work for service monitoring` + +## 2022-10-31 + +- {vytask}`T4786` `(feature): Add package python3-pyhumps` +- {vytask}`T1875` `(feature): Add the ability to use network address as BGP neighbor (bgp listen range)` +- {vytask}`T4785` `(feature): snmp: Allow !, @, * and # in community name` +- {vytask}`T4787` `(feature): ipsec: add support for road-warrior/remote-access RADIUS timeout` + +## 2022-10-29 + +- {vytask}`T4783` `(default): Add support for stunnel` +- {vytask}`T4784` `(feature): Add description node for static route/route6 tagNodes` + +## 2022-10-28 + +- {vytask}`T4291` `(default): Consolidate component version read/write functions` + +## 2022-10-27 + +- {vytask}`T4763` `(feature): Change XML for Show nat destination statistics` +- {vytask}`T4762` `(bug): Show nat rules with empty rules incorrect error` +- {vytask}`T4778` `(bug): Raise error UnconfiguredSubsystem if op-mode ipsec.py fails initialization` + +## 2022-10-26 + +- {vytask}`T4773` `(default): Add camel_case to snake_case conversion utility` + +## 2022-10-25 + +- {vytask}`T4574` `(default): Add token based authentication to GraphQL API` + +## 2022-10-24 + +- {vytask}`T4772` `(default): Return list of dicts in 'raw' output of route.py instead of dict with redundant information` + +## 2022-10-23 + +- {vytask}`T3723` `(bug): op-mode IPSec show vpn ipsec sa output with underscores` + +## 2022-10-21 + +- {vytask}`T4768` `(default): Change name of api child node from 'gql' to 'graphql'` + +## 2022-10-18 + +- {vytask}`T4684` `(feature): Rewrite show ip route by protocol to vyos.opmode format` +- {vytask}`T4533` `(bug): Radius clients don’t have simple permissions` +- {vytask}`T4753` `(enhancment): Extend automatic generation of schema to query SystemStatus` + +## 2022-10-17 + +- {vytask}`T4725` `(bug): Unable to reset vpn IPsec peer` + +## 2022-10-14 + +- {vytask}`T4672` `(bug): RADIUS server disable does not work` +- {vytask}`T4749` `(enhancment): Use config_dict for conf_mode http-api.py` + +## 2022-10-13 + +- {vytask}`T4746` `(bug): Monitoring nft. table vyos_filter by default does not exist but telegraf checks this table` +- {vytask}`T4744` `(bug): BGP directly connected neighbors don't compatible with ebgp-multihop` +- {vytask}`T4716` `(feature): SSH ability to configure RekeyLimit` +- {vytask}`T4343` `(default): Expose powerdns network-timeout for service dns forwarding` +- {vytask}`T4312` `(bug): Telegraf configuration doesn't accept IPs for URL` +- {vytask}`T4274` `(default): Extend OpenConnect RADIUS Timeout to Permit 2FA Entry` + +## 2022-10-12 + +- {vytask}`T4747` `(bug): Monitoring influxdb template input exec plugin does not work` +- {vytask}`T4740` `(bug): Show conntrack table ipv6 fail` +- {vytask}`T4730` `(bug): Conntrack-sync error - listen-address is not the correct type in config as it should be` + +## 2022-10-11 + +- {vytask}`T4742` `(bug): Autocomplete in policy route rule x set table / does not show the tables created in the static protocols` +- {vytask}`T4741` `(bug): set firewall zone Local local-zone failed` +- {vytask}`T4680` `(bug): Telegraf prometheus-client listen-address invalid format` + +## 2022-10-10 + +- {vytask}`T538` `(feature): Support for network mapping in NAT` + +## 2022-10-09 + +- {vytask}`T4738` `(enhancment): Extend automatic generation of schema definition files to native configsession functions; use single resolver/directive` + +## 2022-10-08 + +- {vytask}`T4707` `(feature): Enable OSPF segment routing` + +## 2022-10-07 + +- {vytask}`T4736` `(bug): Error on JSON output of API query ShowConfig` + +## 2022-10-04 + +- {vytask}`T4708` `(bug): 'show nat destination rules' throwing an error` +- {vytask}`T4700` `(feature): Firewall - Add interface match criteria` +- {vytask}`T4699` `(feature): Firewall - Add jump action - Add return action` +- {vytask}`T4651` `(feature): Firewall - Add options to match packet size` +- {vytask}`T4702` `(bug): Wireguard peers configuration is not synchronized with CLI` +- {vytask}`T4685` `(bug): Interface does not exist on boot when used as inbound-interface for local policy route` +- {vytask}`T4652` `(feature): Upgrade PowerDNS recursor to 4.7 series` +- {vytask}`T4582` `(default): Router-advert: Preferred lifetime cannot equal valid lifetime in PIOs` + +## 2022-09-29 + +- {vytask}`T4715` `(feature): Auto logout user after a period of inactivity` +- {vytask}`T4697` `(bug): policy route: Generating ConfigError failes when tcp flag is missing on set tcp-mss rule commit` + +## 2022-09-27 + +- {vytask}`T4711` `(feature): Ability to terminate user TTY and PTS sessions` +- {vytask}`T4557` `(feature): fastnetmon: allow configure limits per protocol (tcp, udp, icmp)` + +## 2022-09-21 + +- {vytask}`T4678` `(feature): Rewrite service ipoe-server to get_config_dict` +- {vytask}`T4703` `(feature): accel-ppp: combine vlan-id and vlan-range into single CLI node` + +## 2022-09-20 + +- {vytask}`T4693` `(bug): ISIS segment routing was broken...` + +## 2022-09-17 + +- {vytask}`T4666` `(bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584` +- {vytask}`T4665` `(bug): Keepalived cannot use same VRID for VRRPv2 and VRRPv3` + +## 2022-09-16 + +- {vytask}`T4698` `(enhancment): Drop validator name="range" and replace it with numeric` +- {vytask}`T4695` `(feature): Add 'es' and 'jp106' keymap option keyboard-layout` +- {vytask}`T4669` `(enhancment): Extend numeric.ml for inversion of values and range values` + +## 2022-09-15 + +- {vytask}`T4679` `(bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address` +- {vytask}`T4691` `(feature): Upgrade Linux Kernel to latest 5.15.y train` +- {vytask}`T4630` `(bug): Prevent attempts to use the same interface as a source interface for pseudo-ethernet and MACsec at the same time` +- {vytask}`T4696` `(default): Extend bgp parameters for bgp bestpath peer-type multipath-relax` + +## 2022-09-12 + +- {vytask}`T4617` `(feature): VRF specification is needed for telegraf prometheus-client listen-address
` +- {vytask}`T4690` `(bug): Update GraphQL resolver for 'SystemStatus' following changes to 'show_uptime' op-mode script` +- {vytask}`T4647` `(feature): Add Google Virtual NIC (gVNIC) support` +- {vytask}`T4170` `(feature): Rename "policy ipv6-route" -> "policy route6"` + +## 2022-09-09 + +- {vytask}`T4682` `(feature): Rewrite 'show system storage' in standardized format` +- {vytask}`T4681` `(feature): Complete standardization of show_uptime.py` + +## 2022-09-06 + +- {vytask}`T4640` `(enhancment): Integrate op-mode exception hierarchy into API` +- {vytask}`T4597` `(bug): Check bind port before assign service HTTPS API and openconnect` +- {vytask}`T4674` `(bug): API should show op-mode error message, if present` +- {vytask}`T4673` `(bug): op-mode bridge.py should raise error on show_fdb for nonexistent bridge interface` + +## 2022-09-05 + +- {vytask}`T4668` `(bug): Adding/removing members from bond doesn't work/results in incorrect interface state` +- {vytask}`T4663` `(bug): Interface pseudo-ethernet does not change mode` +- {vytask}`T4655` `(bug): Firewall in 1.4 sets the default action 'accept' instead of 'drop'` +- {vytask}`T4628` `(bug): ConfigTree() throws ValueError() if tagNode contains whitespaces` + +## 2022-09-01 + +- {vytask}`T4606` `(bug): monitor nat destination translation shows missing script` +- {vytask}`T4435` `(bug): Policy route and firewall - error when using undefined group` +- {vytask}`T4147` `(bug): New Firewall Implementation - proposed changes on group implementation` + +## 2022-08-31 + +- {vytask}`T4650` `(feature): Rewire show nat translation to vyos.opmode format` +- {vytask}`T4644` `(bug): Check bind port before assign vpn sstp` +- {vytask}`T4643` `(bug): Smoketest exclude either sstp or openconnect from pki-misc default listen port` +- {vytask}`T4569` `(feature): Rewrite show bridge to new format` +- {vytask}`T4547` `(bug): Show vpn ipsec sa show unexpected prefix 'B' in packets` +- {vytask}`T4367` `(bug): NAT - Config tmp file not available` + +## 2022-08-29 + +- {vytask}`T4645` `(bug): show nat source statistics lack argument --family` +- {vytask}`T4634` `(bug): Bgp neighbor disable-connected-check does not work` +- {vytask}`T4631` `(feature): Add port and protocol to nat66` +- {vytask}`T4623` `(feature): Add show conntrack statistics` +- {vytask}`T4595` `(bug): DPD interval and timeout do not work in DMVPN` +- {vytask}`T4594` `(feature): Rewrite op-mode IPsec to vyos.opmode format` +- {vytask}`T4508` `(bug): Problem with values of the same environment in different event handlers` +- {vytask}`T4653` `(bug): Interface offload options are not applied correctly` +- {vytask}`T4546` `(bug): Does not connect Cisco spoke to VyOS hub.` +- {vytask}`T4061` `(default): Add util function to check for completion of boot config` +- {vytask}`T4654` `(bug): RPKI cache incorrect description` +- {vytask}`T4572` `(bug): Add an option to force interface MTU to the value received from DHCP` + +## 2022-08-26 + +- {vytask}`T4642` `(bug): proxy: hyphen not allowed in proxy URL` + +## 2022-08-25 + +- {vytask}`T4626` `(bug): Error showing nat66 source and destination` +- {vytask}`T4622` `(feature): Firewall allow drop packets by TCP MSS size` + +## 2022-08-24 + +- {vytask}`T4641` `(bug): prefix-list allows ipv6 prefix as input` +- {vytask}`T4633` `(feature): Change keepalived to v2.2.7` + +## 2022-08-23 + +- {vytask}`T4618` `(bug): Traffic policy not set on virtual interfaces` +- {vytask}`T4538` `(bug): Macsec does not work correctly when the interface status changes.` + +## 2022-08-22 + +- {vytask}`T4089` `(bug): Show nat destination rules shows ip address instead of interface 'any'` +- {vytask}`T4632` `(bug): VLAN-aware bridge not working` +- {vytask}`T4637` `(feature): Upgrade to podman 4.2.0` + +## 2022-08-20 + +- {vytask}`T4596` `(bug): "show openconnect-server sessions" command does not work in the openconnect module` + +## 2022-08-19 + +- {vytask}`T4620` `(bug): UPnP does not work due to incorrect template` +- {vytask}`T4619` `(bug): Static arp is not set if another entry is present` +- {vytask}`T4611` `(bug): UPnP rule IP should be a prefix instead of an address` +- {vytask}`T4614` `(feature): OpenConnect split-dns directive` + +## 2022-08-18 + +- {vytask}`T4613` `(bug): UPnP configuration without listen option fail` +- {vytask}`T4570` `(bug): Exception when trying to set up VXLAN over Wireguard` + +## 2022-08-17 + +- {vytask}`T4598` `(feature): nat66 - Add exclude options` +- {vytask}`T4480` `(default): add an ability to configure squid acl safe ports and acl ssl safe ports` + +## 2022-08-16 + +- {vytask}`T4592` `(bug): macsec: can not create two interfaces using the same source-interface` +- {vytask}`T4584` `(bug): hostap: create custom package build` +- {vytask}`T4413` `(default): Add an API endpoint with basic system stats` +- {vytask}`T4537` `(bug): MACsec not working with cipher gcm-aes-256` + +## 2022-08-15 + +- {vytask}`T4609` `(bug): Unable to Restart Container VyOS 1.4` +- {vytask}`T4565` `(bug): vlan aware bridge not working with - Kernel: T3318: update Linux Kernel to v5.4.205 #249` +- {vytask}`T3988` `(default): Feature Request: IPsec Multiple local/remote prefix for the tunnel` +- {vytask}`T2763` `(feature): New SNMP resource request - SNMP over TCP` + +## 2022-08-14 + +- {vytask}`T4579` `(bug): bridge: can not delete member interface CLI option when VLAN is enabled` +- {vytask}`T4421` `(default): Add support for floating point numbers in the numeric validator` +- {vytask}`T3507` `(bug): Bond with mode LACP show u/u in show interfaces even if peer is not configured` + +## 2022-08-12 + +- {vytask}`T4603` `(feature): Need a config option to specify NAS-IP-Address for vpn l2tp` + +## 2022-08-10 + +- {vytask}`T4408` `(feature): Add sshguard to protect against brut-forces` + +## 2022-08-08 + +- {vytask}`T4586` `(feature): Add to NAT66: SNAT destination address and DNAT source address.` + +## 2022-08-04 + +- {vytask}`T4257` `(feature): Discussion on changing BGP autonomous system number syntax` + +## 2022-08-02 + +- {vytask}`T4585` `(feature): Rewrite op-mode containers to vyos.opmode` +- {vytask}`T4515` `(default): Reduce telegraf binary size` + +## 2022-08-01 + +- {vytask}`T4581` `(bug): 'show system cpu' not working` +- {vytask}`T4578` `(feature): Rewrite show dns forwarding statistics to new format` + +## 2022-07-31 + +- {vytask}`T4580` `(bug): Handle the case of op-mode file names with hyphens in GraphQL schema/resolver generation` + +## 2022-07-30 + +- {vytask}`T4575` `(feature): vyos.utill add new wrapper "rc_cmd" to get the return code and output` +- {vytask}`T4562` `(feature): Rewrite show vrf to new format` +- {vytask}`T4545` `(feature): Rewrite show nat source rules` +- {vytask}`T4543` `(bug): Show source nat statistics shows incorrect interface` +- {vytask}`T4503` `(default): Prevent op mode scripts from restarting services if there's a commit in progress` +- {vytask}`T4411` `(feature): Add migration for service monitoring telegraf influxdb` + +## 2022-07-29 + +- {vytask}`T4554` `(enhancment): Implement GraphQL resolvers for standardized op-mode scripts` +- {vytask}`T4518` `(feature): Add XML for CLI conf mode load-balancing wan` +- {vytask}`T4544` `(enhancment): Generate schema definitions from standardized op-mode scripts` + +## 2022-07-28 + +- {vytask}`T4531` `(bug): NAT op-mode errors with exclude rules` +- {vytask}`T3435` `(bug): NAT rules show corruption` + +## 2022-07-27 + +- {vytask}`T4571` `(bug): Sflow with vrf configured does not use vrf to validate agent-address IP from vrf-configured interfaces` +- {vytask}`T4552` `(bug): Unable to reset IPsec IPv6 peer` + +## 2022-07-26 + +- {vytask}`T4568` `(bug): show vpn debug peer doesn't work` +- {vytask}`T4556` `(feature): fastnetmon: Allow configure white_list_path and populate with hosts/networks that should be ignored.` +- {vytask}`T4495` `(feature): Combine BGP reset op commands` + +## 2022-07-25 + +- {vytask}`T4567` `(default): Merge experimental branch of GraphQL development` +- {vytask}`T4560` `(bug): VRF and BGP neighbor local-as error` +- {vytask}`T4493` `(bug): Incorrect help for "show bgp neighbors"` +- {vytask}`T1233` `(bug): ipsec vpn sa showing down` + +## 2022-07-22 + +- {vytask}`T4145` `(bug): Conntrack table not showing after firewall rewriting` + +## 2022-07-21 + +- {vytask}`T4555` `(feature): fastnetmon: add IPv6 support` +- {vytask}`T4553` `(default): Allow to set ban time on ddos-protection configuration` + +## 2022-07-20 + +- {vytask}`T4056` `(bug): Traffic policy not set in live configuration` + +## 2022-07-18 + +- {vytask}`T4523` `(feature): OP-mode Extend conntrack output to get marks, zones and directions` +- {vytask}`T4228` `(bug): bond: OS error thrown when two bonds use the same member` +- {vytask}`T4539` `(feature): qat: update Intel QuickAssist release version 1.7.L.4.16.0-00017` +- {vytask}`T4534` `(bug): bond: bridge: error out if member interface is assigned to a VRF instance` +- {vytask}`T4525` `(bug): Delete interface from VRF and add it to bonding error` +- {vytask}`T4522` `(feature): bond: add ability to specify mii monitor interval via CLI` +- {vytask}`T4535` `(feature): FRR: upgrade to stable/8.3 version` +- {vytask}`T4521` `(bug): bond: ARP monitor interval is not configured despite set via CLI` +- {vytask}`T4540` `(feature): firmware: update to Linux release 20220708` + +## 2022-07-17 + +- {vytask}`T4028` `(bug): FRR 8.1 routes not being applied to routing table after reboot if an interface has 2 ip addresses` + +## 2022-07-15 + +- {vytask}`T4494` `(bug): Cannot reset BGP peer within VRF` +- {vytask}`T4536` `(feature): FRR: move to systemd for daemon control` + +## 2022-07-14 + +- {vytask}`T4491` `(bug): Use empty string for internal name of root node of config_tree` + +## 2022-07-13 + +- {vytask}`T1375` `(feature): Add clear dhcp server lease function` + +## 2022-07-12 + +- {vytask}`T4527` `(bug): Prevent to create VRF name default` +- {vytask}`T4084` `(default): Dehardcode the default login banner` +- {vytask}`T3948` `(feature): IPSec VPN: Add a new option "none" for the connection-type` +- {vytask}`T235` `(feature): Ability to configure manual IP Rules` + +## 2022-07-10 + +- {vytask}`T3836` `(bug): Setting a default IPv6 route while getting IPv4 gateway via DHCP removes the IPv4 gateway` + +## 2022-07-09 + +- {vytask}`T4507` `(feature): IPoE-server add multiplier option for shaper` +- {vytask}`T4499` `(bug): NAT source translation not showing a single output` +- {vytask}`T4468` `(bug): web-proxy source group cannot start with a number bug` +- {vytask}`T4373` `(feature): PPPoE-server add multiplier option for shaper` +- {vytask}`T3353` `(bug): PPPoE server wrong vlan-range generating config` +- {vytask}`T3648` `(bug): op-mode: nat rules broken` +- {vytask}`T4517` `(feature): ip: Add options to enable directed broadcast forwarding` + +## 2022-07-07 + +- {vytask}`T4456` `(bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many messages` +- {vytask}`T4509` `(feature): Feature Request: DNS64` + +## 2022-07-06 + +- {vytask}`T4513` `(bug): Webproxy monitor commands do not work` +- {vytask}`T4299` `(feature): Firewall - GeoIP filtering` + +## 2022-07-05 + +- {vytask}`T4378` `(bug): Unable to submit wildcard ("*.example.com") A or AAAA records in dns forwarder` +- {vytask}`T2683` `(default): no dual stack in system static-host-mapping host-name` +- {vytask}`T478` `(feature): Firewall address group (multi and nesting)` + +## 2022-07-04 + +- {vytask}`T4501` `(bug): Syslog-identifier does not work in event handler` +- {vytask}`T3600` `(bug): DHCP Interface static route breaks PBR` +- {vytask}`T4498` `(feature): bridge: Add option to enable/disable IGMP/MLD snooping` + +## 2022-07-01 + +- {vytask}`T2455` `(bug): No support for the IPv6 VTI` +- {vytask}`T4490` `(feature): BGP- warning message that AFI/SAFI is needed to establish the neighborship` +- {vytask}`T4489` `(bug): MPLS sysctl not persistent for tunnel interfaces` + +## 2022-06-29 + +- {vytask}`T4477` `(feature): router-advert: support RDNSS lifetime option` + +## 2022-06-28 + +- {vytask}`T4486` `(bug): Container can't be deleted` +- {vytask}`T4473` `(bug): Use container network without network declaration error` +- {vytask}`T4458` `(feature): Firewall - add support for matching ip ttl in firewall rules` +- {vytask}`T3907` `(feature): Firewall - Set log levels` + +## 2022-06-27 + +- {vytask}`T4484` `(default): Firewall op-mode summary doesn't correctly handle address group containing ranges` + +## 2022-06-25 + +- {vytask}`T4482` `(bug): dhcp: toggle of "dhcp-options no-default-route" has no effect` +- {vytask}`T4483` `(feature): Upgrade fastnetmon to v1.2.2 community edition` + +## 2022-06-22 + +- {vytask}`T1748` `(feature): vbash: beautify tab completion output/line breaks` + +## 2022-06-20 + +- {vytask}`T1856` `(feature): Support configuring IPSec SA bytes` + +## 2022-06-18 + +- {vytask}`T4467` `(bug): Validator Does Not Accept Signed Numbers` + +## 2022-06-17 + +- {vytask}`T4209` `(bug): Firewall incorrect handler for recent count and time` + +## 2022-06-16 + +- {vytask}`T4352` `(bug): wan-load balance - priority traffic rule doesn't work` + +## 2022-06-15 + +- {vytask}`T4450` `(feature): Route-map - Extend options for ip|ipv6 address match` +- {vytask}`T4449` `(feature): Route-map - Extend options for ip next-hop match` +- {vytask}`T990` `(feature): Make DNAT/SNAT a valid state in firewall rules.` + +## 2022-06-12 + +- {vytask}`T4420` `(feature): Feature Request: ocserv: show configured 2FA OTP key` +- {vytask}`T4380` `(default): Feature Request: ocserv: 2FA OTP key generator in VyOS CLI` + +## 2022-06-10 + +- {vytask}`T4365` `(bug): NAT - Error on setting up tables` +- {vytask}`T4465` `(feature): node.def generation misses whitespace on multiple use of ` + +## 2022-06-09 + +- {vytask}`T4444` `(default): sstp: Feature request. Port number changing support` +- {vytask}`T2580` `(feature): Support for ip pools for ippoe` + +## 2022-06-08 + +- {vytask}`T4447` `` (bug): DHCPv6 prefix delegation `sla-id` limited to 128 `` + +## 2022-05-31 + +- {vytask}`T4212` `(default): PermissionError when generating/installing server Certificate (generate pki certificate sign ...)` +- {vytask}`T4199` `(bug): Commit failed when setting icmpv6 type any` +- {vytask}`T4148` `(bug): Firewall - Error messages not that clear as it were in old firewall` +- {vytask}`T3659` `(bug): Configuration won't accept IPv6 addresses for site-to-site VPN tunnel prefixes/traffic selectors` + +## 2022-05-30 + +- {vytask}`T4315` `(feature): Telegraf - Output to prometheus` + +## 2022-05-29 + +- {vytask}`T2473` `(feature): Xml for EIGRP [conf_mode]` + +## 2022-05-28 + +- {vytask}`T4448` `(feature): rip: add support for explicit version selection` + +## 2022-05-26 + +- {vytask}`T4442` `(feature): HTTP API add action "reset"` + +## 2022-05-25 + +- {vytask}`T4410` `(feature): Telegraf - Output to Splunk` +- {vytask}`T4382` `(bug): Replacing legacy loadFile exposes missing steps in migration scripts and other errors` + +## 2022-05-21 + +- {vytask}`T4437` `(bug): flow-accounting: support IPv6 flow collectors` + +## 2022-05-20 + +- {vytask}`T4418` `(feature): Telegraf - output Plugin azure-data-explorer` + +## 2022-05-19 + +- {vytask}`T4434` `(bug): DMVPN: cisco-authentication password length is 8 characters` +- {vytask}`T3938` `(default): Rewrite the uptime script in Python to allow using it as a library` +- {vytask}`T4334` `(default): Make the config lexer reentrant` + +## 2022-05-17 + +- {vytask}`T4424` `(bug): policy local-route6 shows ipv4 format` + +## 2022-05-16 + +- {vytask}`T4377` `(default): generate tech-support archive includes previous archives` + +## 2022-05-12 + +- {vytask}`T4417` `(bug): VRRP doesn't start with conntrack-sync` +- {vytask}`T4100` `(feature): Firewall increase maximum number of rules` + +## 2022-05-11 + +- {vytask}`T4405` `` (bug): DHCP client sometimes ignores `no-default-route` option of an interface `` + +## 2022-05-10 + +- {vytask}`T4156` `(default): Adding DHCP Option 13 (bootfile-size)` +- {vytask}`T1972` `(feature): Allow setting interface name for virtual_ipaddress in VRRP VRID` + +## 2022-05-07 + +- {vytask}`T4361` `` (bug): `vyos.config.exists()` does not work for nodes with multiple values `` +- {vytask}`T4354` `(bug): Slave interfaces fall out from bonding during configuration change` +- {vytask}`T4419` `(feature): vrf: support to disable IP forwarding within a given VRF` + +## 2022-05-06 + +- {vytask}`T4385` `(bug): bgp: peer-group member cannot override remote-as of peer-group` + +## 2022-05-05 + +- {vytask}`T4414` `(feature): Add route-map "as-path prepend last-as x" option` + +## 2022-05-03 + +- {vytask}`T4395` `(feature): Extend show vpn debug` + +## 2022-05-01 + +- {vytask}`T4369` `(bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node` +- {vytask}`T4363` `(bug): salt-minion: default mine_interval option is not set` +- {vytask}`T4353` `(feature): Add Jinja2 linter to vyos-1x build process` + +## 2022-04-29 + +- {vytask}`T4388` `(bug): dhcp-server: missing constraint on tftp-server-name option` +- {vytask}`T4366` `(bug): geneve: interface is removed on changes to e.g. description` + +## 2022-04-28 + +- {vytask}`T4400` `(bug): Container OP mode has delete where show and update should be` + +## 2022-04-27 + +- {vytask}`T4398` `(bug): IPSec site-to-site generates unexpected passthrough option` +- {vytask}`T4397` `(feature): arp: migrate static ARP entry configuration to get_config_dict() and make it VRF aware` +- {vytask}`T4357` `(feature): Allow free-form setting of DHCPv6 server options` + +## 2022-04-26 + +- {vytask}`T4210` `(bug): NAT source/destination negated ports throws an error` +- {vytask}`T4235` `(default): Add config tree diff algorithm` + +## 2022-04-25 + +- {vytask}`T4390` `(feature): op-mode: extend "show log" and "monitor log" with additional daemons/subsystems to read journalctl logs` +- {vytask}`T4391` `(bug): PPPoE: IPv6 not working after system boot` + +## 2022-04-24 + +- {vytask}`T4342` `(bug): "show ip ospf neighbor address x.x.x.x" gives "unknown command" error` + +## 2022-04-23 + +- {vytask}`T4386` `(default): Applying limiter on traffic-policy "in" fails, incorrectly reports mirror or redirect policy in use` + +## 2022-04-22 + +- {vytask}`T4389` `(feature): dhcp: add vendor option support for Ubiquity Unifi controller` + +## 2022-04-21 + +- {vytask}`T4384` `(feature): pppoe: replace default-route CLI option with common CLI nodes already present for DHCP` + +## 2022-04-20 + +- {vytask}`T4345` `(bug): New firewall code does not accept "rate/time interval" syntax used in old config` +- {vytask}`T4231` `(feature): Feature Request: ocserv: 2FA (password+OTP) support in Openconnect` + +## 2022-04-19 + +- {vytask}`T4379` `(bug): PPPoE: default-route lost after applying additional static routes` +- {vytask}`T4344` `(bug): DHCP statistics not matching, conf-mode generates incorrect pool name with dash` +- {vytask}`T4268` `(bug): Elevated LA while using VyOS monitoring feature` + +## 2022-04-18 + +- {vytask}`T4351` `(bug): Openvpn conf-mode "openvpn-option" is not respected` +- {vytask}`T4278` `(default): vyos-vm-images: fix vagrant libvirt box` +- {vytask}`T4368` `(bug): bgp: AS specified for local as is the same as the remote as and this is not allowed.` +- {vytask}`T4370` `(feature): vxlan: geneve: support configuration of df bit option` + +## 2022-04-15 + +- {vytask}`T4327` `(default): Ethernet interface configuration fails on Hyper-V due to speed/duplex/autoneg ethtool command error` +- {vytask}`T4364` `(feature): salt-minion: Upgrade to 3004 and migrate to get_config_dict()` + +## 2022-04-13 + +- {vytask}`T4333` `(feature): Jinja2: add plugin to test if a variable is defined and not none to reduce template complexity` + +## 2022-04-08 + +- {vytask}`T4331` `(bug): IPv6 link local addresses are not configured when an interface is in a VRF` +- {vytask}`T4347` `(default): Return complete and consistent error codes from HTTP API` +- {vytask}`T4339` `(bug): wwan: tab-completion results in "No such file or directory" if there is no WWAN interface` +- {vytask}`T4338` `(bug): wwan: changing interface description should not trigger reconnect` +- {vytask}`T4324` `(bug): wwan: check alive script should only be run via cron if a wwan interface is configured at all` + +## 2022-04-07 + +- {vytask}`T4330` `(bug): MTU settings cannot be applied when IPv6 is disabled` +- {vytask}`T4346` `(feature): Deprecate "system ipv6 disable" option to disable address family within OS kernel` +- {vytask}`T4319` `(bug): The command "set system ipv6 disable" doesn't work as expected.` +- {vytask}`T4341` `(feature): login: disable user-account prior to deletion and wait until deletion is complete` +- {vytask}`T4336` `(feature): isis: add support for MD5 authentication password on a circuit` + +## 2022-04-06 + +- {vytask}`T4308` `(feature): Op-comm "Show log frr" to view specific protocol logs` + +## 2022-04-04 + +- {vytask}`T4329` `(bug): Bgp policy route-map bug with set several extcommunity rt` + +## 2022-04-02 + +- {vytask}`T4335` `(bug): open-vmdk fails to build under gcc-10.+` + +## 2022-04-01 + +- {vytask}`T4332` `(bug): bgp: deterministic-med cannot be disabled while addpath-tx-bestpath-per-AS is in use` + +## 2022-03-31 + +- {vytask}`T4326` `(feature): Add bgp option no-suppress-duplicates` +- {vytask}`T4323` `(default): ospf6d crashes on latest vyos nightly` + +## 2022-03-29 + +- {vytask}`T3686` `(bug): Bridging OpenVPN tap with no local-address breaks` +- {vytask}`T3635` `(default): Add ability to use mDNS repeater with VRRP` + +## 2022-03-26 + +- {vytask}`T4321` `(default): Allow BGP neighbors between different VIFs on the same VyOS` + +## 2022-03-24 + +- {vytask}`T4301` `(bug): The "arp-monitor" option in bonding interface settings does not work` +- {vytask}`T4294` `(bug): Adding a new openvpn-option does not restart the OpenVPN process` +- {vytask}`T4290` `(bug): BGP source-interface fails to commit` +- {vytask}`T4230` `(bug): OpenVPN server configuration deleted after reboot when using a VRRP virtual-address` + +## 2022-03-23 + +- {vytask}`T4314` `(bug): Latest 1.4 Rolling release config migration error` + +## 2022-03-21 + +- {vytask}`T4304` `(feature): [OSPF]import/export filter inter-area prefix` + +## 2022-03-20 + +- {vytask}`T4298` `(default): vyos-vm-images: fix ansible group name and remove obsolete empty command` + +## 2022-03-18 + +- {vytask}`T4286` `(bug): Fix for firewall ipv6 name address validator` + +## 2022-03-15 + +- {vytask}`T4302` `(feature): FRRouting upgrade to release 8.2.2` +- {vytask}`T4293` `(default): Add "set ip-next-hop unchanged" in route-map` + +## 2022-03-14 + +- {vytask}`T4275` `(default): Incorrect val_help for local/remote prefix in ipsec vpn` + +## 2022-03-12 + +- {vytask}`T4296` `(bug): Interface config injected by Cloud-Init may interfere with VyOS native` +- {vytask}`T4265` `(feature): Add op-mode for bgp flowspec state and routes` + +## 2022-03-11 + +- {vytask}`T4297` `(bug): Interface configuration saving fails for ice/iavf based interfaces because they can't change speed/duplex settings` + +## 2022-03-09 + +- {vytask}`T3981` `(feature): VRF support for flow-accounting` + +## 2022-03-05 + +- {vytask}`T4259` `(bug): The conntrackd daemon can be started wrongly` + +## 2022-03-03 + +- {vytask}`T4283` `(feature): Add support to "reject" routes - emit an ICMP unreachable when matched` + +## 2022-03-01 + +- {vytask}`T4277` `(feature): flow-accounting: support sending flow-data via VRF interface` + +## 2022-02-28 + +- {vytask}`T4273` `(bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config` +- {vytask}`T4115` `(bug): reboot in not working as expected` +- {vytask}`T3656` `(bug): IPSec 1.4 : "show vpn ike sa" does not show the correct default ike version` + +## 2022-02-26 + +- {vytask}`T4272` `(feature): lldp: migrate Python script to use get_config_dict()` + +## 2022-02-24 + +- {vytask}`T4267` `(bug): Error - Missing required "ip key" parameter` + +## 2022-02-23 + +- {vytask}`T4194` `(bug): prefix-list no check for duplicate entries` +- {vytask}`T4264` `(bug): vxlan: interface is destroyed and rebuild on description change` +- {vytask}`T4263` `(bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes` + +## 2022-02-21 + +- {vytask}`T4120` `(feature): [VXLAN] add ability to set multiple unicast-remotes` + +## 2022-02-20 + +- {vytask}`T4254` `(feature): VPN IPSec charon add options cisco_flexvpn and install_virtual_ip_on` +- {vytask}`T4249` `(feature): Add support for device mapping in containers` +- {vytask}`T3617` `(bug): IPSec 1.4 generate invalid configuration` +- {vytask}`T4261` `(feature): MACsec: add DHCP client support` +- {vytask}`T4203` `(bug): Reconfigure DHCP client interface causes brief outages` + +## 2022-02-19 + +- {vytask}`T4258` `(bug): [DHCP-SERVER] error parameter on Failover` + +## 2022-02-17 + +- {vytask}`T4255` `(bug): Unexpected print of dict bridge on delete` +- {vytask}`T4240` `(bug): Cannot add wlan0 to bridge via configure` +- {vytask}`T4154` `(bug): Error add second gre tunnel with the same source interface` + +## 2022-02-16 + +- {vytask}`T4237` `(bug): Conntrack-sync error - error adding listen-address command` + +## 2022-02-15 + +- {vytask}`T4160` `(bug): Firewall - Error in rules that matches everything except something` +- {vytask}`T3006` `(bug): Accel-PPP & vlan-mon config get invalid VLAN` +- {vytask}`T3494` `(bug): DHCPv6 leases traceback when PD using` +- {vytask}`T1292` `(bug): Issues while deleting all rules from a firewall` + +## 2022-02-13 + +- {vytask}`T4242` `(bug): ethernet speed/duplex can never be switched back to auto/auto` +- {vytask}`T4191` `(bug): Lost access to host after VRF re-creating` + +## 2022-02-11 + +- {vytask}`T3872` `(feature): Add configurable telegraf monitoring service` + +## 2022-02-08 + +- {vytask}`T4227` `(bug): Typo in help completion of hello-time option of bridge interface` + +## 2022-02-07 + +- {vytask}`T4233` `(bug): ssh: sync regex for allow/deny usernames to "system login"` + +## 2022-02-06 + +- {vytask}`T4223` `(bug): policy route cannot have several entries with the same table` +- {vytask}`T4216` `(bug): Firewall: can't use negated groups in firewall rules` +- {vytask}`T4178` `(bug): policy based routing tcp flags issue` +- {vytask}`T4164` `` (bug): PBR: network groups (as well as address and port groups) don't resolve in `nftables_policy.conf` `` +- {vytask}`T3970` `(feature): Add support for op-mode PKI direct install into an active config session` +- {vytask}`T3828` `(bug): ipsec: Subtle change in "pfs enable" behavior from equuleus -> sagitta` + +## 2022-02-05 + +- {vytask}`T4226` `(bug): VRRP transition-script does not work for groups name which contains -(minus) sign` + +## 2022-02-04 + +- {vytask}`T4196` `(bug): DHCP server client-prefix-length parameter results in non-functional leases` + +## 2022-02-03 + +- {vytask}`T4218` `(bug): firewall: rule name is not allowed to start with a number` +- {vytask}`T3643` `(bug): show vpn ipsec sa doesn't show tunnels in "down" state` + +## 2022-02-01 + +- {vytask}`T4224` `(bug): Ethernet interfaces configured for DHCP not working on latest rolling snapshot (vyos-1.4-rolling-202201291849-amd64.iso)` +- {vytask}`T4225` `(bug): Performance degration with latest rolling release` +- {vytask}`T4220` `(bug): Commit broke dhclient 78b247b724f74bdabab0706aaa7f5b00e5809bc1` +- {vytask}`T4138` `(bug): NAT configuration allows to set incorrect port range and invalid port` + +## 2022-01-28 + +- {vytask}`T4184` `(bug): NTP allow-clients address doesn't work it allows to use ntp server for all addresses` +- {vytask}`T4217` `(bug): firewall: port-group requires protocol to be set - but not in VyOS 1.3` + +## 2022-01-27 + +- {vytask}`T4213` `(default): ipv6 policy routing not working anymore` +- {vytask}`T4188` `(bug): Firewall does not correctly handle conntracking` +- {vytask}`T3762` `(feature): Support network and address groups for policy ipv6-route` +- {vytask}`T3560` `(feature): Ability to create groups of MAC addresses` +- {vytask}`T3495` `(feature): Modernising port/protocol definitions` + +## 2022-01-25 + +- {vytask}`T4205` `(feature): Disable Debian Version in SSH (DebianBanner->no)` +- {vytask}`T4131` `(bug): Show firewall group incorrect format members` + +## 2022-01-24 + +- {vytask}`T4204` `(feature): Update Accel-PPP to a newer revision` +- {vytask}`T1795` `(default): Commit rollback by timeout` + +## 2022-01-23 + +- {vytask}`T4186` `(bug): Firewall icmp type - Offered options not supported` +- {vytask}`T4181` `(bug): Firewall ipv6-network-group - incorrect description on helper` + +## 2022-01-21 + +- {vytask}`T4200` `(bug): Assigning ipv6-name to interface is not generating nftables rules` +- {vytask}`T4144` `(bug): Firewall address-group - Improve error messages` +- {vytask}`T4137` `(bug): Firewall group configuration allows to set incorrect port range and invalid port` +- {vytask}`T4133` `(bug): Firewall network group error with zone-based firewall rules` + +## 2022-01-20 + +- {vytask}`T4171` `(bug): Interface config migration error on 1.2.8 -> 1.4 upgrade` + +## 2022-01-19 + +- {vytask}`T4195` `(feature): [OSPF-ECMP]enable set maximun-path` + +## 2022-01-18 + +- {vytask}`T4159` `(bug): Empty firewall group (address, network & port) generates invalid nftables config, commit fails` +- {vytask}`T4155` `` (bug): PBR: `set table main` fails in `firewall.py` with newer rolling releases `` +- {vytask}`T3873` `(feature): Zone based Firewall - Filter traffic in same zone` +- {vytask}`T3286` `(feature): Switch the firewall from iptables to nftables` +- {vytask}`T292` `(feature): [ZBF] Allow filtering intra zone traffic` + +## 2022-01-17 + +- {vytask}`T3164` `(bug): console-server ssh does not work with RADIUS PAM auth` + +## 2022-01-15 + +- {vytask}`T4183` `(feature): IPv6 link-local address not accepted as wireguard peer` +- {vytask}`T4150` `(bug): VRRP with conntrack-sync does not work` +- {vytask}`T4110` `(feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0` + +## 2022-01-14 + +- {vytask}`T4182` `(bug): Show vrrp if vrrp not configured bug` +- {vytask}`T4179` `(feature): Add op-mode CLI for show high-availability virtual-server` + +## 2022-01-13 + +- {vytask}`T4175` `(bug): BGP configuration failed` +- {vytask}`T4109` `(feature): Extend high-availability/keepalived for support virtual-server lb` + +## 2022-01-12 + +- {vytask}`T4174` `(bug): Validation fails when entering port range with upper port 65535` +- {vytask}`T4162` `(bug): VPN ipsec ike-group - Incorrect value help for ikev2-reauth` +- {vytask}`T4161` `(bug): Policy route-map - Incorrect value help for local preference` +- {vytask}`T4152` `(bug): NHRP shortcut-target holding-time does not work` + +## 2022-01-11 + +- {vytask}`T4149` `(bug): [Firewall-IPV6] Error delete Fw rules on VIF/INT` +- {vytask}`T3950` `(bug): CLI backtrace on update if DNS not defined` +- {vytask}`T4166` `(bug): Debug output missing when frr.py called under vyos-configd` + +## 2022-01-10 + +- {vytask}`T3299` `(bug): Allow the web proxy service to listen on all IP addresses` +- {vytask}`T3115` `(feature): Add support for firewall on L3 VIF bridge interface` + +## 2022-01-09 + +- {vytask}`T4142` `(bug): Input ifbX interfaces not displayed in op-mode` +- {vytask}`T3914` `(bug): VRRP rfc3768-compatibility doesn't work with unicast peers` + +## 2022-01-08 + +- {vytask}`T4116` `(bug): Webproxy/Squid not working with IPv6 listen-address` + +## 2022-01-07 + +- {vytask}`T3924` `(bug): VRRP stops working with VRF` + +## 2022-01-06 + +- {vytask}`T4135` `(bug): Declare zone policy firewall without local zone errors` +- {vytask}`T4130` `(bug): Firewall state policy errors chain` +- {vytask}`T4141` `(bug): Set high-availability vrrp sync-group without members error` + +## 2022-01-04 + +- {vytask}`T4134` `(bug): Incorrect firewall protocol completion help uppercase and duplicates` +- {vytask}`T4132` `(bug): Impossible to show a specific firewall group` + +## 2022-01-03 + +- {vytask}`T4126` `(feature): Ability to set priority to site to site IPSec vpn tunnels` +- {vytask}`T4052` `(bug): Validator return traceback on VRRP configuration with the script path not in config dir` +- {vytask}`T4128` `(bug): keepalived: Upgrade package to add VRF support` + +## 2021-12-31 + +- {vytask}`T4081` `(bug): VRRP health-check script stops working when setting up a sync group` + +## 2021-12-30 + +- {vytask}`T4124` `(feature): snmp: migrate to get_config_dict()` + +## 2021-12-29 + +- {vytask}`T4111` `(bug): IPSec generates wrong configuration colons for IPv6 peers` +- {vytask}`T4023` `(feature): Add grepcidr or similar functionality` +- {vytask}`T4086` `(default): system login banner is not removed on deletion.` + +## 2021-12-28 + +- {vytask}`T3380` `(bug): "show vpn ike sa" does not display IPv6 peers` + +## 2021-12-27 + +- {vytask}`T3979` `(bug): vyos-hostd unable to hostfile-update` +- {vytask}`T2566` `(bug): sstp not able to run tunnels ipv6 only` +- {vytask}`T4093` `(bug): SNMPv3 snmpd.conf generation bug` +- {vytask}`T2764` `(enhancment): Increase maximum number of NAT rules` + +## 2021-12-26 + +- {vytask}`T4104` `(bug): RAID1: "add raid md0 member sda1" does not restore boot sector` +- {vytask}`T4108` `(default): OSPFv3: add support for auto-cost parameter` +- {vytask}`T4107` `(default): OSPFv3: add support for "default-information originate"` + +## 2021-12-25 + +- {vytask}`T4101` `(bug): commit-archive: Use of uninitialized value $source_address in concatenation` +- {vytask}`T4099` `(feature): flow-accounting: sync "source-ip" and "source-address" between netflow and sflow ion CLI` +- {vytask}`T4097` `(feature): flow-accounting: migrate implementation to get_config_dict()` +- {vytask}`T4105` `(feature): flow-accounting: drop "sflow agent-address auto"` +- {vytask}`T4106` `(feature): flow-accounting: support specification of capture packet lenght` +- {vytask}`T4102` `(feature): OSPFv3: add support for NSSA area-type` +- {vytask}`T4055` `(feature): Add VRF support for HTTP(S) API service` + +## 2021-12-24 + +- {vytask}`T3854` `(bug): Missing op-mode commands for conntrack-sync` + +## 2021-12-23 + +- {vytask}`T3354` `(default): Convert strip-private script from Perl to Python` + +## 2021-12-22 + +- {vytask}`T3678` `(bug): VyOS 1.4: Invalid error message while deleting ipsec vpn configuration` +- {vytask}`T3356` `(feature): Script for remote file transfers` + +## 2021-12-21 + +- {vytask}`T4083` `(bug): Cluster heartbeat doesn't start b.c lack of directory /run/heartbeat/` +- {vytask}`T4070` `(bug): NATv4 : inbound-interface type "any" is missing.` +- {vytask}`T4053` `(bug): VRRP impossible to set scripts out of the /config directory` +- {vytask}`T3931` `(bug): SSTP doesn't work after rewriting to PKI` + +## 2021-12-20 + +- {vytask}`T4088` `(default): Fix typo in login banner` + +## 2021-12-19 + +- {vytask}`T3912` `(default): Use a more informative default post-login banner` + +## 2021-12-17 + +- {vytask}`T4059` `(bug): VRRP sync-group transition script does not persist after reboot` + +## 2021-12-16 + +- {vytask}`T4046` `(feature): Sflow - Add Source address parameter` +- {vytask}`T3556` `(bug): Commit-archive via scp causes 100% CPU on boot` +- {vytask}`T4076` `(enhancment): Allow setting CORS options in HTTP API` +- {vytask}`T4037` `(default): HTTP transfers do not follow redirects` +- {vytask}`T4029` `(default): Broken SFTP uploads` + +## 2021-12-15 + +- {vytask}`T4077` `(bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"` +- {vytask}`T4073` `(bug): "show protocols bfd peer <>" shows incorrect peer information.` + +## 2021-12-14 + +- {vytask}`T4071` `(feature): Allow HTTP API to bind to unix domain socket` + +## 2021-12-12 + +- {vytask}`T4069` `(feature): BGP: add additional available parameters to VyOS CLI` +- {vytask}`T4036` `(bug): VXLAN incorrect raiseError if set multicast network instead of singe address` + +## 2021-12-10 + +- {vytask}`T4068` `(feature): Python: ConfigError should insert line breaks into the error message` + +## 2021-12-09 + +- {vytask}`T4033` `(bug): VRRP - Error security when setting scripts` +- {vytask}`T4064` `(bug): IP address for vif is not removed from the system when deleted in configuration` +- {vytask}`T4060` `(enhancment): Extend configquery for use before boot configuration is complete` +- {vytask}`T4058` `(bug): BFD: add BGP and OSPF "bfd profile" support` +- {vytask}`T4054` `(bug): BFD profiles configuration incorrect behavior.` + +## 2021-12-07 + +- {vytask}`T4041` `(servicerequest): "transition-script" doesn't work on "sync-group"` + +## 2021-12-06 + +- {vytask}`T4012` `(feature): Add VRF support for TFTP` + +## 2021-12-04 + +- {vytask}`T4049` `(feature): support command-style output with compare command` +- {vytask}`T4047` `(bug): Wrong regex validation in XML definitions` +- {vytask}`T4042` `(bug): BGP L2VPN / EVPN and RD type 0 set` +- {vytask}`T4048` `(bug): BGP: L2VPN/EVPN and individual RD and RT settings for each VNI` +- {vytask}`T4045` `(bug): Unable to "format disk like "` +- {vytask}`T4044` `(feature): BFD: add vrf support` +- {vytask}`T4043` `(feature): BFD: add support for passive mode` + +## 2021-12-02 + +- {vytask}`T4035` `(bug): Geneve interfaces aren't displayed by operational mode commands` + +## 2021-12-01 + +- {vytask}`T3695` `(bug): OpenConnect reports commit success when ocserv fails to start due to SSL cert/key file issues` + +## 2021-11-30 + +- {vytask}`T4010` `(bug): DMVPN generates incorrect configuration life_time for swanctl.conf` +- {vytask}`T3725` `(feature): show configuration in json format` + +## 2021-11-29 + +- {vytask}`T3946` `(enhancment): Automatically resize the root partition if the drive has extra space` + +## 2021-11-28 + +- {vytask}`T3999` `(bug): show lldp neighbor Traceback error` +- {vytask}`T3928` `(feature): Add OSPFv3 VRF support` + +## 2021-11-27 + +- {vytask}`T3755` `(feature): ospf: adjust to new FRR 8 syntax where "no passive-interface " moved to interface section` +- {vytask}`T3753` `(feature): frr: upgrade to stable/8.1 release train` + +## 2021-11-26 + +- {vytask}`T3978` `(bug): containers add network without declaring prefix raise ConfigError` + +## 2021-11-25 + +- {vytask}`T4006` `(default): Add additional Linux capabilities to container configuration` +- {vytask}`T3986` `(bug): Incorrect description for vpn ipsec site-to-site authentication and connection` + +## 2021-11-24 + +- {vytask}`T4015` `(feature): Update Accel-PPP to a newer revision` +- {vytask}`T3865` `(bug): loadkey command help text missing escape sequence` +- {vytask}`T1083` `(feature): Implement persistent/random address and port mapping options for NAT rules` + +## 2021-11-23 + +- {vytask}`T3990` `(bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to files left behind in /var/tmp/frr/ after reboot)` + +## 2021-11-20 + +- {vytask}`T3998` `(bug): route-target completion incorrect description` + +## 2021-11-19 + +- {vytask}`T4003` `(bug): API for "show interfaces ethernet" does not include the interface description` +- {vytask}`T4011` `(bug): ethernet: deleting interface should place interface in admin down state` + +## 2021-11-18 + +- {vytask}`T3612` `(bug): IPoE Server address pool issues.` +- {vytask}`T3995` `(feature): OpenVPN: do not stop/start service on configuration change` +- {vytask}`T4008` `(feature): dhcp: change client retry interval form 300 -> 60 seconds` +- {vytask}`T3795` `(bug): WWAN: issues with non connected interface / no signal` +- {vytask}`T3510` `(bug): RADIUS usersname is not shown on CLI` + +## 2021-11-17 + +- {vytask}`T3350` `(bug): OpenVPN config file generation broken` +- {vytask}`T3996` `(bug): SNMP service error in log` + +## 2021-11-15 + +- {vytask}`T3994` `(bug): VRF: unable to delete vrf when name contains numbers, hyphen or underscore` +- {vytask}`T3960` `(bug): FRR Misconfig when using multiple VRF VNI` +- {vytask}`T3724` `(feature): Allow setting host-name in l2tp section of accel-ppp` +- {vytask}`T645` `(feature): Allow multiple prefixes in ipsec tunnel` + +## 2021-11-10 + +- {vytask}`T3966` `(default): OpenVPN fix the smoketests` +- {vytask}`T3834` `(default): [OPENVPN] Support for Two Factor Authentication totp.` +- {vytask}`T3982` `(bug): DHCP server commit fails if static-mapping contains + or .` + +## 2021-11-09 + +- {vytask}`T3962` `(bug): Image cannot be built without open-vm-tools` + +## 2021-11-07 + +- {vytask}`T3626` `(bug): Configuring and disabling DHCP Server` + +## 2021-11-06 + +- {vytask}`T3514` `(bug): NIC flap at any interface change` + +## 2021-11-05 + +- {vytask}`T3972` `(bug): Removing vif-c interface raises KeyError` + +## 2021-11-04 + +- {vytask}`T3969` `(bug): Container incorrect raiseError format if network doesn't exist` +- {vytask}`T3662` `(bug): Container configuration upgrade destroys system` +- {vytask}`T3964` `(bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses` + +## 2021-11-03 + +- {vytask}`T3952` `(default): Add sh bgp ipv4/ipv6 vpn command` +- {vytask}`T3610` `(bug): DHCP-Server creation for not primary IP address fails` + +## 2021-11-01 + +- {vytask}`T3958` `(default): OpenVPN breaks the smoketests` +- {vytask}`T3956` `(bug): GRE tunnel - unable to move from source-interface to source-address, commit error` + +## 2021-10-31 + +- {vytask}`T3945` `(feature): Add route-map for bgp aggregate-address` +- {vytask}`T3954` `(bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated, config system error` +- {vytask}`T3943` `(bug): "netflow source-ip" prevents image upgrades if IP address does not exist locally` + +## 2021-10-29 + +- {vytask}`T3942` `(feature): Generate IPSec debug archive from op-mode` + +## 2021-10-28 + +- {vytask}`T3951` `(bug): After resetting vti ipsec tunnel old child SA still active` +- {vytask}`T3941` `(bug): "show vpn ipsec sa" shows established time of parent SA not child SA's` +- {vytask}`T3916` `(feature): Add additional Linux capabilities to container configuration` + +## 2021-10-27 + +- {vytask}`T3944` `(bug): VRRP fails over when adding new group to master` + +## 2021-10-22 + +- {vytask}`T3897` `(feature): Dynamic DNS doesn't work with IPv6 addresses` +- {vytask}`T3832` `(feature): Allow to set DHCP client-id in hexadecimal format` +- {vytask}`T3188` `(bug): Tunnel local-ip to dhcp-interface Change Fails to Update` +- {vytask}`T3917` `(default): Use Avahi as mDNS repeater for IPv6 support` + +## 2021-10-21 + +- {vytask}`T3926` `(bug): strip-private does not sanitize "cisco-authentication" from NHRP configuration` +- {vytask}`T3925` `(feature): Tunnel: dhcp-interface not implemented - use source-interface instead` +- {vytask}`T3923` `(feature): Kernel: Enable TLS/IPSec offload support for Mellanox ConnectX NICs` +- {vytask}`T3927` `(feature): Kernel: Enable kernel support for HW offload of the TLS protocol` + +## 2021-10-20 + +- {vytask}`T3918` `(bug): DHCPv6 prefix delegation incorrect verify error` +- {vytask}`T3921` `(bug): tunnel: KeyError when using dhcp-interface` + +## 2021-10-19 + +- {vytask}`T3396` `(bug): syslog can't be configured with an ipv6 literal destination in 1.2.x` + +## 2021-10-18 + +- {vytask}`T3002` `(default): VRRP change on IPSec interface causes packet routing issues` + +## 2021-10-17 + +- {vytask}`T3786` `(bug): GRE tunnel source address 0.0.0.0 error` +- {vytask}`T3217` `(default): Save FRR configuration on each commit` +- {vytask}`T3381` `(bug): Change GRE tunnel failed` +- {vytask}`T3254` `(bug): Dynamic DNS status shows incorrect last update time` +- {vytask}`T1243` `(bug): BGP local-as accept wrong values` +- {vytask}`T697` `(bug): Clean up and sanitize package dependencies` +- {vytask}`T578` `(feature): Support Linux Container` + +## 2021-10-16 + +- {vytask}`T3879` `(bug): GPG key verification fails when upgrading from a 1.3 beta version` + +## 2021-10-15 + +- {vytask}`T3748` `(bug): Container deletion bug` +- {vytask}`T3693` `(feature): ISIS Route redistribution ipv6 support missing` +- {vytask}`T3676` `(feature): Container option to add Linux capabilities` +- {vytask}`T3613` `(feature): Selectors for route-based IPsec tunnel (vti)` +- {vytask}`T3692` `(bug): VyOS build failing due to repo.saltstack.com` +- {vytask}`T3673` `(feature): BGP large-community del operation missing` + +## 2021-10-14 + +- {vytask}`T3811` `(bug): NAT (op_mode): NAT op_mode command fails.` +- {vytask}`T3801` `(feature): containers: do not use podman CLI to create container networks` + +## 2021-10-13 + +- {vytask}`T3904` `(bug): NTP pool associations silently fail` +- {vytask}`T3277` `(feature): DNS Forwarding - reverse zones` + +## 2021-10-12 + +- {vytask}`T3216` `(bug): Removal of restricted-shell broke configure mode for RADIUS users` +- {vytask}`T3881` `(bug): Wrong description for container section restart` +- {vytask}`T3868` `(bug): Regex and/or wildcard not accepted with large-community-list` +- {vytask}`T3701` `(bug): ipoe server fails to start when configuring radius dynamic-author on ipoe` + +## 2021-10-10 + +- {vytask}`T3750` `(bug): pdns-recursor 4.4 issue with dont-query and private DNS servers` +- {vytask}`T3885` `(default): dhcpv6-pd: randomly generated DUID is not persisted` +- {vytask}`T3899` `(enhancment): Add support for hd44780 LCD displays` + +## 2021-10-09 + +- {vytask}`T3894` `` (bug): Tunnel Commit Failed if system does not have `eth0` `` + +## 2021-10-08 + +- {vytask}`T3893` `(bug): MGRE Tunnel commit crash If sit tunnel available` + +## 2021-10-05 + +- {vytask}`T3741` `(feature): [BGP] default no-ipv4-unicast - by default` + +## 2021-10-04 + +- {vytask}`T3888` `(bug): Incorrect warning when poweroff command executed from configure mode.` +- {vytask}`T3890` `(feature): dhcp(v6): provide op-mode commands to retrieve both server and client logfiles` +- {vytask}`T3889` `(feature): Migrate to journalctl when reading daemon logs` + +## 2021-10-03 + +- {vytask}`T3880` `(bug): EFI boot shows error on display` + +## 2021-10-02 + +- {vytask}`T3882` `(feature): Upgrade PowerDNs recursor to 4.5 series` +- {vytask}`T3883` `(bug): VRF - Delette vrf config on interface` + +## 2021-09-30 + +- {vytask}`T3874` `(bug): D-Link Ethernet Interface not working.` +- {vytask}`T3869` `(default): Rewrite vyatta_net_name/vyatta_interface_rescan in Python` + +## 2021-09-28 + +- {vytask}`T3853` `(default): nat66 rules gets deleted on reboot in 1.4-rolling-202109240217` + +## 2021-09-27 + +- {vytask}`T3863` `(default): nat66: commit fails/hangs on non existing interface` + +## 2021-09-26 + +- {vytask}`T3860` `(bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64 addresses` +- {vytask}`T3857` `(feature): reboot: send wall message to all users for information` +- {vytask}`T3867` `(bug): vxlan: multicast group address is not validated` +- {vytask}`T3859` `(bug): Add "log-adjacency-changes" to ospfv3 process` +- {vytask}`T3826` `(bug): PKI: op-mode - do input validation when listing certificates` + +## 2021-09-25 + +- {vytask}`T3657` `(default): BGP neighbors ipv6 not able to establish with IPv6 link-local addresses` + +## 2021-09-23 + +- {vytask}`T3850` `(bug): Dots are no longer allowed in SSH public key names` + +## 2021-09-21 + +- {vytask}`T3847` `(feature): keepalived/vrrp: migrate to get_config_dict() - cleanup` + +## 2021-09-20 + +- {vytask}`T3823` `(bug): strip-private does not filter public IPv6 addresses` + +## 2021-09-19 + +- {vytask}`T3841` `(feature): dhcp-server: add ping-check option to CLI` +- {vytask}`T2738` `(bug): Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization` +- {vytask}`T3840` `(feature): dns forwarding: Cache size should allow values > 10k` +- {vytask}`T3672` `(bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.conf configuration file output` + +## 2021-09-18 + +- {vytask}`T3831` `(bug): External traffic stops routing when IPSEC tunnel comes up with interface vti0` +- {vytask}`T1968` `(default): Allow multiple static routes in dhcp-server` +- {vytask}`T3838` `(feature): dhcp-server - sync cli for name-servers to other subsystems` +- {vytask}`T3839` `(feature): dhcp-server: Allow configuration of a DNS server and domain name on the shared-network level` + +## 2021-09-17 + +- {vytask}`T3830` `(bug): ipsec: remote-id no longer included in IKE AUTH if not explicitly specified` + +## 2021-09-11 + +- {vytask}`T3402` `(feature): Add VyOS programming library for operational level commands` + +## 2021-09-10 + +- {vytask}`T3802` `(bug): Commit fails if ethernet interface doesn't support flow control` +- {vytask}`T3819` `(bug): Upgrade Salt Stack 3002.3 -> 3003 release train` +- {vytask}`T915` `(feature): MPLS Support` + +## 2021-09-09 + +- {vytask}`T3812` `(bug): Vyos and frr route-map config out of sync` +- {vytask}`T3814` `(bug): wireguard: commit error showing incorrect peer name from the configured name` +- {vytask}`T3805` `(bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP interface` +- {vytask}`T3815` `(bug): pki : the file command 'generate pki wireguard key-pair file' is not working` + +## 2021-09-07 + +- {vytask}`T1894` `(bug): FRR config not loaded after daemons segfault or restart` +- {vytask}`T3807` `(bug): Op Command "show interfaces wireguard" does not show the output` + +## 2021-09-06 + +- {vytask}`T3806` `(bug): Don't set link local ipv6 address if MTU less then 1280` +- {vytask}`T3803` `(default): Add source-address option to the ping CLI` +- {vytask}`T3431` `(bug): Show version all bug` +- {vytask}`T2920` `(bug): Commit crash when adding the second mGRE tunnel with the same key` + +## 2021-09-05 + +- {vytask}`T3804` `(feature): cli: Migrate and merge "system name-servers-dhcp" into "system name-server"` + +## 2021-09-04 + +- {vytask}`T3619` `(bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage` + +## 2021-09-03 + +- {vytask}`T3788` `(bug): Keys are not allowed with ipip and sit tunnels` +- {vytask}`T3634` `(feature): Add op command option for ping for do not fragment bit to be set` +- {vytask}`T3798` `(feature): bgp: add support for "neighbor local-as replace-as" option` + +## 2021-09-02 + +- {vytask}`T3792` `(bug): login: A hypen present in a username from "system login user" is replaced by an underscore` +- {vytask}`T3790` `(bug): Does not possible to configure PPTP static ip-address to users` +- {vytask}`T2947` `(bug): Nat translation many-many with prefix does not map 1-1.` + +## 2021-08-31 + +- {vytask}`T3789` `(feature): Add custom validator for base64 encoded CLI data` +- {vytask}`T3782` `(default): Ingress Shaping with IFB No Longer Functional with 1.3` + +## 2021-08-30 + +- {vytask}`T3768` `(default): Remove early syntaxVersion implementation` +- {vytask}`T2941` `(default): Using a non-ASCII character in the description field causes UnicodeDecodeError in configsource.py` +- {vytask}`T3787` `(bug): Remove deprecated UDP fragmentation offloading option` + +## 2021-08-29 + +- {vytask}`T3708` `(bug): isisd and gre-bridge commit error` +- {vytask}`T3783` `(bug): "set protocols isis spf-delay-ietf" is not working` +- {vytask}`T2750` `(default): Use m4 as a template processor` + +## 2021-08-28 + +- {vytask}`T3743` `(bug): l2tp doesn't work after reboot if outside-address not 0.0.0.0` + +## 2021-08-27 + +- {vytask}`T3182` `(bug): Main blocker Task for FRR 7.4/7.5 series update` +- {vytask}`T3568` `(feature): Add XML for firewall conf-mode` +- {vytask}`T2108` `(default): Use minisign/signify instead of GPG for release signing` + +## 2021-08-26 + +- {vytask}`T3776` `(default): Rename FRR daemon restart op-mode commands` +- {vytask}`T3739` `(feature): policy: route-map: add EVPN match support` + +## 2021-08-25 + +- {vytask}`T3773` `(bug): Delete the "show system integrity" command (to prepare for a re-implementation)` +- {vytask}`T3775` `(bug): Typo in generated Strongswan VPN-config` + +## 2021-08-24 + +- {vytask}`T3772` `(bug): VRRP virtual interfaces are not shown in show interfaces` + +## 2021-08-23 + +- {vytask}`T3769` `(feature): Containers: Network Bridging` + +## 2021-08-22 + +- {vytask}`T3090` `(feature): Move 'adjust-mss' firewall options to the interface section.` +- {vytask}`T3765` `(default): container: additional op-mode commands` + +## 2021-08-20 + +- {vytask}`T1950` `(default): Store VyOS configuration syntax version data in JSON file` + +## 2021-08-19 + +- {vytask}`T3751` `(bug): pki generate ca add new line after passphrase` +- {vytask}`T3764` `(bug): Unconfigurable IKE and ESP lifetime` +- {vytask}`T3234` `(bug): multi_to_list fails in certain cases, with root cause an element redundancy in XML interface-definitions` +- {vytask}`T3732` `(feature): override-default helper should support adding defaultValues to default less nodes` +- {vytask}`T3759` `(default): [L3VPN] VPNv4/VPNv6 add commands` + +## 2021-08-18 + +- {vytask}`T3752` `(bug): generate pki certificate file xxx doesn't touch file` + +## 2021-08-16 + +- {vytask}`T3738` `(default): openvpn fails if server and authentication are configured` +- {vytask}`T1594` `(bug): l2tpv3 error on IPv6 local-ip` + +## 2021-08-15 + +- {vytask}`T3756` `(default): VyOS generates invalid QR code for wireguard clients` +- {vytask}`T3757` `(default): OSPF: add support to configure the area at an interface level` + +## 2021-08-14 + +- {vytask}`T3745` `(feature): op-mode IPSec show vpn ipse sa sorting` + +## 2021-08-13 + +- {vytask}`T3749` `(bug): V4/V6 Counters in network container validation aren't being reset` +- {vytask}`T3728` `(bug): FRR not respect configured RD and RT for L3VNI` +- {vytask}`T3727` `(bug): VPN IPsec ESP proposal and ESP presented in config missmatch` +- {vytask}`T3740` `(bug): HTTPs API breaks when the address is IPv6` + +## 2021-08-12 + +- {vytask}`T3731` `(bug): verify_accel_ppp_base_service return wrong config error for SSP` +- {vytask}`T3405` `(feature): PPPoE server unit-cache` +- {vytask}`T2432` `(default): dhcpd: Can't create new lease file: Permission denied` +- {vytask}`T3746` `(feature): Inform users logging into the system about a pending reboot` +- {vytask}`T3744` `(default): Dns forwarding statistics formatting missing a new line` + +## 2021-08-11 + +- {vytask}`T3709` `(feature): Snmp: Allow enable MIDs/OIDs ipCidrRouteTable` + +## 2021-08-09 + +- {vytask}`T3720` `(bug): IPSec set vti secondary address cause interface disable` + +## 2021-08-08 + +- {vytask}`T3705` `(bug): IPSec: VTI interface does not honor default-esp-group` +- {vytask}`T2027` `(bug): get_config_dict is failing when the configuration section is empty/missing` + +## 2021-08-05 + +- {vytask}`T3719` `(bug): Restart vpn shows some missed files` + +## 2021-08-04 + +- {vytask}`T3704` `(feature): Add ability to interact with Areca RAID adapers` +- {vytask}`T3718` `(bug): VPN IPsec IKE group by default not use DH-group 2` + +## 2021-08-02 + +- {vytask}`T3601` `(default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.` + +## 2021-08-01 + +- {vytask}`T3707` `(bug): Ping incorrect ip host checks` + +## 2021-07-31 + +- {vytask}`T3716` `(feature): Linux kernel parameters ignore_routes_with_link_down- ignore disconnected routing connections` + +## 2021-07-30 + +- {vytask}`T1176` `(default): FRR - BGP replicating routes` +- {vytask}`T1210` `(feature): About IKEv2 IPSec VPN remote access` + +## 2021-07-23 + +- {vytask}`T3699` `(bug): login: verify selected "system login user" name is not already used by the base system.` +- {vytask}`T3698` `(default): Support bridge monitoring` + +## 2021-07-13 + +- {vytask}`T3679` `(default): Point the unexpected exception message link to the new rolling release location` + +## 2021-07-11 + +- {vytask}`T3665` `(bug): Missing VRF support for VxLAN but already documented` + +## 2021-07-10 + +- {vytask}`T3636` `(feature): SSTP / L2TP ipv6 support broken` + +## 2021-07-09 + +- {vytask}`T3667` `(bug): brctl is damaged` + +## 2021-07-06 + +- {vytask}`T3660` `(feature): Conntrack-Sync configuration command to specify destination udp port for peer` + +## 2021-07-03 + +- {vytask}`T57` `(enhancment): Make it possible to disable the entire IPsec peer` + +## 2021-07-01 + +- {vytask}`T3658` `(feature): Add support for dhcpdv6 fixed-prefix6` +- {vytask}`T2035` `(bug): Executing vyos-smoketest multiple times makes ssh test fail on execution` + +## 2021-06-29 + +- {vytask}`T3593` `(bug): PPPoE server called-sid format does not work` +- {vytask}`T1441` `(feature): Add support for IPSec XFRM interfaces` + +## 2021-06-25 + +- {vytask}`T3641` `(feature): Upgrade base system from Debian Buster -> Debian Bullseye` +- {vytask}`T3649` `(feature): Add bonding additional hash-policy` + +## 2021-06-23 + +- {vytask}`T3647` `(feature): Bullseye: gcc defaults to passing --as-needed to linker` + +## 2021-06-22 + +- {vytask}`T3629` `(bug): IPoE server shifting address in the range` +- {vytask}`T3645` `(feature): Bullseye: ethtool changed output for ring-buffer information` + +## 2021-06-21 + +- {vytask}`T3563` `(default): commit-archive breaks with IPv6 source addresses` + +## 2021-06-20 + +- {vytask}`T3637` `(bug): vrf: bind-to-all didn't work properly` +- {vytask}`T3639` `(default): GCC preprocessor clobbers C comments` + +## 2021-06-19 + +- {vytask}`T3633` `(feature): Add LRO offload for interface ethernet` + +## 2021-06-18 + +- {vytask}`T3599` `(default): Migrate NHRP to XML/Python` + +## 2021-06-17 + +- {vytask}`T3624` `(feature): BGP: add support for extended community bandwidth definition` + +## 2021-06-16 + +- {vytask}`T3623` `(default): Fix for dummy interface option in the operational command "clear interfaces dummy"` +- {vytask}`T3630` `(feature): op-mode: add "show version kernel" command` + +## 2021-06-13 + +- {vytask}`T3620` `(feature): Rename WWAN interface from wirelessmodem to wwan to use QMI interface` +- {vytask}`T2173` `(feature): Add the ability to use VRF on VTI interfaces` +- {vytask}`T3622` `(feature): WWAN: add support for APN authentication` +- {vytask}`T3606` `(bug): SNMP unknown notification OID` +- {vytask}`T3621` `(bug): PPPoE interface does not validate if password is supplied when username is set` + +## 2021-06-12 + +- {vytask}`T3611` `(bug): WWAN interface (MC7710) no longer works on Kernel 5.10` +- {vytask}`T1534` `(bug): IPSec w/ IKEv2 Invalid local-address "any"` +- {vytask}`T3616` `(bug): Update to FastAPI causes regression in vyos-http-api-server` + +## 2021-06-11 + +- {vytask}`T3614` `(bug): Container network name with hyphen fail` + +## 2021-06-10 + +- {vytask}`T3250` `(bug): PPPoE server: wrong local usernames` +- {vytask}`T3138` `(bug): ddclient improperly updated when apply rfc2136 config` +- {vytask}`T2645` `(default): Editing route-map action requires adding a new rule` + +## 2021-06-08 + +- {vytask}`T3605` `(default): Allow to set prefer-global for ipv6-next-hop` +- {vytask}`T3607` `(feature): [route-map] set ipv6 next-hop prefer-global` +- {vytask}`T3289` `(bug): No description for node "service" conf-mode` + +## 2021-06-07 + +- {vytask}`T3461` `(bug): OpenConnect Server redundancy check` +- {vytask}`T3455` `(bug): system users can not be added in "edit"` +- {vytask}`T3588` `(default): IPSec: migrate no longer available options from CLI which are now hardcoded/enabled in strongSwan` + +## 2021-06-06 + +- {vytask}`T842` `(feature): Adopt VyOS CLI to latest StrongSwan options and deprecated Keywords` + +## 2021-06-04 + +- {vytask}`T3595` `(default): Cannot create new VTI interface` +- {vytask}`T3592` `(feature): Set default TTL 64 for tunnels` + +## 2021-06-03 + +- {vytask}`T3384` `(feature): Support UDP bandwidth testing` + +## 2021-06-02 + +- {vytask}`T3233` `(bug): Interface redirect to dum0` + +## 2021-06-01 + +- {vytask}`T3585` `(default): Fix NHRP module for updated interfaces tunnel syntax` +- {vytask}`T3594` `(bug): Disable by default service strongswan-starter` + +## 2021-05-30 + +- {vytask}`T3518` `(bug): Warning messages when using SCP commit-archive` +- {vytask}`T3093` `(default): Add xml for vpn ipsec` +- {vytask}`T1866` `(bug): Commit archive over SFTP doesn't work with non-standard ports` +- {vytask}`T3590` `(feature): bgp: add option for limiting maximum number of prefixes to be sent to a peer` +- {vytask}`T3589` `(feature): op-mode: support clearing out logfiles from CLI` +- {vytask}`T2641` `(feature): Rewrite vpn ipsec OP commands in new style XML syntax` +- {vytask}`T3351` `(feature): Installer checking MD5 checksums on the ISO image` + +## 2021-05-29 + +- {vytask}`T1944` `(bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure of Zebra` +- {vytask}`T1888` `(feature): Update to StrongSwan 5.9.1` + +## 2021-05-27 + +- {vytask}`T3561` `(feature): router-advert: support advertising specific routes` +- {vytask}`T2669` `(bug): DHCP-server overlapping ranges.` + +## 2021-05-26 + +- {vytask}`T3540` `(bug): Keepalived memory utilisation issue when constantly getting its state in JSON format` + +## 2021-05-24 + +- {vytask}`T3575` `(bug): pseudo-ethernet: must check source-interface MTU` +- {vytask}`T3571` `(bug): Broken Show Tab Complete` +- {vytask}`T3555` `(bug): GRE TAP tunnel does not silent fragment packets / kernel fix available` +- {vytask}`T3576` `(bug): ISIS does not support IPV6` + +## 2021-05-23 + +- {vytask}`T3570` `(default): Prevent setting of a larger MTU on child interfaces` +- {vytask}`T3573` `(bug): as-path-prepend Description Invalid` +- {vytask}`T3572` `(feature): Basic Drive Diagnostic Tools` + +## 2021-05-22 + +- {vytask}`T3564` `(default): Multiple BGP Confederation Peers Not Allowed` + +## 2021-05-21 + +- {vytask}`T3551` `(bug): QoS control failure of VLAN sub interface` + +## 2021-05-20 + +- {vytask}`T3554` `(feature): Add area-type stub for ospfv3` +- {vytask}`T3565` `(feature): sysctl: rewrite in XML and Python and drop from vyatta-cfg-system` + +## 2021-05-19 + +- {vytask}`T3562` `(feature): Update Accel-PPP to a newer revision` +- {vytask}`T3559` `(feature): Add restart op-command for OpenConnect Server` + +## 2021-05-18 + +- {vytask}`T3525` `(default): VMWare resume script syntax errors` + +## 2021-05-15 + +- {vytask}`T3549` `(bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not correctly exported to dhcpdv6.conf when multiple name-server entries are present` +- {vytask}`T3532` `(bug): Not possible to change ethertype after interface creation` +- {vytask}`T3550` `(bug): Router-advert completion typo` +- {vytask}`T3547` `(feature): conntrackd: remove deprecated config options` +- {vytask}`T3535` `(feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor` + +## 2021-05-14 + +- {vytask}`T3346` `(bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node exists but there are no rules` +- {vytask}`T3248` `(default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3` +- {vytask}`T3426` `(default): add support for script arguments to vyos-configd` + +## 2021-05-13 + +- {vytask}`T3539` `(bug): Typo in RPKI interface definition` +- {vytask}`T439` `(feature): local PBR support` +- {vytask}`T3544` `(feature): DHCP server should validate configuration before applying it` +- {vytask}`T3543` `(feature): Support for setting lacp_rate on LACP bonded interfaces` + +## 2021-05-12 + +- {vytask}`T3302` `(default): Make vyos-configd relay stdout from scripts to the user's console` +- {vytask}`T3542` `(bug): udev net.rules not installed in image since may 2nd` + +## 2021-05-10 + +- {vytask}`T3374` `(bug): IPv6 GRE Tunnel issues` + +## 2021-05-09 + +- {vytask}`T3530` `(bug): BGP peer-group can't contain a hyphen` + +## 2021-05-06 + +- {vytask}`T3523` `(bug): VRF BGP daemon route-map command missing` +- {vytask}`T3519` `(bug): Cannot add / assign L2TPv3 to vrf` + +## 2021-05-05 + +- {vytask}`T3520` `(bug): Cannot add tunnel interface to isis within vrf` +- {vytask}`T3335` `(bug): Some OSPFv3 show commands do not work` + +## 2021-05-04 + +- {vytask}`T3504` `(feature): BGP Per Peer Graceful Restart` + +## 2021-05-02 + +- {vytask}`T3511` `(bug): Update libnss-mapuser and libpam-radius packages from CUMULUS Linux` + +## 2021-05-01 + +- {vytask}`T3379` `(feature): Add global-parameters name-server for dhcpv6-server` +- {vytask}`T3491` `(default): Change Kernel HZ to 1000` + +## 2021-04-29 + +- {vytask}`T3503` `(bug): "route-reflector-client" fails when "remote-as" is "internal"` +- {vytask}`T3502` `(bug): "system ip multipath layer4-hashing" doesn't work` + +## 2021-04-28 + +- {vytask}`T3473` `(bug): IPSec op-mode show sa error` + +## 2021-04-27 + +- {vytask}`T2946` `(bug): Calling 'stty_size' causes show interfaces API to fail` + +## 2021-04-25 + +- {vytask}`T3490` `(bug): priority inversion on PBR "policy route" create, breaks default route from dhcp (live iso)` +- {vytask}`T3468` `(bug): Tunnel interfaces aren't suggested as being available for bridging (regression)` +- {vytask}`T3497` `(bug): Prefix list with rule containing only action is not detected as error during parse` +- {vytask}`T3492` `(bug): BGP Configuration Migration failed (badly!) from rolling 202102240218 to rolling 202104221210` +- {vytask}`T1802` `(feature): Wireguard QR code in cli for mobile devices` + +## 2021-04-24 + +- {vytask}`T3472` `(bug): commit-confirm script not found` +- {vytask}`T3439` `(bug): Commit-archive location not working for scp` + +## 2021-04-23 + +- {vytask}`T3395` `(bug): WAN load-balancing fails with nexthop dhcp` +- {vytask}`T3290` `(bug): Disabling GRE conntrack module fails` + +## 2021-04-20 + +- {vytask}`T3488` `(bug): Specifying an invalid "interface address" like dhcph leads to commit error` + +## 2021-04-18 + +- {vytask}`T3481` `(default): Exclude tag node values from key mangling` +- {vytask}`T3475` `(bug): XML dictionary cache unable to process syntaxVersion elements` + +## 2021-04-17 + +- {vytask}`T3470` `(bug): as-override isn't applied to frr` + +## 2021-04-15 + +- {vytask}`T3386` `(bug): PPPoE-server don't start with local authentication` +- {vytask}`T3190` `(feature): Unable to subtract value from local-preference in route-map` + +## 2021-04-14 + +- {vytask}`T3398` `(bug): Can't commit` +- {vytask}`T3055` `(bug): op-mode incorrect naming for ipsec policy-based tunnels` + +## 2021-04-13 + +- {vytask}`T3436` `(feature): Refactoring ospf op-mode for support vrf` +- {vytask}`T3434` `(feature): Refactoring bgp op-mode for support vrf` + +## 2021-04-12 + +- {vytask}`T3454` `(enhancment): dhclient reject option` +- {vytask}`T3328` `(bug): Bgp not possible to delete bgp route-map` + +## 2021-04-10 + +- {vytask}`T3460` `(bug): bgp, Configuration FRR failed while commiting code` + +## 2021-04-09 + +- {vytask}`T3464` `(bug): OSPF: route-map names containing a hypen are not "found"` + +## 2021-04-08 + +- {vytask}`T3462` `(default): show ipv6 bgp -- missing` +- {vytask}`T3463` `(bug): Prevent IPv4 Route exchange with IPv6 neighbors` + +## 2021-04-05 + +- {vytask}`T3438` `(bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf from the operating system` +- {vytask}`T3418` `(bug): BGP: system wide known interface can not be used as neighbor` + +## 2021-04-04 + +- {vytask}`T3457` `(feature): Output the "monitor log" command in a colorful way` + +## 2021-03-31 + +- {vytask}`T3445` `(bug): vyos-1x build include not all nodes` + +## 2021-03-30 + +- {vytask}`T3448` `(bug): Loading vyos on a system without xdp installed fails` + +## 2021-03-29 + +- {vytask}`T3415` `(feature): bridge: add support for isolated interfaces (private-vlan)` +- {vytask}`T1711` `(feature): BGP - migrate from tagNode to node (remove ASN from tagNode)` + +## 2021-03-28 + +- {vytask}`T3440` `(bug): HTTP API: give uvicorn time to initialize before restarting Nginx proxy` + +## 2021-03-27 + +- {vytask}`T3423` `(bug): Cannot create ipv4 static route for default gateway in vrf` + +## 2021-03-26 + +- {vytask}`T3412` `(default): HTTP API: move to FastAPI as web framework` +- {vytask}`T2397` `(feature): HTTP API: export OpenAPI definition` + +## 2021-03-24 + +- {vytask}`T3419` `(bug): show interfaces | strip-private fails` + +## 2021-03-22 + +- {vytask}`T3284` `(bug): merge/load fail silently if unable to resolve host` + +## 2021-03-21 + +- {vytask}`T3417` `(default): ISIS: provide per VRF instance support` +- {vytask}`T3416` `(bug): NTP: when running inside a VRF op-mode commands do not work` + +## 2021-03-20 + +- {vytask}`T3392` `(bug): vrrp over dhcp default route bug (unexpected vrf)` +- {vytask}`T3373` `(feature): Upgrade to SaltStack version 3002.5` +- {vytask}`T3329` `(default): "system conntrack ignore" rules can no longer be created due to an iptables syntax change` +- {vytask}`T3300` `(feature): Add DHCP default route distance` +- {vytask}`T3306` `(feature): Extend set route-map aggregator as to 4 Bytes` + +## 2021-03-18 + +- {vytask}`T3411` `(default): Extend the redirect_stdout context manager in vyos-configd to redirect stdout from subprocesses` +- {vytask}`T3271` `(bug): qemu-kvm grub issue` + +## 2021-03-17 + +- {vytask}`T3413` `(bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP address string passed to inet_pton"` + +## 2021-03-14 + +- {vytask}`T3345` `(default): BGP: add per VRF instance support` +- {vytask}`T3344` `(default): Per VRF dynamic routing support` +- {vytask}`T3325` `(bug): Bgp listen-range wrong commit message` +- {vytask}`T1513` `(default): Move OSPF and RIP interface configuration under protocols` + +## 2021-03-13 + +- {vytask}`T3406` `(bug): tunnel: interface no longer supports specifying encaplimit none - or migrator is missing` +- {vytask}`T3407` `(bug): console-server: do not allow to spawn a console-server session on serial port used by "system console"` + +## 2021-03-11 + +- {vytask}`T3305` `(bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot` +- {vytask}`T2927` `(bug): isc-dhcpd release and expiry events never execute` + +## 2021-03-09 + +- {vytask}`T3382` `(bug): Error creating Console Server` + +## 2021-03-08 + +- {vytask}`T3387` `(bug): Command "Monitor vpn ipsec" is not working` + +## 2021-03-07 + +- {vytask}`T3388` `(bug): show interfaces doesn't display pppoeX` +- {vytask}`T3211` `(feature): ability to redistribute ISIS into other routing protocols` + +## 2021-03-04 + +- {vytask}`T3377` `(bug): show interfaces throws error` + +## 2021-03-02 + +- {vytask}`T3375` `(bug): Interface becomes up at boot even when disabled` + +## 2021-02-28 + +- {vytask}`T3370` `(bug): dhcp: Invalid domain name "private"` +- {vytask}`T3369` `(feature): VXLAN: add IPv6 underlay support` +- {vytask}`T3363` `(bug): VyOS-Build interactive prompt when using Podman` +- {vytask}`T3320` `(bug): Bgp neighbor peer-group without peer-group fail` + +## 2021-02-27 + +- {vytask}`T3365` `(bug): Bgp neighbor interface ordering for remote-as` +- {vytask}`T3225` `(bug): Adding a BGP neighbor with an address on a local interface throws a vyos.frr.CommitError: Configuration FRR failed while committing code: ''` +- {vytask}`T3368` `(feature): macsec: add support for gcm-aes-256 cipher` +- {vytask}`T3173` `(feature): Need 'nopmtudisc' option for tunnel interface` + +## 2021-02-26 + +- {vytask}`T3324` `(bug): Bgp space in the password` +- {vytask}`T3357` `(default): HTTP-API redirect from http correct https port` +- {vytask}`T3323` `(bug): Bgp ttl-security and ebgp-multihop fail` + +## 2021-02-24 + +- {vytask}`T3303` `(feature): Change welcome message on boot` + +## 2021-02-22 + +- {vytask}`T3322` `(bug): Bgp neighbor timers not applyed to FRR config` +- {vytask}`T3327` `(bug): OSPFv3: Cannot add dummy interface` + +## 2021-02-21 + +- {vytask}`T3331` `(bug): Bgp unsuppress-map should be as "value leafNode"` +- {vytask}`T3330` `(bug): Bgp capability orf prefix-list fail` +- {vytask}`T3163` `(feature): ethernet ring-buffer can be set with an invalid value` + +## 2021-02-19 + +- {vytask}`T3326` `(bug): OSPFv3: Cannot add L2TPv3 interface` +- {vytask}`T3332` `(bug): BGP unnumbered - UnboundLocalError: local variable 'peer_group' referenced before assignment` + +## 2021-02-18 + +- {vytask}`T3259` `(default): many dnat rules makes the vyos http api crash, even showConfig op timeouts` + +## 2021-02-17 + +- {vytask}`T3312` `(feature): SolarFlare NICs support` + +## 2021-02-16 + +- {vytask}`T3313` `(bug): ospfv3 interface missing options` +- {vytask}`T3318` `(feature): Update Linux Kernel to v5.4.208 / 5.10.142` + +## 2021-02-15 + +- {vytask}`T3311` `(bug): BGP Error: Remote AS must be set for neighbor or peer-group` + +## 2021-02-14 + +- {vytask}`T2848` `(feature): bgp-add-path configuration options` + +## 2021-02-12 + +- {vytask}`T3301` `(bug): Wrong format and valueHelp for policy as-path-list regex` + +## 2021-02-11 + +- {vytask}`T3281` `(default): Rewrite protocol RIPng [conf-mode] to new XML/Python style` +- {vytask}`T3282` `(default): Add XML for [conf-mode] RIPng` +- {vytask}`T3279` `(default): Rewrite protocol STATIC [op-mode] to new XML/Python style` +- {vytask}`T3297` `(bug): Optimize irrelevant error stack hints` + +## 2021-02-08 + +- {vytask}`T3295` `(feature): Update Linux Kernel to v5.4.96 / 5.10.14` + +## 2021-02-05 + +- {vytask}`T3030` `(feature): Support ERSPAN Tunnel Protocol` + +## 2021-02-04 + +- {vytask}`T3283` `(feature): Support for IPv4 neigh tables` +- {vytask}`T3280` `(default): Add XML for [conf-mode] STATIC` + +## 2021-02-03 + +- {vytask}`T3278` `(feature): Add XML for "protocols vrf" [conf-mode]` +- {vytask}`T3239` `(default): XML: override 'defaultValue' for mtu of certain interfaces; remove workarounds` +- {vytask}`T2910` `(feature): XML: generator should support override of variables` + +## 2021-02-02 + +- {vytask}`T3018` `(bug): Unclear behaviour when configuring vif and vif-s interfaces` +- {vytask}`T3255` `(default): Rewrite protocol RPKI to new XML/Python style` +- {vytask}`T3263` `(feature): OSPF Hello subsecond timer` + +## 2021-01-31 + +- {vytask}`T3276` `(feature): Update Linux Kernel to v5.4.94 / 5.10.12` + +## 2021-01-30 + +- {vytask}`T3240` `(feature): Support per-interface DHCPv6 DUIDs` +- {vytask}`T3273` `(default): PPPoE static default-routes deleted on interface down when not added by interface up` + +## 2021-01-29 + +- {vytask}`T3261` `(bug): Does not possible to disable pppoe client interface.` +- {vytask}`T3272` `(default): OSPF: interface config is not removed` + +## 2021-01-27 + +- {vytask}`T3257` `(feature): tcpdump supporting complete protocol` +- {vytask}`T3244` `(default): Rewrite protocol OSPFv3 to new XML/Python style` + +## 2021-01-26 + +- {vytask}`T3251` `(bug): PPPoE client trying to authorize with the wrong username` +- {vytask}`T3256` `(default): Add XML for protocol RPKI [conf-mode]` + +## 2021-01-25 + +- {vytask}`T3249` `(feature): Support operation mode forwarding table output` + +## 2021-01-24 + +- {vytask}`T3227` `(bug): Latest releases don't work with RPKI (crash)` +- {vytask}`T3230` `(bug): RPKI can't be deleted` +- {vytask}`T3221` `(bug): FRR config` +- {vytask}`T3245` `(default): Add XML for protocol ospfv3 [conf-mode]` + +## 2021-01-23 + +- {vytask}`T3236` `(default): Add XML for [conf-mode] OSPF` + +## 2021-01-17 + +- {vytask}`T3222` `(bug): Typo in BGP dampening description` +- {vytask}`T3226` `(bug): Repair bridge smoke test damage` + +## 2021-01-16 + +- {vytask}`T3215` `(bug): Operational command "show ipv6 route" is broken` +- {vytask}`T3157` `(bug): salt-minion fails to start due to permission error accessing /root/.salt/minion.log` +- {vytask}`T3137` `(feature): Let VLAN aware bridge approach the behavior of professional equipment` + +## 2021-01-15 + +- {vytask}`T3210` `(feature): ISIS three-way-handshake` +- {vytask}`T3184` `(feature): Add correct desctiptions for BGP neighbors` + +## 2021-01-14 + +- {vytask}`T3213` `(bug): show interface command python error` + +## 2021-01-12 + +- {vytask}`T3205` `(bug): Does not possible to configure tunnel mode gre-bridge` + +## 2020-12-20 + +- {vytask}`T3132` `(feature): Enable egress flow accounting` + +## 2020-11-29 + +- {vytask}`T2297` `(feature): NTP add support for pool configuration` diff --git a/docs/changelog/1.4.rst b/docs/changelog/1.4.rst deleted file mode 100644 index 0ad129e1..00000000 --- a/docs/changelog/1.4.rst +++ /dev/null @@ -1,6044 +0,0 @@ -########### -1.4 Sagitta -########### - -.. - Please don't add anything by hand. - This file is managed by the script: - _ext/releasenotes.py - - -2024-04-25 -========== - -* :vytask:`T6263` ``(bug): Multicast: Could not commit multicast config with multicast join group using source-address`` -* :vytask:`T5833` ``(bug): Not all AFIs compatible with VRF`` - - -2024-04-24 -========== - -* :vytask:`T6255` ``(bug): Static table description should not contain white-space`` -* :vytask:`T6226` ``(feature): add HAPROXY `tcp-request content accept` related block to load-balancing reverse proxy config`` -* :vytask:`T6109` ``(bug): remote syslog do not get all the logs`` -* :vytask:`T6217` ``(feature): VRRP contrack-sync script change name of the logger`` -* :vytask:`T6244` ``(feature): Spacing of "Show System Uptime" hard to parse`` - - -2024-04-23 -========== - -* :vytask:`T6260` ``(bug): image-tools: remove failed image directory if 'No space left on device' error`` -* :vytask:`T6261` ``(default): Typo in op_mode connect_disconnect print statement for check_ppp_running`` -* :vytask:`T6237` ``(feature): IPSec remote access VPN: ability to set EAP ID of clients`` - - -2024-04-22 -========== - -* :vytask:`T5996` ``(bug): unescape backslashes for config save, compare commands`` -* :vytask:`T6103` ``(bug): DHCP-server bootfile-name double slash syntax weird behaviour`` -* :vytask:`T6080` ``(default): Default NTP server settings`` -* :vytask:`T5986` ``(bug): Container: Error on commit when environment variable value contains \n line break`` - - -2024-04-21 -========== - -* :vytask:`T6191` ``(bug): Policy Route TCP-MSS Behavior Different from 1.3.x`` -* :vytask:`T5535` ``(feature): disable-directed-broadcast should be moved to firewall global-options`` - - -2024-04-20 -========== - -* :vytask:`T6252` ``(bug): gre tunnel - doesn't allow configure jumbo frame more than 8024`` - - -2024-04-19 -========== - -* :vytask:`T6221` ``(bug): Enabling VRF breaks connectivity`` -* :vytask:`T6035` ``(bug): QoS policy shaper queue-type random-detect requires limit avpkt`` -* :vytask:`T6246` ``(feature): Enable basic haproxy http-check configuration options`` -* :vytask:`T6242` ``(feature): Loadbalancer reverse-proxy: SSL backend skip CA certificate verification`` - - -2024-04-17 -========== - -* :vytask:`T6168` ``(bug): add system image does not set default boot to current console type in compatibility mode`` -* :vytask:`T6243` ``(bug): Update vyos-http-api-tools for package idna security advisory`` -* :vytask:`T6154` ``(enhancment): Installer should ask for password twice`` -* :vytask:`T5966` ``(default): Adjust dynamic dns configuration address subpath to be more intuitive and other op-mode adjustments`` -* :vytask:`T5723` ``(default): mdns repeater: Always reload systemd daemon before applying changes`` -* :vytask:`T5722` ``(bug): Failing to add route in failover if gateway not in the same interface network`` -* :vytask:`T5612` ``(default): Miscellaneous improvements and fixes for dynamic DNS configuration`` -* :vytask:`T5574` ``(default): Support per-service cache management for dynamic dns providers`` -* :vytask:`T5360` ``(bug): ddclient generating abuse`` - - -2024-04-15 -========== - -* :vytask:`T6100` ``(bug): NAT config migration error in 1.4.0-epa1 if invalid address/network defined in 1.3.6 version`` -* :vytask:`T5734` ``(bug): OpenVPN server dh-params that are not in PKI error`` - - -2024-04-14 -========== - -* :vytask:`T6210` ``(feature): Add container ability to configure capability sys-nice`` - - -2024-04-13 -========== - -* :vytask:`T6173` ``(bug): Build Causes Errors When "--version" Contains Slashes ("/")`` -* :vytask:`T2518` ``(feature): Support NAT for ipv6(NPT)`` -* :vytask:`T6238` ``(default): vyos-build Check pull request title requires the python script`` -* :vytask:`T6235` ``(default): Git check PR status: conflicts and resolution`` - - -2024-04-12 -========== - -* :vytask:`T5872` ``(default): ipsec remote access VPN: support dhcp-interface`` -* :vytask:`T6216` ``(bug): Upgrade error from 1.3 to 1.4 - Firewall using character '+'`` -* :vytask:`T6214` ``(bug): Error when using some constraints`` -* :vytask:`T6213` ``(bug): Firewall group constraints`` -* :vytask:`T6148` ``(bug): Reset vpn ipsec command breaks tunnel and does not reset SAs that are down`` -* :vytask:`T1487` ``(default): DNS (pdns_recursor) stats logs not saved to disk`` -* :vytask:`T6222` ``(bug): VRRP rfc3768-compatibility not working correctly when resulting interface name is over 15 characters`` -* :vytask:`T6218` ``(bug): Container network interface in VRF fails to generate IPv6 link-local address`` -* :vytask:`T5959` ``(default): Streamline dns forwarding service`` -* :vytask:`T5846` ``(default): Refactor and simplify DUID definition in conf-mode`` -* :vytask:`T5631` ``(feature): Ability to export the current configuration in JSON format`` -* :vytask:`T5615` ``(default): Narrow down spurious name conflict with mdns`` -* :vytask:`T5530` ``(default): Add LFA to IS-IS`` -* :vytask:`T5195` ``(default): Break up the vyos.util module`` -* :vytask:`T5124` ``(bug): Python3 deprecation distutils.version import LooseVersion`` -* :vytask:`T1871` ``(feature): add MTU option when configure limiter traffic-policy`` -* :vytask:`T874` ``(feature): Support for Two Factor Authentication for CLI access via Google Authenticator/OTP`` -* :vytask:`T6204` ``(default): Remove shebang lines from Python modules`` -* :vytask:`T6166` ``(bug): Tech support generation error for custom output location`` -* :vytask:`T6062` ``(feature): container: add support for image manipulation based on tag name`` -* :vytask:`T5877` ``(default): Reduce unnecessary nesting in system domain-search path and improve smoketest`` -* :vytask:`T5871` ``(default): ipsec remote access VPN: specify "cacerts" to disambiguate mulitple remote access configurations`` -* :vytask:`T5870` ``(default): ipsec remote access VPN: add x509 ("pubkey") authentication`` -* :vytask:`T5772` ``(default): Require HTTPS API server configurations to include at least one key if key-based auth is used`` -* :vytask:`T5447` ``(feature): Allow static MACsec keys with peers`` -* :vytask:`T4221` ``(default): Add a template filter for converting scalars to single-item lists`` -* :vytask:`T3766` ``(feature): containers: Expanding options for networking and building containers`` - - -2024-04-11 -========== - -* :vytask:`T4516` ``(feature): Rewrite system image manipulation tools in Python`` -* :vytask:`T4548` ``(feature): GRUB loader configuration rework`` -* :vytask:`T3774` ``(bug): atop logs are not limited in size`` -* :vytask:`T3574` ``(default): Add constraintGroup for combining validators with logical AND`` -* :vytask:`T3474` ``(default): Revisit storing syntax version of interface definitions in XML file`` -* :vytask:`T160` ``(feature): Support NAT64`` -* :vytask:`T6228` ``(bug): Cleanup of not existing units`` - - -2024-04-10 -========== - -* :vytask:`T6207` ``(bug): image-tools: restore ability to copy config.boot.default on image install`` -* :vytask:`T5750` ``(bug): Upgrade from 1.3.4 to 1.4 Rolling fails QoS`` -* :vytask:`T5858` ``(bug): Show conntrack statistics formatting is all over the place`` -* :vytask:`T4734` ``(feature): Feature Request: openvpn: add OTP 2FA support`` - - -2024-04-09 -========== - -* :vytask:`T3409` ``(feature): Add back TCP-MSS Clamp to PMTU`` -* :vytask:`T6121` ``(feature): Extend service config-sync for sections vpn, policy, vrf`` - - -2024-04-08 -========== - -* :vytask:`T6197` ``(bug): IPoE-server interface client-subnet looks broken or works with the wrong logic`` -* :vytask:`T6196` ``(bug): Route-map and summary-only do not work in BGP aggregation at the same time`` -* :vytask:`T6068` ``(feature): dhcp server: allow switching between load-balanced and hotspare mode`` - - -2024-04-07 -========== - -* :vytask:`T6205` ``(bug): ipoe: error in migration script logic while renaming mac-address to mac node`` -* :vytask:`T6039` ``(bug): cloud-init DNS search-domain causes configuration migration/validation error`` -* :vytask:`T5862` ``(bug): Default MTU is not acceptable in some environments`` -* :vytask:`T6208` ``(feature): container: rename "cap-add" CLI node to "capability"`` -* :vytask:`T6188` ``(feature): Add Firewall Rule Description to "show firewall" commands`` -* :vytask:`T1244` ``(default): Support for StartupResync in conntrackd`` - - -2024-04-06 -========== - -* :vytask:`T6203` ``(enhancment): Remove obsoleted xml lib`` -* :vytask:`T6202` ``(bug): Multi-Protocol BGP is broken by 6PE patch in upstream FRR 9.1`` - - -2024-04-05 -========== - -* :vytask:`T6089` ``(bug): [1.3.6->1.4.0-epa1 Migration] "ospf passive-interface default" incorrectly added`` -* :vytask:`T2590` ``(bug): DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c`` -* :vytask:`T6199` ``(feature): spring cleaning - drop unused Python imports`` - - -2024-04-04 -========== - -* :vytask:`T6119` ``(default): Use a compliant TOML parser`` -* :vytask:`T6171` ``(feature): dhcp server fail-over - Rename fail-over node`` -* :vytask:`T6115` ``(bug): Build from Git tags fail`` -* :vytask:`T5122` ``(feature): Move "archive-areas" to defaults.toml to support "non-free-firmware" repository`` -* :vytask:`T5121` ``(bug): Incorrect "architecture" config loaded`` -* :vytask:`T4951` ``(default): Add an op mode exception for cases when operations fail due to insufficient system resources`` -* :vytask:`T4883` ``(default): Add a description field for routing tables`` -* :vytask:`T4796` ``(bug): build-vyos-image ignores multiple options`` -* :vytask:`T4795` ``(feature): Cleanup custom python validators`` -* :vytask:`T4761` ``(default): Add a generic URL validator`` -* :vytask:`T3843` ``(bug): l2tp configuration not cleared after delete`` -* :vytask:`T3681` ``(default): The VMware Tools resume script did not run successfully in this virtual machine.`` -* :vytask:`T1991` ``(feature): Rework time services`` -* :vytask:`T5711` ``(default): Put the version data file inside the ISO image`` -* :vytask:`T5672` ``(default): Remove the old-style command definition importer`` -* :vytask:`T5639` ``(default): Group vyos-1x dependencies by their VyOS components and specify their purpose`` -* :vytask:`T5638` ``(default): Add support for requiring numeric values to be ranges rather than single numbers`` -* :vytask:`T5634` ``(default): Remove support for Blowfish and DES from OpenVPN`` -* :vytask:`T5605` ``(default): Do not generate keysize option in OpenVPN configs`` -* :vytask:`T5582` ``(default): Add a command to force NTP sync`` -* :vytask:`T5449` ``(default): Add options for TCP MSS probing`` -* :vytask:`T4440` ``(default): Add OCI compliant image labels to vyos-build and vyos containers`` -* :vytask:`T671` ``(enhancment): Identify and remove dead code`` -* :vytask:`T5109` ``(feature): Improve OCaml XML validator`` -* :vytask:`T1449` ``(feature): Add opportunity to include custom default configs (few) at building`` - - -2024-04-03 -========== - -* :vytask:`T6198` ``(feature): configverify: add common helper for PKI certificate validation`` -* :vytask:`T6192` ``(feature): Multi VRF support for SSH`` - - -2024-04-02 -========== - -* :vytask:`T6167` ``(bug): VNI not set on VRF after reboot`` -* :vytask:`T6151` ``(default): BGP VRF - Route-leaking not work when the next-hop is a recursive route.`` -* :vytask:`T6033` ``(bug): hsflowd fails to start when using a tunnel interface`` - - -2024-04-01 -========== - -* :vytask:`T6195` ``(feature): dropbear: package upgrade 2022.83-1 -> 2022.83-1+deb12u1`` -* :vytask:`T6193` ``(bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP name-server option" for VLAN interfaces`` -* :vytask:`T6178` ``(bug): Reverse-proxy should check that certificate exists during commit`` - - -2024-03-31 -========== - -* :vytask:`T6186` ``(bug): Fix regression in 'set system image default-boot'`` -* :vytask:`T5832` ``(feature): Keepalived: Allow using the 'dev' statement on excluded-addresses`` - - -2024-03-28 -========== - -* :vytask:`T6147` ``(bug): Conntrack not working as expected with global state-policy`` -* :vytask:`T6175` ``(bug): op-mode: "renew dhcp interface " does not check if it's an actual DHCP interface`` - - -2024-03-26 -========== - -* :vytask:`T6066` ``(bug): Setting same network in different ospf area will raise exception`` - - -2024-03-25 -========== - -* :vytask:`T6145` ``(bug): Service config-sync does not rely on priorities but must`` - - -2024-03-24 -========== - -* :vytask:`T6161` ``(feature): Output container images as JSON`` -* :vytask:`T6165` ``(bug): grub: vyos-grub-update failed to start on "slow" systems`` -* :vytask:`T6085` ``(bug): VTI interfaces are in UP state by default`` -* :vytask:`T6152` ``(bug): Kernel panic for ZimaBoard 232`` - - -2024-03-23 -========== - -* :vytask:`T6160` ``(bug): isis: NameError: name 'process' is not defined`` -* :vytask:`T6131` ``(bug): Disabling openvpn interface(s) causes OSPF to fail to load on reboot`` -* :vytask:`T4022` ``(feature): Add package nat-rtsp-dkms`` - - -2024-03-22 -========== - -* :vytask:`T6136` ``(bug): Configuring a dynamic address group, config script did not check whether the group was created`` -* :vytask:`T6130` ``(bug): [1.3.6->1.4.0-epa2 Migration] BGP "set community" missing`` -* :vytask:`T6090` ``(bug): [1.3.6->1.4.0-epa1 Migration] policy route fails due tcp flag case sensitivity`` -* :vytask:`T6155` ``(default): ixgbe: failed to initialize because an unsupported SFP+ module type was detected.`` -* :vytask:`T6125` ``(feature): Support 802.1ad (0x88a8) vlan filtering for bridge`` -* :vytask:`T5624` ``(default): Remove /etc/debian_version from the image`` - - -2024-03-21 -========== - -* :vytask:`T6143` ``(feature): Increase configuration timeout range for service config-sync`` - - -2024-03-20 -========== - -* :vytask:`T6133` ``(feature): Add domain-name to commit-archive`` -* :vytask:`T6129` ``(feature): bgp: add route-map option "as-path exclude all"`` - - -2024-03-19 -========== - -* :vytask:`T6127` ``(bug): Ability to view logs for rules with Offload not functional`` -* :vytask:`T6138` ``(bug): Conntrack table op-mode fails with flowtable offload entries`` - - -2024-03-15 -========== - -* :vytask:`T6118` ``(feature): radvd: RFC8781: add nat64prefix support`` - - -2024-03-12 -========== - -* :vytask:`T6020` ``(bug): VRRP health-check script is not applied correctly in keepalived.conf`` -* :vytask:`T5646` ``(bug): QoS policy limiter broken if class without match`` -* :vytask:`T2433` ``(feature): Improve CLI value validator performance`` -* :vytask:`T1436` ``(bug): Config entries with default values do not correctly show as changed`` - - -2024-03-11 -========== - -* :vytask:`T6098` ``(bug): Description doesnt seem to allow for non international characters`` -* :vytask:`T6070` ``(bug): bnx2x NIC causes a commit error due to incorrect implementation of EEE status reading`` -* :vytask:`T2998` ``(bug): SNMP v3 oid "exclude" option doesn't work`` -* :vytask:`T6107` ``(bug): Nginx does not allow big config queries for configure endpoint API`` -* :vytask:`T6096` ``(bug): Config commits are not synced properly because 00vyos-sync is deleted by vyos-router`` -* :vytask:`T6093` ``(bug): Incorrect dhcp-options vendor-class-id regex`` -* :vytask:`T6083` ``(feature): ethtool: move string parsing to JSON parsing`` -* :vytask:`T6069` ``(bug): HTTP API segfault during concurrent configuration requests`` -* :vytask:`T6057` ``(feature): Add ability to disable syslog for conntrackd`` -* :vytask:`T5504` ``(feature): Keepalived VRRP ability to set more than one peer-address`` -* :vytask:`T5717` ``(feature): ospfv3 - add allow to set metric-type to ospf redistribution while frr docs says its possible.`` -* :vytask:`T6071` ``(bug): firewall: CLI description limit of 256 characters cause config upgrade issues`` - - -2024-03-08 -========== - -* :vytask:`T6086` ``(bug): NAT does not work with network-groups`` -* :vytask:`T6094` ``(bug): Destination Nat not Making Firewall Rules`` -* :vytask:`T6061` ``(bug): connection-status nat destination firewall filter not working in 1.4.0-epa1`` -* :vytask:`T6075` ``(bug): Applying firewall rules with a non-existent interface group`` - - -2024-03-07 -========== - -* :vytask:`T6104` ``(bug): Regression in commit-archive for non-interactive configuration`` -* :vytask:`T6084` ``(bug): OpenNHRP DMVPN configuration file clean after reboot if we have any IPSec configuration`` -* :vytask:`T5348` ``(bug): Service config-sync can freeze the secondary router if it has commit-archive location`` -* :vytask:`T6073` ``(bug): Conntrack/NAT not being disabled when VRFs are defined`` -* :vytask:`T6095` ``(default): Tab completion for "set interfaces wireless wlan0 country-code" incorrect country "uk"`` - - -2024-03-06 -========== - -* :vytask:`T6079` ``(bug): dhcp: migration fails for duplicate static-mapping`` - - -2024-03-05 -========== - -* :vytask:`T5903` ``(bug): NHRP don´t start on reboot from version 1.5-rolling-202401010026`` -* :vytask:`T2447` ``(feature): Additional Boot Argument Configuration to limit CPU C-States`` - - -2024-03-04 -========== - -* :vytask:`T6054` ``(bug): load-balancing wan - doesn't configure a list of ports`` -* :vytask:`T6087` ``(feature): ospfv3: add support to redistribute IS-IS routes`` - - -2024-03-02 -========== - -* :vytask:`T6081` ``(bug): QoS policy shaper target and interval wrong calcuations`` - - -2024-02-29 -========== - -* :vytask:`T6078` ``(feature): Update ethtool to 6.6`` -* :vytask:`T6077` ``(feature): banner: implement ASCII contest winner default logo`` -* :vytask:`T6074` ``(feature): container: do not allow deleting images which have a container running`` - - -2024-02-28 -========== - -* :vytask:`T6055` ``(bug): PKI error: "failed to install x value" when executed the command from conf mode`` -* :vytask:`T4270` ``(bug): dns forwarding - When "ignore-hosts-file" is unset, local hostname of router resolves to 127.0.1.1`` - - -2024-02-27 -========== - -* :vytask:`T6065` ``(bug): Duplicate lines in build-vyos-image script cause sagitta build to fail`` -* :vytask:`T5080` ``(bug): Conntrack enabled by default`` - - -2024-02-26 -========== - -* :vytask:`T6064` ``(bug): Can not build VyOS if repository it not cloned to a branch`` -* :vytask:`T5754` ``(default): Update to StrongSwan 5.9.11`` - - -2024-02-25 -========== - -* :vytask:`T6060` ``(feature): op-mode: container: support removing all container images at once`` - - -2024-02-24 -========== - -* :vytask:`T5909` ``(bug): Container registry with authentication prevents config load (section container) after reboot`` - - -2024-02-23 -========== - -* :vytask:`T5376` ``(bug): Conntrack FTP helper does not work properly`` -* :vytask:`T970` ``(feature): Hostname Support in NAT and Firewall Rules`` -* :vytask:`T4940` ``(feature): Interface debugging`` - - -2024-02-22 -========== - -* :vytask:`T6048` ``(bug): Exception in event handler script`` -* :vytask:`T3902` ``(bug): Firewall does not load on boot, address-group not found, even though it exists`` - - -2024-02-21 -========== - -* :vytask:`T6050` ``(bug): Wrong scripting commands descriptions in accel-ppp services`` - - -2024-02-19 -========== - -* :vytask:`T5971` ``(default): Create the same view of ppp section for all accel-ppp services`` -* :vytask:`T6029` ``(default): Rewrite Accel-PPP services to an identical feature set`` -* :vytask:`T3722` ``(bug): op-mode IPSec show vpn ike sa always shows L-TIME 0`` - - -2024-02-18 -========== - -* :vytask:`T6043` ``(bug): VxLAN and bridge error bug`` -* :vytask:`T6041` ``(bug): image-tools: install fails from PXE boot into live iso due to restrictive logic`` - - -2024-02-17 -========== - -* :vytask:`T5972` ``(feature): login: add possibility to disable individual local user accounts`` - - -2024-02-16 -========== - -* :vytask:`T6009` ``(bug): Firewall - Time not working properly when not using UTC`` -* :vytask:`T6005` ``(bug): Error on adding a wireguard interface to OSPFv3`` -* :vytask:`T2113` ``(bug): OpenVPN Options error: you cannot use --verify-x509-name with --compat-names or --no-name-remapping`` -* :vytask:`T6019` ``(feature): Bump nftables and libnftnl version`` -* :vytask:`T3471` ``(bug): DHCP hook is not able to detect all running DHCP instances`` -* :vytask:`T6015` ``(default): "journalctl_charon" file does not contain data in the generated "ipsec debug-archive" file`` -* :vytask:`T6001` ``(default): Add option to enable resolve-via-default`` -* :vytask:`T5965` ``(bug): WWAN modems using raw-ip do not work with dhclient/dhcp6c`` -* :vytask:`T5418` ``(bug): PPPoE-Server Client IP pool Subnet`` -* :vytask:`T5245` ``(bug): Wireless interfaces do not get IPv6 link-local address assigned`` - - -2024-02-15 -========== - -* :vytask:`T5977` ``(bug): nftables: Operation not supported when using match-ipsec in outbound firewall`` -* :vytask:`T2612` ``(bug): HTTPS API, changing API key fails but goes through`` -* :vytask:`T5989` ``(bug): IP subnets not usable in UPnP ACLs`` -* :vytask:`T5890` ``(default): OTP key generation is broken`` -* :vytask:`T5719` ``(default): mdns repeater: Add op-mode commands`` -* :vytask:`T4839` ``(feature): Dynamic Firewall groups`` -* :vytask:`T4801` ``(feature): Support for building AWS-ready ISO`` -* :vytask:`T3993` ``(enhancment): Extend HTTP API GraphQL support`` -* :vytask:`T3991` ``(bug): PKI operational command return traceback`` -* :vytask:`T3780` ``(bug): VTI not being brought down when tunnel is down`` -* :vytask:`T3001` ``(feature): Disable spectre mitigation patches from CLI`` -* :vytask:`T562` ``(feature): PDNS: Add support for authoritative dns server`` -* :vytask:`T71` ``(feature): Add virtual IP and route installation policy options for IPsec`` -* :vytask:`T5496` ``(default): `show firewall` error`` -* :vytask:`T4038` ``(default): Rewrite `vyatta-image-tools.pl` in Python`` -* :vytask:`T4997` ``(default): Add DHCP client user hooks dir`` -* :vytask:`T775` ``(feature): Config Sync between two VyOS routers`` -* :vytask:`T381` ``(feature): config nodes for EasyRSA CAs`` -* :vytask:`T118` ``(feature): Native Zabbix Support`` - - -2024-02-14 -========== - -* :vytask:`T6034` ``(feature): rpki: move file based SSH keys for authentication to PKI subsystem`` -* :vytask:`T5981` ``(bug): IPsec site-to-site migrated PKI ca certificates are created with an '@'`` -* :vytask:`T5930` ``(bug): vrf - route-leak not work using route-target both command.`` -* :vytask:`T5709` ``(bug): IPoE-server fails if next pool mentioned but not defined`` -* :vytask:`T4119` ``(bug): Issue with l2tp remote-access ipv6 configuration`` -* :vytask:`T2044` ``(bug): RPKI doesn't boot properly`` -* :vytask:`T6032` ``(feature): bgp: add EVPN MAC-VRF Site-of-Origin support`` -* :vytask:`T5960` ``(default): Rewriting authentication section in accel-ppp services`` - - -2024-02-13 -========== - -* :vytask:`T5928` ``(bug): Configuration fails to load on boot if offloading has VLAN interfaces defined`` -* :vytask:`T5482` ``(bug): Chrony NTP Server Fails To Sync Time`` -* :vytask:`T5064` ``(bug): Value validation for domain-groups seems to be broken`` - - -2024-02-12 -========== - -* :vytask:`T6010` ``(bug): Support setting multiple values in BGP path-attribute`` -* :vytask:`T6004` ``(bug): RPKI is not configured`` -* :vytask:`T5952` ``(default): DHCP allow same MAC Address on same subnet`` -* :vytask:`T5849` ``(feature): Add SRv6 route commands`` - - -2024-02-10 -========== - -* :vytask:`T6023` ``(bug): rpki: add support for CLI knobs expire-interval and retry-interval`` -* :vytask:`T1090` ``(default): Webproxy overhaul`` - - -2024-02-09 -========== - -* :vytask:`T6028` ``(bug): QoS policy shaper wrong class_id_max and default_minor_id`` -* :vytask:`T6026` ``(bug): QoS hide attempts to delete qdisc from devices`` -* :vytask:`T5788` ``(feature): frr: update to 9.1 release`` -* :vytask:`T5703` ``(bug): QoS config on pppoe interface resets back to fq_codel after tunnel reboots`` -* :vytask:`T5685` ``(feature): Keepalived VRRP prefix is not necessary for the virtual address`` - - -2024-02-08 -========== - -* :vytask:`T6014` ``(feature): Bump keepalived version`` -* :vytask:`T5910` ``(bug): Grub problem(?) Serial Console no longer working`` -* :vytask:`T6021` ``(bug): QoS r2q wrong calculation`` - - -2024-02-07 -========== - -* :vytask:`T6017` ``(bug): Update vyos-http-api-tools for security advisory`` -* :vytask:`T6016` ``(bug): Resolve intermittent failures in cleanup function after failed image install`` -* :vytask:`T6024` ``(feature): bgp: add additional missing FRR features`` -* :vytask:`T6011` ``(feature): rpki: known-hosts-file is no longer supported by FRR CLI - remove VyOS CLI node`` -* :vytask:`T5998` ``(feature): replay_window setting under vpn in config`` - - -2024-02-06 -========== - -* :vytask:`T6018` ``(default): smoketest: updating http-api framework requires a pause before test`` -* :vytask:`T5921` ``(bug): Trying to commit an OpenConnect configuration without any local users results in an exception`` -* :vytask:`T5687` ``(feature): Implement ECS settings for PowerDNS recursor`` - - -2024-02-05 -========== - -* :vytask:`T5974` ``(bug): QoS policy shaper is currently miscalculating bandwidth and ceil values for the default class`` -* :vytask:`T5865` ``(feature): Rewrite ipv6 pool section to ipv6 named pools in Accel-ppp services`` - - -2024-02-02 -========== - -* :vytask:`T5739` ``(bug): Password recovery does not work if public keys are configured`` -* :vytask:`T5955` ``(feature): Rootless containers/set uid/gid for container`` -* :vytask:`T5941` ``(bug): [1.3.5 -> 1.4.0-RC1 Migration] Orphaned Configuration Nodes Cause Issues`` -* :vytask:`T6003` ``(feature): Add 'show rpki as-number' and 'show rpki prefix'`` -* :vytask:`T5848` ``(feature): Add triple-isolate flow isolation option to CAKE QoS policy`` - - -2024-02-01 -========== - -* :vytask:`T5995` ``(bug): Kernel NIC-drivers for Huawei NICs are not properly enabled`` -* :vytask:`T5978` ``(bug): ethernet: hw-tc-offload does not actually get enabled on the NIC`` -* :vytask:`T5979` ``(enhancment): Add configurable kernel boot parameters`` -* :vytask:`T5973` ``(bug): vrf: RTNETLINK answers: File exists`` -* :vytask:`T5967` ``(bug): Multi-hop BFD connections can't be established; please add minimum-ttl option.`` -* :vytask:`T5619` ``(default): Update the Intel ixgbe driver due to issues with Intel X533`` - - -2024-01-31 -========== - -* :vytask:`T6000` ``(bug): [1.3.x -> 1.5.x] migrating threw exception in /opt/vyatta/etc/config-migrate/migrate/https/5-to-6, performed workaround`` -* :vytask:`T5999` ``(bug): load-balancing reverse-proxy can't configure root as a redirect`` - - -2024-01-30 -========== - -* :vytask:`T5980` ``(feature): Add image-tools support for configurable kernel boot options`` - - -2024-01-29 -========== - -* :vytask:`T5988` ``(bug): image-tools: a check of valid image name is missing from 'add image'`` -* :vytask:`T5994` ``(bug): Fix typo in 'remote' module preventing 'add system image' via ftp`` - - -2024-01-26 -========== - -* :vytask:`T5957` ``(bug): Firewall fails to delete inbound-interface name`` -* :vytask:`T5779` ``(bug): custom conntrack timeout rule not applicable`` -* :vytask:`T5984` ``(feature): Add user util numactl`` - - -2024-01-25 -========== - -* :vytask:`T5983` ``(bug): image-tools: minor regression in pruning version files in compatibility mode`` -* :vytask:`T5927` ``(bug): QoS policy shaper-hfsc class does not have a `bandwidth` node but requires one in the check`` -* :vytask:`T5834` ``(bug): Rename 'enable-default-log' to 'default-log'`` - - -2024-01-22 -========== - -* :vytask:`T5968` ``(feature): hsflowd: add VRF support`` -* :vytask:`T5975` ``(bug): GraphQL expects script otp.py that does not exists in 1.4`` -* :vytask:`T5961` ``(bug): QoS policy shaper vif with ceiling fails on commit`` -* :vytask:`T5958` ``(bug): QoS policy shaper-hfsc is not implemented`` -* :vytask:`T5160` ``(feature): Firewall refactor`` -* :vytask:`T5969` ``(feature): op-mode: list multicast group membership`` - - -2024-01-21 -========== - -* :vytask:`T5799` ``(bug): vyos unbootable after 1.4-rolling-202308240020 to 1.5-rolling-202312010026 upgrade`` -* :vytask:`T5787` ``(bug): dhcp-server allows duplicate static-mapping for the same IP address`` -* :vytask:`T5692` ``(enhancment): NTP leap smear`` -* :vytask:`T5954` ``(feature): Enable nvme_hwmon and drivetemp in KERNEL`` - - -2024-01-20 -========== - -* :vytask:`T5915` ``(bug): Firewall zone - Re add op-mode commands`` -* :vytask:`T5805` ``(bug): Missed per-interface statistic in telegraf`` -* :vytask:`T5724` ``(feature): About dhcp client hooks`` -* :vytask:`T5577` ``(bug): Optimize PAM configs for RADIUS/TACACS+`` -* :vytask:`T5550` ``(bug): Source validation on interface does not work properly`` -* :vytask:`T5267` ``(bug): Another corruption on upgrade`` -* :vytask:`T5239` ``(bug): frr 'hostname' missing or incorrect, and domain-name missing totally`` -* :vytask:`T5219` ``(bug): ddclient: Cloudflare doesn't require login`` -* :vytask:`T5217` ``(feature): Add firewall SYNPROXY`` -* :vytask:`T5203` ``(feature): load-balancing wan add systemd unit instead of old vyatta-wanloadbalance.init`` -* :vytask:`T5199` ``(bug): Salt-minion cannot connect to server in python 3.10 and up`` -* :vytask:`T5138` ``(feature): Add patch to accel-ppp build L2TP LNS use Calling-Number as RADIUS Calling-Station-ID`` -* :vytask:`T5054` ``(bug): ipsec: "show vpn ipsec remote-access" does not list active connections`` -* :vytask:`T5053` ``(bug): Vyatta-cfg Post-Removal Hook Tries to Disable Deleted Service`` -* :vytask:`T5035` ``(feature): Add more actions to policy route rule`` -* :vytask:`T4990` ``(bug): Commit results may not be properly saved if power is cut immediately after a successful commit`` -* :vytask:`T4988` ``(default): Expose time and size conversion functions as Jinja2 filters`` -* :vytask:`T4986` ``(feature): Ability to filter traffic originating from the router itself via firewall`` -* :vytask:`T4963` ``(default): vyos.ethtool: improve/fix driver name detection`` -* :vytask:`T4935` ``(bug): ospfv3: "not-advertise" and "advertise" conflict`` -* :vytask:`T4897` ``(bug): Setting 'source-address' or `source-interface` on existing vxlan interface doesn't work`` -* :vytask:`T4888` ``(default): Rewrite the conntrack sync script using vyos.opmode`` -* :vytask:`T4863` ``(feature): need an option for route policy to apply to dynamic interfaces l2tp*/ipoe*/pppoe* (for TCP MSS setting)`` -* :vytask:`T4817` ``(feature): Please add support for RFC 9234`` -* :vytask:`T4765` ``(default): Normalize field names in op mode JSON outputs`` -* :vytask:`T4751` ``(enhancment): Feature Request: system login: 2FA OTP key generator in VyOS CLI`` -* :vytask:`T4726` ``(default): Add completion and validation for the accel-ppp RADIUS vendor option`` -* :vytask:`T4722` ``(default): Improve abbreviation/acronym consistency`` -* :vytask:`T4172` ``(feature): Patch ndppd to not read route table if there are no auto prefixes`` -* :vytask:`T4085` ``(feature): Rewrite L2TP/PPTP/SSTP/PPPoE services to get_config_dict`` -* :vytask:`T4031` ``(feature): Ability to configure DMVPN in vrf`` -* :vytask:`T4030` ``(bug): SR-IOV and interface renaming bug`` -* :vytask:`T4014` ``(feature): Add “command” and “arg” configuration options for containers`` -* :vytask:`T3965` ``(default): arm: Extend configure scripts to allow for arm builds`` -* :vytask:`T3813` ``(bug): Some custom sysctl parameters can't be applied bug`` -* :vytask:`T3778` ``(bug): Abnormal network communication and settings`` -* :vytask:`T3591` ``(bug): OpenVPN with/without VRF not working (NordVPN)`` -* :vytask:`T3372` ``(feature): Support public HTTPS repos in live-build`` -* :vytask:`T5963` ``(bug): QoS policy shaper rate calculations could be wrong for some ethernet devices`` -* :vytask:`T5962` ``(feature): QoS policy set default speed to 100mbit or 1gbit instead of 10mbit`` -* :vytask:`T5697` ``(bug): event-handler keep failing`` -* :vytask:`T4779` ``(default): Make raw op mode command outputs use bytes for data amount values`` - - -2024-01-19 -========== - -* :vytask:`T5897` ``(bug): VyOS with Cloud-init and VRF stucks at reboot/shutdown process`` -* :vytask:`T5554` ``(bug): Disable sudo for PAM RADIUS`` -* :vytask:`T4754` ``(default): Improvement: system login: show configured 2FA OTP key`` -* :vytask:`T5857` ``(bug): show interfaces wireless info`` -* :vytask:`T5841` ``(default): Remove old ssh-session-cleanup.service`` -* :vytask:`T5543` ``(bug): Fix source address handling in static joins`` -* :vytask:`T5884` ``(default): Minor description fix (op-mode: generate wireguard)`` -* :vytask:`T5781` ``(default): Add ability to add additional minisign keys`` - - -2024-01-18 -========== - -* :vytask:`T5863` ``(bug): Failure to Load Config on Recent 1.5 Versions`` -* :vytask:`T4638` ``(bug): Deleting a parent interface does not delete its underlying VLAN interfaces`` -* :vytask:`T5953` ``(default): Rename 'close_action' value from `hold` to `trap` in IPSEC IKE`` -* :vytask:`T905` ``(bug): The command show remote-config does not work for remote-platform openvpn`` - - -2024-01-17 -========== - -* :vytask:`T5923` ``(bug): Config mode system_console.py is not aware of revised GRUB file structure`` -* :vytask:`T4658` ``(feature): Rename DPD action `hold` to `trap``` -* :vytask:`T5932` ``(bug): 1.4-rolling-202304120317 to 1.4.0-rc1: dynamic dns migration fail`` - - -2024-01-16 -========== - -* :vytask:`T5951` ``(bug): [1.4.0-RC2] show hardware dmi Operational Mode Command Broken`` -* :vytask:`T5937` ``(bug): [1.3.5 -> 1.4.0-RC1 Migration] IPv6 BGP Neighbor Peer Groups Missing / Not Migrated`` -* :vytask:`T5889` ``(bug): Migration NAT 5-to-6 bug`` -* :vytask:`T5859` ``(bug): Invalid format of pool range in accel-ppp services`` -* :vytask:`T5842` ``(feature): Rewrite PPTP service to get_config_dict`` -* :vytask:`T5801` ``(feature): Rewrite L2TP service to get_config_dict`` -* :vytask:`T5688` ``(default): Create the same view of pool configuration for all accel-ppp services`` - - -2024-01-15 -========== - -* :vytask:`T5944` ``(bug): "reboot in 1" not working`` -* :vytask:`T5936` ``(bug): [1.3.5 -> 1.4.0-RC1 Migration] OSPF Passive Interface Configuration Not Working Correctly`` -* :vytask:`T5247` ``(bug): the bug of the command "show interfaces system"`` -* :vytask:`T5901` ``(bug): Cloud-init and DHCP exit hook errors`` -* :vytask:`T4856` ``(bug): DHCP-client exit hook for IPsec is incorrect`` -* :vytask:`T2556` ``(bug): "show interfaces vrrp" does not return any interface`` - - -2024-01-14 -========== - -* :vytask:`T4428` ``(feature): Update ddclient to newer version`` - - -2024-01-12 -========== - -* :vytask:`T5925` ``(feature): Containers change systemd KillMode`` -* :vytask:`T5920` ``(bug): Quick Start documentation contains error`` -* :vytask:`T5919` ``(bug): Firewall - opmode for ipv6`` -* :vytask:`T5306` ``(default): bgp config migration failed with v6only option configured with peer-group`` -* :vytask:`T3429` ``(bug): Hyper-V integration services not working on VyOS 1.4 (sagitta/current)`` - - -2024-01-11 -========== - -* :vytask:`T5896` ``(bug): Config Error on Boot with Podman and Firewall`` -* :vytask:`T5532` ``(bug): After add system image the boot stuck and works again after the second reboot`` -* :vytask:`T5512` ``(bug): build linux-firmware script cannot expand asterisks if firmware name is a glob string`` -* :vytask:`T5379` ``(bug): show system updates doesnt seem to be working`` -* :vytask:`T5275` ``(default): Add op mode commands for exporting certificates to PEM files with correct headers`` -* :vytask:`T5274` ``(default): Add a deprecation warning for OpenVPN site-to-site with pre-shared secret`` -* :vytask:`T5262` ``(default): Warn the user about unsaved config on reboot/shutdown attempts`` -* :vytask:`T5257` ``(feature): Cannont assign netflow source ip to ip in non default VRF`` -* :vytask:`T5026` ``(feature): Python3 modules crypt and spwd are deprecated`` -* :vytask:`T5814` ``(bug): VyOS 1.3 to 1.4 LTS Firewall ruleset migration script breaks configuration`` -* :vytask:`T4610` ``(bug): Firewall with 20K entries cannot load after reboot`` -* :vytask:`T3191` ``(bug): PAM RADIUS freezing when accounting does not configured on RADIUS server`` -* :vytask:`T5917` ``(feature): Restore annotations of (running)/(default boot) in select image list`` -* :vytask:`T5916` ``(default): Added segment routing check for index size and SRGB size`` -* :vytask:`T5913` ``(feature): Allow for Peer-Groups in ipv4-labeled-unicast SAFI`` - - -2024-01-10 -========== - -* :vytask:`T5918` ``(bug): Verification problem for `set vpn ipsec interface``` -* :vytask:`T5911` ``(bug): pki: service update ignored if certificate name contains a hyphen (-)`` -* :vytask:`T5886` ``(feature): Add support for ACME protocol (LetsEncrypt)`` -* :vytask:`T5766` ``(bug): http: rewrite conf-mode script to get_config_dict()`` -* :vytask:`T5144` ``(default): Modernize dynamic dns operation`` -* :vytask:`T4689` ``(feature): Support RFS(Receive Flow Steering)`` -* :vytask:`T4659` ``(feature): Use vtysh to display bridge and some interface parameter information`` -* :vytask:`T4646` ``(bug): USB serial output console does not work`` -* :vytask:`T4577` ``(bug): WWAN commit failed which simple config`` -* :vytask:`T4502` ``(feature): Consider implementing (NAT/other) flow table offload`` -* :vytask:`T4446` ``(default): Unified CLI for displaying neithbors (ARP, IP, and NDP)`` -* :vytask:`T4427` ``(default): Remove the vyos-utils package list from vyos-build`` -* :vytask:`T4300` ``(feature): Extend list of supported interfaces for Cloud-init Network Configuration`` -* :vytask:`T4250` ``(bug): Organize logrotate settings to avoid duplicates`` -* :vytask:`T4236` ``(feature): Generate ovpn openvpn client configuration files`` -* :vytask:`T4222` ``(feature): Support for TWAMP as round-trip metric`` -* :vytask:`T3833` ``(bug): Cloud-init not finding data source in OpenStack`` -* :vytask:`T5902` ``(bug): http: remove virtual-host configuration in webserver`` -* :vytask:`T3499` ``(bug): Podman is not compatible with nat rules`` -* :vytask:`T3430` ``(bug): Cloud-init failing with “Unable to render networking” on VyOS 1.3`` -* :vytask:`T3011` ``(bug): router becomes unreachable for few minutes when vti interfaces goes down`` -* :vytask:`T5791` ``(default): Update dynamic dns configuration path to be consistent with other areas of VyOS`` -* :vytask:`T5708` ``(default): Additional dynamic dns improvements to align with ddclient 3.11.1 release`` -* :vytask:`T5573` ``(bug): Fix ddclient cache entries`` -* :vytask:`T5012` ``(feature): Control network configuration from Cloud-Init config`` -* :vytask:`T3116` ``(feature): Support back-end L4 level load balancing`` -* :vytask:`T5614` ``(default): Add conntrack helper matching on firewall`` -* :vytask:`T4782` ``(enhancment): Allow multiple CA certificates (on e.g. EAPoL)`` -* :vytask:`T2199` ``(default): Rewrite firewall in new XML/Python style`` - - -2024-01-09 -========== - -* :vytask:`T5898` ``(bug): Replace partprobe with partx due to unable to install VyOS`` -* :vytask:`T5838` ``(feature): Add Infiniband kernel modules`` -* :vytask:`T5785` ``(bug): API output of show container image broken`` -* :vytask:`T5410` ``(feature): Improve `utils.convert.convert_data()` to process all stdtypes`` -* :vytask:`T5269` ``(default): OpenVPN non-TLS site-to-site mode deprecation`` -* :vytask:`T5249` ``(feature): Add rollback-soft feature to rollback without a reboot`` -* :vytask:`T4944` ``(default): Prevent op mode functions from returning bare literals in raw output`` -* :vytask:`T4910` ``(default): Rewrite the remote access VPN op mode in the new style`` -* :vytask:`T4470` ``(feature): Rewrite load-balancing wan to XML/Python`` -* :vytask:`T3763` ``(bug): wireguard checks if port already binding`` -* :vytask:`T3489` ``(bug): NUMA has been disabled for the past few years and no-one has noticed`` -* :vytask:`T3476` ``(feature): Update availability check`` -* :vytask:`T2845` ``(bug): BGP conf_mode unable to delete configuration with peer-group`` -* :vytask:`T2844` ``(bug): BGP conf_mode errors disable-send-community`` -* :vytask:`T2755` ``(default): Requirements for partial interface setup`` -* :vytask:`T2721` ``(enhancment): Set FQ-CoDel as the default queueing mechanism for every class in Shaper`` -* :vytask:`T2511` ``(feature): Migrate vyatta-op-quagga to new XML format`` -* :vytask:`T2302` ``(default): Convert configuration scripts from executables to modules and use a script runner`` -* :vytask:`T2281` ``(feature): DHCP and Static IPs on Same Interface`` -* :vytask:`T2216` ``(default): Containerized third-party applications for VyOS`` -* :vytask:`T2171` ``(feature): Unify creation and manipulation of interfaces`` -* :vytask:`T1759` ``(feature): Replacing Vyatta::Interface perl`` -* :vytask:`T2408` ``(enhancment): DHCP Relay upstream and downstream interfaces`` -* :vytask:`T1297` ``(feature): Add GARP settings to VRRP/keepalived`` - - -2024-01-08 -========== - -* :vytask:`T5888` ``(bug): Firewall upgrade fails because of icmpv6`` -* :vytask:`T5844` ``(bug): HTTPS API doesn't start without configured keys even when GraphQL authentication type is set to token`` -* :vytask:`T5664` ``(bug): 1.4 user has no permissions?`` -* :vytask:`T5215` ``(default): Add a built-in ICMP health check for VRRP groups`` -* :vytask:`T5045` ``(bug): BFD is not starting after upgrade to 1.4-rolling-202302150317`` -* :vytask:`T4193` ``(default): Add support for transparent firewall`` -* :vytask:`T3754` ``(default): Make config scripts more testable`` -* :vytask:`T3663` ``(default): Use inotify file watching where applicable`` -* :vytask:`T3480` ``(bug): Does not possible to change console baud-rate`` -* :vytask:`T2897` ``(default): Remove cluster command`` -* :vytask:`T5904` ``(feature): op-mode: add "show ipv6 route vrf " command`` - - -2024-01-07 -========== - -* :vytask:`T5891` ``(bug): OpenVPN IPv6 config issue with 1.4-rc1`` -* :vytask:`T5887` ``(feature): Upgrade Linux Kernel to 6.6.y (2023 LTS edition)`` - - -2024-01-06 -========== - -* :vytask:`T3670` ``(feature): Option to disable HTTP port 80 redirect`` - - -2024-01-05 -========== - -* :vytask:`T3642` ``(feature): PKI configuration`` -* :vytask:`T5894` ``(feature): Extend get_config_dict() with additional parameter with_pki that defaults to False`` - - -2024-01-04 -========== - -* :vytask:`T4072` ``(feature): Feature Request: Firewall on bridge interfaces`` -* :vytask:`T3459` ``(default): Inform the user when unable to install outdated image`` - - -2024-01-03 -========== - -* :vytask:`T5880` ``(bug): verify_source_interface should not allow dynamic interfaces like ppp, l2tp, ipoe or sstpc client interfaces`` -* :vytask:`T5879` ``(bug): tunnel: sourceing from dynamic pppoe0 interface will fail on reboots`` -* :vytask:`T4500` ``(bug): Missing firewall logs`` - - -2024-01-02 -========== - -* :vytask:`T5885` ``(default): image-tools: relax restriction on image-name length from 32 to 64`` - - -2024-01-01 -========== - -* :vytask:`T5883` ``(bug): Preserve file ownership in /config subdirs on add system image`` -* :vytask:`T5474` ``(feature): Establish common file name pattern for XML conf mode commands`` - - -2023-12-30 -========== - -* :vytask:`T5875` ``(bug): login: removing and re-adding a user keeps the home directory but UID will change, thus SSH keys no longer work`` -* :vytask:`T5653` ``(feature): Command to display fingerprint`` - - -2023-12-29 -========== - -* :vytask:`T5829` ``(bug): Can't Add IPv6 Address to Containers`` -* :vytask:`T5852` ``(bug): Reboots fail with eapol WAN interface`` -* :vytask:`T5869` ``(bug): vyos.template.first_host_address() does not honor RFC4291 section 2.6.1`` - - -2023-12-28 -========== - -* :vytask:`T4163` ``(feature): [BMP-BGP] Routing monitoring feature`` -* :vytask:`T5867` ``(feature): Upgrade podman to Debian Trixie version 4.7.x`` -* :vytask:`T5866` ``(feature): Add op-mode command to restart IPv6 RA daemon`` -* :vytask:`T5861` ``(bug): Flavor build system fails with third-party packages`` -* :vytask:`T5854` ``(feature): Extend override-default script to allow embedded defaultValue settings`` -* :vytask:`T5792` ``(default): Upgrade ddclient 3.11.2 release`` - - -2023-12-25 -========== - -* :vytask:`T5855` ``(feature): Migrate "set service lldp snmp enable" -> `set service lldp snmp"`` -* :vytask:`T5837` ``(bug): vyos.configdict.node_changed does not return keys per adding`` -* :vytask:`T5856` ``(bug): SNMP service removal fails`` - - -2023-12-24 -========== - -* :vytask:`T5853` ``(default): Typo interfaces-virtual-ethernet.xml.in`` - - -2023-12-22 -========== - -* :vytask:`T5804` ``(bug): SNAT "any" interface error`` -* :vytask:`T4760` ``(bug): VyOS does not support running multiple instances of DHCPv6 clients`` - - -2023-12-21 -========== - -* :vytask:`T5778` ``(bug): The show dhcp server leases operation mode command does not work as expected`` -* :vytask:`T5775` ``(default): Migrated Firewall Global State Policy ineffective on latest firewall zone config`` -* :vytask:`T5637` ``(bug): Firewall default-action log`` -* :vytask:`T5796` ``(bug): Openconnect - HTTPS security headers are missing`` -* :vytask:`T3580` ``(feature): Refactoring firewall ipv6 rule icmpv6`` -* :vytask:`T2898` ``(feature): Support NDP proxy`` -* :vytask:`T2229` ``(feature): PPPOE Default Queue type selection`` - - -2023-12-20 -========== - -* :vytask:`T5823` ``(feature): Protocol BGP add default values for config dictionary`` -* :vytask:`T5798` ``(enhancment): reverse-proxy load-balancing service should support multiple certificates for frontend`` - - -2023-12-19 -========== - -* :vytask:`T5828` ``(default): Fix GRUB installation on arm64`` - - -2023-12-18 -========== - -* :vytask:`T5751` ``(feature): Adjust new image tools for non-interactive use`` -* :vytask:`T5831` ``(feature): show system image should reverse order by addition date`` -* :vytask:`T5825` ``(bug): image-tools: restore authentication on 'add system image'`` -* :vytask:`T5821` ``(bug): image-tools: restore vrf-aware 'add system image'`` -* :vytask:`T5819` ``(bug): Don't echo password on install image`` -* :vytask:`T5806` ``(bug): Clear old raid data on new install image`` -* :vytask:`T5789` ``(bug): image-tools should copy ssh host keys on image update`` -* :vytask:`T5758` ``(default): Restore scanning configs when live installing`` - - -2023-12-15 -========== - -* :vytask:`T5824` ``(bug): busybox cannot connect some websites from initramfs`` -* :vytask:`T5803` ``(default): git/github: Adjust configuration for safe and baseline defaults`` - - -2023-12-14 -========== - -* :vytask:`T5773` ``(bug): Unable to load config via HTTP`` -* :vytask:`T5816` ``(bug): BGP Large Community List Validation Broken`` -* :vytask:`T5812` ``(bug): rollback check max revision number does not work`` -* :vytask:`T5749` ``(feature): Show MAC address VRF and MTU by default for "show interfaces"`` -* :vytask:`T5774` ``(bug): commit-archive to FTP server broken after update (VyOS 1.5-rolling)`` -* :vytask:`T5826` ``(default): Add dmicode as an explicit dependency`` -* :vytask:`T5793` ``(default): mdns-repeater: Cleanup avahi-daemon configuration in /etc`` - - -2023-12-13 -========== - -* :vytask:`T591` ``(feature): Support SRv6`` - - -2023-12-12 -========== - -* :vytask:`T4704` ``(feature): Allow to set metric (MED) to rtt with rtt,+rtt or -rtt`` -* :vytask:`T5815` ``(enhancment): Add load_config module`` -* :vytask:`T5413` ``(default): Deny the opportunity to use one public/private key pair on both wireguard peers.`` - - -2023-12-11 -========== - -* :vytask:`T5741` ``(bug): WAN Load Balancing failover route tables aren't created`` - - -2023-12-10 -========== - -* :vytask:`T5658` ``(default): Add VRF support for mtr`` - - -2023-12-09 -========== - -* :vytask:`T5808` ``(bug): op-mode: ipv6 ospfv3 graceful-restart description contains incorrect info`` -* :vytask:`T5802` ``(bug): ping (ip or hostname) interface produces error`` -* :vytask:`T5747` ``(feature): op-mode add MAC VRF and MTU for show interfaces summary`` -* :vytask:`T3983` ``(bug): show pki certificate Doesnt show x509 certificates`` - - -2023-12-08 -========== - -* :vytask:`T5782` ``(enhancment): Use a single config mode script for https and http-api`` -* :vytask:`T5768` ``(enhancment): Remove auxiliary http-api.conf for simplification of http-api config mode script`` -* :vytask:`T5809` ``(default): Enable GRUB support for gzip compressed kernels`` - - -2023-12-04 -========== - -* :vytask:`T5769` ``(bug): VTI tunnels lose their v6 Link Local addresses when set down/up`` - - -2023-12-03 -========== - -* :vytask:`T5753` ``(feature): Add VXLAN vnifilter support`` -* :vytask:`T5759` ``(feature): Change VXLAN default MTU to 1500 bytes`` - - -2023-11-30 -========== - -* :vytask:`T4601` ``(bug): dhcp : relay agent IP address issue.`` - - -2023-11-28 -========== - -* :vytask:`T4276` ``(bug): IPsec peers dh-group negotiation issue with pfs enabled and multiple proposals configured with IKEv1`` - - -2023-11-27 -========== - -* :vytask:`T5763` ``(bug): Fix imprecise check for remote file name in vyos-load-config.py`` -* :vytask:`T5783` ``(feature): frr: smoketests must notice any daemon crash`` - - -2023-11-26 -========== - -* :vytask:`T5760` ``(feature): DHCP client custom dhcp-options`` -* :vytask:`T2405` ``(feature): archive to GIT or other platform`` - - -2023-11-25 -========== - -* :vytask:`T5655` ``(bug): commit-archive: Ctrl+C should not eror out with stack trace, signal should be cought`` -* :vytask:`T4946` ``(default): Rewrite "add system image" in the new op-mode`` -* :vytask:`T4454` ``(default): `install-image` should check free storage`` - - -2023-11-24 -========== - -* :vytask:`T5776` ``(feature): Enable VFIO support`` -* :vytask:`T5402` ``(bug): VRRP router with rfc3768-compatibility sends multiple ARP replies`` -* :vytask:`T3895` ``(default): VYOS firewall rules do not adhere to time schedule unless placed in UTC mode.`` - - -2023-11-23 -========== - -* :vytask:`T4891` ``(bug): BFD flapping loop`` -* :vytask:`T4867` ``(bug): "show bgp neighbors ... advertised-routes" and some other commands fail for IPv4 neighbors`` - - -2023-11-22 -========== - -* :vytask:`T5767` ``(feature): Add reboot and poweroff the system via API`` -* :vytask:`T5729` ``(bug): Firewall, nat and policy route - Switch to valueless`` -* :vytask:`T5681` ``(feature): Interface match - Simplified and unified cli`` -* :vytask:`T4877` ``(bug): Need verification in using import vrf and import vpn, export vpn commands`` -* :vytask:`T4021` ``(bug): Long commit time on bridge interface with 1-4094 allowed VLAN tags`` -* :vytask:`T5338` ``(feature): Add 'mpls bgp forwarding' feature`` -* :vytask:`T3818` ``(bug): BGP export route-map only works after bgpd restart`` -* :vytask:`T5590` ``(default): Firewall "log enable" logs every packet`` -* :vytask:`T5426` ``(default): Add exceptions in vici functions calls`` - - -2023-11-21 -========== - -* :vytask:`T5762` ``(bug): http: api: smoketests fail as they can not establish IPv6 connection to uvicorn backend server`` - - -2023-11-20 -========== - -* :vytask:`T2816` ``(default): Rewrite IPsec scripts with the new XML/Python approach`` - - -2023-11-18 -========== - -* :vytask:`T1354` ``(feature): Add support for VLAN-Aware bridges`` - - -2023-11-16 -========== - -* :vytask:`T5726` ``(bug): HTTPS API image cannot be updated`` -* :vytask:`T5738` ``(feature): Extend XML building blocks`` -* :vytask:`T5736` ``(feature): igmp: migrate "protocols igmp" to "protocols pim"`` -* :vytask:`T5733` ``(feature): pim(6): rewrite FRR PIM daemon configuration to get_config_dict() and add missing IGMP features`` -* :vytask:`T5689` ``(default): FRR 9.0.1 in VyOS current segfaults on show rpki prefix $prefix`` -* :vytask:`T5595` ``(feature): Multicast - PIM bfd feature enable`` -* :vytask:`T3638` ``(bug): Passwords With Dollar Sign Set Incorrectly`` - - -2023-11-15 -========== - -* :vytask:`T5695` ``(feature): Build FRR with LUA scripts --enable-scripting option`` -* :vytask:`T5665` ``(bug): radius user not working`` -* :vytask:`T5728` ``(bug): Improve compatibility between OpenVPN on VyOS 1.5 and OpenVPN Connect Client`` -* :vytask:`T5732` ``(bug): generate firewall rule-resequence drops geoip country-code from output`` -* :vytask:`T5661` ``(enhancment): Add show show ssh dynamic-protection attacker and show log ssh dynamic-protection`` -* :vytask:`T1276` ``(bug): dhcp relay + VLAN fails`` - - -2023-11-13 -========== - -* :vytask:`T5698` ``(feature): EVPN ESI Multihoming`` -* :vytask:`T5563` ``(bug): container: Container environment variable cannot be set`` -* :vytask:`T5706` ``(bug): Systemd-udevd high CPU utilization for multiple dynamic ppp/l2tp/ipoe interfaces`` - - -2023-11-10 -========== - -* :vytask:`T5727` ``(bug): validator: Use native URL validator instead of regex-based validator`` - - -2023-11-08 -========== - -* :vytask:`T5720` ``(bug): PPPoE-server adding new interface does not work`` -* :vytask:`T5716` ``(bug): PPPoE-server shaper template bug down-limiter option does not rely on fwmark`` -* :vytask:`T5702` ``(feature): Add ability to set include_ifmib_iface_prefix and ifmib_max_num_ifaces for SNMP`` -* :vytask:`T5648` ``(bug): ldpd neighbour template errors`` -* :vytask:`T5564` ``(bug): Both show firewall group and show firewall summary fails`` -* :vytask:`T5559` ``(feature): Selective proxy-arp/proxy-ndp when doing SNAT/DNAT`` -* :vytask:`T5541` ``(bug): Zone-Based Firewalling in VyOS Sagitta 1.4`` -* :vytask:`T5513` ``(bug): Anomalies in show firewall command after refactoring`` -* :vytask:`T4864` ``(bug): `show firewall` command errors`` - - -2023-11-07 -========== - -* :vytask:`T5586` ``(feature): Disable by default SNMP for Keepalived VRRP`` - - -2023-11-06 -========== - -* :vytask:`T5705` ``(bug): rsyslog - Not working when using facility=all`` -* :vytask:`T5704` ``(feature): PPPoE-server add max-starting option`` -* :vytask:`T5707` ``(bug): Wireguard peer public key update leaves redundant peers and breaks connectivity`` -* :vytask:`T4269` ``(feature): node.def generator should automatically add default values`` - - -2023-11-05 -========== - -* :vytask:`T4020` ``(feature): Add ability to control FRR daemons options`` - - -2023-11-03 -========== - -* :vytask:`T5700` ``(bug): Monitoring telegraf deprecated plugins inputs outputs`` -* :vytask:`T5018` ``(bug): Redirect to IFB removed after change in qos policy`` - - -2023-11-02 -========== - -* :vytask:`T5701` ``(feature): Update telegraf package`` - - -2023-11-01 -========== - -* :vytask:`T5690` ``(bug): Change to definition of environment variable 'vyos_rootfs_dir' is incorrect`` - - -2023-10-31 -========== - -* :vytask:`T5699` ``(feature): vxlan: migrate "external" CLI know to "parameters external"`` -* :vytask:`T5668` ``(feature): Disable VXLAN bridge learning and enable neigh_suppress when using EVPN`` - - -2023-10-27 -========== - -* :vytask:`T5652` ``(bug): Config migrate to image upgrade does not properly generate home directory`` -* :vytask:`T4057` ``(bug): Commit time for deleting sflow configuration ~1.5 min`` - - -2023-10-26 -========== - -* :vytask:`T5683` ``(bug): reverse-proxy pki filenames mismatch`` -* :vytask:`T4903` ``(bug): conntrack ignore does not suppotr IPv6 addresses`` -* :vytask:`T4309` ``(feature): Support network/address-groups and ipv6-network/ipv6-address-groups in conntrack ignore`` -* :vytask:`T5606` ``(feature): IPSec VPN: Allow multiple CAs certificates`` -* :vytask:`T5650` ``(default): Progressbars suffer from staircasing effect`` -* :vytask:`T5568` ``(default): Install image from live ISO always defaults boot to KVM entry`` -* :vytask:`T3509` ``(default): No BCP38 for IPv6 on VyOS`` - - -2023-10-23 -========== - -* :vytask:`T5299` ``(bug): QoS shaper ceiling does not work`` -* :vytask:`T5667` ``(feature): BGP label-unicast - enable ecmp`` -* :vytask:`T5337` ``(bug): MPLS/BGP: Route leak does not happen from the VPNv4 table to specific vrf`` - - -2023-10-22 -========== - -* :vytask:`T5254` ``(bug): Modification of any interface setting sets MTU back to default when MTU has been inherited from a bond`` -* :vytask:`T5671` ``(feature): vxlan: change port to IANA assigned default port`` - - -2023-10-21 -========== - -* :vytask:`T5670` ``(bug): bridge: missing member interface validator`` -* :vytask:`T5617` ``(feature): Add an option to exclude single values to the numeric validator`` -* :vytask:`T5414` ``(bug): dhcp-server does not allow valid bootfile-names`` -* :vytask:`T5261` ``(feature): Add AWS gateway load-balanceing tunnel handler (gwlbtun)`` -* :vytask:`T5260` ``(bug): Python3 module crypt is deprecated`` -* :vytask:`T5191` ``(default): Replace underscores with hyphens in command-line options generated by vyos.opmode`` -* :vytask:`T5172` ``(default): Set Python3 version dependency for vyos-1x to 3.10`` -* :vytask:`T4956` ``(default): 'show hardware cpu' issue on arm64`` -* :vytask:`T4837` ``(default): Expose "show ip route summary" in the op mode API`` -* :vytask:`T4770` ``(feature): Rewrite OpenVPN op-mode to vyos.opmode format`` -* :vytask:`T4657` ``(bug): op-mode scripts with type hints in `return` do not work`` -* :vytask:`T4604` ``(bug): bgpd eats huge amount of memory (about 500Megs a day)`` -* :vytask:`T4432` ``(default): Display load average normalized according to the number of CPU cores`` -* :vytask:`T4416` ``(default): Convert 'traceroute' operation to the new syntax and expand available options using python`` -* :vytask:`T4402` ``(bug): OpenVPN client-ip-pool option is broken`` -* :vytask:`T3433` ``(default): A review of the use of racist language in VyOS`` -* :vytask:`T2719` ``(feature): Standardized op mode script structure`` - - -2023-10-20 -========== - -* :vytask:`T5233` ``(bug): Op-mode flow-accounting netflow with disable-imt errors`` -* :vytask:`T5232` ``(bug): Flow-accounting uacctd.service cannot restart correctly`` - - -2023-10-19 -========== - -* :vytask:`T4913` ``(default): Rewrite the wireless op mode in the new style`` - - -2023-10-18 -========== - -* :vytask:`T5642` ``(bug): op cmd: generate tech-support archive: does not work`` -* :vytask:`T5521` ``(bug): Home owner directory changed to vyos for the user after reboot`` - - -2023-10-17 -========== - -* :vytask:`T5662` ``(bug): Fix indexing error in configdep script organization`` -* :vytask:`T5235` ``(bug): SSH keys with special characters cannot be applied via Cloud-init`` - - -2023-10-16 -========== - -* :vytask:`T5165` ``(feature): Policy local-route ability set protocol and port`` - - -2023-10-14 -========== - -* :vytask:`T5629` ``(bug): Policy local-route bug after migration to destination node address`` - - -2023-10-13 -========== - -* :vytask:`T5227` ``(feature): mDNS reflector should allow additional domains to browse and allow filtering services`` -* :vytask:`T5166` ``(feature): Remove local minisign package from build repo for 1.4`` -* :vytask:`T5118` ``(bug): Cleanup vestigial ntp completion script`` -* :vytask:`T5115` ``(default): Support custom port for name servers for forwarding zones`` -* :vytask:`T5113` ``(default): PDNS: Support custom port for DNS forwarders`` -* :vytask:`T5112` ``(feature): Enable support for Network Time Security (NTS) for chrony`` -* :vytask:`T5143` ``(enhancment): Apply constraint on powerdns forward-zones configuration`` - - -2023-10-12 -========== - -* :vytask:`T5649` ``(bug): vyos-1x should generate XML cache after building command templates for less cryptic error on typo`` - - -2023-10-10 -========== - -* :vytask:`T5489` ``(feature): Change to BBR as TCP congestion control, or at least make it an config option`` -* :vytask:`T5479` ``(bug): Helper leftovers found in nftables (firewall) even with all helpers disabled`` -* :vytask:`T5436` ``(bug): vyos-preconfig-bootup.script is missing`` -* :vytask:`T5014` ``(feature): Destination NAT - Add Load Balancing capabilities`` - - -2023-10-08 -========== - -* :vytask:`T5630` ``(feature): pppoe: allow to specify MRU in addition to already configurable MTU`` - - -2023-10-06 -========== - -* :vytask:`T5096` ``(feature): Change 'accept' firewall rule action from 'return' to 'accept'`` -* :vytask:`T5576` ``(feature): Add bgp remove-private-as all option`` -* :vytask:`T3506` ``(default): Migrate loadkey command to op-mode`` - - -2023-10-05 -========== - -* :vytask:`T4320` ``(default): Remove legacy version files in vyatta-cfg-system/cfg-version`` - - -2023-10-04 -========== - -* :vytask:`T5632` ``(feature): Add jq package to parse JSON files`` -* :vytask:`T3655` ``(bug): NAT Problem with VRF`` -* :vytask:`T5585` ``(bug): Fix file access mode for dynamic dns configuration`` - - -2023-10-03 -========== - -* :vytask:`T5618` ``(bug): Flow-accounting crushes when IMT is enabled`` -* :vytask:`T5561` ``(feature): NAT - Inbound or outbound interface should not be mandatory`` -* :vytask:`T5553` ``(feature): Firewall - Add action continue`` -* :vytask:`T5250` ``(bug): Firewall - show firewall group`` -* :vytask:`T4383` ``(bug): Flow Accounting returns permission error and fails to start`` -* :vytask:`T5626` ``(feature): Only select required Kernel CGROUP controllers`` -* :vytask:`T5628` ``(feature): op-mode: login: DeprecationWarning: 'spwd'`` - - -2023-10-01 -========== - -* :vytask:`T936` ``(feature): Reimplementation of tech-support diagnostic file generation`` - - -2023-09-30 -========== - -* :vytask:`T5048` ``(bug): QoS doesn't work correctly root task`` -* :vytask:`T4989` ``(bug): QoS Policy Limiter - classes for marked traffic do not work`` - - -2023-09-28 -========== - -* :vytask:`T5596` ``(feature): bgp: add new features from FRR 9`` -* :vytask:`T5412` ``(feature): Add support for extending config-mode dependencies in supplemental package`` - - -2023-09-26 -========== - -* :vytask:`T5480` ``(bug): Ability to disable SNMP for VRRP keepalived service`` - - -2023-09-25 -========== - -* :vytask:`T5533` ``(bug): Keepalived VRRP IPv6 group enters in FAULT state`` - - -2023-09-24 -========== - -* :vytask:`T5511` ``(feature): Cleanup of unused directories (and files) in order to shrink image-size`` - - -2023-09-23 -========== - -* :vytask:`T5518` ``(default): Add MLD protocol support`` - - -2023-09-22 -========== - -* :vytask:`T5602` ``(feature): For reverse-proxy type of load-balancing feature, support "backup" option in backends configuration`` -* :vytask:`T5609` ``(enhancment): Add util to get drive device name from id`` -* :vytask:`T5608` ``(enhancment): Rewrite add/delete raid member to Python and remove from vyatta-op`` -* :vytask:`T5607` ``(bug): Adjust RAID smoketest for non-deterministic SCSI device probing`` - - -2023-09-20 -========== - -* :vytask:`T5588` ``(bug): Add kernel conntrack_bridge module`` -* :vytask:`T5271` ``(default): Add support for peer-fingerprint to OpenVPN`` -* :vytask:`T5241` ``(feature): Support veth interfaces to working with netns`` -* :vytask:`T5238` ``(default): interface virtual-etherne - error when it doesn't use a peer`` -* :vytask:`T5592` ``(feature): salt: upgrade minion to 3005.2`` - - -2023-09-19 -========== - -* :vytask:`T5597` ``(feature): isis: add new features from FRR 9.`` -* :vytask:`T4284` ``(feature): QoS: rewrite to XML and Python`` - - -2023-09-18 -========== - -* :vytask:`T5419` ``(feature): Software/Hardware fastpath with nftables flowtable`` - - -2023-09-15 -========== - -* :vytask:`T5581` ``(feature): Add "show ip nht" op-mode command (IPv4 nexthop tracking table)`` - - -2023-09-11 -========== - -* :vytask:`T5567` ``(bug): vyos-1x: webproxy: maximum-object-size allowed ranges not in sync with Equuleus`` -* :vytask:`T5551` ``(bug): Missing check for boot_configuration_complete raises error in vyos-save-config.py`` -* :vytask:`T5353` ``(bug): config-mgmt: normalize archive updates and commit log entries`` -* :vytask:`T3424` ``(default): PPPoE IA-PD doesn't work in VRF`` -* :vytask:`T2773` ``(feature): EIGRP support for VRF`` - - -2023-09-10 -========== - -* :vytask:`T5565` ``(bug): Builds as vyos-999-timestamp instead of vyos-1.4-rolling-timestamp`` -* :vytask:`T5555` ``(bug): Fix timezone migrator (system 13-to-14)`` -* :vytask:`T5529` ``(bug): Missing symbolic link in linux-firmware package.`` - - -2023-09-09 -========== - -* :vytask:`T5540` ``(bug): vyos-1x: Wrong VHT configuration for WiFi 802.11ac`` -* :vytask:`T5423` ``(bug): ipsec: no output for op-cmd "show vpn ike secrets"`` -* :vytask:`T3700` ``(feature): Support VLAN tunnel mapping of VLAN aware bridges`` - - -2023-09-08 -========== - -* :vytask:`T5502` ``(bug): Firewall - wrong parser for inbound and/or outbound interface`` -* :vytask:`T5460` ``(feature): Firewall - remove config-trap`` -* :vytask:`T5450` ``(feature): Firewall interface group - Allow inverted matcher`` -* :vytask:`T4426` ``(default): Add arpwatch to the image`` -* :vytask:`T4356` ``(bug): DHCP v6 client only supports single interface configuration`` - - -2023-09-07 -========== - -* :vytask:`T5510` ``(feature): Shrink imagesize and improve read performance by changing mksquashfs syntax`` - - -2023-09-06 -========== - -* :vytask:`T5542` ``(bug): ipoe-server: external-dhcp(dhcp-relay) not woking / not implemented`` -* :vytask:`T5548` ``(bug): HAProxy renders timeouts incorrectly`` -* :vytask:`T5544` ``(feature): Allow CAP_SYS_MODULE to be set on containers`` - - -2023-09-05 -========== - -* :vytask:`T5524` ``(feature): Add config directory to liveCD`` -* :vytask:`T5519` ``(bug): Function `call` sometimes hangs`` -* :vytask:`T5508` ``(bug): Configuration Migration Fails to New Netfilter Firewall Syntax`` -* :vytask:`T5495` ``(feature): Enable snmp module also for frr/ldpd`` -* :vytask:`T2958` ``(bug): DHCP server doesn't work from a live CD`` -* :vytask:`T5428` ``(bug): dhcp: client renewal fails when running inside VRF`` - - -2023-09-04 -========== - -* :vytask:`T5536` ``(bug): show dhcp client leases caues No module named 'vyos.validate'`` -* :vytask:`T5506` ``(bug): Container bridge interfaces do not have a link-local address`` - - -2023-09-03 -========== - -* :vytask:`T5538` ``(bug): Change order within variable lb_config_tmpl to fit order of manpage and fix some typos`` -* :vytask:`T4612` ``(feature): Support arbitrary netmasks in firewall rules`` - - -2023-08-31 -========== - -* :vytask:`T5190` ``(feature): Cloud-Init cannot fetch Meta-data on machines where the main Ethernet interface is not eth0`` -* :vytask:`T4895` ``(bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data`` -* :vytask:`T4776` ``(bug): NVME storage is not detected properly during installation`` -* :vytask:`T5531` ``(feature): Containers add label option`` -* :vytask:`T5525` ``(default): Change dev.packages.vyos.net repo to rolling-packages.vyos.net vyos-build:current uses`` - - -2023-08-30 -========== - -* :vytask:`T4933` ``(default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a nondescript error`` -* :vytask:`T4790` ``(bug): RADIUS login does not work if sum of timeouts more than 50s`` -* :vytask:`T4113` ``(bug): Incorrect GRUB configuration parsing`` -* :vytask:`T5520` ``(bug): Likely source of corruption on system update exposed by change in coreutils for Bookworm`` -* :vytask:`T4151` ``(feature): IPV6 local PBR Support`` -* :vytask:`T4485` ``(default): OpenVPN: Allow multiple CAs certificates`` - - -2023-08-29 -========== - -* :vytask:`T3940` ``(bug): DHCP client does not remove IP address when stopped by the 02-vyos-stopdhclient hook`` -* :vytask:`T3713` ``(default): Create a meta-package for user utilities`` -* :vytask:`T3339` ``(bug): Cloud-Init domain search setting not applied`` -* :vytask:`T3577` ``(bug): Generating vpn x509 key pair fails with command not found`` - - -2023-08-28 -========== - -* :vytask:`T4745` ``(bug): CLI TAB issue with values with '-' at the beginning in conf mode`` -* :vytask:`T5472` ``(bug): NAT redirect should not require port`` - - -2023-08-27 -========== - -* :vytask:`T4759` ``(bug): domain-group on policy route not working`` -* :vytask:`T1097` ``(feature): Make firewall groups work everywhere that's appropropriate`` - - -2023-08-26 -========== - -* :vytask:`T5039` ``(bug): Can't add new local user`` -* :vytask:`T5023` ``(bug): PKI commit fails to update dependents`` -* :vytask:`T4512` ``(feature): enable-default-log on zone-policy`` -* :vytask:`T5003` ``(default): Upgrade base system to Debian 12 "Bookworm"`` - - -2023-08-25 -========== - -* :vytask:`T5468` ``(feature): Remove unused manpages to free up space`` -* :vytask:`T5463` ``(feature): Containers allow publish IPv6 address port`` -* :vytask:`T4412` ``(bug): commit archive: reboot not working with sftp`` -* :vytask:`T3702` ``(feature): Policy: Allow routing by fwmark`` -* :vytask:`T3536` ``(default): Unable to list all available routes`` - - -2023-08-24 -========== - -* :vytask:`T5448` ``(feature): Add service zabbix-agent`` -* :vytask:`T5006` ``(bug): Http api segfault with concurrent requests`` -* :vytask:`T5505` ``(feature): system: zebra route-map is not removed from FRR`` -* :vytask:`T5305` ``(bug): REST API configure operation should not be defined as async`` -* :vytask:`T4292` ``(feature): Rewrite vyatta-save-config.pl to Python`` - - -2023-08-23 -========== - -* :vytask:`T5478` ``(bug): Cannot configure resolver-cache options for firewall`` -* :vytask:`T5466` ``(feature): L3VPN - label allocation mode`` -* :vytask:`T5453` ``(bug): Fix nat66 - broken after load-balance was introduced in nat`` -* :vytask:`T5446` ``(bug): bgp: validity check for bestpath med option`` -* :vytask:`T5500` ``(feature): Minor fixes to configtree render`` -* :vytask:`T5469` ``(default): Incorrect dependency set in the openvpn-dco package when building VyOS for arm64`` -* :vytask:`T5387` ``(feature): dhcp6c: add a no release option`` -* :vytask:`T5491` ``(feature): Hostapd - AP-Mode - allow white-/blacklisting of Clients`` -* :vytask:`T4889` ``(default): Add nftables NAT REDIRECT [to localhost] to CLI`` - - -2023-08-22 -========== - -* :vytask:`T5407` ``(bug): Static routes pointed to container networks fail to persist after reboot`` - - -2023-08-20 -========== - -* :vytask:`T5470` ``(bug): wlan: can not disable interface if SSID is not configured`` - - -2023-08-18 -========== - -* :vytask:`T5488` ``(bug): System conntrack ignore does not take any effect`` - - -2023-08-17 -========== - -* :vytask:`T4202` ``(bug): NFT: Zone policies fail to apply when "l2tp+" is in the interface list`` -* :vytask:`T5409` ``(feature): Add 'set interfaces wireguard wgX threaded'`` -* :vytask:`T5476` ``(feature): netplug: replace Perl helper scripts with a Python equivalent`` -* :vytask:`T5223` ``(bug): tunnel key doesn't clear`` -* :vytask:`T5490` ``(feature): login: add missing regex for home direcotry and radius server key`` - - -2023-08-16 -========== - -* :vytask:`T5483` ``(bug): Residual dhcp-server test file causing zabbix-agent smoketest to fail`` - - -2023-08-15 -========== - -* :vytask:`T5293` ``(feature): Support for Floating Rules (Global Firewall-Rules that are automatically applied before all other Zone Rules)`` -* :vytask:`T5273` ``(default): Add op mode commands for displaying certificate details and fingerprints`` -* :vytask:`T5270` ``(default): Make OpenVPN `tls dh-params` optional`` - - -2023-08-14 -========== - -* :vytask:`T5477` ``(bug): op-mode pki.py should use Config for defaults`` -* :vytask:`T5461` ``(feature): Improve rootfs directory variable`` -* :vytask:`T5457` ``(feature): Add environmental variable pointing to current rootfs directory`` -* :vytask:`T5440` ``(bug): Restore pre/postconfig scripts if user deleted them`` - - -2023-08-12 -========== - -* :vytask:`T5467` ``(bug): ospf(v3): removing an interface from the OSPF process does not clear FRR configuration`` - - -2023-08-11 -========== - -* :vytask:`T5465` ``(feature): adjust-mss: config migration fails if applied to a VLAN or Q-in-Q interface`` -* :vytask:`T2665` ``(bug): vyos.xml.defaults for tag nodes`` -* :vytask:`T5434` ``(enhancment): Replace remaining calls of vyos.xml library`` -* :vytask:`T5319` ``(enhancment): Remove remaining workarounds for incorrect defaults`` -* :vytask:`T5464` ``(feature): ipv6: add support for per-interface dad (duplicate address detection) setting`` - - -2023-08-10 -========== - -* :vytask:`T5416` ``(bug): Ignoring "ipsec match-none" for firewall`` -* :vytask:`T5329` ``(bug): Wireguard interface as GRE tunnel source causes configuration error on boot`` - - -2023-08-09 -========== - -* :vytask:`T5452` ``(bug): Uncaught error in generate_cache during vyos-1x build`` -* :vytask:`T5443` ``(enhancment): Add merge_defaults as Config method`` -* :vytask:`T5435` ``(enhancment): Expose utility function for default values at path`` - - -2023-08-07 -========== - -* :vytask:`T5406` ``(bug): "update webproxy blacklists" fails when vrf is being configured`` -* :vytask:`T5302` ``(bug): QoS class with multiple matches generates one filter rule but expects several rules`` -* :vytask:`T5266` ``(bug): QoS- HTB error when match with a dscp parameter for queue-type 'priority'`` -* :vytask:`T5071` ``(bug): QOS-Rewrite: DSCP match missing`` - - -2023-08-06 -========== - -* :vytask:`T5420` ``(feature): nftables - upgrade to latest 1.0.8`` -* :vytask:`T5445` ``(feature): dyndns: add possibility to specify update interval (timeout)`` - - -2023-08-05 -========== - -* :vytask:`T5291` ``(bug): vyatta-cfg-cmd-wrapper missing ${vyos_libexec_dir} variable`` -* :vytask:`T5290` ``(bug): Failing commits for SR-IOV interfaces using ixgbevf driver due to change speed/duplex settings`` -* :vytask:`T5439` ``(bug): Upgrade to FRR version 9.0 added new daemons which must be adjusted`` - - -2023-08-04 -========== - -* :vytask:`T5427` ``(bug): Change migration script len arguments checking`` - - -2023-08-03 -========== - -* :vytask:`T5301` ``(bug): NTP: chrony only allows one bind address`` -* :vytask:`T5154` ``(bug): Chrony - multiple listen addresses`` - - -2023-08-02 -========== - -* :vytask:`T5374` ``(feature): Ability to set 24-hour time format`` -* :vytask:`T5350` ``(bug): Confusing warning message when committing VRRP config`` -* :vytask:`T5430` ``(bug): bridge: vxlan interfaces are not listed as bridgable in completion helpers`` -* :vytask:`T5429` ``(bug): vxlan: source-interface is not honored and throws config error`` -* :vytask:`T5415` ``(feature): Upgrade FRR to version 9.0`` -* :vytask:`T5422` ``(feature): Support LXD Agent`` - - -2023-08-01 -========== - -* :vytask:`T5399` ``(bug): "show ntp" fails when vrf is being configured`` -* :vytask:`T5346` ``(bug): MPLS sysctl not persistent for L2TP interfaces`` -* :vytask:`T5343` ``(feature): BGP peer group VPNv4 & VPNv6 Address Family Support`` -* :vytask:`T5339` ``(feature): Geneve interface - option to use IPv4 as inner protocol`` -* :vytask:`T5335` ``(bug): ISIS: error when loading config from file`` - - -2023-07-31 -========== - -* :vytask:`T5421` ``(feature): Add arg to completion helper 'list_interfaces' to filter out vlan subinterfaces`` - - -2023-07-29 -========== - -* :vytask:`T5403` ``(feature): Add support for extending xml cache`` - - -2023-07-28 -========== - -* :vytask:`T4602` ``(bug): DHCP `ping-check` enabled by default`` -* :vytask:`T5411` ``(feature): Remove old background monitoring implementation`` -* :vytask:`T5317` ``(enhancment): configtree: remove mutable references`` -* :vytask:`T5316` ``(enhancment): configtree: use a single pass of the diff algorithm`` - - -2023-07-27 -========== - -* :vytask:`T5368` ``(feature): FastNetmon service ids ddos-protection add support sflow mode`` - - -2023-07-26 -========== - -* :vytask:`T5398` ``(bug): FRR mangles container network interface names`` -* :vytask:`T5365` ``(bug): Container systemd units require authentication`` -* :vytask:`T4974` ``(feature): OpenVPN- Data Channel Offload(DCO)`` - - -2023-07-25 -========== - -* :vytask:`T5377` ``(feature): ospf: add graceful restart FRR feature (RFC 3623)`` - - -2023-07-21 -========== - -* :vytask:`T5373` ``(bug): LLDP seems to be running even if its disabled on all interfaces`` -* :vytask:`T5328` ``(default): bgp: Incorrect warning showed for address-family configured with neighbor as interface`` -* :vytask:`T5363` ``(bug): Bash history file does not exists after reboot and ony other file in home directory`` -* :vytask:`T5385` ``(bug): reference_tree: catch parse error on non-transcluded files`` -* :vytask:`T5361` ``(bug): "monitor log" behaves like "show log"`` - - -2023-07-20 -========== - -* :vytask:`T5362` ``(bug): `set high-availability vrrp global-parameters version 3` seems to have no effect`` -* :vytask:`T5355` ``(bug): IPSec: OP cmd : "show vpn ike sa" does not show output`` -* :vytask:`T5330` ``(enhancment): Keep track of source of config dict value when merging defaults`` -* :vytask:`T4497` ``(feature): ping cannot force ipv4 or ipv6`` -* :vytask:`T4288` ``(bug): IPsec tunnel will break when ESP timeout`` - - -2023-07-19 -========== - -* :vytask:`T5340` ``(bug): SNMP and VRF`` -* :vytask:`T5059` ``(feature): add 'disable' option to DHCP relay config`` - - -2023-07-17 -========== - -* :vytask:`T2051` ``(bug): Throughput anomalies`` - - -2023-07-16 -========== - -* :vytask:`T141` ``(feature): TACACS+ Support`` - - -2023-07-15 -========== - -* :vytask:`T5341` ``(feature): Improve CLI for high-availability virtual-server to work with multiple ports`` - - -2023-07-14 -========== - -* :vytask:`T5358` ``(bug): 99-ipsec-dhclient-hook prevents DHCP stateless routes from being installed in VRF table`` -* :vytask:`T4376` ``(bug): DNAT with multiwan and policy routing, incoming connections only work on primary interface`` -* :vytask:`T305` ``(default): loadbalancing does not work with one pppoe connection and another connection of either dhcp or static`` - - -2023-07-13 -========== - -* :vytask:`T4713` ``(bug): vyos@vyos:~$ show nat destination rules | doesn't work`` -* :vytask:`T2315` ``(feature): Ability to have right address-family for BGP peers.`` - - -2023-07-12 -========== - -* :vytask:`T5347` ``(bug): Compare commit revision bug`` -* :vytask:`T5161` ``(default): BFD Static Route Monitoring`` -* :vytask:`T5105` ``(bug): DHCP Server - Wrong error message`` -* :vytask:`T4927` ``(bug): Need to change restart to reload-or-restart in Webproxy module`` -* :vytask:`T3835` ``(bug): vyos router 1.2.7 snmp Dos bug`` -* :vytask:`T5352` ``(default): Fix missing dependency for netavark`` -* :vytask:`T4959` ``(feature): Add container registry authentication config for containers`` - - -2023-07-11 -========== - -* :vytask:`T5314` ``(bug): QOS Default classes are not configured with correct qdisc`` -* :vytask:`T4862` ``(bug): webproxy domain-block does not work`` -* :vytask:`T4844` ``(bug): Incorrect permissions of the safeguard DB directory`` -* :vytask:`T4815` ``(bug): Fix various name server config issues`` -* :vytask:`T4810` ``(bug): Op-mode show/monitor log pppoe interface does not show any logs`` -* :vytask:`T4758` ``(feature): Rewrite show dhcp server to vyos.opmode format`` -* :vytask:`T4262` ``(bug): install image doesn't respect chosen root partition size`` -* :vytask:`T3810` ``(bug): webproxy squidguard rules don't work properly after rewriting to python.`` -* :vytask:`T1928` ``(bug): Is the 'Welcome to VyOS' message when using SSH an information leak?`` -* :vytask:`T1877` ``(default): Feature Request: Allow NAT to use network and address groups`` -* :vytask:`T4813` ``(feature): L3VPN over GRE Tunnels`` -* :vytask:`T4943` ``(bug): Radius SSH login displays "permission denied" on 1.4 rolling release`` -* :vytask:`T4542` ``(default): route-map: "match prefix-len" incorrect behavior`` -* :vytask:`T4392` ``(default): Multiline login banner text reports error on commit`` - - -2023-07-10 -========== - -* :vytask:`T5345` ``(bug): Error incorrectly raised in revised multi_to_list when tag node value name == tag node name`` -* :vytask:`T3578` ``(bug): Prefix-List(6) update cause empty prefix-list(6)`` -* :vytask:`T762` ``(feature): Include rulseset in firewall`` - - -2023-07-06 -========== - -* :vytask:`T5336` ``(feature): Add Swedish keyboard-layout`` - - -2023-07-04 -========== - -* :vytask:`T5333` ``(bug): Policy base routing PBR generetes incorrect rules with name POSTROUTING`` -* :vytask:`T5081` ``(feature): ISIS and OSPF syncronization with IGP-LDP sync`` - - -2023-07-03 -========== - -* :vytask:`T5295` ``(bug): QoS shaper incorrect rate limit the traffic`` -* :vytask:`T5334` ``(feature): ospf: add support for External Route Summarisation Type-5 and Type-7`` - - -2023-07-02 -========== - -* :vytask:`T5332` ``(bug): Show policy route not working when no interface is configured`` - - -2023-07-01 -========== - -* :vytask:`T5304` ``(feature): Containers add bind-propagation option rshared`` -* :vytask:`T5296` ``(bug): QoS class cannot calculate correctly the default bandwidth auto`` -* :vytask:`T5210` ``(bug): IPSec cosmetic bug for Warning vti inrerface`` -* :vytask:`T5277` ``(bug): Dhcpv6-relay does not start on boot`` - - -2023-06-30 -========== - -* :vytask:`T5315` ``(feature): vrrp: add support for version 3`` -* :vytask:`T5283` ``(bug): IPoE server assigns network address`` -* :vytask:`T5313` ``(bug): UDP broadcast relay - missing verify() that relay interfaces have an IP address assigned`` - - -2023-06-29 -========== - -* :vytask:`T5320` ``(enhancment): Add warning when entering config mode after a boot configuration error`` - - -2023-06-28 -========== - -* :vytask:`T1237` ``(feature): Static Route Path Monitoring, failover`` - - -2023-06-26 -========== - -* :vytask:`T5159` ``(bug): DHCPv6-server leases op-command shows warning message even if configured`` - - -2023-06-25 -========== - -* :vytask:`T5240` ``(bug): Service router-advert failed to start radvd with more then 3 name-servers`` -* :vytask:`T5312` ``(bug): Nonescaped special character in help text`` - - -2023-06-24 -========== - -* :vytask:`T5303` ``(bug): Rsyslog.service is not working`` -* :vytask:`T5298` ``(bug): Add RFKILL support into kernel.`` -* :vytask:`T5308` ``(enhancment): Remove workarounds for incorrect defaults in get_interface_dict`` -* :vytask:`T5228` ``(enhancment): Simplify get_config_dict and add argument with_defaults`` -* :vytask:`T5310` ``(bug): Need some help troubleshooting NIC detection.`` - - -2023-06-22 -========== - -* :vytask:`T5297` ``(default): Utility function to check if config under node has been changed between revisions`` - - -2023-06-20 -========== - -* :vytask:`T5300` ``(bug): verification of port availability can return false negative on boot`` -* :vytask:`T5248` ``(feature): Ability to load config via API in JSON format`` - - -2023-06-19 -========== - -* :vytask:`T5281` ``(feature): Add kernel options for vhost-net`` -* :vytask:`T5072` ``(default): QOS-Rewrite: protocol name used literally`` -* :vytask:`T4969` ``(bug): QoS Policy - Unable to set class match mark number`` - - -2023-06-18 -========== - -* :vytask:`T5256` ``(bug): QoS expects protocol number but not protocol name`` - - -2023-06-13 -========== - -* :vytask:`T5258` ``(bug): git Actions use ubuntu-22.04 instead of deprecated ubuntu-18.04 for PR conflicts checker`` -* :vytask:`T5222` ``(feature): Add load-balancing reverse-proxy based on haproxy`` -* :vytask:`T5213` ``(feature): Accel-ppp sending accounting interim updates acct-interim-interval option`` -* :vytask:`T5171` ``(feature): Use XML for conf-mode "load-balancing wan" instead of legacy templates`` - - -2023-06-12 -========== - -* :vytask:`T5282` ``(bug): Poweroff now does not work`` -* :vytask:`T5264` ``(feature): Add Mellanox Technologies firmware flash module mlxfw to kernel`` -* :vytask:`T5286` ``(feature): Remove XDP support`` - - -2023-06-10 -========== - -* :vytask:`T5231` ``(feature): Add op-mode for load-balancing reverse-proxy`` - - -2023-06-09 -========== - -* :vytask:`T5253` ``(bug): MPLS config removed at boot when wireguard interfaces present`` - - -2023-06-05 -========== - -* :vytask:`T5259` ``(bug): Openconnect cannot pass migration 1-to-2`` - - -2023-06-02 -========== - -* :vytask:`T5252` ``(bug): Route distinguisher and route targets changing upon adding interface to new VRF`` -* :vytask:`T5251` ``(bug): Uncaught errors for functions delete/delete_value in Python module configtree.py`` - - -2023-06-01 -========== - -* :vytask:`T5127` ``(bug): VPNv4/VPNv6 routes are not reinstalled following link flap`` - - -2023-05-28 -========== - -* :vytask:`T5244` ``(feature): dropbear: update to 2022.83`` -* :vytask:`T5242` ``(feature): interfaces: smoketest: automatically detect "capabilities"`` -* :vytask:`T5234` ``(feature): Add bash identifier for given VRF instance`` - - -2023-05-25 -========== - -* :vytask:`T5237` ``(feature): interfaces virtual-ethernet - Extend capabilitys of Vlans/QinQ`` -* :vytask:`T4686` ``(feature): Provides support for veth`` - - -2023-05-24 -========== - -* :vytask:`T4605` ``(feature): Firewall change default table names`` -* :vytask:`T4550` ``(feature): router-advert: Add deprecate-prefix & decrement-lifetimes options`` - - -2023-05-23 -========== - -* :vytask:`T4916` ``(feature): Rewrite IPsec authentication`` - - -2023-05-22 -========== - -* :vytask:`T5214` ``(bug): PPPoE-server incorrect warning if a named pool is defined`` -* :vytask:`T4977` ``(feature): Babel routing protocol support`` - - -2023-05-21 -========== - -* :vytask:`T4733` ``(default): Feature Request: dhcp server: add VRF support`` -* :vytask:`T5218` ``(enhancment): Revise vyos xml lib for bug fixes and extensions`` - - -2023-05-17 -========== - -* :vytask:`T5226` ``(default): Deduplicate and standardize validators and constraints for hostname and IP address`` -* :vytask:`T5225` ``(bug): BGP allowas-in unusable`` -* :vytask:`T5208` ``(bug): Failed to start nvmf-autoconnect.service during the boot`` - - -2023-05-16 -========== - -* :vytask:`T5194` ``(default): Add reference tree to vyos1x-config`` - - -2023-05-15 -========== - -* :vytask:`T3896` ``(feature): Extend ocserv support to allow for per-group configs`` - - -2023-05-12 -========== - -* :vytask:`T2778` ``(feature): Migrate "system syslog" to get_config_dict() to support new features`` -* :vytask:`T2769` ``(feature): Add VRF support for syslog`` - - -2023-05-10 -========== - -* :vytask:`T5209` ``(bug): dhclient load-balancing exit hook 04-dhcp-wanlb returned non-zero exit status`` -* :vytask:`T5065` ``(bug): Mixing `destination port xxx` and `destination group port-group yyy` in firewall rules doesn't work, but can be commited`` -* :vytask:`T5060` ``(feature): add a VRRP 'maintenance mode'`` - - -2023-05-09 -========== - -* :vytask:`T5202` ``(bug): After removal load-balancing a pid remained which used in dhclient-exit-hooks`` - - -2023-05-06 -========== - -* :vytask:`T5206` ``(bug): ethtool.py:Ethtool.__init__ has always true conditional due to typo`` - - -2023-05-05 -========== - -* :vytask:`T5082` ``(feature): container: switch to netavark network stack`` - - -2023-05-04 -========== - -* :vytask:`T5193` ``(feature): Ability to specify NS records to specify NS servers for subdomains`` -* :vytask:`T3891` ``(bug): X550-T2/Possibly other X550/X540 cards no link on VyOS`` -* :vytask:`T5010` ``(bug): bgp: EVPN route-target not honored`` -* :vytask:`T5196` ``(feature): wwan: op-mode should inform user if there is no WWAN interface`` - - -2023-05-03 -========== - -* :vytask:`T5163` ``(feature): Policy route-map add match source-protocol`` - - -2023-05-02 -========== - -* :vytask:`T5042` ``(bug): Command 'show vpn ipsec remote-access' does not work`` - - -2023-04-27 -========== - -* :vytask:`T5185` ``(bug): Static IPv6 route with blackhole fails`` -* :vytask:`T5175` ``(bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0`` -* :vytask:`T5183` ``(bug): IPv6 route6 problem`` -* :vytask:`T5181` ``(bug): Wrong dependencies or priorities for zebra vni vrf interfaces and bgpd`` -* :vytask:`T5128` ``(feature): Policy route - Allow wildcard interfaces`` -* :vytask:`T5055` ``(feature): Firewall - Add packet type matcher (pkttype)`` -* :vytask:`T5050` ``(feature): Firewall - Add options for logging packets`` -* :vytask:`T5037` ``(feature): Firewall - Add queue action`` -* :vytask:`T5176` ``(bug): http-api: update vyos-http-api-tools for FastAPI security vulnerability`` -* :vytask:`T5174` ``(bug): vrf: ensure no duplicate VNIs can be created`` -* :vytask:`T5123` ``(default): Display route originator in show ospf table command`` - - -2023-04-25 -========== - -* :vytask:`T5179` ``(bug): multi nodes defined in XML are not properly represented as list in get_config_dict()`` - - -2023-04-17 -========== - -* :vytask:`T5052` ``(bug): Error displaying dhcpv6 prefix delegation leases`` -* :vytask:`T5150` ``(feature): Rework CLI definitions to apply route-maps between routing daemons and zebra/kernel`` -* :vytask:`T3734` ``(bug): Move EVPN VRF up in FRR config`` - - -2023-04-13 -========== - -* :vytask:`T5152` ``(bug): Telegraf agent hostname isn't qualified`` -* :vytask:`T4727` ``(feature): Add RADIUS rate limit support to PPTP server`` -* :vytask:`T4939` ``(bug): VRRP command no-preempt not work as expected`` -* :vytask:`T4791` ``(default): Consistent normalization of 'raw' output of op-mode scripts for CLI and API`` -* :vytask:`T3608` ``(default): Standardize warnings from configure scripts`` - - -2023-04-11 -========== - -* :vytask:`T4924` ``(bug): Systemctl strongswan.service for some reason is not disabled`` -* :vytask:`T4197` ``(bug): Vyos arm64-latest build issue with telegraf pkg`` -* :vytask:`T4051` ``(bug): Connected routes strange / not working`` - - -2023-04-10 -========== - -* :vytask:`T5151` ``(bug): EAP-TLS TLSv1.0/1.1 regression after T5003`` -* :vytask:`T5148` ``(bug): OpenVPN cannot start due to could not load plugin shared object /openvpn-otp.so`` -* :vytask:`T5110` ``(bug): Show frr op-mode vtysh_pam: Failed in account validation`` -* :vytask:`T5078` ``(feature): VyOS BGP does not support 'show bgp neighbors $NB filtered-routes'`` -* :vytask:`T5070` ``(feature): show bgp nexthop unavailable in VRF`` -* :vytask:`T5061` ``(bug): All containers restart on config change`` - - -2023-04-07 -========== - -* :vytask:`T5149` ``(bug): op-mode openvpn should not raise error in case interface is disabled`` - - -2023-04-06 -========== - -* :vytask:`T5147` ``(bug): Can't Commit with Container Network`` -* :vytask:`T5142` ``(feature): One of the requirements is to use a system auditing tool to monitor and log all security-relevant events.`` -* :vytask:`T5125` ``(feature): Add op-mode commands for hsflowd based sflow`` - - -2023-04-05 -========== - -* :vytask:`T5145` ``(feature): Add maxsyslogins maximum number of all logins on system`` -* :vytask:`T5135` ``(default): Rewrite opennhrp script using vyos.ipsec library`` -* :vytask:`T4975` ``(bug): CLI does not work after cutting off the power or reset`` -* :vytask:`T5136` ``(bug): Possible config corruption on upgrade`` - - -2023-04-04 -========== - -* :vytask:`T5141` ``(feature): Add numbers for dhclient-exit-hooks.d to enforce script order execution`` -* :vytask:`T5093` ``(bug): Command 'reset vpn ipsec-profile' doesn't work`` -* :vytask:`T4362` ``(bug): Wan Load Balancing - Can't create routing tables`` - - -2023-04-03 -========== - -* :vytask:`T5139` ``(feature): IKE life-time should start from 0 for disable rekey`` -* :vytask:`T4173` ``(bug): Wan Load Balancing - Error on firewall NAT rules`` - - -2023-04-02 -========== - -* :vytask:`T5134` ``(feature): Try if netavark networks can be moved to a VRF instance`` - - -2023-04-01 -========== - -* :vytask:`T5047` ``(bug): Recreate only a specific container`` -* :vytask:`T5132` ``(default): Operational command "show isis vrf XXX route | neighbord" aren't working`` - - -2023-03-31 -========== - -* :vytask:`T5129` ``(feature): Add AWS build flavour`` -* :vytask:`T5126` ``(feature): http-api: add 'allow-client' to restrict IP address of client connections`` - - -2023-03-30 -========== - -* :vytask:`T5130` ``(bug): op-mode: drop remaining reference to obsoleted 'show_interfaces.py'`` -* :vytask:`T4866` ``(feature): Rewrite show_interfaces to standardized form`` -* :vytask:`T366` ``(bug): SNMP Query for BGP Tunnels Returns IPv4 Tunnels Only`` - - -2023-03-29 -========== - -* :vytask:`T5100` ``(feature): Update FRR to 8.5`` -* :vytask:`T5094` ``(bug): FRR systemd logs unknow key LimitNOFILESoft`` -* :vytask:`T5085` ``(bug): ospfv3 route-map not applied in FRR configuration`` -* :vytask:`T5056` ``(bug): IPoE server vlan-mon is not working`` -* :vytask:`T5033` ``(bug): generate-public-key command fails for address with multiple public keys like GitHub`` -* :vytask:`T4876` ``(bug): mpls - LSP broken on FRR 8.4.1`` -* :vytask:`T5097` ``(bug): the operational command "show interfaces ethernet ethx" doesn't reflect a call to 'clear counters'`` -* :vytask:`T5089` ``(enhancment): Add unit test of config_diff`` -* :vytask:`T5088` ``(enhancment): Add lexicographical-numeric compare function for vytree/configtree`` -* :vytask:`T5087` ``(enhancment): Add support for lexical ordering of nodes in config_tree`` -* :vytask:`T4885` ``(feature): Rewrite 'clear interfaces counters' from Perl to Python`` -* :vytask:`T4846` ``(bug): L3VPN- network command doesn't install direct connected prefix`` - - -2023-03-28 -========== - -* :vytask:`T5043` ``(feature): Need to create reset command for IKEv2 remote-access vpn connections`` - - -2023-03-27 -========== - -* :vytask:`T5099` ``(feature): IPoE server add option 'next-pool' for named ip pools`` -* :vytask:`T5106` ``(feature): Extend generation of API client requests to configsession native functions and composite requests`` -* :vytask:`T5104` ``(bug): DHCP default route issues with static routes in VRFs`` -* :vytask:`T5079` ``(feature): xml: schema extension to support defaultValues on tagNodes`` -* :vytask:`T5114` ``(feature): bgp: implement new CLI commands introduced in FRR 8.5`` - - -2023-03-23 -========== - -* :vytask:`T5108` ``(feature): Get rate limit for L2TP/PPTP/SSTP/IPoE in raw format`` -* :vytask:`T5086` ``(feature): Integrate hsflowd for sflow accounting`` -* :vytask:`T5107` ``(bug): Raise error in op-mode dns.py instead of calling exit`` - - -2023-03-22 -========== - -* :vytask:`T5068` ``(feature): Generate op-mode API client requests along with schema generation`` - - -2023-03-21 -========== - -* :vytask:`T5098` ``(feature): PPPoE client holdoff configuration`` -* :vytask:`T3694` ``(bug): Static routes not installed into kernel nor frr`` -* :vytask:`T5102` ``(feature): ospf: "redistribute babel" is always set`` - - -2023-03-20 -========== - -* :vytask:`T5057` ``(bug): IPoE server incorrect interface regex`` -* :vytask:`T5095` ``(feature): Return list instead of dict for 'raw' output of op-mode openvpn`` - - -2023-03-19 -========== - -* :vytask:`T4925` ``(feature): Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2`` - - -2023-03-17 -========== - -* :vytask:`T5092` ``(bug): IPoE-server named pool must not rely on the authentication type`` -* :vytask:`T5091` ``(bug): IPoE server with RADIUS authentication does not verify radius configuration`` - - -2023-03-16 -========== - -* :vytask:`T5073` ``(bug): IPoE-server interface option failed to parse`` -* :vytask:`T5063` ``(bug): IPoE-server ethX vlan must not be used with client-subnet`` -* :vytask:`T5058` ``(feature): Extend template filter range_to_regex`` -* :vytask:`T3083` ``(feature): Add feature event-handler`` -* :vytask:`T2516` ``(bug): vyos-container: cannot configure ethernet interface`` - - -2023-03-13 -========== - -* :vytask:`T5074` ``(bug): Show IPSEC SA failed if remote access IKEv2 vpn is used.`` -* :vytask:`T4973` ``(bug): show dhcp server leases error for lease time 4294967295`` - - -2023-03-11 -========== - -* :vytask:`T5076` ``(feature): CI/CD: Docker container is bloated by legacy and conflicting dependencies`` - - -2023-03-09 -========== - -* :vytask:`T5066` ``(bug): Different GRE tunnel but same tunnel keys error`` -* :vytask:`T4952` ``(feature): Improve interface completion helper CLI experience`` - - -2023-03-08 -========== - -* :vytask:`T4381` ``(default): OpenVPN: Add "Tunnel IP" column in "show openvpn server" operational command`` -* :vytask:`T4872` ``(bug): Op-mode show openvpn misses a case when parsing for tunnel IP`` - - -2023-03-07 -========== - -* :vytask:`T2838` ``(bug): Ethernet device names changing, multiple hw-id being added`` -* :vytask:`T5051` ``(feature): Use Literal types to provide op-mode CLI choices and API enums`` -* :vytask:`T4900` ``(default): Cache intermediary results of get_config_diff in Config instance`` - - -2023-03-05 -========== - -* :vytask:`T5040` ``(default): Generate API GraphQL schema on installation, rather than dynamically`` - - -2023-03-03 -========== - -* :vytask:`T4625` ``(enhancment): Update ocserv to current revision (1.1.6)`` - - -2023-03-02 -========== - -* :vytask:`T4967` ``(feature): Ability to set hostname for the container`` - - -2023-03-01 -========== - -* :vytask:`T5015` ``(bug): Invalid format character error at hfsc class settings help text`` - - -2023-02-28 -========== - -* :vytask:`T5029` ``(feature): Nginx change default root directory and fix regex`` -* :vytask:`T5025` ``(bug): Time-zone validation failed`` -* :vytask:`T4955` ``(bug): Openconnect radiusclient.conf generating with extra authserver`` -* :vytask:`T4843` ``(feature): Command-line arguments in container config`` -* :vytask:`T4219` ``(feature): support incoming-interface (iif) in local PBR`` -* :vytask:`T3903` ``(bug): Containers: after command "reboot" the host system will reboot after 1.5 minutes`` - - -2023-02-27 -========== - -* :vytask:`T5028` ``(feature): Add package exfatprogs to VyOS`` -* :vytask:`T4985` ``(bug): reset vpn ipsec-peer command with peer name does not work`` - - -2023-02-26 -========== - -* :vytask:`T4979` ``(feature): Add API request 'show_user_info' for UI`` - - -2023-02-25 -========== - -* :vytask:`T5008` ``(bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine`` -* :vytask:`T5007` ``(bug): Interface multicast setting is invalid`` -* :vytask:`T5027` ``(bug): OpenVPN options and site-to-site cannot pass smoketest`` -* :vytask:`T4978` ``(bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.4-rolling-202302041536`` -* :vytask:`T5034` ``(bug): Migrate multicast CLI node to valueLess`` -* :vytask:`T4948` ``(feature): pppoe: add CLI option to allow definition of host-uniq flag`` - - -2023-02-24 -========== - -* :vytask:`T5030` ``(bug): HTTPS-API delete key without id error`` - - -2023-02-23 -========== - -* :vytask:`T5013` ``(feature): Extend accelppp.py op-mode to get subnet start stop info from config`` -* :vytask:`T5002` ``(feature): Add uk (United Kingdom) keymap`` - - -2023-02-22 -========== - -* :vytask:`T5024` ``(bug): check-qemu-install VM is not shutdown the first time`` -* :vytask:`T5011` ``(bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu check should be skipped`` - - -2023-02-21 -========== - -* :vytask:`T5021` ``(bug): IPsec SA is closed before negotiating a new one or it is negotiated on every second if big life-time is set in swanctl.conf`` -* :vytask:`T5020` ``(feature): Extend openvpn.py op-mode to get a list of configured clients`` - - -2023-02-20 -========== - -* :vytask:`T5005` ``(feature): Skip user authentication for PPPoE Server with noauth option`` - - -2023-02-16 -========== - -* :vytask:`T4971` ``(feature): Radius attribute "Framed-Pool" for PPPoE`` - - -2023-02-15 -========== - -* :vytask:`T4991` ``(bug): Restore path level information to compare output`` - - -2023-02-14 -========== - -* :vytask:`T4968` ``(bug): VPN IPsec check dpd and close action for empty values`` -* :vytask:`T1993` ``(feature): Extended pppoe rate-limiter`` - - -2023-02-13 -========== - -* :vytask:`T4905` ``(feature): Convert show nhrp tunnel to tabulate format`` -* :vytask:`T4153` ``(bug): Monitor bandwidth-test initiate not working`` - - -2023-02-12 -========== - -* :vytask:`T4998` ``(bug): pppoe username validation too restrictive (regression)`` - - -2023-02-11 -========== - -* :vytask:`T2603` ``(feature): pppoe-server: reduce min MTU`` - - -2023-02-10 -========== - -* :vytask:`T4857` ``(feature): SNMP - Implement FRR SNMP recommendations`` -* :vytask:`T4995` ``(feature): pppoe, wwan and sstp-client - rename user -> username on authentication`` - - -2023-02-07 -========== - -* :vytask:`T4980` ``(bug): chrony not listening as a server`` -* :vytask:`T4868` ``(bug): L2TP ppp-options ipv6 does not work without ipv6 pool but should`` -* :vytask:`T4117` ``(bug): Does not possible to configure PoD/CoA for L2TP vpn`` - - -2023-02-01 -========== - -* :vytask:`T4970` ``(default): pin OCaml pcre package to avoid JIT support`` - - -2023-01-31 -========== - -* :vytask:`T4964` ``(bug): FRR bgp address-family l2vpn-evpn route-target export/import not working`` -* :vytask:`T4780` ``(feature): Firewall - Add interface group`` -* :vytask:`T4157` ``(default): Add jinja2 to pip test requirements`` - - -2023-01-30 -========== - -* :vytask:`T4958` ``(feature): Add OpenConnect RADIUS Accounting support`` -* :vytask:`T4954` ``(bug): DNS cannot be configured via Network-Config v1 received from ConfigDrive / Cloud-Init`` -* :vytask:`T4118` ``(default): IPsec syntax overhaul`` - - -2023-01-29 -========== - -* :vytask:`T4965` ``(default): empty description in firewall group causes configuration error on migration`` - - -2023-01-28 -========== - -* :vytask:`T4961` ``(bug): Uncaught configtree error allows ntp migration 1-to-2 to fail silentlly on config.boot.default`` - - -2023-01-27 -========== - -* :vytask:`T4960` ``(bug): Bugs in `cc_vyos.py` code (Cloud-Init)`` - - -2023-01-26 -========== - -* :vytask:`T4886` ``(feature): Firewall and Policy - Add connection mark`` -* :vytask:`T4957` ``(bug): config-mgmt should not attempt to archive config at boot`` -* :vytask:`T4962` ``(bug): Fix typo in regex in vyos.config_mgmt compare function`` -* :vytask:`T4912` ``(default): Rewrite the IGMP op mode in the new style`` - - -2023-01-25 -========== - -* :vytask:`T4941` ``(bug): Accel-ppp IPoE incompatibility with kernel 6.1`` - - -2023-01-24 -========== - -* :vytask:`T4947` ``(feature): Support mounting container volumes as ro or rw`` - - -2023-01-23 -========== - -* :vytask:`T4798` ``(default): Migrate the file-exists validator away from Python`` -* :vytask:`T4683` ``(enhancment): Add kitty-terminfo package to build`` -* :vytask:`T4953` ``(bug): Remove convert_kwargs_to_snake_case decorator in dynamic generation of GraphQL resolvers`` -* :vytask:`T4875` ``(default): Replace Python validator 'interface-name' to avoid Python startup cost`` -* :vytask:`T4664` ``(bug): Add validation to reject whitespace in tag node value names`` - - -2023-01-22 -========== - -* :vytask:`T4906` ``(bug): ipsec connections shows only one connection as up`` - - -2023-01-21 -========== - -* :vytask:`T4799` ``(bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd`` -* :vytask:`T4878` ``(bug): Any interface bonding changes cause interface flapping`` -* :vytask:`T4387` ``(default): Create additional smoketests for multiwan PBR & load-balanced configurations`` - - -2023-01-20 -========== - -* :vytask:`T4551` ``(bug): IPsec rekeying collisions bug`` -* :vytask:`T4942` ``(feature): Rewrite vyatta-config-mgmt to Python/XML`` - - -2023-01-17 -========== - -* :vytask:`T4938` ``(bug): Interface input ifb does not work`` -* :vytask:`T4902` ``(bug): snmpd: exclude container storage from monitoring`` -* :vytask:`T4140` ``(bug): Lack of SNMP IANA mibs`` - - -2023-01-15 -========== - -* :vytask:`T4832` ``(feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)`` -* :vytask:`T4937` ``(feature): ocserv: upgrade package to version 1.1.6`` -* :vytask:`T4918` ``(bug): Odd show interface behavior`` -* :vytask:`T3008` ``(feature): Migrate from ntpd to chronyd`` - - -2023-01-13 -========== - -* :vytask:`T4911` ``(default): Rewrite the LLDP op mode in the new format`` -* :vytask:`T4928` ``(feature): Upgrade Linux Kernel to 6.1.y (2022 LTS edition)`` - - -2023-01-12 -========== - -* :vytask:`T4934` ``(bug): ospf: Fix inter-area route summarization`` -* :vytask:`T4929` ``(feature): Update Intel QAT drivers to 4.20.0-00001`` - - -2023-01-10 -========== - -* :vytask:`T4880` ``(feature): Expose 'add/delete container image' in HTTP-API`` - - -2023-01-09 -========== - -* :vytask:`T4922` ``(feature): Add ssh-client source-interface CLI option`` -* :vytask:`T4524` ``(bug): Squid webproxy not working properly`` - - -2023-01-08 -========== - -* :vytask:`T4920` ``(bug): ospf: Fix `passive-interface default` option`` - - -2023-01-07 -========== - -* :vytask:`T4884` ``(bug): Missing a community6 in snmpd config`` - - -2023-01-05 -========== - -* :vytask:`T4904` ``(feature): Allow multiple ports for high-availability virtual-server`` -* :vytask:`T4789` ``(feature): Ability to get L2TP/PPTP/SSTP sessions info in a machine readable format`` -* :vytask:`T3937` ``(default): Rewrite "show system memory" in Python to make it usable as a library function`` - - -2023-01-04 -========== - -* :vytask:`T4848` ``(bug): Minor bug in OpenConnect server with default route`` -* :vytask:`T4656` ``(feature): Support the listen-host config field of openconnect server`` - - -2023-01-03 -========== - -* :vytask:`T4907` ``(bug): nat source translations couldn't show metrics`` - - -2023-01-02 -========== - -* :vytask:`T4893` ``(feature): l2tp add ppp-options IPv6 interface identifier`` -* :vytask:`T4717` ``(feature): Connect to console server by name`` -* :vytask:`T725` ``(feature): Cake and FQ-PIE`` - - -2022-12-31 -========== - -* :vytask:`T4898` ``(feature): Add mtu config option for dummy interfaces`` - - -2022-12-30 -========== - -* :vytask:`T4834` ``(bug): Limit container network name to 15 characters`` -* :vytask:`T4901` ``(bug): Update Podman to v4.3.1`` -* :vytask:`T4899` ``(bug): Podman systemd services not being installed correctly`` - - -2022-12-28 -========== - -* :vytask:`T4593` ``(feature): Upgrade strongswan to 5.9.8`` - - -2022-12-26 -========== - -* :vytask:`T4511` ``(bug): IPv6 DNS lookup`` -* :vytask:`T4809` ``(feature): radvd: Allow use of AdvRASrcAddress`` - - -2022-12-25 -========== - -* :vytask:`T3579` ``(feature): Rewrite vyatta-conntrack in new XML and Python flavour`` - - -2022-12-24 -========== - -* :vytask:`T4890` ``(bug): show conntrack table ipv4 fail`` -* :vytask:`T4879` ``(bug): IPSec migration failed with missing remote-id`` -* :vytask:`T4870` ``(feature): Containers switch to using overlay driver for podman storage`` - - -2022-12-23 -========== - -* :vytask:`T4792` ``(feature): Add SSTP VPN client`` - - -2022-12-21 -========== - -* :vytask:`T4887` ``(bug): Schema generation from op-mode functions should set default 'false' on boolean arguments`` - - -2022-12-18 -========== - -* :vytask:`T4882` ``(bug): Missing ICMPv6 type names in firewall configuration`` - - -2022-12-15 -========== - -* :vytask:`T4671` ``(bug): linux-firmware package is missing symlinks defined in WHENCE file`` - - -2022-12-14 -========== - -* :vytask:`T4881` ``(bug): Return opmode.Error on openconnect.py show_sessions`` - - -2022-12-12 -========== - -* :vytask:`T4861` ``(feature): Openconnect restart on adding users - Aborts all active connections`` - - -2022-12-09 -========== - -* :vytask:`T4865` ``(bug): container impossible to generate local image from a file if it requires install some pkgs`` - - -2022-12-05 -========== - -* :vytask:`T4860` ``(bug): Openconnect server incorrect unconfigured check`` -* :vytask:`T4804` ``(bug): PPPoE server incorrect unconfigured check`` -* :vytask:`T4854` ``(feature): BGP-route reflector allows to apply route-maps`` - - -2022-12-04 -========== - -* :vytask:`T4825` ``(feature): interfaces veth/veth-pairs -standalone used`` -* :vytask:`T4805` ``(bug): PPPoE server does not restart service if pool was changed`` - - -2022-12-02 -========== - -* :vytask:`T4830` ``(bug): nat66 - Error in port translation rules`` -* :vytask:`T4859` ``(bug): Correct calling of config mode script dependencies from http-api.py`` -* :vytask:`T4820` ``(enhancment): Support for inter-config-mode script dependencies`` -* :vytask:`T4858` ``(bug): L3VPN- Route Distinguisher notations`` -* :vytask:`T1024` ``(feature): Policy Based Routing by DSCP`` - - -2022-12-01 -========== - -* :vytask:`T4841` ``(feature): add fan control`` -* :vytask:`T4847` ``(bug): Correct calling of config mode script dependencies from pki.py`` - - -2022-11-29 -========== - -* :vytask:`T4842` ``(bug): Routing config broken if mpls config exists`` -* :vytask:`T4845` ``(default): Add smoketest to detect cycles in config-mode script dependency calls`` - - -2022-11-27 -========== - -* :vytask:`T4739` ``(feature): ISIS and OSPF segment routing being refactored`` - - -2022-11-24 -========== - -* :vytask:`T4794` ``(bug): show firewall name - Can't use .items() on a list`` -* :vytask:`T4714` ``(feature): Delete unused ipset from the filecaps`` -* :vytask:`T3541` ``(bug): Route Map large community set additive is missing`` - - -2022-11-23 -========== - -* :vytask:`T4836` ``(feature): Kernel: enable new features like switchdev, ESP in TCP and HSR`` -* :vytask:`T4835` ``(bug): SNMPD configuration incorrect for IPv6`` -* :vytask:`T4819` ``(feature): Allow printing Warning messages in multiple lines with \n`` -* :vytask:`T4807` ``(feature): Need to fix traceroute help completion`` -* :vytask:`T4660` ``(feature): Reorganize route map set community CLI`` -* :vytask:`T4526` ``(bug): keepalived-fifo.py unable to load config`` -* :vytask:`T4793` ``(feature): Create warning message about disable-route-autoinstall when ipsec vti is used`` -* :vytask:`T4492` ``(bug): Incorrect list of neighbors in help for "show bgp vrf VRF neighbors"`` -* :vytask:`T4496` ``(feature): ping vrf help does not list VRFs`` - - -2022-11-22 -========== - -* :vytask:`T4823` ``(bug): swanctl.conf is broken when ipsec site-to-site peer set.`` -* :vytask:`T4706` ``(bug): NAT and NAT66 issues`` -* :vytask:`T4670` ``(feature): policy route - Update matching criteria`` - - -2022-11-21 -========== - -* :vytask:`T4812` ``(feature): IPsec ability to show all configured connections`` -* :vytask:`T4829` ``(default): Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional`` - - -2022-11-20 -========== - -* :vytask:`T4827` ``(bug): route-map issues , not load configuration FRR`` - - -2022-11-19 -========== - -* :vytask:`T4826` ``(bug): Wrong key type is used for SSH SK public keys`` -* :vytask:`T4720` ``(feature): Ability to configure SSH HostKeyAlgorithms`` -* :vytask:`T4828` ``(default): Raise appropriate op-mode errors in ipsec.py 'reset_peer'`` - - -2022-11-18 -========== - -* :vytask:`T4821` ``(bug): Correct calling of config mode script dependencies from firewall.py`` - - -2022-11-17 -========== - -* :vytask:`T4750` ``(feature): Support of higher level SSH keys (sk-ssh-ed25519)`` - - -2022-11-15 -========== - -* :vytask:`T4808` ``(feature): Add details of configtree operations to migration log`` - - -2022-11-12 -========== - -* :vytask:`T4814` ``(bug): Regression in bundled powerdns version`` - - -2022-11-09 -========== - -* :vytask:`T4800` ``(bug): undefined var includes_chroot_dir in build-vyos-image`` - - -2022-11-08 -========== - -* :vytask:`T4771` ``(feature): Rewrite protocol BGP op-mode to vyos.opmode format`` -* :vytask:`T4806` ``(default): Update FRR to 8.4 in 1.4 version`` - - -2022-11-06 -========== - -* :vytask:`T4803` ``(bug): The header 'Authorization' needs to be explictly allowed in http-api CORS middleware`` - - -2022-11-05 -========== - -* :vytask:`T4802` ``(feature): Ability to define per container shared-memory size`` - - -2022-11-01 -========== - -* :vytask:`T4764` ``(bug): NAT tables vyos_nat and vyos_static_nat not deleting after deleting nat`` -* :vytask:`T4177` ``(bug): Strip-private doesn't work for service monitoring`` - - -2022-10-31 -========== - -* :vytask:`T4786` ``(feature): Add package python3-pyhumps`` -* :vytask:`T1875` ``(feature): Add the ability to use network address as BGP neighbor (bgp listen range)`` -* :vytask:`T4785` ``(feature): snmp: Allow !, @, * and # in community name`` -* :vytask:`T4787` ``(feature): ipsec: add support for road-warrior/remote-access RADIUS timeout`` - - -2022-10-29 -========== - -* :vytask:`T4783` ``(default): Add support for stunnel`` -* :vytask:`T4784` ``(feature): Add description node for static route/route6 tagNodes`` - - -2022-10-28 -========== - -* :vytask:`T4291` ``(default): Consolidate component version read/write functions`` - - -2022-10-27 -========== - -* :vytask:`T4763` ``(feature): Change XML for Show nat destination statistics`` -* :vytask:`T4762` ``(bug): Show nat rules with empty rules incorrect error`` -* :vytask:`T4778` ``(bug): Raise error UnconfiguredSubsystem if op-mode ipsec.py fails initialization`` - - -2022-10-26 -========== - -* :vytask:`T4773` ``(default): Add camel_case to snake_case conversion utility`` - - -2022-10-25 -========== - -* :vytask:`T4574` ``(default): Add token based authentication to GraphQL API`` - - -2022-10-24 -========== - -* :vytask:`T4772` ``(default): Return list of dicts in 'raw' output of route.py instead of dict with redundant information`` - - -2022-10-23 -========== - -* :vytask:`T3723` ``(bug): op-mode IPSec show vpn ipsec sa output with underscores`` - - -2022-10-21 -========== - -* :vytask:`T4768` ``(default): Change name of api child node from 'gql' to 'graphql'`` - - -2022-10-18 -========== - -* :vytask:`T4684` ``(feature): Rewrite show ip route by protocol to vyos.opmode format`` -* :vytask:`T4533` ``(bug): Radius clients don’t have simple permissions`` -* :vytask:`T4753` ``(enhancment): Extend automatic generation of schema to query SystemStatus`` - - -2022-10-17 -========== - -* :vytask:`T4725` ``(bug): Unable to reset vpn IPsec peer`` - - -2022-10-14 -========== - -* :vytask:`T4672` ``(bug): RADIUS server disable does not work`` -* :vytask:`T4749` ``(enhancment): Use config_dict for conf_mode http-api.py`` - - -2022-10-13 -========== - -* :vytask:`T4746` ``(bug): Monitoring nft. table vyos_filter by default does not exist but telegraf checks this table`` -* :vytask:`T4744` ``(bug): BGP directly connected neighbors don't compatible with ebgp-multihop`` -* :vytask:`T4716` ``(feature): SSH ability to configure RekeyLimit`` -* :vytask:`T4343` ``(default): Expose powerdns network-timeout for service dns forwarding`` -* :vytask:`T4312` ``(bug): Telegraf configuration doesn't accept IPs for URL`` -* :vytask:`T4274` ``(default): Extend OpenConnect RADIUS Timeout to Permit 2FA Entry`` - - -2022-10-12 -========== - -* :vytask:`T4747` ``(bug): Monitoring influxdb template input exec plugin does not work`` -* :vytask:`T4740` ``(bug): Show conntrack table ipv6 fail`` -* :vytask:`T4730` ``(bug): Conntrack-sync error - listen-address is not the correct type in config as it should be`` - - -2022-10-11 -========== - -* :vytask:`T4742` ``(bug): Autocomplete in policy route rule x set table / does not show the tables created in the static protocols`` -* :vytask:`T4741` ``(bug): set firewall zone Local local-zone failed`` -* :vytask:`T4680` ``(bug): Telegraf prometheus-client listen-address invalid format`` - - -2022-10-10 -========== - -* :vytask:`T538` ``(feature): Support for network mapping in NAT`` - - -2022-10-09 -========== - -* :vytask:`T4738` ``(enhancment): Extend automatic generation of schema definition files to native configsession functions; use single resolver/directive`` - - -2022-10-08 -========== - -* :vytask:`T4707` ``(feature): Enable OSPF segment routing`` - - -2022-10-07 -========== - -* :vytask:`T4736` ``(bug): Error on JSON output of API query ShowConfig`` - - -2022-10-04 -========== - -* :vytask:`T4708` ``(bug): 'show nat destination rules' throwing an error`` -* :vytask:`T4700` ``(feature): Firewall - Add interface match criteria`` -* :vytask:`T4699` ``(feature): Firewall - Add jump action - Add return action`` -* :vytask:`T4651` ``(feature): Firewall - Add options to match packet size`` -* :vytask:`T4702` ``(bug): Wireguard peers configuration is not synchronized with CLI`` -* :vytask:`T4685` ``(bug): Interface does not exist on boot when used as inbound-interface for local policy route`` -* :vytask:`T4652` ``(feature): Upgrade PowerDNS recursor to 4.7 series`` -* :vytask:`T4582` ``(default): Router-advert: Preferred lifetime cannot equal valid lifetime in PIOs`` - - -2022-09-29 -========== - -* :vytask:`T4715` ``(feature): Auto logout user after a period of inactivity`` -* :vytask:`T4697` ``(bug): policy route: Generating ConfigError failes when tcp flag is missing on set tcp-mss rule commit`` - - -2022-09-27 -========== - -* :vytask:`T4711` ``(feature): Ability to terminate user TTY and PTS sessions`` -* :vytask:`T4557` ``(feature): fastnetmon: allow configure limits per protocol (tcp, udp, icmp)`` - - -2022-09-21 -========== - -* :vytask:`T4678` ``(feature): Rewrite service ipoe-server to get_config_dict`` -* :vytask:`T4703` ``(feature): accel-ppp: combine vlan-id and vlan-range into single CLI node`` - - -2022-09-20 -========== - -* :vytask:`T4693` ``(bug): ISIS segment routing was broken...`` - - -2022-09-17 -========== - -* :vytask:`T4666` ``(bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584`` -* :vytask:`T4665` ``(bug): Keepalived cannot use same VRID for VRRPv2 and VRRPv3`` - - -2022-09-16 -========== - -* :vytask:`T4698` ``(enhancment): Drop validator name="range" and replace it with numeric`` -* :vytask:`T4695` ``(feature): Add 'es' and 'jp106' keymap option keyboard-layout`` -* :vytask:`T4669` ``(enhancment): Extend numeric.ml for inversion of values and range values`` - - -2022-09-15 -========== - -* :vytask:`T4679` ``(bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address`` -* :vytask:`T4691` ``(feature): Upgrade Linux Kernel to latest 5.15.y train`` -* :vytask:`T4630` ``(bug): Prevent attempts to use the same interface as a source interface for pseudo-ethernet and MACsec at the same time`` -* :vytask:`T4696` ``(default): Extend bgp parameters for bgp bestpath peer-type multipath-relax`` - - -2022-09-12 -========== - -* :vytask:`T4617` ``(feature): VRF specification is needed for telegraf prometheus-client listen-address
`` -* :vytask:`T4690` ``(bug): Update GraphQL resolver for 'SystemStatus' following changes to 'show_uptime' op-mode script`` -* :vytask:`T4647` ``(feature): Add Google Virtual NIC (gVNIC) support`` -* :vytask:`T4170` ``(feature): Rename "policy ipv6-route" -> "policy route6"`` - - -2022-09-09 -========== - -* :vytask:`T4682` ``(feature): Rewrite 'show system storage' in standardized format`` -* :vytask:`T4681` ``(feature): Complete standardization of show_uptime.py`` - - -2022-09-06 -========== - -* :vytask:`T4640` ``(enhancment): Integrate op-mode exception hierarchy into API`` -* :vytask:`T4597` ``(bug): Check bind port before assign service HTTPS API and openconnect`` -* :vytask:`T4674` ``(bug): API should show op-mode error message, if present`` -* :vytask:`T4673` ``(bug): op-mode bridge.py should raise error on show_fdb for nonexistent bridge interface`` - - -2022-09-05 -========== - -* :vytask:`T4668` ``(bug): Adding/removing members from bond doesn't work/results in incorrect interface state`` -* :vytask:`T4663` ``(bug): Interface pseudo-ethernet does not change mode`` -* :vytask:`T4655` ``(bug): Firewall in 1.4 sets the default action 'accept' instead of 'drop'`` -* :vytask:`T4628` ``(bug): ConfigTree() throws ValueError() if tagNode contains whitespaces`` - - -2022-09-01 -========== - -* :vytask:`T4606` ``(bug): monitor nat destination translation shows missing script`` -* :vytask:`T4435` ``(bug): Policy route and firewall - error when using undefined group`` -* :vytask:`T4147` ``(bug): New Firewall Implementation - proposed changes on group implementation`` - - -2022-08-31 -========== - -* :vytask:`T4650` ``(feature): Rewire show nat translation to vyos.opmode format`` -* :vytask:`T4644` ``(bug): Check bind port before assign vpn sstp`` -* :vytask:`T4643` ``(bug): Smoketest exclude either sstp or openconnect from pki-misc default listen port`` -* :vytask:`T4569` ``(feature): Rewrite show bridge to new format`` -* :vytask:`T4547` ``(bug): Show vpn ipsec sa show unexpected prefix 'B' in packets`` -* :vytask:`T4367` ``(bug): NAT - Config tmp file not available`` - - -2022-08-29 -========== - -* :vytask:`T4645` ``(bug): show nat source statistics lack argument --family`` -* :vytask:`T4634` ``(bug): Bgp neighbor disable-connected-check does not work`` -* :vytask:`T4631` ``(feature): Add port and protocol to nat66`` -* :vytask:`T4623` ``(feature): Add show conntrack statistics`` -* :vytask:`T4595` ``(bug): DPD interval and timeout do not work in DMVPN`` -* :vytask:`T4594` ``(feature): Rewrite op-mode IPsec to vyos.opmode format`` -* :vytask:`T4508` ``(bug): Problem with values of the same environment in different event handlers`` -* :vytask:`T4653` ``(bug): Interface offload options are not applied correctly`` -* :vytask:`T4546` ``(bug): Does not connect Cisco spoke to VyOS hub.`` -* :vytask:`T4061` ``(default): Add util function to check for completion of boot config`` -* :vytask:`T4654` ``(bug): RPKI cache incorrect description`` -* :vytask:`T4572` ``(bug): Add an option to force interface MTU to the value received from DHCP`` - - -2022-08-26 -========== - -* :vytask:`T4642` ``(bug): proxy: hyphen not allowed in proxy URL`` - - -2022-08-25 -========== - -* :vytask:`T4626` ``(bug): Error showing nat66 source and destination`` -* :vytask:`T4622` ``(feature): Firewall allow drop packets by TCP MSS size`` - - -2022-08-24 -========== - -* :vytask:`T4641` ``(bug): prefix-list allows ipv6 prefix as input`` -* :vytask:`T4633` ``(feature): Change keepalived to v2.2.7`` - - -2022-08-23 -========== - -* :vytask:`T4618` ``(bug): Traffic policy not set on virtual interfaces`` -* :vytask:`T4538` ``(bug): Macsec does not work correctly when the interface status changes.`` - - -2022-08-22 -========== - -* :vytask:`T4089` ``(bug): Show nat destination rules shows ip address instead of interface 'any'`` -* :vytask:`T4632` ``(bug): VLAN-aware bridge not working`` -* :vytask:`T4637` ``(feature): Upgrade to podman 4.2.0`` - - -2022-08-20 -========== - -* :vytask:`T4596` ``(bug): "show openconnect-server sessions" command does not work in the openconnect module`` - - -2022-08-19 -========== - -* :vytask:`T4620` ``(bug): UPnP does not work due to incorrect template`` -* :vytask:`T4619` ``(bug): Static arp is not set if another entry is present`` -* :vytask:`T4611` ``(bug): UPnP rule IP should be a prefix instead of an address`` -* :vytask:`T4614` ``(feature): OpenConnect split-dns directive`` - - -2022-08-18 -========== - -* :vytask:`T4613` ``(bug): UPnP configuration without listen option fail`` -* :vytask:`T4570` ``(bug): Exception when trying to set up VXLAN over Wireguard`` - - -2022-08-17 -========== - -* :vytask:`T4598` ``(feature): nat66 - Add exclude options`` -* :vytask:`T4480` ``(default): add an ability to configure squid acl safe ports and acl ssl safe ports`` - - -2022-08-16 -========== - -* :vytask:`T4592` ``(bug): macsec: can not create two interfaces using the same source-interface`` -* :vytask:`T4584` ``(bug): hostap: create custom package build`` -* :vytask:`T4413` ``(default): Add an API endpoint with basic system stats`` -* :vytask:`T4537` ``(bug): MACsec not working with cipher gcm-aes-256`` - - -2022-08-15 -========== - -* :vytask:`T4609` ``(bug): Unable to Restart Container VyOS 1.4`` -* :vytask:`T4565` ``(bug): vlan aware bridge not working with - Kernel: T3318: update Linux Kernel to v5.4.205 #249`` -* :vytask:`T3988` ``(default): Feature Request: IPsec Multiple local/remote prefix for the tunnel`` -* :vytask:`T2763` ``(feature): New SNMP resource request - SNMP over TCP`` - - -2022-08-14 -========== - -* :vytask:`T4579` ``(bug): bridge: can not delete member interface CLI option when VLAN is enabled`` -* :vytask:`T4421` ``(default): Add support for floating point numbers in the numeric validator`` -* :vytask:`T3507` ``(bug): Bond with mode LACP show u/u in show interfaces even if peer is not configured`` - - -2022-08-12 -========== - -* :vytask:`T4603` ``(feature): Need a config option to specify NAS-IP-Address for vpn l2tp`` - - -2022-08-10 -========== - -* :vytask:`T4408` ``(feature): Add sshguard to protect against brut-forces`` - - -2022-08-08 -========== - -* :vytask:`T4586` ``(feature): Add to NAT66: SNAT destination address and DNAT source address.`` - - -2022-08-04 -========== - -* :vytask:`T4257` ``(feature): Discussion on changing BGP autonomous system number syntax`` - - -2022-08-02 -========== - -* :vytask:`T4585` ``(feature): Rewrite op-mode containers to vyos.opmode`` -* :vytask:`T4515` ``(default): Reduce telegraf binary size`` - - -2022-08-01 -========== - -* :vytask:`T4581` ``(bug): 'show system cpu' not working`` -* :vytask:`T4578` ``(feature): Rewrite show dns forwarding statistics to new format`` - - -2022-07-31 -========== - -* :vytask:`T4580` ``(bug): Handle the case of op-mode file names with hyphens in GraphQL schema/resolver generation`` - - -2022-07-30 -========== - -* :vytask:`T4575` ``(feature): vyos.utill add new wrapper "rc_cmd" to get the return code and output`` -* :vytask:`T4562` ``(feature): Rewrite show vrf to new format`` -* :vytask:`T4545` ``(feature): Rewrite show nat source rules`` -* :vytask:`T4543` ``(bug): Show source nat statistics shows incorrect interface`` -* :vytask:`T4503` ``(default): Prevent op mode scripts from restarting services if there's a commit in progress`` -* :vytask:`T4411` ``(feature): Add migration for service monitoring telegraf influxdb`` - - -2022-07-29 -========== - -* :vytask:`T4554` ``(enhancment): Implement GraphQL resolvers for standardized op-mode scripts`` -* :vytask:`T4518` ``(feature): Add XML for CLI conf mode load-balancing wan`` -* :vytask:`T4544` ``(enhancment): Generate schema definitions from standardized op-mode scripts`` - - -2022-07-28 -========== - -* :vytask:`T4531` ``(bug): NAT op-mode errors with exclude rules`` -* :vytask:`T3435` ``(bug): NAT rules show corruption`` - - -2022-07-27 -========== - -* :vytask:`T4571` ``(bug): Sflow with vrf configured does not use vrf to validate agent-address IP from vrf-configured interfaces`` -* :vytask:`T4552` ``(bug): Unable to reset IPsec IPv6 peer`` - - -2022-07-26 -========== - -* :vytask:`T4568` ``(bug): show vpn debug peer doesn't work`` -* :vytask:`T4556` ``(feature): fastnetmon: Allow configure white_list_path and populate with hosts/networks that should be ignored.`` -* :vytask:`T4495` ``(feature): Combine BGP reset op commands`` - - -2022-07-25 -========== - -* :vytask:`T4567` ``(default): Merge experimental branch of GraphQL development`` -* :vytask:`T4560` ``(bug): VRF and BGP neighbor local-as error`` -* :vytask:`T4493` ``(bug): Incorrect help for "show bgp neighbors"`` -* :vytask:`T1233` ``(bug): ipsec vpn sa showing down`` - - -2022-07-22 -========== - -* :vytask:`T4145` ``(bug): Conntrack table not showing after firewall rewriting`` - - -2022-07-21 -========== - -* :vytask:`T4555` ``(feature): fastnetmon: add IPv6 support`` -* :vytask:`T4553` ``(default): Allow to set ban time on ddos-protection configuration`` - - -2022-07-20 -========== - -* :vytask:`T4056` ``(bug): Traffic policy not set in live configuration`` - - -2022-07-18 -========== - -* :vytask:`T4523` ``(feature): OP-mode Extend conntrack output to get marks, zones and directions`` -* :vytask:`T4228` ``(bug): bond: OS error thrown when two bonds use the same member`` -* :vytask:`T4539` ``(feature): qat: update Intel QuickAssist release version 1.7.L.4.16.0-00017`` -* :vytask:`T4534` ``(bug): bond: bridge: error out if member interface is assigned to a VRF instance`` -* :vytask:`T4525` ``(bug): Delete interface from VRF and add it to bonding error`` -* :vytask:`T4522` ``(feature): bond: add ability to specify mii monitor interval via CLI`` -* :vytask:`T4535` ``(feature): FRR: upgrade to stable/8.3 version`` -* :vytask:`T4521` ``(bug): bond: ARP monitor interval is not configured despite set via CLI`` -* :vytask:`T4540` ``(feature): firmware: update to Linux release 20220708`` - - -2022-07-17 -========== - -* :vytask:`T4028` ``(bug): FRR 8.1 routes not being applied to routing table after reboot if an interface has 2 ip addresses`` - - -2022-07-15 -========== - -* :vytask:`T4494` ``(bug): Cannot reset BGP peer within VRF`` -* :vytask:`T4536` ``(feature): FRR: move to systemd for daemon control`` - - -2022-07-14 -========== - -* :vytask:`T4491` ``(bug): Use empty string for internal name of root node of config_tree`` - - -2022-07-13 -========== - -* :vytask:`T1375` ``(feature): Add clear dhcp server lease function`` - - -2022-07-12 -========== - -* :vytask:`T4527` ``(bug): Prevent to create VRF name default`` -* :vytask:`T4084` ``(default): Dehardcode the default login banner`` -* :vytask:`T3948` ``(feature): IPSec VPN: Add a new option "none" for the connection-type`` -* :vytask:`T235` ``(feature): Ability to configure manual IP Rules`` - - -2022-07-10 -========== - -* :vytask:`T3836` ``(bug): Setting a default IPv6 route while getting IPv4 gateway via DHCP removes the IPv4 gateway`` - - -2022-07-09 -========== - -* :vytask:`T4507` ``(feature): IPoE-server add multiplier option for shaper`` -* :vytask:`T4499` ``(bug): NAT source translation not showing a single output`` -* :vytask:`T4468` ``(bug): web-proxy source group cannot start with a number bug`` -* :vytask:`T4373` ``(feature): PPPoE-server add multiplier option for shaper`` -* :vytask:`T3353` ``(bug): PPPoE server wrong vlan-range generating config`` -* :vytask:`T3648` ``(bug): op-mode: nat rules broken`` -* :vytask:`T4517` ``(feature): ip: Add options to enable directed broadcast forwarding`` - - -2022-07-07 -========== - -* :vytask:`T4456` ``(bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many messages`` -* :vytask:`T4509` ``(feature): Feature Request: DNS64`` - - -2022-07-06 -========== - -* :vytask:`T4513` ``(bug): Webproxy monitor commands do not work`` -* :vytask:`T4299` ``(feature): Firewall - GeoIP filtering`` - - -2022-07-05 -========== - -* :vytask:`T4378` ``(bug): Unable to submit wildcard ("*.example.com") A or AAAA records in dns forwarder`` -* :vytask:`T2683` ``(default): no dual stack in system static-host-mapping host-name`` -* :vytask:`T478` ``(feature): Firewall address group (multi and nesting)`` - - -2022-07-04 -========== - -* :vytask:`T4501` ``(bug): Syslog-identifier does not work in event handler`` -* :vytask:`T3600` ``(bug): DHCP Interface static route breaks PBR`` -* :vytask:`T4498` ``(feature): bridge: Add option to enable/disable IGMP/MLD snooping`` - - -2022-07-01 -========== - -* :vytask:`T2455` ``(bug): No support for the IPv6 VTI`` -* :vytask:`T4490` ``(feature): BGP- warning message that AFI/SAFI is needed to establish the neighborship`` -* :vytask:`T4489` ``(bug): MPLS sysctl not persistent for tunnel interfaces`` - - -2022-06-29 -========== - -* :vytask:`T4477` ``(feature): router-advert: support RDNSS lifetime option`` - - -2022-06-28 -========== - -* :vytask:`T4486` ``(bug): Container can't be deleted`` -* :vytask:`T4473` ``(bug): Use container network without network declaration error`` -* :vytask:`T4458` ``(feature): Firewall - add support for matching ip ttl in firewall rules`` -* :vytask:`T3907` ``(feature): Firewall - Set log levels`` - - -2022-06-27 -========== - -* :vytask:`T4484` ``(default): Firewall op-mode summary doesn't correctly handle address group containing ranges`` - - -2022-06-25 -========== - -* :vytask:`T4482` ``(bug): dhcp: toggle of "dhcp-options no-default-route" has no effect`` -* :vytask:`T4483` ``(feature): Upgrade fastnetmon to v1.2.2 community edition`` - - -2022-06-22 -========== - -* :vytask:`T1748` ``(feature): vbash: beautify tab completion output/line breaks`` - - -2022-06-20 -========== - -* :vytask:`T1856` ``(feature): Support configuring IPSec SA bytes`` - - -2022-06-18 -========== - -* :vytask:`T4467` ``(bug): Validator Does Not Accept Signed Numbers`` - - -2022-06-17 -========== - -* :vytask:`T4209` ``(bug): Firewall incorrect handler for recent count and time`` - - -2022-06-16 -========== - -* :vytask:`T4352` ``(bug): wan-load balance - priority traffic rule doesn't work`` - - -2022-06-15 -========== - -* :vytask:`T4450` ``(feature): Route-map - Extend options for ip|ipv6 address match`` -* :vytask:`T4449` ``(feature): Route-map - Extend options for ip next-hop match`` -* :vytask:`T990` ``(feature): Make DNAT/SNAT a valid state in firewall rules.`` - - -2022-06-12 -========== - -* :vytask:`T4420` ``(feature): Feature Request: ocserv: show configured 2FA OTP key`` -* :vytask:`T4380` ``(default): Feature Request: ocserv: 2FA OTP key generator in VyOS CLI`` - - -2022-06-10 -========== - -* :vytask:`T4365` ``(bug): NAT - Error on setting up tables`` -* :vytask:`T4465` ``(feature): node.def generation misses whitespace on multiple use of `` - - -2022-06-09 -========== - -* :vytask:`T4444` ``(default): sstp: Feature request. Port number changing support`` -* :vytask:`T2580` ``(feature): Support for ip pools for ippoe`` - - -2022-06-08 -========== - -* :vytask:`T4447` ``(bug): DHCPv6 prefix delegation `sla-id` limited to 128`` - - -2022-05-31 -========== - -* :vytask:`T4212` ``(default): PermissionError when generating/installing server Certificate (generate pki certificate sign ...)`` -* :vytask:`T4199` ``(bug): Commit failed when setting icmpv6 type any`` -* :vytask:`T4148` ``(bug): Firewall - Error messages not that clear as it were in old firewall`` -* :vytask:`T3659` ``(bug): Configuration won't accept IPv6 addresses for site-to-site VPN tunnel prefixes/traffic selectors`` - - -2022-05-30 -========== - -* :vytask:`T4315` ``(feature): Telegraf - Output to prometheus`` - - -2022-05-29 -========== - -* :vytask:`T2473` ``(feature): Xml for EIGRP [conf_mode]`` - - -2022-05-28 -========== - -* :vytask:`T4448` ``(feature): rip: add support for explicit version selection`` - - -2022-05-26 -========== - -* :vytask:`T4442` ``(feature): HTTP API add action "reset"`` - - -2022-05-25 -========== - -* :vytask:`T4410` ``(feature): Telegraf - Output to Splunk`` -* :vytask:`T4382` ``(bug): Replacing legacy loadFile exposes missing steps in migration scripts and other errors`` - - -2022-05-21 -========== - -* :vytask:`T4437` ``(bug): flow-accounting: support IPv6 flow collectors`` - - -2022-05-20 -========== - -* :vytask:`T4418` ``(feature): Telegraf - output Plugin azure-data-explorer`` - - -2022-05-19 -========== - -* :vytask:`T4434` ``(bug): DMVPN: cisco-authentication password length is 8 characters`` -* :vytask:`T3938` ``(default): Rewrite the uptime script in Python to allow using it as a library`` -* :vytask:`T4334` ``(default): Make the config lexer reentrant`` - - -2022-05-17 -========== - -* :vytask:`T4424` ``(bug): policy local-route6 shows ipv4 format`` - - -2022-05-16 -========== - -* :vytask:`T4377` ``(default): generate tech-support archive includes previous archives`` - - -2022-05-12 -========== - -* :vytask:`T4417` ``(bug): VRRP doesn't start with conntrack-sync`` -* :vytask:`T4100` ``(feature): Firewall increase maximum number of rules`` - - -2022-05-11 -========== - -* :vytask:`T4405` ``(bug): DHCP client sometimes ignores `no-default-route` option of an interface`` - - -2022-05-10 -========== - -* :vytask:`T4156` ``(default): Adding DHCP Option 13 (bootfile-size)`` -* :vytask:`T1972` ``(feature): Allow setting interface name for virtual_ipaddress in VRRP VRID`` - - -2022-05-07 -========== - -* :vytask:`T4361` ``(bug): `vyos.config.exists()` does not work for nodes with multiple values`` -* :vytask:`T4354` ``(bug): Slave interfaces fall out from bonding during configuration change`` -* :vytask:`T4419` ``(feature): vrf: support to disable IP forwarding within a given VRF`` - - -2022-05-06 -========== - -* :vytask:`T4385` ``(bug): bgp: peer-group member cannot override remote-as of peer-group`` - - -2022-05-05 -========== - -* :vytask:`T4414` ``(feature): Add route-map "as-path prepend last-as x" option`` - - -2022-05-03 -========== - -* :vytask:`T4395` ``(feature): Extend show vpn debug`` - - -2022-05-01 -========== - -* :vytask:`T4369` ``(bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node`` -* :vytask:`T4363` ``(bug): salt-minion: default mine_interval option is not set`` -* :vytask:`T4353` ``(feature): Add Jinja2 linter to vyos-1x build process`` - - -2022-04-29 -========== - -* :vytask:`T4388` ``(bug): dhcp-server: missing constraint on tftp-server-name option`` -* :vytask:`T4366` ``(bug): geneve: interface is removed on changes to e.g. description`` - - -2022-04-28 -========== - -* :vytask:`T4400` ``(bug): Container OP mode has delete where show and update should be`` - - -2022-04-27 -========== - -* :vytask:`T4398` ``(bug): IPSec site-to-site generates unexpected passthrough option`` -* :vytask:`T4397` ``(feature): arp: migrate static ARP entry configuration to get_config_dict() and make it VRF aware`` -* :vytask:`T4357` ``(feature): Allow free-form setting of DHCPv6 server options`` - - -2022-04-26 -========== - -* :vytask:`T4210` ``(bug): NAT source/destination negated ports throws an error`` -* :vytask:`T4235` ``(default): Add config tree diff algorithm`` - - -2022-04-25 -========== - -* :vytask:`T4390` ``(feature): op-mode: extend "show log" and "monitor log" with additional daemons/subsystems to read journalctl logs`` -* :vytask:`T4391` ``(bug): PPPoE: IPv6 not working after system boot`` - - -2022-04-24 -========== - -* :vytask:`T4342` ``(bug): "show ip ospf neighbor address x.x.x.x" gives "unknown command" error`` - - -2022-04-23 -========== - -* :vytask:`T4386` ``(default): Applying limiter on traffic-policy "in" fails, incorrectly reports mirror or redirect policy in use`` - - -2022-04-22 -========== - -* :vytask:`T4389` ``(feature): dhcp: add vendor option support for Ubiquity Unifi controller`` - - -2022-04-21 -========== - -* :vytask:`T4384` ``(feature): pppoe: replace default-route CLI option with common CLI nodes already present for DHCP`` - - -2022-04-20 -========== - -* :vytask:`T4345` ``(bug): New firewall code does not accept "rate/time interval" syntax used in old config`` -* :vytask:`T4231` ``(feature): Feature Request: ocserv: 2FA (password+OTP) support in Openconnect`` - - -2022-04-19 -========== - -* :vytask:`T4379` ``(bug): PPPoE: default-route lost after applying additional static routes`` -* :vytask:`T4344` ``(bug): DHCP statistics not matching, conf-mode generates incorrect pool name with dash`` -* :vytask:`T4268` ``(bug): Elevated LA while using VyOS monitoring feature`` - - -2022-04-18 -========== - -* :vytask:`T4351` ``(bug): Openvpn conf-mode "openvpn-option" is not respected`` -* :vytask:`T4278` ``(default): vyos-vm-images: fix vagrant libvirt box`` -* :vytask:`T4368` ``(bug): bgp: AS specified for local as is the same as the remote as and this is not allowed.`` -* :vytask:`T4370` ``(feature): vxlan: geneve: support configuration of df bit option`` - - -2022-04-15 -========== - -* :vytask:`T4327` ``(default): Ethernet interface configuration fails on Hyper-V due to speed/duplex/autoneg ethtool command error`` -* :vytask:`T4364` ``(feature): salt-minion: Upgrade to 3004 and migrate to get_config_dict()`` - - -2022-04-13 -========== - -* :vytask:`T4333` ``(feature): Jinja2: add plugin to test if a variable is defined and not none to reduce template complexity`` - - -2022-04-08 -========== - -* :vytask:`T4331` ``(bug): IPv6 link local addresses are not configured when an interface is in a VRF`` -* :vytask:`T4347` ``(default): Return complete and consistent error codes from HTTP API`` -* :vytask:`T4339` ``(bug): wwan: tab-completion results in "No such file or directory" if there is no WWAN interface`` -* :vytask:`T4338` ``(bug): wwan: changing interface description should not trigger reconnect`` -* :vytask:`T4324` ``(bug): wwan: check alive script should only be run via cron if a wwan interface is configured at all`` - - -2022-04-07 -========== - -* :vytask:`T4330` ``(bug): MTU settings cannot be applied when IPv6 is disabled`` -* :vytask:`T4346` ``(feature): Deprecate "system ipv6 disable" option to disable address family within OS kernel`` -* :vytask:`T4319` ``(bug): The command "set system ipv6 disable" doesn't work as expected.`` -* :vytask:`T4341` ``(feature): login: disable user-account prior to deletion and wait until deletion is complete`` -* :vytask:`T4336` ``(feature): isis: add support for MD5 authentication password on a circuit`` - - -2022-04-06 -========== - -* :vytask:`T4308` ``(feature): Op-comm "Show log frr" to view specific protocol logs`` - - -2022-04-04 -========== - -* :vytask:`T4329` ``(bug): Bgp policy route-map bug with set several extcommunity rt`` - - -2022-04-02 -========== - -* :vytask:`T4335` ``(bug): open-vmdk fails to build under gcc-10.+`` - - -2022-04-01 -========== - -* :vytask:`T4332` ``(bug): bgp: deterministic-med cannot be disabled while addpath-tx-bestpath-per-AS is in use`` - - -2022-03-31 -========== - -* :vytask:`T4326` ``(feature): Add bgp option no-suppress-duplicates`` -* :vytask:`T4323` ``(default): ospf6d crashes on latest vyos nightly`` - - -2022-03-29 -========== - -* :vytask:`T3686` ``(bug): Bridging OpenVPN tap with no local-address breaks`` -* :vytask:`T3635` ``(default): Add ability to use mDNS repeater with VRRP`` - - -2022-03-26 -========== - -* :vytask:`T4321` ``(default): Allow BGP neighbors between different VIFs on the same VyOS`` - - -2022-03-24 -========== - -* :vytask:`T4301` ``(bug): The "arp-monitor" option in bonding interface settings does not work`` -* :vytask:`T4294` ``(bug): Adding a new openvpn-option does not restart the OpenVPN process`` -* :vytask:`T4290` ``(bug): BGP source-interface fails to commit`` -* :vytask:`T4230` ``(bug): OpenVPN server configuration deleted after reboot when using a VRRP virtual-address`` - - -2022-03-23 -========== - -* :vytask:`T4314` ``(bug): Latest 1.4 Rolling release config migration error`` - - -2022-03-21 -========== - -* :vytask:`T4304` ``(feature): [OSPF]import/export filter inter-area prefix`` - - -2022-03-20 -========== - -* :vytask:`T4298` ``(default): vyos-vm-images: fix ansible group name and remove obsolete empty command`` - - -2022-03-18 -========== - -* :vytask:`T4286` ``(bug): Fix for firewall ipv6 name address validator`` - - -2022-03-15 -========== - -* :vytask:`T4302` ``(feature): FRRouting upgrade to release 8.2.2`` -* :vytask:`T4293` ``(default): Add "set ip-next-hop unchanged" in route-map`` - - -2022-03-14 -========== - -* :vytask:`T4275` ``(default): Incorrect val_help for local/remote prefix in ipsec vpn`` - - -2022-03-12 -========== - -* :vytask:`T4296` ``(bug): Interface config injected by Cloud-Init may interfere with VyOS native`` -* :vytask:`T4265` ``(feature): Add op-mode for bgp flowspec state and routes`` - - -2022-03-11 -========== - -* :vytask:`T4297` ``(bug): Interface configuration saving fails for ice/iavf based interfaces because they can't change speed/duplex settings`` - - -2022-03-09 -========== - -* :vytask:`T3981` ``(feature): VRF support for flow-accounting`` - - -2022-03-05 -========== - -* :vytask:`T4259` ``(bug): The conntrackd daemon can be started wrongly`` - - -2022-03-03 -========== - -* :vytask:`T4283` ``(feature): Add support to "reject" routes - emit an ICMP unreachable when matched`` - - -2022-03-01 -========== - -* :vytask:`T4277` ``(feature): flow-accounting: support sending flow-data via VRF interface`` - - -2022-02-28 -========== - -* :vytask:`T4273` ``(bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config`` -* :vytask:`T4115` ``(bug): reboot in not working as expected`` -* :vytask:`T3656` ``(bug): IPSec 1.4 : "show vpn ike sa" does not show the correct default ike version`` - - -2022-02-26 -========== - -* :vytask:`T4272` ``(feature): lldp: migrate Python script to use get_config_dict()`` - - -2022-02-24 -========== - -* :vytask:`T4267` ``(bug): Error - Missing required "ip key" parameter`` - - -2022-02-23 -========== - -* :vytask:`T4194` ``(bug): prefix-list no check for duplicate entries`` -* :vytask:`T4264` ``(bug): vxlan: interface is destroyed and rebuild on description change`` -* :vytask:`T4263` ``(bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes`` - - -2022-02-21 -========== - -* :vytask:`T4120` ``(feature): [VXLAN] add ability to set multiple unicast-remotes`` - - -2022-02-20 -========== - -* :vytask:`T4254` ``(feature): VPN IPSec charon add options cisco_flexvpn and install_virtual_ip_on`` -* :vytask:`T4249` ``(feature): Add support for device mapping in containers`` -* :vytask:`T3617` ``(bug): IPSec 1.4 generate invalid configuration`` -* :vytask:`T4261` ``(feature): MACsec: add DHCP client support`` -* :vytask:`T4203` ``(bug): Reconfigure DHCP client interface causes brief outages`` - - -2022-02-19 -========== - -* :vytask:`T4258` ``(bug): [DHCP-SERVER] error parameter on Failover`` - - -2022-02-17 -========== - -* :vytask:`T4255` ``(bug): Unexpected print of dict bridge on delete`` -* :vytask:`T4240` ``(bug): Cannot add wlan0 to bridge via configure`` -* :vytask:`T4154` ``(bug): Error add second gre tunnel with the same source interface`` - - -2022-02-16 -========== - -* :vytask:`T4237` ``(bug): Conntrack-sync error - error adding listen-address command`` - - -2022-02-15 -========== - -* :vytask:`T4160` ``(bug): Firewall - Error in rules that matches everything except something`` -* :vytask:`T3006` ``(bug): Accel-PPP & vlan-mon config get invalid VLAN`` -* :vytask:`T3494` ``(bug): DHCPv6 leases traceback when PD using`` -* :vytask:`T1292` ``(bug): Issues while deleting all rules from a firewall`` - - -2022-02-13 -========== - -* :vytask:`T4242` ``(bug): ethernet speed/duplex can never be switched back to auto/auto`` -* :vytask:`T4191` ``(bug): Lost access to host after VRF re-creating`` - - -2022-02-11 -========== - -* :vytask:`T3872` ``(feature): Add configurable telegraf monitoring service`` - - -2022-02-08 -========== - -* :vytask:`T4227` ``(bug): Typo in help completion of hello-time option of bridge interface`` - - -2022-02-07 -========== - -* :vytask:`T4233` ``(bug): ssh: sync regex for allow/deny usernames to "system login"`` - - -2022-02-06 -========== - -* :vytask:`T4223` ``(bug): policy route cannot have several entries with the same table`` -* :vytask:`T4216` ``(bug): Firewall: can't use negated groups in firewall rules`` -* :vytask:`T4178` ``(bug): policy based routing tcp flags issue`` -* :vytask:`T4164` ``(bug): PBR: network groups (as well as address and port groups) don't resolve in `nftables_policy.conf``` -* :vytask:`T3970` ``(feature): Add support for op-mode PKI direct install into an active config session`` -* :vytask:`T3828` ``(bug): ipsec: Subtle change in "pfs enable" behavior from equuleus -> sagitta`` - - -2022-02-05 -========== - -* :vytask:`T4226` ``(bug): VRRP transition-script does not work for groups name which contains -(minus) sign`` - - -2022-02-04 -========== - -* :vytask:`T4196` ``(bug): DHCP server client-prefix-length parameter results in non-functional leases`` - - -2022-02-03 -========== - -* :vytask:`T4218` ``(bug): firewall: rule name is not allowed to start with a number`` -* :vytask:`T3643` ``(bug): show vpn ipsec sa doesn't show tunnels in "down" state`` - - -2022-02-01 -========== - -* :vytask:`T4224` ``(bug): Ethernet interfaces configured for DHCP not working on latest rolling snapshot (vyos-1.4-rolling-202201291849-amd64.iso)`` -* :vytask:`T4225` ``(bug): Performance degration with latest rolling release`` -* :vytask:`T4220` ``(bug): Commit broke dhclient 78b247b724f74bdabab0706aaa7f5b00e5809bc1`` -* :vytask:`T4138` ``(bug): NAT configuration allows to set incorrect port range and invalid port`` - - -2022-01-28 -========== - -* :vytask:`T4184` ``(bug): NTP allow-clients address doesn't work it allows to use ntp server for all addresses`` -* :vytask:`T4217` ``(bug): firewall: port-group requires protocol to be set - but not in VyOS 1.3`` - - -2022-01-27 -========== - -* :vytask:`T4213` ``(default): ipv6 policy routing not working anymore`` -* :vytask:`T4188` ``(bug): Firewall does not correctly handle conntracking`` -* :vytask:`T3762` ``(feature): Support network and address groups for policy ipv6-route`` -* :vytask:`T3560` ``(feature): Ability to create groups of MAC addresses`` -* :vytask:`T3495` ``(feature): Modernising port/protocol definitions`` - - -2022-01-25 -========== - -* :vytask:`T4205` ``(feature): Disable Debian Version in SSH (DebianBanner->no)`` -* :vytask:`T4131` ``(bug): Show firewall group incorrect format members`` - - -2022-01-24 -========== - -* :vytask:`T4204` ``(feature): Update Accel-PPP to a newer revision`` -* :vytask:`T1795` ``(default): Commit rollback by timeout`` - - -2022-01-23 -========== - -* :vytask:`T4186` ``(bug): Firewall icmp type - Offered options not supported`` -* :vytask:`T4181` ``(bug): Firewall ipv6-network-group - incorrect description on helper`` - - -2022-01-21 -========== - -* :vytask:`T4200` ``(bug): Assigning ipv6-name to interface is not generating nftables rules`` -* :vytask:`T4144` ``(bug): Firewall address-group - Improve error messages`` -* :vytask:`T4137` ``(bug): Firewall group configuration allows to set incorrect port range and invalid port`` -* :vytask:`T4133` ``(bug): Firewall network group error with zone-based firewall rules`` - - -2022-01-20 -========== - -* :vytask:`T4171` ``(bug): Interface config migration error on 1.2.8 -> 1.4 upgrade`` - - -2022-01-19 -========== - -* :vytask:`T4195` ``(feature): [OSPF-ECMP]enable set maximun-path`` - - -2022-01-18 -========== - -* :vytask:`T4159` ``(bug): Empty firewall group (address, network & port) generates invalid nftables config, commit fails`` -* :vytask:`T4155` ``(bug): PBR: `set table main` fails in `firewall.py` with newer rolling releases`` -* :vytask:`T3873` ``(feature): Zone based Firewall - Filter traffic in same zone`` -* :vytask:`T3286` ``(feature): Switch the firewall from iptables to nftables`` -* :vytask:`T292` ``(feature): [ZBF] Allow filtering intra zone traffic`` - - -2022-01-17 -========== - -* :vytask:`T3164` ``(bug): console-server ssh does not work with RADIUS PAM auth`` - - -2022-01-15 -========== - -* :vytask:`T4183` ``(feature): IPv6 link-local address not accepted as wireguard peer`` -* :vytask:`T4150` ``(bug): VRRP with conntrack-sync does not work`` -* :vytask:`T4110` ``(feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0`` - - -2022-01-14 -========== - -* :vytask:`T4182` ``(bug): Show vrrp if vrrp not configured bug`` -* :vytask:`T4179` ``(feature): Add op-mode CLI for show high-availability virtual-server`` - - -2022-01-13 -========== - -* :vytask:`T4175` ``(bug): BGP configuration failed`` -* :vytask:`T4109` ``(feature): Extend high-availability/keepalived for support virtual-server lb`` - - -2022-01-12 -========== - -* :vytask:`T4174` ``(bug): Validation fails when entering port range with upper port 65535`` -* :vytask:`T4162` ``(bug): VPN ipsec ike-group - Incorrect value help for ikev2-reauth`` -* :vytask:`T4161` ``(bug): Policy route-map - Incorrect value help for local preference`` -* :vytask:`T4152` ``(bug): NHRP shortcut-target holding-time does not work`` - - -2022-01-11 -========== - -* :vytask:`T4149` ``(bug): [Firewall-IPV6] Error delete Fw rules on VIF/INT`` -* :vytask:`T3950` ``(bug): CLI backtrace on update if DNS not defined`` -* :vytask:`T4166` ``(bug): Debug output missing when frr.py called under vyos-configd`` - - -2022-01-10 -========== - -* :vytask:`T3299` ``(bug): Allow the web proxy service to listen on all IP addresses`` -* :vytask:`T3115` ``(feature): Add support for firewall on L3 VIF bridge interface`` - - -2022-01-09 -========== - -* :vytask:`T4142` ``(bug): Input ifbX interfaces not displayed in op-mode`` -* :vytask:`T3914` ``(bug): VRRP rfc3768-compatibility doesn't work with unicast peers`` - - -2022-01-08 -========== - -* :vytask:`T4116` ``(bug): Webproxy/Squid not working with IPv6 listen-address`` - - -2022-01-07 -========== - -* :vytask:`T3924` ``(bug): VRRP stops working with VRF`` - - -2022-01-06 -========== - -* :vytask:`T4135` ``(bug): Declare zone policy firewall without local zone errors`` -* :vytask:`T4130` ``(bug): Firewall state policy errors chain`` -* :vytask:`T4141` ``(bug): Set high-availability vrrp sync-group without members error`` - - -2022-01-04 -========== - -* :vytask:`T4134` ``(bug): Incorrect firewall protocol completion help uppercase and duplicates`` -* :vytask:`T4132` ``(bug): Impossible to show a specific firewall group`` - - -2022-01-03 -========== - -* :vytask:`T4126` ``(feature): Ability to set priority to site to site IPSec vpn tunnels`` -* :vytask:`T4052` ``(bug): Validator return traceback on VRRP configuration with the script path not in config dir`` -* :vytask:`T4128` ``(bug): keepalived: Upgrade package to add VRF support`` - - -2021-12-31 -========== - -* :vytask:`T4081` ``(bug): VRRP health-check script stops working when setting up a sync group`` - - -2021-12-30 -========== - -* :vytask:`T4124` ``(feature): snmp: migrate to get_config_dict()`` - - -2021-12-29 -========== - -* :vytask:`T4111` ``(bug): IPSec generates wrong configuration colons for IPv6 peers`` -* :vytask:`T4023` ``(feature): Add grepcidr or similar functionality`` -* :vytask:`T4086` ``(default): system login banner is not removed on deletion.`` - - -2021-12-28 -========== - -* :vytask:`T3380` ``(bug): "show vpn ike sa" does not display IPv6 peers`` - - -2021-12-27 -========== - -* :vytask:`T3979` ``(bug): vyos-hostd unable to hostfile-update`` -* :vytask:`T2566` ``(bug): sstp not able to run tunnels ipv6 only`` -* :vytask:`T4093` ``(bug): SNMPv3 snmpd.conf generation bug`` -* :vytask:`T2764` ``(enhancment): Increase maximum number of NAT rules`` - - -2021-12-26 -========== - -* :vytask:`T4104` ``(bug): RAID1: "add raid md0 member sda1" does not restore boot sector`` -* :vytask:`T4108` ``(default): OSPFv3: add support for auto-cost parameter`` -* :vytask:`T4107` ``(default): OSPFv3: add support for "default-information originate"`` - - -2021-12-25 -========== - -* :vytask:`T4101` ``(bug): commit-archive: Use of uninitialized value $source_address in concatenation`` -* :vytask:`T4099` ``(feature): flow-accounting: sync "source-ip" and "source-address" between netflow and sflow ion CLI`` -* :vytask:`T4097` ``(feature): flow-accounting: migrate implementation to get_config_dict()`` -* :vytask:`T4105` ``(feature): flow-accounting: drop "sflow agent-address auto"`` -* :vytask:`T4106` ``(feature): flow-accounting: support specification of capture packet lenght`` -* :vytask:`T4102` ``(feature): OSPFv3: add support for NSSA area-type`` -* :vytask:`T4055` ``(feature): Add VRF support for HTTP(S) API service`` - - -2021-12-24 -========== - -* :vytask:`T3854` ``(bug): Missing op-mode commands for conntrack-sync`` - - -2021-12-23 -========== - -* :vytask:`T3354` ``(default): Convert strip-private script from Perl to Python`` - - -2021-12-22 -========== - -* :vytask:`T3678` ``(bug): VyOS 1.4: Invalid error message while deleting ipsec vpn configuration`` -* :vytask:`T3356` ``(feature): Script for remote file transfers`` - - -2021-12-21 -========== - -* :vytask:`T4083` ``(bug): Cluster heartbeat doesn't start b.c lack of directory /run/heartbeat/`` -* :vytask:`T4070` ``(bug): NATv4 : inbound-interface type "any" is missing.`` -* :vytask:`T4053` ``(bug): VRRP impossible to set scripts out of the /config directory`` -* :vytask:`T3931` ``(bug): SSTP doesn't work after rewriting to PKI`` - - -2021-12-20 -========== - -* :vytask:`T4088` ``(default): Fix typo in login banner`` - - -2021-12-19 -========== - -* :vytask:`T3912` ``(default): Use a more informative default post-login banner`` - - -2021-12-17 -========== - -* :vytask:`T4059` ``(bug): VRRP sync-group transition script does not persist after reboot`` - - -2021-12-16 -========== - -* :vytask:`T4046` ``(feature): Sflow - Add Source address parameter`` -* :vytask:`T3556` ``(bug): Commit-archive via scp causes 100% CPU on boot`` -* :vytask:`T4076` ``(enhancment): Allow setting CORS options in HTTP API`` -* :vytask:`T4037` ``(default): HTTP transfers do not follow redirects`` -* :vytask:`T4029` ``(default): Broken SFTP uploads`` - - -2021-12-15 -========== - -* :vytask:`T4077` ``(bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"`` -* :vytask:`T4073` ``(bug): "show protocols bfd peer <>" shows incorrect peer information.`` - - -2021-12-14 -========== - -* :vytask:`T4071` ``(feature): Allow HTTP API to bind to unix domain socket`` - - -2021-12-12 -========== - -* :vytask:`T4069` ``(feature): BGP: add additional available parameters to VyOS CLI`` -* :vytask:`T4036` ``(bug): VXLAN incorrect raiseError if set multicast network instead of singe address`` - - -2021-12-10 -========== - -* :vytask:`T4068` ``(feature): Python: ConfigError should insert line breaks into the error message`` - - -2021-12-09 -========== - -* :vytask:`T4033` ``(bug): VRRP - Error security when setting scripts`` -* :vytask:`T4064` ``(bug): IP address for vif is not removed from the system when deleted in configuration`` -* :vytask:`T4060` ``(enhancment): Extend configquery for use before boot configuration is complete`` -* :vytask:`T4058` ``(bug): BFD: add BGP and OSPF "bfd profile" support`` -* :vytask:`T4054` ``(bug): BFD profiles configuration incorrect behavior.`` - - -2021-12-07 -========== - -* :vytask:`T4041` ``(servicerequest): "transition-script" doesn't work on "sync-group"`` - - -2021-12-06 -========== - -* :vytask:`T4012` ``(feature): Add VRF support for TFTP`` - - -2021-12-04 -========== - -* :vytask:`T4049` ``(feature): support command-style output with compare command`` -* :vytask:`T4047` ``(bug): Wrong regex validation in XML definitions`` -* :vytask:`T4042` ``(bug): BGP L2VPN / EVPN and RD type 0 set`` -* :vytask:`T4048` ``(bug): BGP: L2VPN/EVPN and individual RD and RT settings for each VNI`` -* :vytask:`T4045` ``(bug): Unable to "format disk like "`` -* :vytask:`T4044` ``(feature): BFD: add vrf support`` -* :vytask:`T4043` ``(feature): BFD: add support for passive mode`` - - -2021-12-02 -========== - -* :vytask:`T4035` ``(bug): Geneve interfaces aren't displayed by operational mode commands`` - - -2021-12-01 -========== - -* :vytask:`T3695` ``(bug): OpenConnect reports commit success when ocserv fails to start due to SSL cert/key file issues`` - - -2021-11-30 -========== - -* :vytask:`T4010` ``(bug): DMVPN generates incorrect configuration life_time for swanctl.conf`` -* :vytask:`T3725` ``(feature): show configuration in json format`` - - -2021-11-29 -========== - -* :vytask:`T3946` ``(enhancment): Automatically resize the root partition if the drive has extra space`` - - -2021-11-28 -========== - -* :vytask:`T3999` ``(bug): show lldp neighbor Traceback error`` -* :vytask:`T3928` ``(feature): Add OSPFv3 VRF support`` - - -2021-11-27 -========== - -* :vytask:`T3755` ``(feature): ospf: adjust to new FRR 8 syntax where "no passive-interface " moved to interface section`` -* :vytask:`T3753` ``(feature): frr: upgrade to stable/8.1 release train`` - - -2021-11-26 -========== - -* :vytask:`T3978` ``(bug): containers add network without declaring prefix raise ConfigError`` - - -2021-11-25 -========== - -* :vytask:`T4006` ``(default): Add additional Linux capabilities to container configuration`` -* :vytask:`T3986` ``(bug): Incorrect description for vpn ipsec site-to-site authentication and connection`` - - -2021-11-24 -========== - -* :vytask:`T4015` ``(feature): Update Accel-PPP to a newer revision`` -* :vytask:`T3865` ``(bug): loadkey command help text missing escape sequence`` -* :vytask:`T1083` ``(feature): Implement persistent/random address and port mapping options for NAT rules`` - - -2021-11-23 -========== - -* :vytask:`T3990` ``(bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to files left behind in /var/tmp/frr/ after reboot)`` - - -2021-11-20 -========== - -* :vytask:`T3998` ``(bug): route-target completion incorrect description`` - - -2021-11-19 -========== - -* :vytask:`T4003` ``(bug): API for "show interfaces ethernet" does not include the interface description`` -* :vytask:`T4011` ``(bug): ethernet: deleting interface should place interface in admin down state`` - - -2021-11-18 -========== - -* :vytask:`T3612` ``(bug): IPoE Server address pool issues.`` -* :vytask:`T3995` ``(feature): OpenVPN: do not stop/start service on configuration change`` -* :vytask:`T4008` ``(feature): dhcp: change client retry interval form 300 -> 60 seconds`` -* :vytask:`T3795` ``(bug): WWAN: issues with non connected interface / no signal`` -* :vytask:`T3510` ``(bug): RADIUS usersname is not shown on CLI`` - - -2021-11-17 -========== - -* :vytask:`T3350` ``(bug): OpenVPN config file generation broken`` -* :vytask:`T3996` ``(bug): SNMP service error in log`` - - -2021-11-15 -========== - -* :vytask:`T3994` ``(bug): VRF: unable to delete vrf when name contains numbers, hyphen or underscore`` -* :vytask:`T3960` ``(bug): FRR Misconfig when using multiple VRF VNI`` -* :vytask:`T3724` ``(feature): Allow setting host-name in l2tp section of accel-ppp`` -* :vytask:`T645` ``(feature): Allow multiple prefixes in ipsec tunnel`` - - -2021-11-10 -========== - -* :vytask:`T3966` ``(default): OpenVPN fix the smoketests`` -* :vytask:`T3834` ``(default): [OPENVPN] Support for Two Factor Authentication totp.`` -* :vytask:`T3982` ``(bug): DHCP server commit fails if static-mapping contains + or .`` - - -2021-11-09 -========== - -* :vytask:`T3962` ``(bug): Image cannot be built without open-vm-tools`` - - -2021-11-07 -========== - -* :vytask:`T3626` ``(bug): Configuring and disabling DHCP Server`` - - -2021-11-06 -========== - -* :vytask:`T3514` ``(bug): NIC flap at any interface change`` - - -2021-11-05 -========== - -* :vytask:`T3972` ``(bug): Removing vif-c interface raises KeyError`` - - -2021-11-04 -========== - -* :vytask:`T3969` ``(bug): Container incorrect raiseError format if network doesn't exist`` -* :vytask:`T3662` ``(bug): Container configuration upgrade destroys system`` -* :vytask:`T3964` ``(bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses`` - - -2021-11-03 -========== - -* :vytask:`T3952` ``(default): Add sh bgp ipv4/ipv6 vpn command`` -* :vytask:`T3610` ``(bug): DHCP-Server creation for not primary IP address fails`` - - -2021-11-01 -========== - -* :vytask:`T3958` ``(default): OpenVPN breaks the smoketests`` -* :vytask:`T3956` ``(bug): GRE tunnel - unable to move from source-interface to source-address, commit error`` - - -2021-10-31 -========== - -* :vytask:`T3945` ``(feature): Add route-map for bgp aggregate-address`` -* :vytask:`T3954` ``(bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated, config system error`` -* :vytask:`T3943` ``(bug): "netflow source-ip" prevents image upgrades if IP address does not exist locally`` - - -2021-10-29 -========== - -* :vytask:`T3942` ``(feature): Generate IPSec debug archive from op-mode`` - - -2021-10-28 -========== - -* :vytask:`T3951` ``(bug): After resetting vti ipsec tunnel old child SA still active`` -* :vytask:`T3941` ``(bug): "show vpn ipsec sa" shows established time of parent SA not child SA's`` -* :vytask:`T3916` ``(feature): Add additional Linux capabilities to container configuration`` - - -2021-10-27 -========== - -* :vytask:`T3944` ``(bug): VRRP fails over when adding new group to master`` - - -2021-10-22 -========== - -* :vytask:`T3897` ``(feature): Dynamic DNS doesn't work with IPv6 addresses`` -* :vytask:`T3832` ``(feature): Allow to set DHCP client-id in hexadecimal format`` -* :vytask:`T3188` ``(bug): Tunnel local-ip to dhcp-interface Change Fails to Update`` -* :vytask:`T3917` ``(default): Use Avahi as mDNS repeater for IPv6 support`` - - -2021-10-21 -========== - -* :vytask:`T3926` ``(bug): strip-private does not sanitize "cisco-authentication" from NHRP configuration`` -* :vytask:`T3925` ``(feature): Tunnel: dhcp-interface not implemented - use source-interface instead`` -* :vytask:`T3923` ``(feature): Kernel: Enable TLS/IPSec offload support for Mellanox ConnectX NICs`` -* :vytask:`T3927` ``(feature): Kernel: Enable kernel support for HW offload of the TLS protocol`` - - -2021-10-20 -========== - -* :vytask:`T3918` ``(bug): DHCPv6 prefix delegation incorrect verify error`` -* :vytask:`T3921` ``(bug): tunnel: KeyError when using dhcp-interface`` - - -2021-10-19 -========== - -* :vytask:`T3396` ``(bug): syslog can't be configured with an ipv6 literal destination in 1.2.x`` - - -2021-10-18 -========== - -* :vytask:`T3002` ``(default): VRRP change on IPSec interface causes packet routing issues`` - - -2021-10-17 -========== - -* :vytask:`T3786` ``(bug): GRE tunnel source address 0.0.0.0 error`` -* :vytask:`T3217` ``(default): Save FRR configuration on each commit`` -* :vytask:`T3381` ``(bug): Change GRE tunnel failed`` -* :vytask:`T3254` ``(bug): Dynamic DNS status shows incorrect last update time`` -* :vytask:`T1243` ``(bug): BGP local-as accept wrong values`` -* :vytask:`T697` ``(bug): Clean up and sanitize package dependencies`` -* :vytask:`T578` ``(feature): Support Linux Container`` - - -2021-10-16 -========== - -* :vytask:`T3879` ``(bug): GPG key verification fails when upgrading from a 1.3 beta version`` - - -2021-10-15 -========== - -* :vytask:`T3748` ``(bug): Container deletion bug`` -* :vytask:`T3693` ``(feature): ISIS Route redistribution ipv6 support missing`` -* :vytask:`T3676` ``(feature): Container option to add Linux capabilities`` -* :vytask:`T3613` ``(feature): Selectors for route-based IPsec tunnel (vti)`` -* :vytask:`T3692` ``(bug): VyOS build failing due to repo.saltstack.com`` -* :vytask:`T3673` ``(feature): BGP large-community del operation missing`` - - -2021-10-14 -========== - -* :vytask:`T3811` ``(bug): NAT (op_mode): NAT op_mode command fails.`` -* :vytask:`T3801` ``(feature): containers: do not use podman CLI to create container networks`` - - -2021-10-13 -========== - -* :vytask:`T3904` ``(bug): NTP pool associations silently fail`` -* :vytask:`T3277` ``(feature): DNS Forwarding - reverse zones`` - - -2021-10-12 -========== - -* :vytask:`T3216` ``(bug): Removal of restricted-shell broke configure mode for RADIUS users`` -* :vytask:`T3881` ``(bug): Wrong description for container section restart`` -* :vytask:`T3868` ``(bug): Regex and/or wildcard not accepted with large-community-list`` -* :vytask:`T3701` ``(bug): ipoe server fails to start when configuring radius dynamic-author on ipoe`` - - -2021-10-10 -========== - -* :vytask:`T3750` ``(bug): pdns-recursor 4.4 issue with dont-query and private DNS servers`` -* :vytask:`T3885` ``(default): dhcpv6-pd: randomly generated DUID is not persisted`` -* :vytask:`T3899` ``(enhancment): Add support for hd44780 LCD displays`` - - -2021-10-09 -========== - -* :vytask:`T3894` ``(bug): Tunnel Commit Failed if system does not have `eth0``` - - -2021-10-08 -========== - -* :vytask:`T3893` ``(bug): MGRE Tunnel commit crash If sit tunnel available`` - - -2021-10-05 -========== - -* :vytask:`T3741` ``(feature): [BGP] default no-ipv4-unicast - by default`` - - -2021-10-04 -========== - -* :vytask:`T3888` ``(bug): Incorrect warning when poweroff command executed from configure mode.`` -* :vytask:`T3890` ``(feature): dhcp(v6): provide op-mode commands to retrieve both server and client logfiles`` -* :vytask:`T3889` ``(feature): Migrate to journalctl when reading daemon logs`` - - -2021-10-03 -========== - -* :vytask:`T3880` ``(bug): EFI boot shows error on display`` - - -2021-10-02 -========== - -* :vytask:`T3882` ``(feature): Upgrade PowerDNs recursor to 4.5 series`` -* :vytask:`T3883` ``(bug): VRF - Delette vrf config on interface`` - - -2021-09-30 -========== - -* :vytask:`T3874` ``(bug): D-Link Ethernet Interface not working.`` -* :vytask:`T3869` ``(default): Rewrite vyatta_net_name/vyatta_interface_rescan in Python`` - - -2021-09-28 -========== - -* :vytask:`T3853` ``(default): nat66 rules gets deleted on reboot in 1.4-rolling-202109240217`` - - -2021-09-27 -========== - -* :vytask:`T3863` ``(default): nat66: commit fails/hangs on non existing interface`` - - -2021-09-26 -========== - -* :vytask:`T3860` ``(bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64 addresses`` -* :vytask:`T3857` ``(feature): reboot: send wall message to all users for information`` -* :vytask:`T3867` ``(bug): vxlan: multicast group address is not validated`` -* :vytask:`T3859` ``(bug): Add "log-adjacency-changes" to ospfv3 process`` -* :vytask:`T3826` ``(bug): PKI: op-mode - do input validation when listing certificates`` - - -2021-09-25 -========== - -* :vytask:`T3657` ``(default): BGP neighbors ipv6 not able to establish with IPv6 link-local addresses`` - - -2021-09-23 -========== - -* :vytask:`T3850` ``(bug): Dots are no longer allowed in SSH public key names`` - - -2021-09-21 -========== - -* :vytask:`T3847` ``(feature): keepalived/vrrp: migrate to get_config_dict() - cleanup`` - - -2021-09-20 -========== - -* :vytask:`T3823` ``(bug): strip-private does not filter public IPv6 addresses`` - - -2021-09-19 -========== - -* :vytask:`T3841` ``(feature): dhcp-server: add ping-check option to CLI`` -* :vytask:`T2738` ``(bug): Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization`` -* :vytask:`T3840` ``(feature): dns forwarding: Cache size should allow values > 10k`` -* :vytask:`T3672` ``(bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.conf configuration file output`` - - -2021-09-18 -========== - -* :vytask:`T3831` ``(bug): External traffic stops routing when IPSEC tunnel comes up with interface vti0`` -* :vytask:`T1968` ``(default): Allow multiple static routes in dhcp-server`` -* :vytask:`T3838` ``(feature): dhcp-server - sync cli for name-servers to other subsystems`` -* :vytask:`T3839` ``(feature): dhcp-server: Allow configuration of a DNS server and domain name on the shared-network level`` - - -2021-09-17 -========== - -* :vytask:`T3830` ``(bug): ipsec: remote-id no longer included in IKE AUTH if not explicitly specified`` - - -2021-09-11 -========== - -* :vytask:`T3402` ``(feature): Add VyOS programming library for operational level commands`` - - -2021-09-10 -========== - -* :vytask:`T3802` ``(bug): Commit fails if ethernet interface doesn't support flow control`` -* :vytask:`T3819` ``(bug): Upgrade Salt Stack 3002.3 -> 3003 release train`` -* :vytask:`T915` ``(feature): MPLS Support`` - - -2021-09-09 -========== - -* :vytask:`T3812` ``(bug): Vyos and frr route-map config out of sync`` -* :vytask:`T3814` ``(bug): wireguard: commit error showing incorrect peer name from the configured name`` -* :vytask:`T3805` ``(bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP interface`` -* :vytask:`T3815` ``(bug): pki : the file command 'generate pki wireguard key-pair file' is not working`` - - -2021-09-07 -========== - -* :vytask:`T1894` ``(bug): FRR config not loaded after daemons segfault or restart`` -* :vytask:`T3807` ``(bug): Op Command "show interfaces wireguard" does not show the output`` - - -2021-09-06 -========== - -* :vytask:`T3806` ``(bug): Don't set link local ipv6 address if MTU less then 1280`` -* :vytask:`T3803` ``(default): Add source-address option to the ping CLI`` -* :vytask:`T3431` ``(bug): Show version all bug`` -* :vytask:`T2920` ``(bug): Commit crash when adding the second mGRE tunnel with the same key`` - - -2021-09-05 -========== - -* :vytask:`T3804` ``(feature): cli: Migrate and merge "system name-servers-dhcp" into "system name-server"`` - - -2021-09-04 -========== - -* :vytask:`T3619` ``(bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage`` - - -2021-09-03 -========== - -* :vytask:`T3788` ``(bug): Keys are not allowed with ipip and sit tunnels`` -* :vytask:`T3634` ``(feature): Add op command option for ping for do not fragment bit to be set`` -* :vytask:`T3798` ``(feature): bgp: add support for "neighbor local-as replace-as" option`` - - -2021-09-02 -========== - -* :vytask:`T3792` ``(bug): login: A hypen present in a username from "system login user" is replaced by an underscore`` -* :vytask:`T3790` ``(bug): Does not possible to configure PPTP static ip-address to users`` -* :vytask:`T2947` ``(bug): Nat translation many-many with prefix does not map 1-1.`` - - -2021-08-31 -========== - -* :vytask:`T3789` ``(feature): Add custom validator for base64 encoded CLI data`` -* :vytask:`T3782` ``(default): Ingress Shaping with IFB No Longer Functional with 1.3`` - - -2021-08-30 -========== - -* :vytask:`T3768` ``(default): Remove early syntaxVersion implementation`` -* :vytask:`T2941` ``(default): Using a non-ASCII character in the description field causes UnicodeDecodeError in configsource.py`` -* :vytask:`T3787` ``(bug): Remove deprecated UDP fragmentation offloading option`` - - -2021-08-29 -========== - -* :vytask:`T3708` ``(bug): isisd and gre-bridge commit error`` -* :vytask:`T3783` ``(bug): "set protocols isis spf-delay-ietf" is not working`` -* :vytask:`T2750` ``(default): Use m4 as a template processor`` - - -2021-08-28 -========== - -* :vytask:`T3743` ``(bug): l2tp doesn't work after reboot if outside-address not 0.0.0.0`` - - -2021-08-27 -========== - -* :vytask:`T3182` ``(bug): Main blocker Task for FRR 7.4/7.5 series update`` -* :vytask:`T3568` ``(feature): Add XML for firewall conf-mode`` -* :vytask:`T2108` ``(default): Use minisign/signify instead of GPG for release signing`` - - -2021-08-26 -========== - -* :vytask:`T3776` ``(default): Rename FRR daemon restart op-mode commands`` -* :vytask:`T3739` ``(feature): policy: route-map: add EVPN match support`` - - -2021-08-25 -========== - -* :vytask:`T3773` ``(bug): Delete the "show system integrity" command (to prepare for a re-implementation)`` -* :vytask:`T3775` ``(bug): Typo in generated Strongswan VPN-config`` - - -2021-08-24 -========== - -* :vytask:`T3772` ``(bug): VRRP virtual interfaces are not shown in show interfaces`` - - -2021-08-23 -========== - -* :vytask:`T3769` ``(feature): Containers: Network Bridging`` - - -2021-08-22 -========== - -* :vytask:`T3090` ``(feature): Move 'adjust-mss' firewall options to the interface section.`` -* :vytask:`T3765` ``(default): container: additional op-mode commands`` - - -2021-08-20 -========== - -* :vytask:`T1950` ``(default): Store VyOS configuration syntax version data in JSON file`` - - -2021-08-19 -========== - -* :vytask:`T3751` ``(bug): pki generate ca add new line after passphrase`` -* :vytask:`T3764` ``(bug): Unconfigurable IKE and ESP lifetime`` -* :vytask:`T3234` ``(bug): multi_to_list fails in certain cases, with root cause an element redundancy in XML interface-definitions`` -* :vytask:`T3732` ``(feature): override-default helper should support adding defaultValues to default less nodes`` -* :vytask:`T3759` ``(default): [L3VPN] VPNv4/VPNv6 add commands`` - - -2021-08-18 -========== - -* :vytask:`T3752` ``(bug): generate pki certificate file xxx doesn't touch file`` - - -2021-08-16 -========== - -* :vytask:`T3738` ``(default): openvpn fails if server and authentication are configured`` -* :vytask:`T1594` ``(bug): l2tpv3 error on IPv6 local-ip`` - - -2021-08-15 -========== - -* :vytask:`T3756` ``(default): VyOS generates invalid QR code for wireguard clients`` -* :vytask:`T3757` ``(default): OSPF: add support to configure the area at an interface level`` - - -2021-08-14 -========== - -* :vytask:`T3745` ``(feature): op-mode IPSec show vpn ipse sa sorting`` - - -2021-08-13 -========== - -* :vytask:`T3749` ``(bug): V4/V6 Counters in network container validation aren't being reset`` -* :vytask:`T3728` ``(bug): FRR not respect configured RD and RT for L3VNI`` -* :vytask:`T3727` ``(bug): VPN IPsec ESP proposal and ESP presented in config missmatch`` -* :vytask:`T3740` ``(bug): HTTPs API breaks when the address is IPv6`` - - -2021-08-12 -========== - -* :vytask:`T3731` ``(bug): verify_accel_ppp_base_service return wrong config error for SSP`` -* :vytask:`T3405` ``(feature): PPPoE server unit-cache`` -* :vytask:`T2432` ``(default): dhcpd: Can't create new lease file: Permission denied`` -* :vytask:`T3746` ``(feature): Inform users logging into the system about a pending reboot`` -* :vytask:`T3744` ``(default): Dns forwarding statistics formatting missing a new line`` - - -2021-08-11 -========== - -* :vytask:`T3709` ``(feature): Snmp: Allow enable MIDs/OIDs ipCidrRouteTable`` - - -2021-08-09 -========== - -* :vytask:`T3720` ``(bug): IPSec set vti secondary address cause interface disable`` - - -2021-08-08 -========== - -* :vytask:`T3705` ``(bug): IPSec: VTI interface does not honor default-esp-group`` -* :vytask:`T2027` ``(bug): get_config_dict is failing when the configuration section is empty/missing`` - - -2021-08-05 -========== - -* :vytask:`T3719` ``(bug): Restart vpn shows some missed files`` - - -2021-08-04 -========== - -* :vytask:`T3704` ``(feature): Add ability to interact with Areca RAID adapers`` -* :vytask:`T3718` ``(bug): VPN IPsec IKE group by default not use DH-group 2`` - - -2021-08-02 -========== - -* :vytask:`T3601` ``(default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.`` - - -2021-08-01 -========== - -* :vytask:`T3707` ``(bug): Ping incorrect ip host checks`` - - -2021-07-31 -========== - -* :vytask:`T3716` ``(feature): Linux kernel parameters ignore_routes_with_link_down- ignore disconnected routing connections`` - - -2021-07-30 -========== - -* :vytask:`T1176` ``(default): FRR - BGP replicating routes`` -* :vytask:`T1210` ``(feature): About IKEv2 IPSec VPN remote access`` - - -2021-07-23 -========== - -* :vytask:`T3699` ``(bug): login: verify selected "system login user" name is not already used by the base system.`` -* :vytask:`T3698` ``(default): Support bridge monitoring`` - - -2021-07-13 -========== - -* :vytask:`T3679` ``(default): Point the unexpected exception message link to the new rolling release location`` - - -2021-07-11 -========== - -* :vytask:`T3665` ``(bug): Missing VRF support for VxLAN but already documented`` - - -2021-07-10 -========== - -* :vytask:`T3636` ``(feature): SSTP / L2TP ipv6 support broken`` - - -2021-07-09 -========== - -* :vytask:`T3667` ``(bug): brctl is damaged`` - - -2021-07-06 -========== - -* :vytask:`T3660` ``(feature): Conntrack-Sync configuration command to specify destination udp port for peer`` - - -2021-07-03 -========== - -* :vytask:`T57` ``(enhancment): Make it possible to disable the entire IPsec peer`` - - -2021-07-01 -========== - -* :vytask:`T3658` ``(feature): Add support for dhcpdv6 fixed-prefix6`` -* :vytask:`T2035` ``(bug): Executing vyos-smoketest multiple times makes ssh test fail on execution`` - - -2021-06-29 -========== - -* :vytask:`T3593` ``(bug): PPPoE server called-sid format does not work`` -* :vytask:`T1441` ``(feature): Add support for IPSec XFRM interfaces`` - - -2021-06-25 -========== - -* :vytask:`T3641` ``(feature): Upgrade base system from Debian Buster -> Debian Bullseye`` -* :vytask:`T3649` ``(feature): Add bonding additional hash-policy`` - - -2021-06-23 -========== - -* :vytask:`T3647` ``(feature): Bullseye: gcc defaults to passing --as-needed to linker`` - - -2021-06-22 -========== - -* :vytask:`T3629` ``(bug): IPoE server shifting address in the range`` -* :vytask:`T3645` ``(feature): Bullseye: ethtool changed output for ring-buffer information`` - - -2021-06-21 -========== - -* :vytask:`T3563` ``(default): commit-archive breaks with IPv6 source addresses`` - - -2021-06-20 -========== - -* :vytask:`T3637` ``(bug): vrf: bind-to-all didn't work properly`` -* :vytask:`T3639` ``(default): GCC preprocessor clobbers C comments`` - - -2021-06-19 -========== - -* :vytask:`T3633` ``(feature): Add LRO offload for interface ethernet`` - - -2021-06-18 -========== - -* :vytask:`T3599` ``(default): Migrate NHRP to XML/Python`` - - -2021-06-17 -========== - -* :vytask:`T3624` ``(feature): BGP: add support for extended community bandwidth definition`` - - -2021-06-16 -========== - -* :vytask:`T3623` ``(default): Fix for dummy interface option in the operational command "clear interfaces dummy"`` -* :vytask:`T3630` ``(feature): op-mode: add "show version kernel" command`` - - -2021-06-13 -========== - -* :vytask:`T3620` ``(feature): Rename WWAN interface from wirelessmodem to wwan to use QMI interface`` -* :vytask:`T2173` ``(feature): Add the ability to use VRF on VTI interfaces`` -* :vytask:`T3622` ``(feature): WWAN: add support for APN authentication`` -* :vytask:`T3606` ``(bug): SNMP unknown notification OID`` -* :vytask:`T3621` ``(bug): PPPoE interface does not validate if password is supplied when username is set`` - - -2021-06-12 -========== - -* :vytask:`T3611` ``(bug): WWAN interface (MC7710) no longer works on Kernel 5.10`` -* :vytask:`T1534` ``(bug): IPSec w/ IKEv2 Invalid local-address "any"`` -* :vytask:`T3616` ``(bug): Update to FastAPI causes regression in vyos-http-api-server`` - - -2021-06-11 -========== - -* :vytask:`T3614` ``(bug): Container network name with hyphen fail`` - - -2021-06-10 -========== - -* :vytask:`T3250` ``(bug): PPPoE server: wrong local usernames`` -* :vytask:`T3138` ``(bug): ddclient improperly updated when apply rfc2136 config`` -* :vytask:`T2645` ``(default): Editing route-map action requires adding a new rule`` - - -2021-06-08 -========== - -* :vytask:`T3605` ``(default): Allow to set prefer-global for ipv6-next-hop`` -* :vytask:`T3607` ``(feature): [route-map] set ipv6 next-hop prefer-global`` -* :vytask:`T3289` ``(bug): No description for node "service" conf-mode`` - - -2021-06-07 -========== - -* :vytask:`T3461` ``(bug): OpenConnect Server redundancy check`` -* :vytask:`T3455` ``(bug): system users can not be added in "edit"`` -* :vytask:`T3588` ``(default): IPSec: migrate no longer available options from CLI which are now hardcoded/enabled in strongSwan`` - - -2021-06-06 -========== - -* :vytask:`T842` ``(feature): Adopt VyOS CLI to latest StrongSwan options and deprecated Keywords`` - - -2021-06-04 -========== - -* :vytask:`T3595` ``(default): Cannot create new VTI interface`` -* :vytask:`T3592` ``(feature): Set default TTL 64 for tunnels`` - - -2021-06-03 -========== - -* :vytask:`T3384` ``(feature): Support UDP bandwidth testing`` - - -2021-06-02 -========== - -* :vytask:`T3233` ``(bug): Interface redirect to dum0`` - - -2021-06-01 -========== - -* :vytask:`T3585` ``(default): Fix NHRP module for updated interfaces tunnel syntax`` -* :vytask:`T3594` ``(bug): Disable by default service strongswan-starter`` - - -2021-05-30 -========== - -* :vytask:`T3518` ``(bug): Warning messages when using SCP commit-archive`` -* :vytask:`T3093` ``(default): Add xml for vpn ipsec`` -* :vytask:`T1866` ``(bug): Commit archive over SFTP doesn't work with non-standard ports`` -* :vytask:`T3590` ``(feature): bgp: add option for limiting maximum number of prefixes to be sent to a peer`` -* :vytask:`T3589` ``(feature): op-mode: support clearing out logfiles from CLI`` -* :vytask:`T2641` ``(feature): Rewrite vpn ipsec OP commands in new style XML syntax`` -* :vytask:`T3351` ``(feature): Installer checking MD5 checksums on the ISO image`` - - -2021-05-29 -========== - -* :vytask:`T1944` ``(bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure of Zebra`` -* :vytask:`T1888` ``(feature): Update to StrongSwan 5.9.1`` - - -2021-05-27 -========== - -* :vytask:`T3561` ``(feature): router-advert: support advertising specific routes`` -* :vytask:`T2669` ``(bug): DHCP-server overlapping ranges.`` - - -2021-05-26 -========== - -* :vytask:`T3540` ``(bug): Keepalived memory utilisation issue when constantly getting its state in JSON format`` - - -2021-05-24 -========== - -* :vytask:`T3575` ``(bug): pseudo-ethernet: must check source-interface MTU`` -* :vytask:`T3571` ``(bug): Broken Show Tab Complete`` -* :vytask:`T3555` ``(bug): GRE TAP tunnel does not silent fragment packets / kernel fix available`` -* :vytask:`T3576` ``(bug): ISIS does not support IPV6`` - - -2021-05-23 -========== - -* :vytask:`T3570` ``(default): Prevent setting of a larger MTU on child interfaces`` -* :vytask:`T3573` ``(bug): as-path-prepend Description Invalid`` -* :vytask:`T3572` ``(feature): Basic Drive Diagnostic Tools`` - - -2021-05-22 -========== - -* :vytask:`T3564` ``(default): Multiple BGP Confederation Peers Not Allowed`` - - -2021-05-21 -========== - -* :vytask:`T3551` ``(bug): QoS control failure of VLAN sub interface`` - - -2021-05-20 -========== - -* :vytask:`T3554` ``(feature): Add area-type stub for ospfv3`` -* :vytask:`T3565` ``(feature): sysctl: rewrite in XML and Python and drop from vyatta-cfg-system`` - - -2021-05-19 -========== - -* :vytask:`T3562` ``(feature): Update Accel-PPP to a newer revision`` -* :vytask:`T3559` ``(feature): Add restart op-command for OpenConnect Server`` - - -2021-05-18 -========== - -* :vytask:`T3525` ``(default): VMWare resume script syntax errors`` - - -2021-05-15 -========== - -* :vytask:`T3549` ``(bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not correctly exported to dhcpdv6.conf when multiple name-server entries are present`` -* :vytask:`T3532` ``(bug): Not possible to change ethertype after interface creation`` -* :vytask:`T3550` ``(bug): Router-advert completion typo`` -* :vytask:`T3547` ``(feature): conntrackd: remove deprecated config options`` -* :vytask:`T3535` ``(feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor`` - - -2021-05-14 -========== - -* :vytask:`T3346` ``(bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node exists but there are no rules`` -* :vytask:`T3248` ``(default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3`` -* :vytask:`T3426` ``(default): add support for script arguments to vyos-configd`` - - -2021-05-13 -========== - -* :vytask:`T3539` ``(bug): Typo in RPKI interface definition`` -* :vytask:`T439` ``(feature): local PBR support`` -* :vytask:`T3544` ``(feature): DHCP server should validate configuration before applying it`` -* :vytask:`T3543` ``(feature): Support for setting lacp_rate on LACP bonded interfaces`` - - -2021-05-12 -========== - -* :vytask:`T3302` ``(default): Make vyos-configd relay stdout from scripts to the user's console`` -* :vytask:`T3542` ``(bug): udev net.rules not installed in image since may 2nd`` - - -2021-05-10 -========== - -* :vytask:`T3374` ``(bug): IPv6 GRE Tunnel issues`` - - -2021-05-09 -========== - -* :vytask:`T3530` ``(bug): BGP peer-group can't contain a hyphen`` - - -2021-05-06 -========== - -* :vytask:`T3523` ``(bug): VRF BGP daemon route-map command missing`` -* :vytask:`T3519` ``(bug): Cannot add / assign L2TPv3 to vrf`` - - -2021-05-05 -========== - -* :vytask:`T3520` ``(bug): Cannot add tunnel interface to isis within vrf`` -* :vytask:`T3335` ``(bug): Some OSPFv3 show commands do not work`` - - -2021-05-04 -========== - -* :vytask:`T3504` ``(feature): BGP Per Peer Graceful Restart`` - - -2021-05-02 -========== - -* :vytask:`T3511` ``(bug): Update libnss-mapuser and libpam-radius packages from CUMULUS Linux`` - - -2021-05-01 -========== - -* :vytask:`T3379` ``(feature): Add global-parameters name-server for dhcpv6-server`` -* :vytask:`T3491` ``(default): Change Kernel HZ to 1000`` - - -2021-04-29 -========== - -* :vytask:`T3503` ``(bug): "route-reflector-client" fails when "remote-as" is "internal"`` -* :vytask:`T3502` ``(bug): "system ip multipath layer4-hashing" doesn't work`` - - -2021-04-28 -========== - -* :vytask:`T3473` ``(bug): IPSec op-mode show sa error`` - - -2021-04-27 -========== - -* :vytask:`T2946` ``(bug): Calling 'stty_size' causes show interfaces API to fail`` - - -2021-04-25 -========== - -* :vytask:`T3490` ``(bug): priority inversion on PBR "policy route" create, breaks default route from dhcp (live iso)`` -* :vytask:`T3468` ``(bug): Tunnel interfaces aren't suggested as being available for bridging (regression)`` -* :vytask:`T3497` ``(bug): Prefix list with rule containing only action is not detected as error during parse`` -* :vytask:`T3492` ``(bug): BGP Configuration Migration failed (badly!) from rolling 202102240218 to rolling 202104221210`` -* :vytask:`T1802` ``(feature): Wireguard QR code in cli for mobile devices`` - - -2021-04-24 -========== - -* :vytask:`T3472` ``(bug): commit-confirm script not found`` -* :vytask:`T3439` ``(bug): Commit-archive location not working for scp`` - - -2021-04-23 -========== - -* :vytask:`T3395` ``(bug): WAN load-balancing fails with nexthop dhcp`` -* :vytask:`T3290` ``(bug): Disabling GRE conntrack module fails`` - - -2021-04-20 -========== - -* :vytask:`T3488` ``(bug): Specifying an invalid "interface address" like dhcph leads to commit error`` - - -2021-04-18 -========== - -* :vytask:`T3481` ``(default): Exclude tag node values from key mangling`` -* :vytask:`T3475` ``(bug): XML dictionary cache unable to process syntaxVersion elements`` - - -2021-04-17 -========== - -* :vytask:`T3470` ``(bug): as-override isn't applied to frr`` - - -2021-04-15 -========== - -* :vytask:`T3386` ``(bug): PPPoE-server don't start with local authentication`` -* :vytask:`T3190` ``(feature): Unable to subtract value from local-preference in route-map`` - - -2021-04-14 -========== - -* :vytask:`T3398` ``(bug): Can't commit`` -* :vytask:`T3055` ``(bug): op-mode incorrect naming for ipsec policy-based tunnels`` - - -2021-04-13 -========== - -* :vytask:`T3436` ``(feature): Refactoring ospf op-mode for support vrf`` -* :vytask:`T3434` ``(feature): Refactoring bgp op-mode for support vrf`` - - -2021-04-12 -========== - -* :vytask:`T3454` ``(enhancment): dhclient reject option`` -* :vytask:`T3328` ``(bug): Bgp not possible to delete bgp route-map`` - - -2021-04-10 -========== - -* :vytask:`T3460` ``(bug): bgp, Configuration FRR failed while commiting code`` - - -2021-04-09 -========== - -* :vytask:`T3464` ``(bug): OSPF: route-map names containing a hypen are not "found"`` - - -2021-04-08 -========== - -* :vytask:`T3462` ``(default): show ipv6 bgp -- missing`` -* :vytask:`T3463` ``(bug): Prevent IPv4 Route exchange with IPv6 neighbors`` - - -2021-04-05 -========== - -* :vytask:`T3438` ``(bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf from the operating system`` -* :vytask:`T3418` ``(bug): BGP: system wide known interface can not be used as neighbor`` - - -2021-04-04 -========== - -* :vytask:`T3457` ``(feature): Output the "monitor log" command in a colorful way`` - - -2021-03-31 -========== - -* :vytask:`T3445` ``(bug): vyos-1x build include not all nodes`` - - -2021-03-30 -========== - -* :vytask:`T3448` ``(bug): Loading vyos on a system without xdp installed fails`` - - -2021-03-29 -========== - -* :vytask:`T3415` ``(feature): bridge: add support for isolated interfaces (private-vlan)`` -* :vytask:`T1711` ``(feature): BGP - migrate from tagNode to node (remove ASN from tagNode)`` - - -2021-03-28 -========== - -* :vytask:`T3440` ``(bug): HTTP API: give uvicorn time to initialize before restarting Nginx proxy`` - - -2021-03-27 -========== - -* :vytask:`T3423` ``(bug): Cannot create ipv4 static route for default gateway in vrf`` - - -2021-03-26 -========== - -* :vytask:`T3412` ``(default): HTTP API: move to FastAPI as web framework`` -* :vytask:`T2397` ``(feature): HTTP API: export OpenAPI definition`` - - -2021-03-24 -========== - -* :vytask:`T3419` ``(bug): show interfaces | strip-private fails`` - - -2021-03-22 -========== - -* :vytask:`T3284` ``(bug): merge/load fail silently if unable to resolve host`` - - -2021-03-21 -========== - -* :vytask:`T3417` ``(default): ISIS: provide per VRF instance support`` -* :vytask:`T3416` ``(bug): NTP: when running inside a VRF op-mode commands do not work`` - - -2021-03-20 -========== - -* :vytask:`T3392` ``(bug): vrrp over dhcp default route bug (unexpected vrf)`` -* :vytask:`T3373` ``(feature): Upgrade to SaltStack version 3002.5`` -* :vytask:`T3329` ``(default): "system conntrack ignore" rules can no longer be created due to an iptables syntax change`` -* :vytask:`T3300` ``(feature): Add DHCP default route distance`` -* :vytask:`T3306` ``(feature): Extend set route-map aggregator as to 4 Bytes`` - - -2021-03-18 -========== - -* :vytask:`T3411` ``(default): Extend the redirect_stdout context manager in vyos-configd to redirect stdout from subprocesses`` -* :vytask:`T3271` ``(bug): qemu-kvm grub issue`` - - -2021-03-17 -========== - -* :vytask:`T3413` ``(bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP address string passed to inet_pton"`` - - -2021-03-14 -========== - -* :vytask:`T3345` ``(default): BGP: add per VRF instance support`` -* :vytask:`T3344` ``(default): Per VRF dynamic routing support`` -* :vytask:`T3325` ``(bug): Bgp listen-range wrong commit message`` -* :vytask:`T1513` ``(default): Move OSPF and RIP interface configuration under protocols`` - - -2021-03-13 -========== - -* :vytask:`T3406` ``(bug): tunnel: interface no longer supports specifying encaplimit none - or migrator is missing`` -* :vytask:`T3407` ``(bug): console-server: do not allow to spawn a console-server session on serial port used by "system console"`` - - -2021-03-11 -========== - -* :vytask:`T3305` ``(bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot`` -* :vytask:`T2927` ``(bug): isc-dhcpd release and expiry events never execute`` - - -2021-03-09 -========== - -* :vytask:`T3382` ``(bug): Error creating Console Server`` - - -2021-03-08 -========== - -* :vytask:`T3387` ``(bug): Command "Monitor vpn ipsec" is not working`` - - -2021-03-07 -========== - -* :vytask:`T3388` ``(bug): show interfaces doesn't display pppoeX`` -* :vytask:`T3211` ``(feature): ability to redistribute ISIS into other routing protocols`` - - -2021-03-04 -========== - -* :vytask:`T3377` ``(bug): show interfaces throws error`` - - -2021-03-02 -========== - -* :vytask:`T3375` ``(bug): Interface becomes up at boot even when disabled`` - - -2021-02-28 -========== - -* :vytask:`T3370` ``(bug): dhcp: Invalid domain name "private"`` -* :vytask:`T3369` ``(feature): VXLAN: add IPv6 underlay support`` -* :vytask:`T3363` ``(bug): VyOS-Build interactive prompt when using Podman`` -* :vytask:`T3320` ``(bug): Bgp neighbor peer-group without peer-group fail`` - - -2021-02-27 -========== - -* :vytask:`T3365` ``(bug): Bgp neighbor interface ordering for remote-as`` -* :vytask:`T3225` ``(bug): Adding a BGP neighbor with an address on a local interface throws a vyos.frr.CommitError: Configuration FRR failed while committing code: ''`` -* :vytask:`T3368` ``(feature): macsec: add support for gcm-aes-256 cipher`` -* :vytask:`T3173` ``(feature): Need 'nopmtudisc' option for tunnel interface`` - - -2021-02-26 -========== - -* :vytask:`T3324` ``(bug): Bgp space in the password`` -* :vytask:`T3357` ``(default): HTTP-API redirect from http correct https port`` -* :vytask:`T3323` ``(bug): Bgp ttl-security and ebgp-multihop fail`` - - -2021-02-24 -========== - -* :vytask:`T3303` ``(feature): Change welcome message on boot`` - - -2021-02-22 -========== - -* :vytask:`T3322` ``(bug): Bgp neighbor timers not applyed to FRR config`` -* :vytask:`T3327` ``(bug): OSPFv3: Cannot add dummy interface`` - - -2021-02-21 -========== - -* :vytask:`T3331` ``(bug): Bgp unsuppress-map should be as "value leafNode"`` -* :vytask:`T3330` ``(bug): Bgp capability orf prefix-list fail`` -* :vytask:`T3163` ``(feature): ethernet ring-buffer can be set with an invalid value`` - - -2021-02-19 -========== - -* :vytask:`T3326` ``(bug): OSPFv3: Cannot add L2TPv3 interface`` -* :vytask:`T3332` ``(bug): BGP unnumbered - UnboundLocalError: local variable 'peer_group' referenced before assignment`` - - -2021-02-18 -========== - -* :vytask:`T3259` ``(default): many dnat rules makes the vyos http api crash, even showConfig op timeouts`` - - -2021-02-17 -========== - -* :vytask:`T3312` ``(feature): SolarFlare NICs support`` - - -2021-02-16 -========== - -* :vytask:`T3313` ``(bug): ospfv3 interface missing options`` -* :vytask:`T3318` ``(feature): Update Linux Kernel to v5.4.208 / 5.10.142`` - - -2021-02-15 -========== - -* :vytask:`T3311` ``(bug): BGP Error: Remote AS must be set for neighbor or peer-group`` - - -2021-02-14 -========== - -* :vytask:`T2848` ``(feature): bgp-add-path configuration options`` - - -2021-02-12 -========== - -* :vytask:`T3301` ``(bug): Wrong format and valueHelp for policy as-path-list regex`` - - -2021-02-11 -========== - -* :vytask:`T3281` ``(default): Rewrite protocol RIPng [conf-mode] to new XML/Python style`` -* :vytask:`T3282` ``(default): Add XML for [conf-mode] RIPng`` -* :vytask:`T3279` ``(default): Rewrite protocol STATIC [op-mode] to new XML/Python style`` -* :vytask:`T3297` ``(bug): Optimize irrelevant error stack hints`` - - -2021-02-08 -========== - -* :vytask:`T3295` ``(feature): Update Linux Kernel to v5.4.96 / 5.10.14`` - - -2021-02-05 -========== - -* :vytask:`T3030` ``(feature): Support ERSPAN Tunnel Protocol`` - - -2021-02-04 -========== - -* :vytask:`T3283` ``(feature): Support for IPv4 neigh tables`` -* :vytask:`T3280` ``(default): Add XML for [conf-mode] STATIC`` - - -2021-02-03 -========== - -* :vytask:`T3278` ``(feature): Add XML for "protocols vrf" [conf-mode]`` -* :vytask:`T3239` ``(default): XML: override 'defaultValue' for mtu of certain interfaces; remove workarounds`` -* :vytask:`T2910` ``(feature): XML: generator should support override of variables`` - - -2021-02-02 -========== - -* :vytask:`T3018` ``(bug): Unclear behaviour when configuring vif and vif-s interfaces`` -* :vytask:`T3255` ``(default): Rewrite protocol RPKI to new XML/Python style`` -* :vytask:`T3263` ``(feature): OSPF Hello subsecond timer`` - - -2021-01-31 -========== - -* :vytask:`T3276` ``(feature): Update Linux Kernel to v5.4.94 / 5.10.12`` - - -2021-01-30 -========== - -* :vytask:`T3240` ``(feature): Support per-interface DHCPv6 DUIDs`` -* :vytask:`T3273` ``(default): PPPoE static default-routes deleted on interface down when not added by interface up`` - - -2021-01-29 -========== - -* :vytask:`T3261` ``(bug): Does not possible to disable pppoe client interface.`` -* :vytask:`T3272` ``(default): OSPF: interface config is not removed`` - - -2021-01-27 -========== - -* :vytask:`T3257` ``(feature): tcpdump supporting complete protocol`` -* :vytask:`T3244` ``(default): Rewrite protocol OSPFv3 to new XML/Python style`` - - -2021-01-26 -========== - -* :vytask:`T3251` ``(bug): PPPoE client trying to authorize with the wrong username`` -* :vytask:`T3256` ``(default): Add XML for protocol RPKI [conf-mode]`` - - -2021-01-25 -========== - -* :vytask:`T3249` ``(feature): Support operation mode forwarding table output`` - - -2021-01-24 -========== - -* :vytask:`T3227` ``(bug): Latest releases don't work with RPKI (crash)`` -* :vytask:`T3230` ``(bug): RPKI can't be deleted`` -* :vytask:`T3221` ``(bug): FRR config`` -* :vytask:`T3245` ``(default): Add XML for protocol ospfv3 [conf-mode]`` - - -2021-01-23 -========== - -* :vytask:`T3236` ``(default): Add XML for [conf-mode] OSPF`` - - -2021-01-17 -========== - -* :vytask:`T3222` ``(bug): Typo in BGP dampening description`` -* :vytask:`T3226` ``(bug): Repair bridge smoke test damage`` - - -2021-01-16 -========== - -* :vytask:`T3215` ``(bug): Operational command "show ipv6 route" is broken`` -* :vytask:`T3157` ``(bug): salt-minion fails to start due to permission error accessing /root/.salt/minion.log`` -* :vytask:`T3137` ``(feature): Let VLAN aware bridge approach the behavior of professional equipment`` - - -2021-01-15 -========== - -* :vytask:`T3210` ``(feature): ISIS three-way-handshake`` -* :vytask:`T3184` ``(feature): Add correct desctiptions for BGP neighbors`` - - -2021-01-14 -========== - -* :vytask:`T3213` ``(bug): show interface command python error`` - - -2021-01-12 -========== - -* :vytask:`T3205` ``(bug): Does not possible to configure tunnel mode gre-bridge`` - - -2020-12-20 -========== - -* :vytask:`T3132` ``(feature): Enable egress flow accounting`` - - -2020-11-29 -========== - -* :vytask:`T2297` ``(feature): NTP add support for pool configuration`` diff --git a/docs/changelog/1.5.md b/docs/changelog/1.5.md new file mode 100644 index 00000000..1471358f --- /dev/null +++ b/docs/changelog/1.5.md @@ -0,0 +1,32 @@ +# 1.5 Circinus + +% Please don't add anything by hand. +% This file is managed by the script: +% _ext/releasenotes.py + +## 2023-09-11 + +- {vytask}`T5562` `(bug): Smoketests fail for vyos:current (test_netns.py)` +- {vytask}`T5551` `(bug): Missing check for boot_configuration_complete raises error in vyos-save-config.py` +- {vytask}`T5353` `(bug): config-mgmt: normalize archive updates and commit log entries` + +## 2023-09-10 + +- {vytask}`T5555` `(bug): Fix timezone migrator (system 13-to-14)` + +## 2023-09-09 + +- {vytask}`T5423` `(bug): ipsec: no output for op-cmd "show vpn ike secrets"` + +## 2023-09-08 + +- {vytask}`T5560` `(bug): VyOS version in current branch should be changed from 1.4 to 1.5` + +## 2023-09-07 + +- {vytask}`T5556` `(bug): reboot now and poweroff does not work` +- {vytask}`T5489` `(feature): Change to BBR as TCP congestion control, or at least make it an config option` + +## 2023-09-06 + +- {vytask}`T5548` `(bug): HAProxy renders timeouts incorrectly` diff --git a/docs/changelog/1.5.rst b/docs/changelog/1.5.rst deleted file mode 100644 index 206d5bde..00000000 --- a/docs/changelog/1.5.rst +++ /dev/null @@ -1,47 +0,0 @@ -############ -1.5 Circinus -############ - -.. - Please don't add anything by hand. - This file is managed by the script: - _ext/releasenotes.py - - -2023-09-11 -========== - -* :vytask:`T5562` ``(bug): Smoketests fail for vyos:current (test_netns.py)`` -* :vytask:`T5551` ``(bug): Missing check for boot_configuration_complete raises error in vyos-save-config.py`` -* :vytask:`T5353` ``(bug): config-mgmt: normalize archive updates and commit log entries`` - - -2023-09-10 -========== - -* :vytask:`T5555` ``(bug): Fix timezone migrator (system 13-to-14)`` - - -2023-09-09 -========== - -* :vytask:`T5423` ``(bug): ipsec: no output for op-cmd "show vpn ike secrets"`` - - -2023-09-08 -========== - -* :vytask:`T5560` ``(bug): VyOS version in current branch should be changed from 1.4 to 1.5`` - - -2023-09-07 -========== - -* :vytask:`T5556` ``(bug): reboot now and poweroff does not work`` -* :vytask:`T5489` ``(feature): Change to BBR as TCP congestion control, or at least make it an config option`` - - -2023-09-06 -========== - -* :vytask:`T5548` ``(bug): HAProxy renders timeouts incorrectly`` diff --git a/docs/changelog/index.md b/docs/changelog/index.md new file mode 100644 index 00000000..82511ed6 --- /dev/null +++ b/docs/changelog/index.md @@ -0,0 +1,19 @@ +(release-notes)= + +# Changelog + +```{eval-rst} +.. toctree:: + :maxdepth: 1 + :includehidden: + + 1.5 + 1.4 + 1.3 + 1.2.6 + 1.2.5 + 1.2.4 + 1.2.3 + 1.2.2 + 1.2.1 +``` diff --git a/docs/changelog/index.rst b/docs/changelog/index.rst deleted file mode 100644 index 9467a716..00000000 --- a/docs/changelog/index.rst +++ /dev/null @@ -1,21 +0,0 @@ -.. _release-notes: - - -######### -Changelog -######### - - -.. toctree:: - :maxdepth: 1 - :includehidden: - - 1.5 - 1.4 - 1.3 - 1.2.6 - 1.2.5 - 1.2.4 - 1.2.3 - 1.2.2 - 1.2.1 diff --git a/docs/changelog/md-1.2.1.md b/docs/changelog/md-1.2.1.md deleted file mode 100644 index 967d566e..00000000 --- a/docs/changelog/md-1.2.1.md +++ /dev/null @@ -1,50 +0,0 @@ -# 1.2.1 - -VyOS 1.2.1 is a maintenance release made in April 2019. - -## Resolved issues - -- Package updates: kernel 4.19.32, open-vm-tools 10.3, latest Intel NIC drivers -- {vytask}`T1326` The kernel now includes drivers for various USB serial - adapters, which allows people to add a serial console to a machine without - onboard RS232, or connect to something else from the router -- The collection of network card firmware is now much more extensive -- {vytask}`T1271` VRRP now correctly uses a virtual rather than physical MAC - addresses in the RFC-compliant mode -- {vytask}`T1330` DHCP WPAD URL option works correctly again -- {vytask}`T1312` Many to many NAT rules now can use source/destination and - translation networks of non-matching size. If 1:1 network bits translation is - desired, it's now users responsibility to check if prefix length matches. -- {vytask}`T1290` IPv6 network prefix translation is fixed -- {vytask}`T1308` Non-alphanumeric characters such as `>` can now be safely - used in PPPoE passwords -- {vytask}`T1305` `show | commands` no longer fails when a config section ends - with a leaf node such as `timezone` in `show system | commands` -- {vytask}`T1235` `show | commands` correctly works in config mode now -- {vytask}`T1298` VTI is now compatible with the DHCP-interface IPsec option -- {vytask}`T1277` `show dhcp server statistics` command was broken in latest - Crux -- {vytask}`T1261` An issue with TFTP server refusing to listen on addresses - other than loopback was fixed -- {vytask}`T1224` Template issue that might cause UDP broadcast relay fail to - start is fixed -- {vytask}`T1067` VXLAN value validation is improved -- {vytask}`T1211` Blank hostnames in DHCP updates no longer can crash DNS - forwarding -- {vytask}`T1322` Correct configuration is now generated for DHCPv6 relays with - more than one upstream interface -- {vytask}`T1234` `relay-agents-packets` option works correctly now -- {vytask}`T1231` Dynamic DNS data is now cleaned on configuration change -- {vytask}`T1282` Remote Syslog can now use a fully qualified domain name -- {vytask}`T1279` ACPI power off works again -- {vytask}`T1247` Negation in WAN load balancing rules works again -- {vytask}`T1218` FRR staticd now starts on boot correctly -- {vytask}`T1296` The installer now correctly detects SD card devices -- {vytask}`T1225` Wireguard peers can be disabled now -- {vytask}`T1217` The issue with Wireguard interfaces impossible to delete - is fixed -- {vytask}`T1160` Unintended IPv6 access is fixed in SNMP configuration -- {vytask}`T1060` It's now possible to exclude hosts from the transparent - web proxy -- {vytask}`T484` An issue with rules impossible to delete from the zone-based - firewall is fixed diff --git a/docs/changelog/md-1.2.2.md b/docs/changelog/md-1.2.2.md deleted file mode 100644 index 972a38be..00000000 --- a/docs/changelog/md-1.2.2.md +++ /dev/null @@ -1,43 +0,0 @@ -# 1.2.2 - -1.2.2 is a maintenance release made in July 2019. - -## New features - -- Options for per-interface MSS clamping. -- BGP extended next-hop capability -- Relaxed BGP multipath option -- Internal and external options for "remote-as" (accept any AS as long as it's - the same to this router or different, respectively) -- "Unnumbered" (interface-based) BGP peers -- BGP no-prepend option -- Additive BGP community option -- OSPFv3 network type option -- Custom arguments for VRRP scripts -- A script for querying values from config files - -## Resolved issues - -- Linux kernel 4.19.54, including a fix for the TCP SACK vulnerability -- {vytask}`T1371` VRRP health-check scripts now can use arguments -- {vytask}`T1497` DNS server addresses coming from a DHCP server are now - correctly propagated to resolv.conf -- {vytask}`T1469` Domain-specific name servers in DNS forwarding are now used - for recursive queries -- {vytask}`T1433` `run show dhcpv6 server leases` now display leases correctly -- {vytask}`T1461` Deleting `firewall options` node no longer causes errors -- {vytask}`T1458` Correct hostname is sent to remote syslog again -- {vytask}`T1438` Board serial number from DMI is correctly displayed in - `show version` -- {vytask}`T1358`, {vytask}`T1355`, {vytask}`T1294` Multiple corrections in - remote syslog config -- {vytask}`T1255` Fixed missing newline in `/etc/hosts` -- {vytask}`T1174` `system domain-name` is correctly included in - `/etc/resolv.conf` -- {vytask}`T1465` Fixed priority inversion in `interfaces vti vtiX ip` - settings -- {vytask}`T1446` Fixed errors when installing with RAID1 on UEFI machines -- {vytask}`T1387` Fixed an error on disabling an interfaces that has no address -- {vytask}`T1367` Fixed deleting VLAN interface with non-default MTU -- {vytask}`T1505` vyos.config `return_effective_values()` function now - correctly returns a list rather than a string diff --git a/docs/changelog/md-1.2.3.md b/docs/changelog/md-1.2.3.md deleted file mode 100644 index 96ca1818..00000000 --- a/docs/changelog/md-1.2.3.md +++ /dev/null @@ -1,58 +0,0 @@ -# 1.2.3 - -1.2.3 is a maintenance and feature backport release made in September 2019. - -## New features - -- HTTP API -- {vytask}`T1524` "set service dns forwarding allow-from \" - option for limiting queries to specific client networks -- {vytask}`T1503` Functions for checking if a commit is in progress -- {vytask}`T1543` "set system contig-mangement commit-archive source-address" - option -- {vytask}`T1554` Intel NIC drivers now support receive side scaling and - multiqueue - -## Resolved issues - -- {vytask}`T1209` OSPF max-metric values over 100 no longer causes commit - errors -- {vytask}`T1333` Fixes issue with DNS forwarding not performing recursive - lookups on domain specific forwarders -- {vytask}`T1362` Special characters in VRRP passwords are handled correctly -- {vytask}`T1377` BGP weight is applied properly -- {vytask}`T1420` Fixed permission for log files -- {vytask}`T1425` Wireguard interfaces now support /31 addresses -- {vytask}`T1428` Wireguard correctly handles firewall marks -- {vytask}`T1439` DHCPv6 static mappings now work correctly -- {vytask}`T1450` Flood ping commands now works correctly -- {vytask}`T1460` Op mode "show firewall" commands now support counters longer - than 8 digits (T1460) -- {vytask}`T1465` Fixed priority inversion in VTI commands -- {vytask}`T1468` Fixed remote-as check in the BGP route-reflector-client option -- {vytask}`T1472` It's now possible to re-create VRRP groups with RFC - compatibility mode enabled -- {vytask}`T1527` Fixed a typo in DHCPv6 server help strings -- {vytask}`T1529` Unnumbered BGP peers now support VLAN interfaces -- {vytask}`T1530` Fixed "set system syslog global archive file" command -- {vytask}`T1531` Multiple fixes in cluster configuration scripts -- {vytask}`T1537` Fixed missing help text for "service dns" -- {vytask}`T1541` Fixed input validation in DHCPv6 relay options -- {vytask}`T1551` It's now possible to create a QinQ interface and a firewall - assigned to it in one commit -- {vytask}`T1559` URL filtering now uses correct rule database path and works - again -- {vytask}`T1579` "show log vpn ipsec" command works again -- {vytask}`T1576` "show arp interface \" command works again -- {vytask}`T1605` Fixed regression in L2TP/IPsec server -- {vytask}`T1613` Netflow/sFlow captures IPv6 traffic correctly -- {vytask}`T1616` "renew dhcpv6" command now works from op mode -- {vytask}`T1642` BGP remove-private-as option iBGP vs eBGP check works - correctly now -- {vytask}`T1540`, {vytask}`T1360`, {vytask}`T1264`, {vytask}`T1623` Multiple - improvements in name servers and hosts configuration handling - -## Internals - -`/etc/resolv.conf` and `/etc/hosts` files are now managed by the -*vyos-hostsd* service that listens on a ZMQ socket for update messages. diff --git a/docs/changelog/md-1.2.4.md b/docs/changelog/md-1.2.4.md deleted file mode 100644 index bc098699..00000000 --- a/docs/changelog/md-1.2.4.md +++ /dev/null @@ -1,75 +0,0 @@ -# 1.2.4 - -1.2.4 is a maintenance release made in December 2019. - -## Resolved issues - -- {vytask}`T258` Can not configure wan load-balancing on vyos-1.2 -- {vytask}`T818` SNMP v3 - remove required engineid from user node -- {vytask}`T1030` Upgrade ddclient from 3.8.2 to 3.9. - (support Cloudflare API v4) -- {vytask}`T1183` BFD Support via FRR -- {vytask}`T1299` Allow SNMPd to be extended with custom scripts -- {vytask}`T1351` accel-pppoe adding CIDR based IP pool option -- {vytask}`T1391` In route-map set community additive -- {vytask}`T1394` syslog systemd and host_name.py race condition -- {vytask}`T1401` Copying files with the FTP protocol fails if the passwor - contains special characters -- {vytask}`T1421` OpenVPN client push-route stopped working, needs added quotes - to fix -- {vytask}`T1430` Add options for custom DHCP client-id and hostname -- {vytask}`T1447` Python subprocess called without import in host_name.py -- {vytask}`T1470` improve output of "show dhcpv6 server leases" -- {vytask}`T1485` Enable 'AdvIntervalOpt' option in for radvd.conf -- {vytask}`T1496` Separate rolling release and LTS kernel builds -- {vytask}`T1560` "set load-balancing wan rule 0" causes segfault and prevent - load balancing from starting -- {vytask}`T1568` strip-private command improvement for additional masking o - IPv6 and MAC address -- {vytask}`T1578` completion offers "show table", but show table does not exist -- {vytask}`T1593` Support ip6gre -- {vytask}`T1597` /usr/sbin/rsyslogd after deleting "system syslog" -- {vytask}`T1638` vyos-hostsd not setting system domain name -- {vytask}`T1678` hostfile-update missing line feed -- {vytask}`T1694` NTPd: Do not listen on all interfaces by default -- {vytask}`T1701` Delete domain-name and domain-search won't work -- {vytask}`T1705` High CPU usage by bgpd when snmp is active -- {vytask}`T1707` DHCP static mapping and exclude address not working -- {vytask}`T1708` Update Rolling Release Kernel to 4.19.76 -- {vytask}`T1709` Update WireGuard to 0.0.20190913 -- {vytask}`T1716` Update Intel NIC drivers to recent versions -- {vytask}`T1726` Update Linux Firmware binaries to a more recen - version 2019-03-14 -> 2019-10-07 -- {vytask}`T1728` Update Linux Kernel to 4.19.79 -- {vytask}`T1737` SNMP tab completion missing -- {vytask}`T1738` Copy SNMP configuration from node to node raises exception -- {vytask}`T1740` Broken OSPFv2 virtual-link authentication -- {vytask}`T1742` NHRP unable to commit. -- {vytask}`T1745` dhcp-server commit fails with "DHCP range stop address - must be greater or equal to the range start address y!" when static mapping - has same IP as range stop -- {vytask}`T1749` numeric validator doesn't support multiple ranges -- {vytask}`T1769` Remove complex SNMPv3 Transport Security Model (TSM) -- {vytask}`T1772` \ constraints in XML are partially broken -- {vytask}`T1778` Kilobits/Megabits difference in configuration Vyos/FRR -- {vytask}`T1780` Adding ipsec ike closeaction -- {vytask}`T1786` disable-dhcp-nameservers is missed in current host_name.p - implementation -- {vytask}`T1788` Intel QAT (QuickAssist Technology ) implementation -- {vytask}`T1792` Update WireGuard to Debian release 0.0.20191012-1 -- {vytask}`T1800` Update Linux Kernel to v4.19.84 -- {vytask}`T1809` Wireless: SSID scan does not work in AP mode -- {vytask}`T1811` Upgrade from 1.1.8: Config file migratio - failed: module=l2tp -- {vytask}`T1812` DHCP: hostnames of clients not resolving afte - update v1.2.3 -> 1.2-rolling -- {vytask}`T1819` Reboot kills SNMPv3 configuration -- {vytask}`T1822` Priority inversion wireless interface dhcpv6 -- {vytask}`T1825` Improve DHCP configuration error message -- {vytask}`T1836` import-conf-mode-commands in vyos-1x/scripts fails - to create an xml -- {vytask}`T1839` LLDP shows "VyOS unknown" instead of "VyOS" -- {vytask}`T1841` PPP ipv6-up.d direcotry missing -- {vytask}`T1893` igmp-proxy: Do not allow adding unknown interface -- {vytask}`T1903` Implementation udev predefined interface naming -- {vytask}`T1904` update eth1 and eth2 link files for the vep4600 diff --git a/docs/changelog/md-1.2.5.md b/docs/changelog/md-1.2.5.md deleted file mode 100644 index 4e0c67bb..00000000 --- a/docs/changelog/md-1.2.5.md +++ /dev/null @@ -1,68 +0,0 @@ -# 1.2.5 - -1.2.5 is a maintenance release made in April 2020. - -## Resolved issues - -- {vytask}`T1020` OSPF Stops distributing default route after a while -- {vytask}`T1228` pppoe default-route force option not working (Rel 1.2.0-rc11) -- {vytask}`T1301` bgp peer-groups don't work when "no-ipv4-unicast" is enabled. -- {vytask}`T1341` Adding rate-limiter for pppoe server users -- {vytask}`T1376` Incorrect DHCP lease counting -- {vytask}`T1392` Large firewall rulesets cause the system to lose configuration - and crash at startup -- {vytask}`T1416` 2 dhcp server run in failover mode can't sync hostname with - each other -- {vytask}`T1452` accel-pppoe - add vendor option to shaper -- {vytask}`T1490` BGP configuration (is lost|not applied) when updating - 1.1.8 -> 1.2.1 -- {vytask}`T1780` Adding ipsec ike closeaction -- {vytask}`T1803` Unbind NTP while it's not requested... -- {vytask}`T1821` "authentication mode radius" has no effect for PPPoE server -- {vytask}`T1827` Increase default gc_thresh -- {vytask}`T1828` Missing completion helper for "set system syslog host - 192.0.2.1 facility all protocol" -- {vytask}`T1832` radvd adding feature DNSSL branch.example.com example.com to - existing package -- {vytask}`T1837` PPPoE unrecognized option 'replacedefaultroute' -- {vytask}`T1851` wireguard - changing the pubkey on an existing peer seems to - destroy the running config. -- {vytask}`T1858` l2tp: Delete depricated outside-nexthop and add gateway-address -- {vytask}`T1864` Lower IPSec DPD timeout lower limit from 10s -> 2s -- {vytask}`T1879` Extend Dynamic DNS XML definition value help strings and - validators -- {vytask}`T1881` Execute permissions are removed from custom SNMP scripts at - commit time -- {vytask}`T1884` Keeping VRRP transition-script native behaviour and adding - stop-script -- {vytask}`T1891` Router announcements broken on boot -- {vytask}`T1900` Enable SNMP for VRRP. -- {vytask}`T1902` Add redistribute non main table in bgp -- {vytask}`T1909` Incorrect behaviour of static routes with overlapping networks -- {vytask}`T1913` "system ipv6 blacklist" command has no effect -- {vytask}`T1914` IPv6 multipath hash policy does not apply -- {vytask}`T1917` Update WireGuard to Debian release 0.0.20191219-1 -- {vytask}`T1934` Change default hostname when deploy from OVA without params. -- {vytask}`T1935` NIC identification and usage problem in Hyper-V environments -- {vytask}`T1936` pppoe-server CLI control features -- {vytask}`T1964` SNMP Script-extensions allows names with spaces, but commit - fails -- {vytask}`T1967` BGP parameter "enforce-first-as" does not work anymore -- {vytask}`T1970` Correct adding interfaces on boot -- {vytask}`T1971` Missing modules in initrd.img for PXE boot -- {vytask}`T1998` Update FRR to 7.3 -- {vytask}`T2001` Error when router reboot -- {vytask}`T2032` Monitor bandwidth bits -- {vytask}`T2059` Set source-validation on bond vif don't work -- {vytask}`T2066` PPPoE interface can be created multiple times - last wins -- {vytask}`T2069` PPPoE-client does not works with service-name option -- {vytask}`T2077` ISO build from crux branch is failing -- {vytask}`T2079` Update Linux Kernel to v4.19.106 -- {vytask}`T2087` Add maxfail 0 option to pppoe configuration. -- {vytask}`T2100` BGP route adverisement wih checks rib -- {vytask}`T2120` "reset vpn ipsec-peer" doesn't work with named peers -- {vytask}`T2197` Cant add vif-s interface into a bridge -- {vytask}`T2228` WireGuard does not allow ports < 1024 to be used -- {vytask}`T2252` HTTP API add system image can return '504 Gateway Time-out' -- {vytask}`T2272` Set system flow-accounting disable-imt has syntax error -- {vytask}`T2276` PPPoE server vulnerability diff --git a/docs/changelog/md-1.2.6.md b/docs/changelog/md-1.2.6.md deleted file mode 100644 index 0815bb05..00000000 --- a/docs/changelog/md-1.2.6.md +++ /dev/null @@ -1,104 +0,0 @@ -# 1.2.6-S1 - -1.2.6-S1 is a security release release made in September 2020. - -## Resolved issues - -VyOS 1.2.6 release was found to be suspectible to CVE-2020-10995. It's a low- -impact vulnerability in the PowerDNS recursor that allows an attacker to cause -performance degradation via a specially crafted authoritative DNS server reply. - -- {vytask}`T2899` remote syslog server migration error on update - -# 1.2.6 - -1.2.6 is a maintenance release made in September 2020. - -(resovled-issues-1-2-6)= - -## Resolved issues - -- {vytask}`T103` DHCP server prepends shared network name to hostnames -- {vytask}`T125` Missing PPPoE interfaces in l2tp configuration -- {vytask}`T1194` cronjob is being setup even if not saved -- {vytask}`T1205` module pcspkr missing -- {vytask}`T1219` Redundant active-active configuration, asymmetric routing and - conntrack-sync cache -- {vytask}`T1220` Show transceiver information from plugin modules, e.g SFP+, - QSFP -- {vytask}`T1221` BGP - Default route injection is not processed by the specific - route-map -- {vytask}`T1241` Remove of policy route throws CLI error -- {vytask}`T1291` Under certain conditions the VTI will stay forever down -- {vytask}`T1463` Missing command `show ip bgp scan` appears in command - completion -- {vytask}`T1575` `show snmp mib ifmib` crashes with IndexError -- {vytask}`T1699` Default net.ipv6.route.max_size 32768 is too low -- {vytask}`T1729` PIM (Protocol Independent Multicast) implementation -- {vytask}`T1901` Semicolon in values is interpreted as a part of the shell - command by validators -- {vytask}`T1934` Change default hostname when deploy from OVA without params. -- {vytask}`T1938` syslog doesn't start automatically -- {vytask}`T1949` Multihop IPv6 BFD is unconfigurable -- {vytask}`T1953` DDNS service name validation rejects valid service names -- {vytask}`T1956` PPPoE server: support PADO-delay -- {vytask}`T1973` Allow route-map to match on BGP local preference value -- {vytask}`T1974` Allow route-map to set administrative distance -- {vytask}`T1982` Increase rotation for atop.acct -- {vytask}`T1983` Expose route-map when BGP routes are programmed in to FIB -- {vytask}`T1985` pppoe: Enable ipv6 modules without configured ipv6 pools -- {vytask}`T2000` strongSwan does not install routes to table 220 in certain - cases -- {vytask}`T2021` OSPFv3 doesn't support decimal area syntax -- {vytask}`T2062` Wrong dhcp-server static route subnet bytes -- {vytask}`T2091` swanctl.conf file is not generated properly is more than one - IPsec profile is used -- {vytask}`T2131` Improve syslog remote host CLI definition -- {vytask}`T2224` Update Linux Kernel to v4.19.114 -- {vytask}`T2286` IPoE server vulnerability -- {vytask}`T2303` Unable to delete the image version that came from OVA -- {vytask}`T2305` Add release name to "show version" command -- {vytask}`T2311` Statically configured name servers may not take precedence - over ones from DHCP -- {vytask}`T2327` Unable to create syslog server entry with different port -- {vytask}`T2332` Backport node option for a syslog server -- {vytask}`T2342` Bridge l2tpv3 + ethX errors -- {vytask}`T2344` PPPoE server client static IP assignment silently fails -- {vytask}`T2385` salt-minion: improve completion helpers -- {vytask}`T2389` BGP community-list unknown command -- {vytask}`T2398` op-mode "dhcp client leases interface" completion helper - misses interfaces -- {vytask}`T2402` Live ISO should warn when configuring that changes won't - persist -- {vytask}`T2443` NHRP: Add debugging information to syslog -- {vytask}`T2448` `monitor protocol bgp` subcommands fail with 'command - incomplete' -- {vytask}`T2458` Update FRR to 7.3.1 -- {vytask}`T2476` Bond member description change leads to network outage -- {vytask}`T2478` login radius: use NAS-IP-Address if defined source address -- {vytask}`T2482` Update PowerDNS recursor to 4.3.1 for CVE-2020-10995 -- {vytask}`T2517` vyos-container: link_filter: No such file or directory -- {vytask}`T2526` Wake-On-Lan CLI implementation -- {vytask}`T2528` "update dns dynamic" throws FileNotFoundError excepton -- {vytask}`T2536` "show log dns forwarding" still refers to dnsmasq -- {vytask}`T2538` Update Intel NIC drivers to recent release (preparation for - Kernel >=5.4) -- {vytask}`T2545` Show physical device offloading capabilities for specified - ethernet interface -- {vytask}`T2563` Wrong interface binding for Dell VEP 1445 -- {vytask}`T2605` SNMP service is not disabled by default -- {vytask}`T2625` Provide generic Library for package builds -- {vytask}`T2686` FRR: BGP: large-community configuration is not applied - properly after upgrading FRR to 7.3.x series -- {vytask}`T2701` `vpn ipsec pfs enable` doesn't work with IKE groups -- {vytask}`T2728` Protocol option ignored for IPSec peers in transport mode -- {vytask}`T2734` WireGuard: fwmark CLI definition is inconsistent -- {vytask}`T2757` "show system image version" contains additional new-line - character breaking output -- {vytask}`T2797` Update Linux Kernel to v4.19.139 -- {vytask}`T2822` Update Linux Kernel to v4.19.141 -- {vytask}`T2829` PPPoE server: mppe setting is implemented as node instead of - leafNode -- {vytask}`T2831` Update Linux Kernel to v4.19.142 -- {vytask}`T2852` rename dynamic dns interface breaks ddclient.cache permissions -- {vytask}`T2853` Intel QAT acceleration does not work diff --git a/docs/changelog/md-1.3.md b/docs/changelog/md-1.3.md deleted file mode 100644 index 70eeea87..00000000 --- a/docs/changelog/md-1.3.md +++ /dev/null @@ -1,4317 +0,0 @@ -# 1.3 Equuleus - -% Please don't add anything by hand. -% This file is managed by the script: -% _ext/releasenotes.py - -## 2024-04-25 - -- {vytask}`T6249` `(default): ISO builder fails because of changed buster-backport repository` - -## 2024-04-23 - -- {vytask}`T6261` `(default): Typo in op_mode connect_disconnect print statement for check_ppp_running` - -## 2024-04-17 - -- {vytask}`T6243` `(bug): Update vyos-http-api-tools for package idna security advisory` - -## 2024-04-12 - -- {vytask}`T3437` `(bug): BGP Confederation Addition Causes Error` - -## 2024-04-10 - -- {vytask}`T6124` `(bug): Docker equuleus build image doesn't build due to fpm` - -## 2024-04-08 - -- {vytask}`T6196` `(bug): Route-map and summary-only do not work in BGP aggregation at the same time` - -## 2024-04-07 - -- {vytask}`T1244` `(default): Support for StartupResync in conntrackd` - -## 2024-04-05 - -- {vytask}`T2590` `(bug): DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c` - -## 2024-04-04 - -- {vytask}`T4146` `(bug): Nginx should not listen on port 80` -- {vytask}`T1976` `(default): deleting address-family under neighbor will disable neighbor` -- {vytask}`T5625` `(default): "restart vpn" does not work if ipsec-interfaces is not set` -- {vytask}`T3020` `(bug): The "scp" example is wrong in the bash-completion for "set system config-management commit-archive location"` -- {vytask}`T2250` `(default): vyos-build "make iso" error if configure was ran outside of the docker container` -- {vytask}`T2139` `(default): openvpn: allow "dh-file none" to disable DH for ECDH keys` -- {vytask}`T2014` `(default): Use vendor specific NTP Pool hostname` -- {vytask}`T1118` `(bug): Obsolete "utc" option in time selector in firewall` -- {vytask}`T948` `(feature): integrate aws cloud watch scripts into AMI` - -## 2024-04-02 - -- {vytask}`T6150` `(bug): Impossible to set a static IP address via Radius in IPoE` - -## 2024-04-01 - -- {vytask}`T6193` `(bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP name-server option" for VLAN interfaces` - -## 2024-03-22 - -- {vytask}`T6110` `(bug): dhcp server - If failover is defined, range is required` -- {vytask}`T5624` `(default): Remove /etc/debian_version from the image` - -## 2024-03-11 - -- {vytask}`T2998` `(bug): SNMP v3 oid "exclude" option doesn't work` -- {vytask}`T6096` `(bug): Config commits are not synced properly because 00vyos-sync is deleted by vyos-router` -- {vytask}`T6057` `(feature): Add ability to disable syslog for conntrackd` -- {vytask}`T5504` `(feature): Keepalived VRRP ability to set more than one peer-address` - -## 2024-03-07 - -- {vytask}`T3992` `(bug): Traceback on adding interface to bridge with configured ip address` - -## 2024-03-06 - -- {vytask}`T6088` `(bug): Configuration corrupted after saving and powercut or force reboot` - -## 2024-02-16 - -- {vytask}`T2113` `(bug): OpenVPN Options error: you cannot use --verify-x509-name with --compat-names or --no-name-remapping` -- {vytask}`T5418` `(bug): PPPoE-Server Client IP pool Subnet` - -## 2024-02-15 - -- {vytask}`T2612` `(bug): HTTPS API, changing API key fails but goes through` -- {vytask}`T656` `(enhancment): Rewrite wirelessmodem in new style XML interface definition` - -## 2024-02-14 - -- {vytask}`T2044` `(bug): RPKI doesn't boot properly` - -## 2024-02-08 - -- {vytask}`T6014` `(feature): Bump keepalived version` - -## 2024-02-07 - -- {vytask}`T6017` `(bug): Update vyos-http-api-tools for security advisory` - -## 2024-02-02 - -- {vytask}`T5914` `(bug): CVE-2023-48795 - Terrapin vulnerability` -- {vytask}`T5739` `(bug): Password recovery does not work if public keys are configured` - -## 2024-02-01 - -- {vytask}`T5967` `(bug): Multi-hop BFD connections can't be established; please add minimum-ttl option.` - -## 2024-01-22 - -- {vytask}`T4721` `(feature): Static IPv6 Route Tags Missing` - -## 2024-01-20 - -- {vytask}`T5187` `(bug): Update Realtek r8152 driver` -- {vytask}`T5182` `(bug): Update Intel ice driver` -- {vytask}`T5180` `(bug): initramfs-tools ignores firmware from updates directory` -- {vytask}`T4990` `(bug): Commit results may not be properly saved if power is cut immediately after a successful commit` -- {vytask}`T4039` `(feature): Rsyslog to use 'protocol23format' for protocol UDP` -- {vytask}`T3813` `(bug): Some custom sysctl parameters can't be applied bug` -- {vytask}`T2579` `(feature): The root task for VRF features` -- {vytask}`T2546` `(feature): The root task for rewriting [op-mode] to XML` -- {vytask}`T2452` `(default): Serial console related issues` - -## 2024-01-19 - -- {vytask}`T5543` `(bug): Fix source address handling in static joins` - -## 2024-01-14 - -- {vytask}`T5715` `(bug): IPSec VPN: restart vpn is not working` - -## 2024-01-13 - -- {vytask}`T5924` `(bug): Build cannot pass the smoketest dialup-router-medium-vpn` - -## 2024-01-11 - -- {vytask}`T5275` `(default): Add op mode commands for exporting certificates to PEM files with correct headers` -- {vytask}`T5274` `(default): Add a deprecation warning for OpenVPN site-to-site with pre-shared secret` -- {vytask}`T3191` `(bug): PAM RADIUS freezing when accounting does not configured on RADIUS server` - -## 2024-01-10 - -- {vytask}`T4646` `(bug): USB serial output console does not work` -- {vytask}`T4466` `(bug): intel i225-v nic does not detect link after boot` -- {vytask}`T4222` `(feature): Support for TWAMP as round-trip metric` -- {vytask}`T1369` `(bug): GCP Networking Failure` - -## 2024-01-09 - -- {vytask}`T3242` `(bug): PPPoE Server overhead on virtual interfaces creation` -- {vytask}`T2755` `(default): Requirements for partial interface setup` -- {vytask}`T2494` `(bug): systemd dependencies issues` -- {vytask}`T2343` `(feature): Disable memory ballooning in VM templates` -- {vytask}`T2254` `(default): Provide more information on the build branch in the version data` -- {vytask}`T2223` `(feature): convert operational show interfaces to python/XML` -- {vytask}`T1925` `(bug): DMVPN is always listed as down in "show vpn ipsec sa"` -- {vytask}`T1297` `(feature): Add GARP settings to VRRP/keepalived` - -## 2024-01-08 - -- {vytask}`T5318` `(bug): Security Vulnerabilities for VyOS 1.3.3` -- {vytask}`T3980` `(bug): vrrp transition-script validator makes warning fatal and also causes a python NameError exception` -- {vytask}`T2799` `(feature): VyOS Certificates Manager` - -## 2023-12-29 - -- {vytask}`T5852` `(bug): Reboots fail with eapol WAN interface` - -## 2023-12-22 - -- {vytask}`T4760` `(bug): VyOS does not support running multiple instances of DHCPv6 clients` - -## 2023-12-21 - -- {vytask}`T5714` `(bug): IPSec VPN: op-mode: "show log vpn" does not show results` -- {vytask}`T3039` `(feature): Resize a root partition and filesystem automatically during deployment in virtual environments` -- {vytask}`T2404` `(bug): Cannot change MTU` -- {vytask}`T2353` `(bug): Interface [conf_mode] errors parent task` -- {vytask}`T5796` `(bug): Openconnect - HTTPS security headers are missing` - -## 2023-12-19 - -- {vytask}`T2116` `(feature): Processing configuration via Cloud-init User-Data` - -## 2023-12-18 - -- {vytask}`T2191` `(feature): Using tallow to block sshd probes` - -## 2023-12-15 - -- {vytask}`T5824` `(bug): busybox cannot connect some websites from initramfs` - -## 2023-12-12 - -- {vytask}`T5817` `(bug): Show openvpn server fails in some cases` -- {vytask}`T5413` `(default): Deny the opportunity to use one public/private key pair on both wireguard peers.` - -## 2023-11-30 - -- {vytask}`T4601` `(bug): dhcp : relay agent IP address issue.` - -## 2023-11-28 - -- {vytask}`T5777` `(bug): frr: backport and upstream recent bgpd daemon crashes` - -## 2023-11-27 - -- {vytask}`T5763` `(bug): Fix imprecise check for remote file name in vyos-load-config.py` - -## 2023-11-25 - -- {vytask}`T5655` `(bug): commit-archive: Ctrl+C should not eror out with stack trace, signal should be cought` - -## 2023-11-24 - -- {vytask}`T5402` `(bug): VRRP router with rfc3768-compatibility sends multiple ARP replies` - -## 2023-11-22 - -- {vytask}`T5578` `(bug): "ikev2-reauth" description contains outdated information` - -## 2023-11-15 - -- {vytask}`T5661` `(enhancment): Add show show ssh dynamic-protection attacker and show log ssh dynamic-protection` -- {vytask}`T1276` `(bug): dhcp relay + VLAN fails` - -## 2023-11-07 - -- {vytask}`T5586` `(feature): Disable by default SNMP for Keepalived VRRP` - -## 2023-11-06 - -- {vytask}`T4269` `(feature): node.def generator should automatically add default values` - -## 2023-10-26 - -- {vytask}`T5684` `(bug): services using VRF generates the error "Failed to load BPF prog: 'Operation not permitted'" when the system boots.` -- {vytask}`T5594` `(bug): VRRP - Error if using IPv6 Link Local as hello source address` - -## 2023-10-21 - -- {vytask}`T5670` `(bug): bridge: missing member interface validator` -- {vytask}`T5191` `(default): Replace underscores with hyphens in command-line options generated by vyos.opmode` -- {vytask}`T4402` `(bug): OpenVPN client-ip-pool option is broken` -- {vytask}`T2719` `(feature): Standardized op mode script structure` - -## 2023-10-19 - -- {vytask}`T5669` `(bug): VXLAN interface changing port does not work` - -## 2023-10-17 - -- {vytask}`T5235` `(bug): SSH keys with special characters cannot be applied via Cloud-init` - -## 2023-10-08 - -- {vytask}`T5630` `(feature): pppoe: allow to specify MRU in addition to already configurable MTU` - -## 2023-10-06 - -- {vytask}`T5576` `(feature): Add bgp remove-private-as all option` - -## 2023-10-04 - -- {vytask}`T5632` `(feature): Add jq package to parse JSON files` - -## 2023-09-25 - -- {vytask}`T5533` `(bug): Keepalived VRRP IPv6 group enters in FAULT state` - -## 2023-09-20 - -- {vytask}`T5271` `(default): Add support for peer-fingerprint to OpenVPN` - -## 2023-09-11 - -- {vytask}`T5557` `(bug): bgp: Use treat-as-withdraw for tunnel encapsulation attribute CVE-2023-38802` -- {vytask}`T3424` `(default): PPPoE IA-PD doesn't work in VRF` - -## 2023-09-10 - -- {vytask}`T5555` `(bug): Fix timezone migrator (system 13-to-14)` -- {vytask}`T5545` `(bug): sflow is not working` - -## 2023-09-08 - -- {vytask}`T4426` `(default): Add arpwatch to the image` - -## 2023-09-05 - -- {vytask}`T5524` `(feature): Add config directory to liveCD` -- {vytask}`T2958` `(bug): DHCP server doesn't work from a live CD` -- {vytask}`T5428` `(bug): dhcp: client renewal fails when running inside VRF` - -## 2023-09-04 - -- {vytask}`T5506` `(bug): Container bridge interfaces do not have a link-local address` - -## 2023-08-31 - -- {vytask}`T5190` `(feature): Cloud-Init cannot fetch Meta-data on machines where the main Ethernet interface is not eth0` -- {vytask}`T5140` `(bug): Firewall network-group problems` -- {vytask}`T4895` `(bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data` -- {vytask}`T4874` `(default): Add Warning message to Equuleus` -- {vytask}`T4855` `(bug): Trying to create more than one tunnel of the same type to the same address causes unhandled exception` -- {vytask}`T4776` `(bug): NVME storage is not detected properly during installation` -- {vytask}`T3546` `(feature): Add support for running scripts on PPPoE server session events` -- {vytask}`T738` `(feature): Add local-port and resolver port options for powerdns in CLI configuration tree` - -## 2023-08-30 - -- {vytask}`T5221` `(bug): BGP as-override behavior differs from new FRR and other vendors` -- {vytask}`T4933` `(default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a nondescript error` -- {vytask}`T4790` `(bug): RADIUS login does not work if sum of timeouts more than 50s` -- {vytask}`T4475` `(bug): route-map does not support ipv6 peer` -- {vytask}`T4459` `(bug): API service with VRF doesn't work in 1.3.1` -- {vytask}`T4407` `(bug): Network-config v2 is broken in Cloud-init 22.1 and VyOS 1.3` -- {vytask}`T4113` `(bug): Incorrect GRUB configuration parsing` -- {vytask}`T1764` `(bug): Use lists instead of whitespace-separated strings in vyos.config` -- {vytask}`T4121` `(bug): Nameservers from DHCP client cannot be used in specific cases` -- {vytask}`T4151` `(feature): IPV6 local PBR Support` -- {vytask}`T4306` `(default): Do not check for ditry repository when building release images` - -## 2023-08-29 - -- {vytask}`T3940` `(bug): DHCP client does not remove IP address when stopped by the 02-vyos-stopdhclient hook` -- {vytask}`T3713` `(default): Create a meta-package for user utilities` -- {vytask}`T3339` `(bug): Cloud-Init domain search setting not applied` -- {vytask}`T2640` `(feature): Running VyOS inside Docker containers` -- {vytask}`T3577` `(bug): Generating vpn x509 key pair fails with command not found` - -## 2023-08-28 - -- {vytask}`T4745` `(bug): CLI TAB issue with values with '-' at the beginning in conf mode` -- {vytask}`T2611` `(bug): Prefix list names are shared between ipv4 and ipv6` -- {vytask}`T2296` `(default): Upgrade WALinux to 2.2.41` -- {vytask}`T2123` `(default): Configure 3 NTP servers` -- {vytask}`T469` `(bug): Problem after commit with errors` - -## 2023-08-25 - -- {vytask}`T4412` `(bug): commit archive: reboot not working with sftp` -- {vytask}`T3702` `(feature): Policy: Allow routing by fwmark` -- {vytask}`T3536` `(default): Unable to list all available routes` - -## 2023-08-24 - -- {vytask}`T5006` `(bug): Http api segfault with concurrent requests` -- {vytask}`T5305` `(bug): REST API configure operation should not be defined as async` - -## 2023-08-23 - -- {vytask}`T5387` `(feature): dhcp6c: add a no release option` - -## 2023-08-20 - -- {vytask}`T5470` `(bug): wlan: can not disable interface if SSID is not configured` - -## 2023-08-17 - -- {vytask}`T5486` `(bug): Service dns dynamic cannot pass the smoketest` -- {vytask}`T5223` `(bug): tunnel key doesn't clear` - -## 2023-08-15 - -- {vytask}`T5273` `(default): Add op mode commands for displaying certificate details and fingerprints` -- {vytask}`T5270` `` (default): Make OpenVPN `tls dh-params` optional `` - -## 2023-08-10 - -- {vytask}`T5329` `(bug): Wireguard interface as GRE tunnel source causes configuration error on boot` - -## 2023-07-24 - -- {vytask}`T5354` `(feature): Add sshguard to protect against brut-forces for 1.3` - -## 2023-07-17 - -- {vytask}`T2051` `(bug): Throughput anomalies` - -## 2023-07-14 - -- {vytask}`T305` `(default): loadbalancing does not work with one pppoe connection and another connection of either dhcp or static` - -## 2023-07-13 - -- {vytask}`T3045` `(bug): Changes to Conntrack-Sync don't apply correctly (Mutlicast->UDP)` -- {vytask}`T971` `(bug): authentication public-keys options quoting issue` - -## 2023-07-12 - -- {vytask}`T5009` `(bug): op-mode command: restart dhcp relay-agent not working` -- {vytask}`T4927` `(bug): Need to change restart to reload-or-restart in Webproxy module` -- {vytask}`T3835` `(bug): vyos router 1.2.7 snmp Dos bug` -- {vytask}`T4959` `(feature): Add container registry authentication config for containers` -- {vytask}`T425` `(feature): AWS CloudWatch monitoring scripts` - -## 2023-07-11 - -- {vytask}`T4862` `(bug): webproxy domain-block does not work` -- {vytask}`T4844` `(bug): Incorrect permissions of the safeguard DB directory` -- {vytask}`T4262` `(bug): install image doesn't respect chosen root partition size` -- {vytask}`T3810` `(bug): webproxy squidguard rules don't work properly after rewriting to python.` -- {vytask}`T1928` `(bug): Is the 'Welcome to VyOS' message when using SSH an information leak?` -- {vytask}`T4737` `(bug): FRRouting/zebra 7.5.1 does not redistribute routes to other protocols` -- {vytask}`T3852` `(bug): DHCP client issue - interface has two dhclient processes when link is unpluged and then plug again` -- {vytask}`T2118` `(bug): Failure to boot after power outage due to dirty filesystem and no fsck in initramfs` - -## 2023-07-05 - -- {vytask}`T5331` `(bug): ath10k_pci not functioning` - -## 2023-06-30 - -- {vytask}`T5315` `(feature): vrrp: add support for version 3` -- {vytask}`T5313` `(bug): UDP broadcast relay - missing verify() that relay interfaces have an IP address assigned` - -## 2023-06-26 - -- {vytask}`T5272` `(default): Upgrade OpenVPN to 2.6 in Equuleus` -- {vytask}`T5265` `(bug): WAN load-balancing: missing completion helpers` - -## 2023-06-25 - -- {vytask}`T5240` `(bug): Service router-advert failed to start radvd with more then 3 name-servers` - -## 2023-06-21 - -- {vytask}`T5280` `(bug): Update Expired keys (2023-06-08) for PowerDNS` - -## 2023-06-13 - -- {vytask}`T5213` `(feature): Accel-ppp sending accounting interim updates acct-interim-interval option` - -## 2023-05-29 - -- {vytask}`T5243` `(bug): Default route is inactive if an interface has multiple ip addresses of the same subnet in 1.3.2 Equuleus` - -## 2023-05-19 - -- {vytask}`T5186` `(bug): QoS test cannot pass for 1.3` - -## 2023-05-12 - -- {vytask}`T2769` `(feature): Add VRF support for syslog` - -## 2023-05-08 - -- {vytask}`T5212` `(bug): snmp community name -error with special carracter` - -## 2023-04-27 - -- {vytask}`T5175` `(bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0` -- {vytask}`T5176` `(bug): http-api: update vyos-http-api-tools for FastAPI security vulnerability` - -## 2023-04-13 - -- {vytask}`T5152` `(bug): Telegraf agent hostname isn't qualified` -- {vytask}`T4727` `(feature): Add RADIUS rate limit support to PPTP server` -- {vytask}`T4939` `(bug): VRRP command no-preempt not work as expected` -- {vytask}`T3608` `(default): Standardize warnings from configure scripts` - -## 2023-04-05 - -- {vytask}`T4975` `(bug): CLI does not work after cutting off the power or reset` -- {vytask}`T5136` `(bug): Possible config corruption on upgrade` - -## 2023-04-01 - -- {vytask}`T5047` `(bug): Recreate only a specific container` - -## 2023-03-31 - -- {vytask}`T5111` `(bug): pppd-dns.service startup failed` - -## 2023-03-29 - -- {vytask}`T5033` `(bug): generate-public-key command fails for address with multiple public keys like GitHub` -- {vytask}`T5097` `(bug): the operational command "show interfaces ethernet ethx" doesn't reflect a call to 'clear counters'` - -## 2023-03-21 - -- {vytask}`T5098` `(feature): PPPoE client holdoff configuration` - -## 2023-03-19 - -- {vytask}`T4925` `(feature): Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2` - -## 2023-03-16 - -- {vytask}`T3083` `(feature): Add feature event-handler` -- {vytask}`T2516` `(bug): vyos-container: cannot configure ethernet interface` - -## 2023-03-09 - -- {vytask}`T5066` `(bug): Different GRE tunnel but same tunnel keys error` - -## 2023-03-08 - -- {vytask}`T4381` `(default): OpenVPN: Add "Tunnel IP" column in "show openvpn server" operational command` -- {vytask}`T4872` `(bug): Op-mode show openvpn misses a case when parsing for tunnel IP` - -## 2023-03-07 - -- {vytask}`T2838` `(bug): Ethernet device names changing, multiple hw-id being added` -- {vytask}`T2649` `(default): Ensure configration mode scripts conform to coding guidelines` -- {vytask}`T4900` `(default): Cache intermediary results of get_config_diff in Config instance` - -## 2023-03-03 - -- {vytask}`T4625` `(enhancment): Update ocserv to current revision (1.1.6)` - -## 2023-02-28 - -- {vytask}`T4955` `(bug): Openconnect radiusclient.conf generating with extra authserver` -- {vytask}`T4219` `(feature): support incoming-interface (iif) in local PBR` - -## 2023-02-25 - -- {vytask}`T5008` `(bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine` -- {vytask}`T5007` `(bug): Interface multicast setting is invalid` -- {vytask}`T5017` `(bug): Bug with validator interface-name` -- {vytask}`T4992` `(bug): Incorrect check is_local_address for bgp neighbor with option ip_nonlocal_bind set` -- {vytask}`T4978` `(bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.4-rolling-202302041536` -- {vytask}`T4948` `(feature): pppoe: add CLI option to allow definition of host-uniq flag` - -## 2023-02-22 - -- {vytask}`T5011` `(bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu check should be skipped` - -## 2023-02-18 - -- {vytask}`T4743` `(feature): Enable IPv6 address for Dynamic DNS` - -## 2023-02-16 - -- {vytask}`T4971` `(feature): Radius attribute "Framed-Pool" for PPPoE` - -## 2023-02-15 - -- {vytask}`T4993` `(bug): Can't delete conntrack ignore rule` - -## 2023-02-14 - -- {vytask}`T4999` `(feature): vyos.util backport dict_search_recursive` -- {vytask}`T1993` `(feature): Extended pppoe rate-limiter` - -## 2023-02-13 - -- {vytask}`T4153` `(bug): Monitor bandwidth-test initiate not working` - -## 2023-02-11 - -- {vytask}`T2603` `(feature): pppoe-server: reduce min MTU` - -## 2023-02-08 - -- {vytask}`T1288` `(feature): FRR: rewrite staticd backend (/opt/vyatta/share/vyatta-cfg/templates/protocols/static/*)` - -## 2023-02-07 - -- {vytask}`T4117` `(bug): Does not possible to configure PoD/CoA for L2TP vpn` - -## 2023-02-01 - -- {vytask}`T4970` `(default): pin OCaml pcre package to avoid JIT support` - -## 2023-01-30 - -- {vytask}`T4954` `(bug): DNS cannot be configured via Network-Config v1 received from ConfigDrive / Cloud-Init` - -## 2023-01-24 - -- {vytask}`T4949` `(feature): Backport "monitor log" and "show log" op-mode definitions from current to equuleus` -- {vytask}`T4947` `(feature): Support mounting container volumes as ro or rw` - -## 2023-01-23 - -- {vytask}`T4798` `(default): Migrate the file-exists validator away from Python` -- {vytask}`T4683` `(enhancment): Add kitty-terminfo package to build` -- {vytask}`T4875` `(default): Replace Python validator 'interface-name' to avoid Python startup cost` -- {vytask}`T4664` `(bug): Add validation to reject whitespace in tag node value names` - -## 2023-01-22 - -- {vytask}`T4906` `(bug): ipsec connections shows only one connection as up` - -## 2023-01-21 - -- {vytask}`T4896` `(bug): ospfv3: Fix broken not-advertise option` -- {vytask}`T4799` `(bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd` - -## 2023-01-17 - -- {vytask}`T4902` `(bug): snmpd: exclude container storage from monitoring` - -## 2023-01-15 - -- {vytask}`T4832` `(feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)` -- {vytask}`T4918` `(bug): Odd show interface behavior` - -## 2023-01-09 - -- {vytask}`T4922` `(feature): Add ssh-client source-interface CLI option` - -## 2023-01-07 - -- {vytask}`T4884` `(bug): Missing a community6 in snmpd config` - -## 2023-01-05 - -- {vytask}`T3937` `(default): Rewrite "show system memory" in Python to make it usable as a library function` - -## 2023-01-03 - -- {vytask}`T4869` `` (bug): A network with `/32` or `/128` mask cannot be removed from a network-group `` - -## 2022-12-31 - -- {vytask}`T4898` `(feature): Add mtu config option for dummy interfaces` - -## 2022-12-26 - -- {vytask}`T4511` `(bug): IPv6 DNS lookup` -- {vytask}`T4809` `(feature): radvd: Allow use of AdvRASrcAddress` - -## 2022-12-18 - -- {vytask}`T4709` `(bug): TCP MSS clamping broken in equuleus` - -## 2022-12-15 - -- {vytask}`T4671` `(bug): linux-firmware package is missing symlinks defined in WHENCE file` - -## 2022-12-04 - -- {vytask}`T4825` `(feature): interfaces veth/veth-pairs -standalone used` - -## 2022-12-02 - -- {vytask}`T4122` `(bug): interface ip address config missing after upgrade from 1.2.8 to 1.3.0 (when redirect is configured?)` -- {vytask}`T1024` `(feature): Policy Based Routing by DSCP` - -## 2022-11-23 - -- {vytask}`T4793` `(feature): Create warning message about disable-route-autoinstall when ipsec vti is used` - -## 2022-11-21 - -- {vytask}`T4812` `(feature): IPsec ability to show all configured connections` - -## 2022-11-06 - -- {vytask}`T2913` `(bug): Failure to install fpm while building builder docker image` - -## 2022-11-04 - -- {vytask}`T2417` `(feature): Python validator cleanup` - -## 2022-11-01 - -- {vytask}`T4177` `(bug): Strip-private doesn't work for service monitoring` - -## 2022-10-31 - -- {vytask}`T1875` `(feature): Add the ability to use network address as BGP neighbor (bgp listen range)` -- {vytask}`T4785` `(feature): snmp: Allow !, @, * and # in community name` - -## 2022-10-21 - -- {vytask}`T2189` `(bug): Adding a large port-range will take ~ 20 minutes to commit` - -## 2022-10-18 - -- {vytask}`T4533` `(bug): Radius clients don’t have simple permissions` - -## 2022-10-13 - -- {vytask}`T4312` `(bug): Telegraf configuration doesn't accept IPs for URL` - -## 2022-10-12 - -- {vytask}`T4730` `(bug): Conntrack-sync error - listen-address is not the correct type in config as it should be` - -## 2022-10-11 - -- {vytask}`T4680` `(bug): Telegraf prometheus-client listen-address invalid format` - -## 2022-10-04 - -- {vytask}`T4702` `(bug): Wireguard peers configuration is not synchronized with CLI` -- {vytask}`T4652` `(feature): Upgrade PowerDNS recursor to 4.7 series` -- {vytask}`T4648` `(default): PPPoE: Ignore default router from RA when PPPoE default-route is set to none` -- {vytask}`T4582` `(default): Router-advert: Preferred lifetime cannot equal valid lifetime in PIOs` - -## 2022-09-17 - -- {vytask}`T4666` `(bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584` - -## 2022-09-15 - -- {vytask}`T4679` `(bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address` -- {vytask}`T4630` `(bug): Prevent attempts to use the same interface as a source interface for pseudo-ethernet and MACsec at the same time` - -## 2022-09-12 - -- {vytask}`T4647` `(feature): Add Google Virtual NIC (gVNIC) support` - -## 2022-09-05 - -- {vytask}`T4668` `(bug): Adding/removing members from bond doesn't work/results in incorrect interface state` -- {vytask}`T4628` `(bug): ConfigTree() throws ValueError() if tagNode contains whitespaces` - -## 2022-08-29 - -- {vytask}`T4653` `(bug): Interface offload options are not applied correctly` -- {vytask}`T4061` `(default): Add util function to check for completion of boot config` -- {vytask}`T4654` `(bug): RPKI cache incorrect description` -- {vytask}`T4572` `(bug): Add an option to force interface MTU to the value received from DHCP` - -## 2022-08-26 - -- {vytask}`T4642` `(bug): proxy: hyphen not allowed in proxy URL` - -## 2022-08-23 - -- {vytask}`T4618` `(bug): Traffic policy not set on virtual interfaces` -- {vytask}`T4538` `(bug): Macsec does not work correctly when the interface status changes.` - -## 2022-08-22 - -- {vytask}`T4629` `(bug): Raised ConfigErrors contain dict instead of only the dict key` -- {vytask}`T4632` `(bug): VLAN-aware bridge not working` - -## 2022-08-19 - -- {vytask}`T4616` `(bug): openconnect: KeyError: 'local_users'` -- {vytask}`T4614` `(feature): OpenConnect split-dns directive` - -## 2022-08-16 - -- {vytask}`T4592` `(bug): macsec: can not create two interfaces using the same source-interface` -- {vytask}`T4584` `(bug): hostap: create custom package build` -- {vytask}`T4537` `(bug): MACsec not working with cipher gcm-aes-256` - -## 2022-08-15 - -- {vytask}`T4565` `(bug): vlan aware bridge not working with - Kernel: T3318: update Linux Kernel to v5.4.205 #249` -- {vytask}`T4206` `(bug): Policy Based Routing with DHCP Interface Issue` -- {vytask}`T2763` `(feature): New SNMP resource request - SNMP over TCP` - -## 2022-08-14 - -- {vytask}`T4579` `(bug): bridge: can not delete member interface CLI option when VLAN is enabled` -- {vytask}`T4421` `(default): Add support for floating point numbers in the numeric validator` -- {vytask}`T4415` `(bug): Include license/copyright files in the image but remove user documentation from /usr/share/doc to reduce its size` -- {vytask}`T4313` `(bug): "generate public-key-command" throws unhandled exceptions when it cannot retrieve the key` -- {vytask}`T4082` `(bug): Add op mode command to restart ldpd` -- {vytask}`T3714` `(bug): Some sysctl custom parameters disappear after reboot` -- {vytask}`T4260` `(bug): Extend vyos.configdict.node_changed() to support recursiveness` -- {vytask}`T3785` `(default): Add unicode support to configtree backend` -- {vytask}`T3507` `(bug): Bond with mode LACP show u/u in show interfaces even if peer is not configured` - -## 2022-08-11 - -- {vytask}`T4476` `(default): Next steps after installation is not communicated properly to new users` - -## 2022-08-02 - -- {vytask}`T4515` `(default): Reduce telegraf binary size` - -## 2022-07-30 - -- {vytask}`T4575` `(feature): vyos.utill add new wrapper "rc_cmd" to get the return code and output` -- {vytask}`T4532` `(bug): Flow-accounting IPv6 server/receiver bug` - -## 2022-07-27 - -- {vytask}`T4571` `(bug): Sflow with vrf configured does not use vrf to validate agent-address IP from vrf-configured interfaces` - -## 2022-07-18 - -- {vytask}`T4228` `(bug): bond: OS error thrown when two bonds use the same member` -- {vytask}`T4534` `(bug): bond: bridge: error out if member interface is assigned to a VRF instance` -- {vytask}`T4525` `(bug): Delete interface from VRF and add it to bonding error` -- {vytask}`T4522` `(feature): bond: add ability to specify mii monitor interval via CLI` -- {vytask}`T4521` `(bug): bond: ARP monitor interval is not configured despite set via CLI` - -## 2022-07-14 - -- {vytask}`T4491` `(bug): Use empty string for internal name of root node of config_tree` - -## 2022-07-13 - -- {vytask}`T1375` `(feature): Add clear dhcp server lease function` - -## 2022-07-12 - -- {vytask}`T4527` `(bug): Prevent to create VRF name default` -- {vytask}`T4084` `(default): Dehardcode the default login banner` -- {vytask}`T3864` `(enhancment): Add Edgecore build to VyOS 1.3 Equuleus` - -## 2022-07-09 - -- {vytask}`T4507` `(feature): IPoE-server add multiplier option for shaper` -- {vytask}`T4468` `(bug): web-proxy source group cannot start with a number bug` -- {vytask}`T4373` `(feature): PPPoE-server add multiplier option for shaper` - -## 2022-07-07 - -- {vytask}`T4456` `(bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many messages` -- {vytask}`T4509` `(feature): Feature Request: DNS64` - -## 2022-07-06 - -- {vytask}`T4513` `(bug): Webproxy monitor commands do not work` - -## 2022-07-05 - -- {vytask}`T4510` `(bug): set system static-host-mapping doesn't allow IPv4 and IPv6 for same name.` -- {vytask}`T2654` `(bug): Multiple names unable to be assigned to the same static mapping` -- {vytask}`T2683` `(default): no dual stack in system static-host-mapping host-name` - -## 2022-07-01 - -- {vytask}`T4489` `(bug): MPLS sysctl not persistent for tunnel interfaces` - -## 2022-06-20 - -- {vytask}`T1856` `(feature): Support configuring IPSec SA bytes` - -## 2022-06-16 - -- {vytask}`T3866` `(bug): Configs with DNS forwarding listening on OpenVPN interfaces or interfaces without a fixed address cannot be migrated to the new syntax` - -## 2022-06-15 - -- {vytask}`T1890` `(feature): Metatask: rewrite flow-accounting to XML and Python` - -## 2022-06-09 - -- {vytask}`T2580` `(feature): Support for ip pools for ippoe` - -## 2022-06-08 - -- {vytask}`T4447` `` (bug): DHCPv6 prefix delegation `sla-id` limited to 128 `` -- {vytask}`T4350` `(bug): DMVPN opennhrp spokes dont work behind NAT` - -## 2022-05-30 - -- {vytask}`T4315` `(feature): Telegraf - Output to prometheus` - -## 2022-05-27 - -- {vytask}`T4441` `(bug): wwan: connection not possible after a change added after 1.3.1-S1 release` - -## 2022-05-26 - -- {vytask}`T4442` `(feature): HTTP API add action "reset"` - -## 2022-05-25 - -- {vytask}`T2194` `(default): "show firewall" garbled output` - -## 2022-05-19 - -- {vytask}`T4430` `(bug): Show firewall output with visual shift default rule` - -## 2022-05-16 - -- {vytask}`T4377` `(default): generate tech-support archive includes previous archives` - -## 2022-05-12 - -- {vytask}`T4100` `(feature): Firewall increase maximum number of rules` - -## 2022-05-11 - -- {vytask}`T4405` `` (bug): DHCP client sometimes ignores `no-default-route` option of an interface `` - -## 2022-05-10 - -- {vytask}`T1972` `(feature): Allow setting interface name for virtual_ipaddress in VRRP VRID` - -## 2022-05-07 - -- {vytask}`T4361` `` (bug): `vyos.config.exists()` does not work for nodes with multiple values `` -- {vytask}`T4354` `(bug): Slave interfaces fall out from bonding during configuration change` - -## 2022-05-03 - -- {vytask}`T4395` `(feature): Extend show vpn debug` - -## 2022-05-01 - -- {vytask}`T4369` `(bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node` -- {vytask}`T4363` `(bug): salt-minion: default mine_interval option is not set` - -## 2022-04-29 - -- {vytask}`T4388` `(bug): dhcp-server: missing constraint on tftp-server-name option` -- {vytask}`T4366` `(bug): geneve: interface is removed on changes to e.g. description` - -## 2022-04-26 - -- {vytask}`T4235` `(default): Add config tree diff algorithm` - -## 2022-04-19 - -- {vytask}`T4344` `(bug): DHCP statistics not matching, conf-mode generates incorrect pool name with dash` -- {vytask}`T4268` `(bug): Elevated LA while using VyOS monitoring feature` - -## 2022-04-08 - -- {vytask}`T4331` `(bug): IPv6 link local addresses are not configured when an interface is in a VRF` -- {vytask}`T4339` `(bug): wwan: tab-completion results in "No such file or directory" if there is no WWAN interface` -- {vytask}`T4338` `(bug): wwan: changing interface description should not trigger reconnect` -- {vytask}`T4324` `(bug): wwan: check alive script should only be run via cron if a wwan interface is configured at all` - -## 2022-04-07 - -- {vytask}`T4330` `(bug): MTU settings cannot be applied when IPv6 is disabled` -- {vytask}`T4346` `(feature): Deprecate "system ipv6 disable" option to disable address family within OS kernel` -- {vytask}`T4337` `(bug): isis: IETF SPF delay algorithm can not be configured - results in vyos.frr.CommitError` -- {vytask}`T4319` `(bug): The command "set system ipv6 disable" doesn't work as expected.` -- {vytask}`T4341` `(feature): login: disable user-account prior to deletion and wait until deletion is complete` -- {vytask}`T4336` `(feature): isis: add support for MD5 authentication password on a circuit` - -## 2022-04-06 - -- {vytask}`T4308` `(feature): Op-comm "Show log frr" to view specific protocol logs` - -## 2022-03-29 - -- {vytask}`T3686` `(bug): Bridging OpenVPN tap with no local-address breaks` - -## 2022-03-24 - -- {vytask}`T4294` `(bug): Adding a new openvpn-option does not restart the OpenVPN process` -- {vytask}`T4230` `(bug): OpenVPN server configuration deleted after reboot when using a VRRP virtual-address` - -## 2022-03-21 - -- {vytask}`T4311` `(bug): CVE-2021-4034: local privilege escalation in PolKit` -- {vytask}`T4310` `(bug): CVE-2022-0778: infinite loop in OpenSSL certificate parsing` - -## 2022-03-12 - -- {vytask}`T4296` `(bug): Interface config injected by Cloud-Init may interfere with VyOS native` -- {vytask}`T4002` `(default): firewall group network-group long names restriction incorrect behavior` - -## 2022-03-11 - -- {vytask}`T4297` `(bug): Interface configuration saving fails for ice/iavf based interfaces because they can't change speed/duplex settings` - -## 2022-03-05 - -- {vytask}`T4259` `(bug): The conntrackd daemon can be started wrongly` - -## 2022-02-28 - -- {vytask}`T4273` `(bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config` -- {vytask}`T4115` `(bug): reboot in not working as expected` - -## 2022-02-24 - -- {vytask}`T4267` `(bug): Error - Missing required "ip key" parameter` - -## 2022-02-23 - -- {vytask}`T4264` `(bug): vxlan: interface is destroyed and rebuild on description change` -- {vytask}`T4263` `(bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes` - -## 2022-02-21 - -- {vytask}`T4120` `(feature): [VXLAN] add ability to set multiple unicast-remotes` - -## 2022-02-20 - -- {vytask}`T4261` `(feature): MACsec: add DHCP client support` -- {vytask}`T4203` `(bug): Reconfigure DHCP client interface causes brief outages` - -## 2022-02-19 - -- {vytask}`T4258` `(bug): [DHCP-SERVER] error parameter on Failover` - -## 2022-02-17 - -- {vytask}`T4241` `(bug): ocserv openconnect looks broken in recent bulds of 1.3 Equuleus` -- {vytask}`T4255` `(bug): Unexpected print of dict bridge on delete` -- {vytask}`T4240` `(bug): Cannot add wlan0 to bridge via configure` -- {vytask}`T4154` `(bug): Error add second gre tunnel with the same source interface` - -## 2022-02-16 - -- {vytask}`T4237` `(bug): Conntrack-sync error - error adding listen-address command` - -## 2022-02-15 - -- {vytask}`T4201` `(bug): Firewall - ICMPv6 matches not working as expected on 1.3.0` -- {vytask}`T3006` `(bug): Accel-PPP & vlan-mon config get invalid VLAN` -- {vytask}`T3494` `(bug): DHCPv6 leases traceback when PD using` - -## 2022-02-13 - -- {vytask}`T4242` `(bug): ethernet speed/duplex can never be switched back to auto/auto` -- {vytask}`T4191` `(bug): Lost access to host after VRF re-creating` - -## 2022-02-11 - -- {vytask}`T3872` `(feature): Add configurable telegraf monitoring service` -- {vytask}`T4234` `(bug): Show firewall partly broken in 1.3.x` - -## 2022-02-10 - -- {vytask}`T4165` `(bug): Custom conntrack rules cannot be deleted` - -## 2022-02-08 - -- {vytask}`T4227` `(bug): Typo in help completion of hello-time option of bridge interface` - -## 2022-02-07 - -- {vytask}`T4233` `(bug): ssh: sync regex for allow/deny usernames to "system login"` -- {vytask}`T4087` `(feature): IPsec IKE-group proposals limit of 10 pieces` - -## 2022-02-05 - -- {vytask}`T4226` `(bug): VRRP transition-script does not work for groups name which contains -(minus) sign` - -## 2022-02-04 - -- {vytask}`T4196` `(bug): DHCP server client-prefix-length parameter results in non-functional leases` - -## 2022-02-03 - -- {vytask}`T3643` `(bug): show vpn ipsec sa doesn't show tunnels in "down" state` - -## 2022-02-01 - -- {vytask}`T4198` `(bug): Error shown on commit` - -## 2022-01-28 - -- {vytask}`T4184` `(bug): NTP allow-clients address doesn't work it allows to use ntp server for all addresses` - -## 2022-01-24 - -- {vytask}`T4204` `(feature): Update Accel-PPP to a newer revision` - -## 2022-01-17 - -- {vytask}`T3164` `(bug): console-server ssh does not work with RADIUS PAM auth` - -## 2022-01-15 - -- {vytask}`T4183` `(feature): IPv6 link-local address not accepted as wireguard peer` -- {vytask}`T4110` `(feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0` - -## 2022-01-12 - -- {vytask}`T4168` `(bug): IPsec VPN is impossible to restart when DMVPN is configured` -- {vytask}`T4167` `(bug): DMVPN apply wrong param on the first configuration` -- {vytask}`T4152` `(bug): NHRP shortcut-target holding-time does not work` - -## 2022-01-10 - -- {vytask}`T3299` `(bug): Allow the web proxy service to listen on all IP addresses` -- {vytask}`T3115` `(feature): Add support for firewall on L3 VIF bridge interface` - -## 2022-01-09 - -- {vytask}`T3822` `` (bug): OpenVPN processes do not have permission to read key files generated with `run generate openvpn key` `` -- {vytask}`T4142` `(bug): Input ifbX interfaces not displayed in op-mode` -- {vytask}`T3914` `(bug): VRRP rfc3768-compatibility doesn't work with unicast peers` - -## 2022-01-07 - -- {vytask}`T3924` `(bug): VRRP stops working with VRF` - -## 2022-01-06 - -- {vytask}`T4141` `(bug): Set high-availability vrrp sync-group without members error` - -## 2022-01-03 - -- {vytask}`T4065` `(bug): IPSEC configuration error: connection to unix:///var/run/charon.ctl failed: No such file or directory` -- {vytask}`T4052` `(bug): Validator return traceback on VRRP configuration with the script path not in config dir` -- {vytask}`T4128` `(bug): keepalived: Upgrade package to add VRF support` - -## 2021-12-31 - -- {vytask}`T4081` `(bug): VRRP health-check script stops working when setting up a sync group` - -## 2021-12-29 - -- {vytask}`T2922` `` (bug): The `vpn ipsec logging log-modes` miss the IPSec daemons state check `` -- {vytask}`T2695` `(bug): Flow-accounting bug with subinterfaces` -- {vytask}`T2400` `(default): OpenVPN: dont restart server if no need` -- {vytask}`T4086` `(default): system login banner is not removed on deletion.` - -## 2021-12-28 - -- {vytask}`T3380` `(bug): "show vpn ike sa" does not display IPv6 peers` -- {vytask}`T2933` `(feature): VRRP add option virtual_ipaddress_excluded` - -## 2021-12-27 - -- {vytask}`T2566` `(bug): sstp not able to run tunnels ipv6 only` -- {vytask}`T4093` `(bug): SNMPv3 snmpd.conf generation bug` -- {vytask}`T2764` `(enhancment): Increase maximum number of NAT rules` - -## 2021-12-26 - -- {vytask}`T4104` `(bug): RAID1: "add raid md0 member sda1" does not restore boot sector` - -## 2021-12-25 - -- {vytask}`T4101` `(bug): commit-archive: Use of uninitialized value $source_address in concatenation` -- {vytask}`T4055` `(feature): Add VRF support for HTTP(S) API service` - -## 2021-12-24 - -- {vytask}`T3854` `(bug): Missing op-mode commands for conntrack-sync` - -## 2021-12-23 - -- {vytask}`T4092` `(bug): IKEv2 mobike commit failed with DMVPN nhrp` -- {vytask}`T3354` `(default): Convert strip-private script from Perl to Python` - -## 2021-12-22 - -- {vytask}`T3356` `(feature): Script for remote file transfers` - -## 2021-12-21 - -- {vytask}`T4053` `(bug): VRRP impossible to set scripts out of the /config directory` -- {vytask}`T4013` `(bug): Add pkg cloudwatch for AWS images` -- {vytask}`T3913` `(bug): VRF traffic fails after upgrade from 1.3.0-RC6 to 1.3.0-EPA1/2` - -## 2021-12-20 - -- {vytask}`T4088` `(default): Fix typo in login banner` - -## 2021-12-19 - -- {vytask}`T3912` `(default): Use a more informative default post-login banner` - -## 2021-12-17 - -- {vytask}`T3176` `(bug): Ordering of ports on EdgeCore SAF51015I is mixed up?` -- {vytask}`T4059` `(bug): VRRP sync-group transition script does not persist after reboot` - -## 2021-12-16 - -- {vytask}`T4046` `(feature): Sflow - Add Source address parameter` -- {vytask}`T2615` `(default): Provide an explicit option for server fingerprint in commit archive, and make insecure the default` -- {vytask}`T4076` `(enhancment): Allow setting CORS options in HTTP API` -- {vytask}`T3378` `(bug): commit-archive source-address broken for IPv6 addresses` - -## 2021-12-15 - -- {vytask}`T4077` `(bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"` -- {vytask}`T4073` `(bug): "show protocols bfd peer <>" shows incorrect peer information.` - -## 2021-12-14 - -- {vytask}`T4071` `(feature): Allow HTTP API to bind to unix domain socket` - -## 2021-12-12 - -- {vytask}`T4036` `(bug): VXLAN incorrect raiseError if set multicast network instead of singe address` - -## 2021-12-10 - -- {vytask}`T4068` `(feature): Python: ConfigError should insert line breaks into the error message` - -## 2021-12-09 - -- {vytask}`T4033` `(bug): VRRP - Error security when setting scripts` -- {vytask}`T4064` `(bug): IP address for vif is not removed from the system when deleted in configuration` -- {vytask}`T4063` `(bug): VRRP log error - /usr/libexec/vyos/vyos-vrrp-conntracksync.sh - No such file or directory` -- {vytask}`T4060` `(enhancment): Extend configquery for use before boot configuration is complete` - -## 2021-12-08 - -- {vytask}`T4024` `(bug): Access-lists and prefix-lists disappear when setting ldp hello-ipv4-interval` - -## 2021-12-07 - -- {vytask}`T4041` `(servicerequest): "transition-script" doesn't work on "sync-group"` - -## 2021-12-06 - -- {vytask}`T4012` `(feature): Add VRF support for TFTP` - -## 2021-12-05 - -- {vytask}`T4034` `(bug): "make xcp-ng-iso" still includes vyos-xe-guest-utilities` -- {vytask}`T2076` `(feature): RAID install: sfdisk change-id is deprecated in favor of --part-type` -- {vytask}`T1126` `(bug): Reusing a RAID from a BIOS install in an EFI install causes a failure to boot` - -## 2021-12-04 - -- {vytask}`T4049` `(feature): support command-style output with compare command` -- {vytask}`T4047` `(bug): Wrong regex validation in XML definitions` -- {vytask}`T4045` `(bug): Unable to "format disk like "` - -## 2021-12-02 - -- {vytask}`T4035` `(bug): Geneve interfaces aren't displayed by operational mode commands` - -## 2021-12-01 - -- {vytask}`T3695` `(bug): OpenConnect reports commit success when ocserv fails to start due to SSL cert/key file issues` - -## 2021-11-30 - -- {vytask}`T3725` `(feature): show configuration in json format` - -## 2021-11-29 - -- {vytask}`T2661` `(bug): SSTP wrong certificates check` -- {vytask}`T3946` `(enhancment): Automatically resize the root partition if the drive has extra space` - -## 2021-11-28 - -- {vytask}`T3999` `(bug): show lldp neighbor Traceback error` - -## 2021-11-26 - -- {vytask}`T4019` `(bug): Smoketests for SSTP and openconnect fails` - -## 2021-11-25 - -- {vytask}`T4005` `(feature): Feature Request: IPsec IKEv1 + IKEv2 for one peer` - -## 2021-11-24 - -- {vytask}`T4015` `(feature): Update Accel-PPP to a newer revision` -- {vytask}`T1083` `(feature): Implement persistent/random address and port mapping options for NAT rules` - -## 2021-11-23 - -- {vytask}`T3990` `(bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to files left behind in /var/tmp/frr/ after reboot)` - -## 2021-11-20 - -- {vytask}`T4004` `(bug): IPsec ike-group parameters are not saved correctly (after reboot)` - -## 2021-11-19 - -- {vytask}`T4003` `(bug): API for "show interfaces ethernet" does not include the interface description` -- {vytask}`T4011` `(bug): ethernet: deleting interface should place interface in admin down state` - -## 2021-11-18 - -- {vytask}`T3995` `(feature): OpenVPN: do not stop/start service on configuration change` -- {vytask}`T4008` `(feature): dhcp: change client retry interval form 300 -> 60 seconds` -- {vytask}`T3795` `(bug): WWAN: issues with non connected interface / no signal` - -## 2021-11-17 - -- {vytask}`T3350` `(bug): OpenVPN config file generation broken` -- {vytask}`T3996` `(bug): SNMP service error in log` - -## 2021-11-15 - -- {vytask}`T3934` `(bug): Openconnect VPN broken: ocserv-worker general protection fault on client connect` -- {vytask}`T3724` `(feature): Allow setting host-name in l2tp section of accel-ppp` - -## 2021-11-14 - -- {vytask}`T3974` `(bug): route-map commit fails if interface does not exist` - -## 2021-11-11 - -- {vytask}`T1349` `(bug): L2TP remote-access vpn terminated and not showing as connected` -- {vytask}`T1058` `(default): hw-id is ignored when naming interfaces` -- {vytask}`T914` `(feature): Extend list_interfaces.py to support multiple interface types` -- {vytask}`T688` `(enhancment): Move component versions used for config migration purposes into vyos-1x` - -## 2021-11-10 - -- {vytask}`T3982` `(bug): DHCP server commit fails if static-mapping contains + or .` - -## 2021-11-09 - -- {vytask}`T3962` `(bug): Image cannot be built without open-vm-tools` -- {vytask}`T2088` `(bug): Increased boot time from 1.2.4 -> 1.3 rolling by 100%` -- {vytask}`T2136` `(bug): XML command definition convertor doesn't disallow tag nodes with multi flag on` - -## 2021-11-07 - -- {vytask}`T2874` `(feature): Add MTU and TCP-MSS discovery tool` -- {vytask}`T3626` `(bug): Configuring and disabling DHCP Server` - -## 2021-11-06 - -- {vytask}`T3971` `(feature): Ability to build ISO images for XCP-NG hypervisor` -- {vytask}`T3514` `(bug): NIC flap at any interface change` - -## 2021-11-05 - -- {vytask}`T3972` `(bug): Removing vif-c interface raises KeyError` - -## 2021-11-04 - -- {vytask}`T3964` `(bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses` - -## 2021-11-03 - -- {vytask}`T3610` `(bug): DHCP-Server creation for not primary IP address fails` - -## 2021-11-01 - -- {vytask}`T3846` `(bug): dmvpn configuration not reapllied after "restart vpn"` -- {vytask}`T3956` `(bug): GRE tunnel - unable to move from source-interface to source-address, commit error` - -## 2021-10-31 - -- {vytask}`T3945` `(feature): Add route-map for bgp aggregate-address` -- {vytask}`T3341` `(bug): Wrong behavior of the "reset vpn ipsec-peer XXX tunnel XXX" command` -- {vytask}`T3954` `(bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated, config system error` -- {vytask}`T3943` `(bug): "netflow source-ip" prevents image upgrades if IP address does not exist locally` - -## 2021-10-29 - -- {vytask}`T3942` `(feature): Generate IPSec debug archive from op-mode` - -## 2021-10-28 - -- {vytask}`T3941` `(bug): "show vpn ipsec sa" shows established time of parent SA not child SA's` - -## 2021-10-27 - -- {vytask}`T3944` `(bug): VRRP fails over when adding new group to master` - -## 2021-10-25 - -- {vytask}`T3935` `(bug): Update from rc5 to EPA2 failed` - -## 2021-10-22 - -- {vytask}`T3188` `(bug): Tunnel local-ip to dhcp-interface Change Fails to Update` - -## 2021-10-21 - -- {vytask}`T3920` `(bug): dhclient exit hook script 01-vyos-cleanup causes too many arguments error` -- {vytask}`T3926` `(bug): strip-private does not sanitize "cisco-authentication" from NHRP configuration` -- {vytask}`T3925` `(feature): Tunnel: dhcp-interface not implemented - use source-interface instead` -- {vytask}`T3927` `(feature): Kernel: Enable kernel support for HW offload of the TLS protocol` - -## 2021-10-20 - -- {vytask}`T3922` `(bug): NHRP: delete fails` -- {vytask}`T3918` `(bug): DHCPv6 prefix delegation incorrect verify error` -- {vytask}`T3921` `(bug): tunnel: KeyError when using dhcp-interface` - -## 2021-10-19 - -- {vytask}`T3396` `(bug): syslog can't be configured with an ipv6 literal destination in 1.2.x` -- {vytask}`T690` `(feature): Allow OpenVPN servers to push routes with custom metric values` - -## 2021-10-17 - -- {vytask}`T3786` `(bug): GRE tunnel source address 0.0.0.0 error` -- {vytask}`T3425` `(bug): Scripts from the /config/scripts/ folder do not run on live system` -- {vytask}`T3217` `(default): Save FRR configuration on each commit` -- {vytask}`T3076` `(bug): Router reboot adds unwanted 'conntrack-sync mcast-group '225.0.0.50'' line to configuration` -- {vytask}`T2800` `(bug): Pseudo-Ethernet: source-interface must not be member of a bridge` -- {vytask}`T3422` `(bug): Dynamic DNS doesn't allow zone field with cloudflare protocol` -- {vytask}`T3381` `(bug): Change GRE tunnel failed` -- {vytask}`T3254` `(bug): Dynamic DNS status shows incorrect last update time` -- {vytask}`T3253` `(bug): rpki: multiple peers cannot be configured` -- {vytask}`T3219` `(default): Typo in openvpn server client config for IPv6 iroute` -- {vytask}`T2100` `(feature): BGP route adverisement wih checks rib` -- {vytask}`T1663` `(enhancment): T1656 equuleus: buster: arm64/aarch64: ipaddrcheck does not complete testing` -- {vytask}`T1243` `(bug): BGP local-as accept wrong values` -- {vytask}`T770` `(bug): Bonded interfaces get updated with incorrect hw-id in config.` -- {vytask}`T697` `(bug): Clean up and sanitize package dependencies` -- {vytask}`T3837` `(default): OpenConnect: Fix typo in help property` -- {vytask}`T1440` `(bug): Creating two DHCPv6 shared-network-names with the same subnet is allowed, causes dhcpd to fail to start.` -- {vytask}`T578` `(feature): Support Linux Container` - -## 2021-10-16 - -- {vytask}`T3879` `(bug): GPG key verification fails when upgrading from a 1.3 beta version` -- {vytask}`T3851` `(bug): Missing ospf and rip options for bridge vifs` - -## 2021-10-13 - -- {vytask}`T3904` `(bug): NTP pool associations silently fail` -- {vytask}`T3277` `(feature): DNS Forwarding - reverse zones` - -## 2021-10-11 - -- {vytask}`T2607` `(feature): Support for pppoe-server radius mode auth and config radius accouting port` - -## 2021-10-10 - -- {vytask}`T3750` `(bug): pdns-recursor 4.4 issue with dont-query and private DNS servers` -- {vytask}`T3885` `(default): dhcpv6-pd: randomly generated DUID is not persisted` -- {vytask}`T3899` `(enhancment): Add support for hd44780 LCD displays` - -## 2021-10-09 - -- {vytask}`T3894` `` (bug): Tunnel Commit Failed if system does not have `eth0` `` - -## 2021-10-08 - -- {vytask}`T3893` `(bug): MGRE Tunnel commit crash If sit tunnel available` - -## 2021-10-04 - -- {vytask}`T3888` `(bug): Incorrect warning when poweroff command executed from configure mode.` -- {vytask}`T3890` `(feature): dhcp(v6): provide op-mode commands to retrieve both server and client logfiles` -- {vytask}`T3889` `(feature): Migrate to journalctl when reading daemon logs` - -## 2021-10-03 - -- {vytask}`T3880` `(bug): EFI boot shows error on display` - -## 2021-10-02 - -- {vytask}`T3882` `(feature): Upgrade PowerDNs recursor to 4.5 series` -- {vytask}`T3883` `(bug): VRF - Delette vrf config on interface` - -## 2021-10-01 - -- {vytask}`T3877` `(bug): VRRP always enabled rfc3768-compatibility even when not specified` - -## 2021-09-30 - -- {vytask}`T3874` `(bug): D-Link Ethernet Interface not working.` - -## 2021-09-27 - -- {vytask}`T3858` `(bug): Deleting OSPFv3 process yields: Unknown command: no router-id` - -## 2021-09-26 - -- {vytask}`T3860` `(bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64 addresses` -- {vytask}`T3857` `(feature): reboot: send wall message to all users for information` -- {vytask}`T3867` `(bug): vxlan: multicast group address is not validated` -- {vytask}`T3859` `(bug): Add "log-adjacency-changes" to ospfv3 process` - -## 2021-09-23 - -- {vytask}`T3850` `(bug): Dots are no longer allowed in SSH public key names` - -## 2021-09-21 - -- {vytask}`T2602` `(bug): pptp/sstp/l2tp add possibility enable or disable CCP` - -## 2021-09-19 - -- {vytask}`T3841` `(feature): dhcp-server: add ping-check option to CLI` -- {vytask}`T2738` `(bug): Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization` -- {vytask}`T3842` `(feature): Backport DHCP server improvements from VyOS 1.4 sagitta to 1.3 equuleus` -- {vytask}`T3840` `(feature): dns forwarding: Cache size should allow values > 10k` -- {vytask}`T3672` `(bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.conf configuration file output` - -## 2021-09-11 - -- {vytask}`T3402` `(feature): Add VyOS programming library for operational level commands` - -## 2021-09-10 - -- {vytask}`T3802` `(bug): Commit fails if ethernet interface doesn't support flow control` -- {vytask}`T3819` `(bug): Upgrade Salt Stack 3002.3 -> 3003 release train` -- {vytask}`T3421` `(bug): MTR/Traceroute broken in 1.3-beta` -- {vytask}`T3820` `(feature): PowerDNS recursor - update from 4.3 -> 4.4 to sync with current` -- {vytask}`T1770` `(bug): webproxy breaks commit and http access on routed client` -- {vytask}`T915` `(feature): MPLS Support` - -## 2021-09-09 - -- {vytask}`T3816` `(bug): Error after entering outbound-interface command in NAT` -- {vytask}`T3814` `(bug): wireguard: commit error showing incorrect peer name from the configured name` -- {vytask}`T3805` `(bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP interface` - -## 2021-09-07 - -- {vytask}`T2322` `(bug): CLI [op-mode] bugs. Root task` -- {vytask}`T1894` `(bug): FRR config not loaded after daemons segfault or restart` -- {vytask}`T3807` `(bug): Op Command "show interfaces wireguard" does not show the output` -- {vytask}`T3808` `(default): ipsec is mistakenly restarted after delete` - -## 2021-09-06 - -- {vytask}`T3806` `(bug): Don't set link local ipv6 address if MTU less then 1280` -- {vytask}`T3803` `(default): Add source-address option to the ping CLI` -- {vytask}`T3431` `(bug): Show version all bug` -- {vytask}`T3362` `(bug): 1.3 - RC1 ifb redirect failing to commit` -- {vytask}`T3291` `(bug): Fault on setting offload RPS with single-core CPU` -- {vytask}`T2920` `(bug): Commit crash when adding the second mGRE tunnel with the same key` -- {vytask}`T2895` `(bug): VPN IPsec "leftsubnet" declared 2 times` -- {vytask}`T2019` `(bug): LLDP wrong config generation for interface 'all'` - -## 2021-09-05 - -- {vytask}`T3804` `(feature): cli: Migrate and merge "system name-servers-dhcp" into "system name-server"` - -## 2021-09-04 - -- {vytask}`T3697` `(bug): Impossible to delete IPsec completely` -- {vytask}`T3619` `(bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage` -- {vytask}`T1785` `(bug): Deleting partitions on disks (Raid1) with default value 'no'` - -## 2021-09-03 - -- {vytask}`T3788` `(bug): Keys are not allowed with ipip and sit tunnels` -- {vytask}`T3683` `(bug): VXLAN not accept ipv6 and source-interface options and mtu bug` -- {vytask}`T3634` `(feature): Add op command option for ping for do not fragment bit to be set` - -## 2021-09-02 - -- {vytask}`T3792` `(bug): login: A hypen present in a username from "system login user" is replaced by an underscore` -- {vytask}`T3790` `(bug): Does not possible to configure PPTP static ip-address to users` - -## 2021-09-01 - -- {vytask}`T2434` `(bug): Duplicate Address Detection Breaks Interfaces` - -## 2021-08-31 - -- {vytask}`T3789` `(feature): Add custom validator for base64 encoded CLI data` -- {vytask}`T3782` `(default): Ingress Shaping with IFB No Longer Functional with 1.3` - -## 2021-08-30 - -- {vytask}`T3777` `(bug): adding IPv6 EUI64 address fails commit in 1.3.0-rc6` -- {vytask}`T3768` `(default): Remove early syntaxVersion implementation` -- {vytask}`T2558` `` (feature): Add some CPU information to `show version` + fix broken hypervisor detection `` -- {vytask}`T2430` `(default): cannot delete specific route static next-hop` -- {vytask}`T1350` `(bug): VRRP transition script will be executed once only` -- {vytask}`T2941` `(default): Using a non-ASCII character in the description field causes UnicodeDecodeError in configsource.py` -- {vytask}`T3787` `(bug): Remove deprecated UDP fragmentation offloading option` -- {vytask}`T3677` `(feature): "sipcalc" not included in 1.3` - -## 2021-08-29 - -- {vytask}`T3708` `(bug): isisd and gre-bridge commit error` -- {vytask}`T3783` `(bug): "set protocols isis spf-delay-ietf" is not working` -- {vytask}`T2750` `(default): Use m4 as a template processor` - -## 2021-08-27 - -- {vytask}`T3182` `(bug): Main blocker Task for FRR 7.4/7.5 series update` -- {vytask}`T2108` `(default): Use minisign/signify instead of GPG for release signing` - -## 2021-08-26 - -- {vytask}`T3781` `(bug): Revert the NAT implementation in 1.3 back to iptables` -- {vytask}`T3776` `(default): Rename FRR daemon restart op-mode commands` -- {vytask}`T3779` `(feature): Backport all 1.4 IS-IS features and configuration to 1.3 except VRF` - -## 2021-08-25 - -- {vytask}`T3773` `(bug): Delete the "show system integrity" command (to prepare for a re-implementation)` -- {vytask}`T1514` `(default): Add ability to restart frr processes` - -## 2021-08-24 - -- {vytask}`T3772` `(bug): VRRP virtual interfaces are not shown in show interfaces` - -## 2021-08-23 - -- {vytask}`T2555` `(bug): XML op-mode generation scripts silently discard XML nodes` - -## 2021-08-21 - -- {vytask}`T3682` `(bug): Remove running dhclient from ether-resume.py` - -## 2021-08-20 - -- {vytask}`T1950` `(default): Store VyOS configuration syntax version data in JSON file` - -## 2021-08-19 - -- {vytask}`T2759` `(bug): validate-value prints error messages from validators that fail even if overall validation succeeds` -- {vytask}`T3234` `(bug): multi_to_list fails in certain cases, with root cause an element redundancy in XML interface-definitions` -- {vytask}`T3732` `(feature): override-default helper should support adding defaultValues to default less nodes` -- {vytask}`T1962` `(default): Add syntax version to schema` - -## 2021-08-17 - -- {vytask}`T2525` `(bug): OSPFv3 missing route map, not establishing` -- {vytask}`T508` `(bug): ISC DHCP incorrect UDP checksum generation` -- {vytask}`T1643` `(bug): Deleting all firewall zones failed and locked out box` -- {vytask}`T1550` `(bug): Add support for Large BGP Community show commands` - -## 2021-08-16 - -- {vytask}`T3738` `(default): openvpn fails if server and authentication are configured` -- {vytask}`T1594` `(bug): l2tpv3 error on IPv6 local-ip` - -## 2021-08-15 - -- {vytask}`T3756` `(default): VyOS generates invalid QR code for wireguard clients` - -## 2021-08-14 - -- {vytask}`T3745` `(feature): op-mode IPSec show vpn ipse sa sorting` -- {vytask}`T521` `(bug): Network services may fail if vyatta-router.service startup takes longer than a few seconds` - -## 2021-08-13 - -- {vytask}`T3740` `(bug): HTTPs API breaks when the address is IPv6` - -## 2021-08-12 - -- {vytask}`T3731` `(bug): verify_accel_ppp_base_service return wrong config error for SSP` -- {vytask}`T3405` `(feature): PPPoE server unit-cache` -- {vytask}`T2432` `(default): dhcpd: Can't create new lease file: Permission denied` -- {vytask}`T3746` `(feature): Inform users logging into the system about a pending reboot` -- {vytask}`T3744` `(default): Dns forwarding statistics formatting missing a new line` - -## 2021-08-10 - -- {vytask}`T3730` `(bug): op-mode conntrack-sync miss some functions` - -## 2021-08-09 - -- {vytask}`T1501` `(bug): VPN Commit Errors` - -## 2021-08-08 - -- {vytask}`T2027` `(bug): get_config_dict is failing when the configuration section is empty/missing` -- {vytask}`T169` `(feature): Image install should put correct serial console device in created GRUB menu entry` - -## 2021-08-07 - -- {vytask}`T548` `(feature): BGP IPv6 multipath support` - -## 2021-08-06 - -- {vytask}`T1153` `(bug): VyOS 1.2.0RC10, RAID-1, fresh install, unable to save config` - -## 2021-08-05 - -- {vytask}`T696` `(feature): Rewrite conntrack sync to XML` - -## 2021-08-04 - -- {vytask}`T3704` `(feature): Add ability to interact with Areca RAID adapers` -- {vytask}`T320` `(default): OSPF does not redistribute connected routes associated with virtual tunnel interfaces` - -## 2021-08-02 - -- {vytask}`T2623` `(bug): Creating sit tunnel fails with “Can not set “local” for tunnel sit tun1 at tunnel creation”` -- {vytask}`T2161` `(default): snmpd cannot start if ipv6 disabled` -- {vytask}`T3601` `(default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.` - -## 2021-08-01 - -- {vytask}`T3707` `(bug): Ping incorrect ip host checks` - -## 2021-07-31 - -- {vytask}`T3716` `(feature): Linux kernel parameters ignore_routes_with_link_down- ignore disconnected routing connections` -- {vytask}`T1626` `(bug): BGP exchanges prefixes without specified address-family` - -## 2021-07-30 - -- {vytask}`T1176` `(default): FRR - BGP replicating routes` -- {vytask}`T1123` `(bug): Inconsistency in community-list naming validation` - -## 2021-07-29 - -- {vytask}`T2931` `(bug): Unicode decode error causes vyos.configd service to restart` -- {vytask}`T2727` `(bug): Add a dotted decimal value validator` -- {vytask}`T2328` `(default): dhcpv6 server not starting (disable check reversed?)` -- {vytask}`T1758` `(default): Switch vyos.config to libvyosconfig` -- {vytask}`T954` `(bug): Using the 10.255.255.0/24 subnet on other interfaces breaks L2TP/IPSec` - -## 2021-07-23 - -- {vytask}`T3699` `(bug): login: verify selected "system login user" name is not already used by the base system.` - -## 2021-07-21 - -- {vytask}`T3689` `(bug): static ipv6 route doesn't deleted in some cases` -- {vytask}`T3685` `(feature): IPv6 PBR doesn't allow setting of an egress interface` - -## 2021-07-20 - -- {vytask}`T3691` `(bug): GRETAP: key is not applied when interface is created` - -## 2021-07-13 - -- {vytask}`T3679` `(default): Point the unexpected exception message link to the new rolling release location` - -## 2021-07-11 - -- {vytask}`T3665` `(bug): Missing VRF support for VxLAN but already documented` - -## 2021-07-06 - -- {vytask}`T3660` `(feature): Conntrack-Sync configuration command to specify destination udp port for peer` - -## 2021-07-01 - -- {vytask}`T3658` `(feature): Add support for dhcpdv6 fixed-prefix6` - -## 2021-06-29 - -- {vytask}`T3593` `(bug): PPPoE server called-sid format does not work` - -## 2021-06-25 - -- {vytask}`T3650` `(bug): OpenVPN: Upgrade package to 2.5.1 before releasing VyOS 1.3.0` -- {vytask}`T3649` `(feature): Add bonding additional hash-policy` - -## 2021-06-24 - -- {vytask}`T2722` `(bug): get_config_dict() and key_mangling=('-', '_') will alter CLI data for tagNodes` - -## 2021-06-22 - -- {vytask}`T3629` `(bug): IPoE server shifting address in the range` - -## 2021-06-20 - -- {vytask}`T3637` `(bug): vrf: bind-to-all didn't work properly` - -## 2021-06-19 - -- {vytask}`T3633` `(feature): Add LRO offload for interface ethernet` - -## 2021-06-17 - -- {vytask}`T3631` `(feature): route-map: migrate "set extcommunity-rt" and "set extcommunity-soo" to "set extcommunity rt|soo" to match FRR syntax` - -## 2021-06-16 - -- {vytask}`T2425` `(feature): Rewrite all policy zebra filters to XML/Python style` -- {vytask}`T3630` `(feature): op-mode: add "show version kernel" command` - -## 2021-06-13 - -- {vytask}`T3620` `(feature): Rename WWAN interface from wirelessmodem to wwan to use QMI interface` -- {vytask}`T3622` `(feature): WWAN: add support for APN authentication` -- {vytask}`T3621` `(bug): PPPoE interface does not validate if password is supplied when username is set` - -## 2021-06-10 - -- {vytask}`T3250` `(bug): PPPoE server: wrong local usernames` -- {vytask}`T3138` `(bug): ddclient improperly updated when apply rfc2136 config` -- {vytask}`T2645` `(default): Editing route-map action requires adding a new rule` - -## 2021-06-09 - -- {vytask}`T3602` `(bug): Renaming BGP Peer Groups Leaves Router Broken` -- {vytask}`T2916` `(bug): A state of VTI interface in a configuration does not being processing properly` - -## 2021-06-08 - -- {vytask}`T3605` `(default): Allow to set prefer-global for ipv6-next-hop` -- {vytask}`T3607` `(feature): [route-map] set ipv6 next-hop prefer-global` - -## 2021-06-07 - -- {vytask}`T3581` `` (bug): Incomplete command `show ipv6 ospfv3 linkstate` `` -- {vytask}`T3516` `(bug): FRR 7.5 adds a second route when you attempt to change a static route distance instead of overwriting the old route` -- {vytask}`T3461` `(bug): OpenConnect Server redundancy check` -- {vytask}`T3455` `(bug): system users can not be added in "edit"` - -## 2021-06-04 - -- {vytask}`T3592` `(feature): Set default TTL 64 for tunnels` - -## 2021-06-01 - -- {vytask}`T406` `(bug): VPN configuration error: IPv6 over IPv4 IPsec is not supported when using IPv6 ONLY tunnel.` - -## 2021-05-30 - -- {vytask}`T1866` `(bug): Commit archive over SFTP doesn't work with non-standard ports` -- {vytask}`T3589` `(feature): op-mode: support clearing out logfiles from CLI` -- {vytask}`T3508` `(bug): Check if there's enough drive space for an upgrade before downloading an image` -- {vytask}`T1506` `(enhancment): commit-archive scp/sftp public key authentication` - -## 2021-05-29 - -- {vytask}`T3135` `(bug): BFD configurations fail to be applied` -- {vytask}`T3103` `(default): Rewrite parts of vyos\frr.py for readability, logging and to fix mulitiline regex "bugs"` -- {vytask}`T2739` `(default): vyos-utils is not compiled with a Jenkins pipeline.` -- {vytask}`T2451` `(bug): Cannot use !tcp or !tcp_udp while adding firewall rule` -- {vytask}`T2436` `(default): equuleus: Testing: vyos-1x: syntax checking Python scripts in PR` -- {vytask}`T2184` `(bug): OpenVPN op_mode tools broken` -- {vytask}`T1944` `(bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure of Zebra` - -## 2021-05-28 - -- {vytask}`T1579` `(feature): Rewrite all interface types in new XML/Python style` - -## 2021-05-27 - -- {vytask}`T2629` `(bug): VXLAN interfaces don't actually allow you to configure most settings` -- {vytask}`T2617` `(feature): Rewrite vyatta-op-quagga "show" to XML` -- {vytask}`T2512` `(feature): vyatta-op-quagga [show ip] to XML format` -- {vytask}`T1905` `(default): Update to Keepalived 2.0.19` -- {vytask}`T2669` `(bug): DHCP-server overlapping ranges.` - -## 2021-05-26 - -- {vytask}`T3558` `(default): autocomplete options for dhcp-interface is not showing for the static route command` -- {vytask}`T3540` `(bug): Keepalived memory utilisation issue when constantly getting its state in JSON format` -- {vytask}`T2807` `(feature): IPv6 Link-Local Address - Automatically generation/configuration on GRE Interfaces` - -## 2021-05-24 - -- {vytask}`T3575` `(bug): pseudo-ethernet: must check source-interface MTU` -- {vytask}`T3571` `(bug): Broken Show Tab Complete` -- {vytask}`T3576` `(bug): ISIS does not support IPV6` - -## 2021-05-23 - -- {vytask}`T3570` `(default): Prevent setting of a larger MTU on child interfaces` -- {vytask}`T3572` `(feature): Basic Drive Diagnostic Tools` - -## 2021-05-20 - -- {vytask}`T3554` `(feature): Add area-type stub for ospfv3` - -## 2021-05-19 - -- {vytask}`T3562` `(feature): Update Accel-PPP to a newer revision` -- {vytask}`T3559` `(feature): Add restart op-command for OpenConnect Server` - -## 2021-05-18 - -- {vytask}`T3525` `(default): VMWare resume script syntax errors` -- {vytask}`T2462` `(default): LLDP op-mode exception: IndexError: list index out of range` - -## 2021-05-15 - -- {vytask}`T3549` `(bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not correctly exported to dhcpdv6.conf when multiple name-server entries are present` -- {vytask}`T3532` `(bug): Not possible to change ethertype after interface creation` -- {vytask}`T3550` `(bug): Router-advert completion typo` -- {vytask}`T3547` `(feature): conntrackd: remove deprecated config options` -- {vytask}`T3535` `(feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor` -- {vytask}`T2049` `(feature): Update strongSwan cipher suites list for IPSec settings` - -## 2021-05-14 - -- {vytask}`T3346` `(bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node exists but there are no rules` -- {vytask}`T3248` `(default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3` -- {vytask}`T3426` `(default): add support for script arguments to vyos-configd` - -## 2021-05-13 - -- {vytask}`T3544` `(feature): DHCP server should validate configuration before applying it` -- {vytask}`T3543` `(feature): Support for setting lacp_rate on LACP bonded interfaces` - -## 2021-05-12 - -- {vytask}`T3302` `(default): Make vyos-configd relay stdout from scripts to the user's console` - -## 2021-05-11 - -- {vytask}`T3526` `(bug): Smoketest policy fail in CI` - -## 2021-05-10 - -- {vytask}`T3528` `(bug): Frr 7.5.1 uses 'seq' for community-lists` - -## 2021-05-08 - -- {vytask}`T3517` `(bug): FRR 7.5 bfd behavior for 1.3` - -## 2021-05-07 - -- {vytask}`T1171` `(bug): 1.2.0 epa2 - IPsec VPN initiation` - -## 2021-05-06 - -- {vytask}`T3519` `(bug): Cannot add / assign L2TPv3 to vrf` - -## 2021-05-01 - -- {vytask}`T3379` `(feature): Add global-parameters name-server for dhcpv6-server` -- {vytask}`T3491` `(default): Change Kernel HZ to 1000` - -## 2021-04-30 - -- {vytask}`T3170` `(default): Add a sanity check for empty node.def files` - -## 2021-04-29 - -- {vytask}`T3502` `(bug): "system ip multipath layer4-hashing" doesn't work` -- {vytask}`T3029` `(bug): Generated NGINX configuration is wrong for the redirection (http -> https)` -- {vytask}`T3156` `(feature): Add op and additional conf commands for ISIS` -- {vytask}`T2012` `(feature): Global PBR` -- {vytask}`T1314` `(feature): Allow BGP on unnumbered interfaces` - -## 2021-04-27 - -- {vytask}`T2946` `(bug): Calling 'stty_size' causes show interfaces API to fail` - -## 2021-04-25 - -- {vytask}`T3468` `(bug): Tunnel interfaces aren't suggested as being available for bridging (regression)` -- {vytask}`T1802` `(feature): Wireguard QR code in cli for mobile devices` - -## 2021-04-23 - -- {vytask}`T3290` `(bug): Disabling GRE conntrack module fails` - -## 2021-04-18 - -- {vytask}`T3481` `(default): Exclude tag node values from key mangling` -- {vytask}`T3475` `(bug): XML dictionary cache unable to process syntaxVersion elements` - -## 2021-04-15 - -- {vytask}`T3386` `(bug): PPPoE-server don't start with local authentication` - -## 2021-04-14 - -- {vytask}`T3055` `(bug): op-mode incorrect naming for ipsec policy-based tunnels` - -## 2021-04-12 - -- {vytask}`T3454` `(enhancment): dhclient reject option` - -## 2021-04-05 - -- {vytask}`T1612` `(default): dhcp-server time-offset fails to validate` -- {vytask}`T3438` `(bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf from the operating system` -- {vytask}`T3418` `(bug): BGP: system wide known interface can not be used as neighbor` - -## 2021-04-04 - -- {vytask}`T3457` `(feature): Output the "monitor log" command in a colorful way` - -## 2021-03-31 - -- {vytask}`T3445` `(bug): vyos-1x build include not all nodes` - -## 2021-03-25 - -- {vytask}`T2639` `(feature): sort output of show vpn ipsec sa` - -## 2021-03-22 - -- {vytask}`T3284` `(bug): merge/load fail silently if unable to resolve host` - -## 2021-03-21 - -- {vytask}`T3416` `(bug): NTP: when running inside a VRF op-mode commands do not work` - -## 2021-03-20 - -- {vytask}`T3392` `(bug): vrrp over dhcp default route bug (unexpected vrf)` -- {vytask}`T3373` `(feature): Upgrade to SaltStack version 3002.5` -- {vytask}`T3329` `(default): "system conntrack ignore" rules can no longer be created due to an iptables syntax change` -- {vytask}`T3300` `(feature): Add DHCP default route distance` -- {vytask}`T3306` `(feature): Extend set route-map aggregator as to 4 Bytes` - -## 2021-03-18 - -- {vytask}`T3411` `(default): Extend the redirect_stdout context manager in vyos-configd to redirect stdout from subprocesses` -- {vytask}`T3271` `(bug): qemu-kvm grub issue` - -## 2021-03-17 - -- {vytask}`T3413` `(bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP address string passed to inet_pton"` - -## 2021-03-14 - -- {vytask}`T2271` `(feature): OSPF: add per VRF instance support` -- {vytask}`T175` `(feature): Add source route option to VTI interfaces` - -## 2021-03-13 - -- {vytask}`T3406` `(bug): tunnel: interface no longer supports specifying encaplimit none - or migrator is missing` -- {vytask}`T3407` `(bug): console-server: do not allow to spawn a console-server session on serial port used by "system console"` - -## 2021-03-11 - -- {vytask}`T3399` `(bug): RPKI: dashes in hostnames are replaced with underscores when rendering the FRR config` -- {vytask}`T3305` `(bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot` -- {vytask}`T2927` `(bug): isc-dhcpd release and expiry events never execute` -- {vytask}`T899` `(bug): Tunnels cannot be moved from one bridge to another` -- {vytask}`T786` `(feature): new style xml and conf-mode scripts: posibillity to add tagNode value as parameter to conf-script` - -## 2021-03-09 - -- {vytask}`T3382` `(bug): Error creating Console Server` - -## 2021-03-08 - -- {vytask}`T3387` `(bug): Command "Monitor vpn ipsec" is not working` - -## 2021-03-07 - -- {vytask}`T3319` `(bug): VXLAN uses ttl 1 (auto) by default` -- {vytask}`T3391` `(feature): Add CLI support for specifying maximum-paths per address family ipv4 unicast and ipv6 unicast` -- {vytask}`T3211` `(feature): ability to redistribute ISIS into other routing protocols` - -## 2021-03-05 - -- {vytask}`T2659` `(feature): Add fastnetmon (DDoS detection) support` - -## 2021-03-04 - -- {vytask}`T2861` `(bug): route-map "set community additive" not working correctly` - -## 2021-03-03 - -- {vytask}`T2966` `(feature): tunnel: add new encapsulation types ip6tnl and ip6gretap` - -## 2021-03-01 - -- {vytask}`T3342` `(bug): On xen-netback interfaces must set "scattergather" offload before MTU>1500` - -## 2021-02-28 - -- {vytask}`T3370` `(bug): dhcp: Invalid domain name "private"` -- {vytask}`T3369` `(feature): VXLAN: add IPv6 underlay support` - -## 2021-02-27 - -- {vytask}`T2291` `(bug): Bad hostnames in /etc/hosts with static-mapping in dhcp server config` -- {vytask}`T3364` `(feature): tunnel: cleanup/rename CLI nodes` -- {vytask}`T3368` `(feature): macsec: add support for gcm-aes-256 cipher` -- {vytask}`T3366` `(bug): tunnel: can not change local / remote ip address for gre-bridge tunnel` -- {vytask}`T3173` `(feature): Need 'nopmtudisc' option for tunnel interface` - -## 2021-02-26 - -- {vytask}`T3357` `(default): HTTP-API redirect from http correct https port` - -## 2021-02-24 - -- {vytask}`T3303` `(feature): Change welcome message on boot` - -## 2021-02-21 - -- {vytask}`T3163` `(feature): ethernet ring-buffer can be set with an invalid value` - -## 2021-02-19 - -- {vytask}`T3326` `(bug): OSPFv3: Cannot add L2TPv3 interface` - -## 2021-02-18 - -- {vytask}`T3259` `(default): many dnat rules makes the vyos http api crash, even showConfig op timeouts` - -## 2021-02-17 - -- {vytask}`T3047` `(bug): OSPF : virtual-link and passive-interface default parameters does not work together` -- {vytask}`T3312` `(feature): SolarFlare NICs support` - -## 2021-02-16 - -- {vytask}`T3318` `(feature): Update Linux Kernel to v5.4.208 / 5.10.142` - -## 2021-02-14 - -- {vytask}`T2152` `(bug): ddclient has bug which prevents use_web from being used` -- {vytask}`T3308` `(feature): BGP: add gracefull shutdown support` - -## 2021-02-13 - -- {vytask}`T3028` `(feature): Create a default user when metadata is not available (for Cloud-init builds)` -- {vytask}`T2867` `(feature): Cleanup DataSourceOVF.py in the Cloud-init` -- {vytask}`T2726` `(feature): Allow to use all supported SSH key types in Cloud-init` -- {vytask}`T2403` `(feature): Full support for networking config in Cloud-init` -- {vytask}`T2387` `(feature): Create XML scheme for [conf_mode] BGP` -- {vytask}`T2174` `(feature): Rewrite protocol BGP to new XML/Python style` -- {vytask}`T1987` `(bug): A default route can be deleted by dhclient-script in some cases` -- {vytask}`T723` `(feature): Add support for first boot or installation time saved config modification` -- {vytask}`T1775` `(bug): Cloud-init not running userdata runcmd` -- {vytask}`T1389` `(feature): Add support for NoCloud cloud-init datasource` -- {vytask}`T1315` `(feature): Allow BGP to use address-family l2vpn evpn` - -## 2021-02-11 - -- {vytask}`T2638` `(default): FRR: New framework for configuring FRR` - -## 2021-02-08 - -- {vytask}`T3295` `(feature): Update Linux Kernel to v5.4.96 / 5.10.14` - -## 2021-02-07 - -- {vytask}`T3293` `(bug): RPKI migration script errors out after CLI rewrite` - -## 2021-02-06 - -- {vytask}`T3285` `(feature): Schedule reboots through systemd-shutdownd instead of atd` -- {vytask}`T661` `(feature): Show a warning if the router is going to reboot soon (due to "commit-confirm" command)` - -## 2021-02-05 - -- {vytask}`T2450` `(feature): Rewrite "protocols vrf" tree in XML and Python` -- {vytask}`T208` `(feature): Ability to ignore default-route from dhcpcd per interface` - -## 2021-02-03 - -- {vytask}`T3239` `(default): XML: override 'defaultValue' for mtu of certain interfaces; remove workarounds` -- {vytask}`T2910` `(feature): XML: generator should support override of variables` -- {vytask}`T2873` `(bug): "show nat destination translation address" doesn't filter at all` - -## 2021-02-02 - -- {vytask}`T3018` `(bug): Unclear behaviour when configuring vif and vif-s interfaces` -- {vytask}`T3255` `(default): Rewrite protocol RPKI to new XML/Python style` - -## 2021-02-01 - -- {vytask}`T3268` `(feature): Add VRF support to VIF-S interfaces` -- {vytask}`T3274` `(default): ask_yes_no() doesn't handle EOFError` - -## 2021-01-31 - -- {vytask}`T3276` `(feature): Update Linux Kernel to v5.4.94 / 5.10.12` - -## 2021-01-30 - -- {vytask}`T3269` `(bug): VIF-C interfaces don't verify configuration` -- {vytask}`T3240` `(feature): Support per-interface DHCPv6 DUIDs` -- {vytask}`T3273` `(default): PPPoE static default-routes deleted on interface down when not added by interface up` - -## 2021-01-29 - -- {vytask}`T3262` `(bug): DHCPv6 client runs when dhcpv6-options is configured without requesting an address or PD` -- {vytask}`T3261` `(bug): Does not possible to disable pppoe client interface.` - -## 2021-01-27 - -- {vytask}`T3257` `(feature): tcpdump supporting complete protocol` -- {vytask}`T3110` `(bug): Broken pipe in show interfaces` -- {vytask}`T651` `(enhancment): Split CI'ed, VyOS-specific packages and other packages into separate repos` -- {vytask}`T597` `(enhancment): Code testing on sonarcloud.com` -- {vytask}`T516` `(default): Make Python / XML code development more testable` -- {vytask}`T625` `(default): Lack of IKEv1 lifetime negotiation` -- {vytask}`T613` `(bug): Missing linux-kbuild` -- {vytask}`T505` `(bug): Hostapd cannot log` - -## 2021-01-26 - -- {vytask}`T3251` `(bug): PPPoE client trying to authorize with the wrong username` -- {vytask}`T2859` `(bug): show nat source translation - Errors out` - -## 2021-01-25 - -- {vytask}`T3249` `(feature): Support operation mode forwarding table output` - -## 2021-01-24 - -- {vytask}`T3230` `(bug): RPKI can't be deleted` -- {vytask}`T3243` `(feature): Update Linux Kernel to v5.4.92 / 5.10.10` - -## 2021-01-18 - -- {vytask}`T2761` `(feature): Extend "show vrrp" op-mode command with router priority` -- {vytask}`T2679` `(feature): VRRP with BFD Failure Detection` -- {vytask}`T3212` `(bug): SSH: configuration directory is not always created on boot` -- {vytask}`T3231` `(bug): "system option ctrl-alt-delete" has no effect` - -## 2021-01-17 - -- {vytask}`T3222` `(bug): Typo in BGP dampening description` -- {vytask}`T2944` `(bug): NTP by default listen on any address/interface` -- {vytask}`T3226` `(bug): Repair bridge smoke test damage` -- {vytask}`T2442` `(enhancment): Move application of STP settings for bridge members from interfaces-bridge.py to Interface.add_to_bridge()` -- {vytask}`T2381` `(bug): OpenVPN: openvpn-option parsed/rendered improperly` - -## 2021-01-16 - -- {vytask}`T3215` `(bug): Operational command "show ipv6 route" is broken` -- {vytask}`T3172` `(bug): Builds sometime after 2020-12-17 have broken routing after reboot` -- {vytask}`T3157` `(bug): salt-minion fails to start due to permission error accessing /root/.salt/minion.log` -- {vytask}`T3167` `(default): Recurring bugs in Intel NIC drivers` -- {vytask}`T3151` `(default): Decide on the final list of packages for 1.3` -- {vytask}`T3137` `(feature): Let VLAN aware bridge approach the behavior of professional equipment` -- {vytask}`T3223` `(feature): Update Linux Kernel to v5.4.89 / 5.10.7` - -## 2021-01-15 - -- {vytask}`T3210` `(feature): ISIS three-way-handshake` -- {vytask}`T3184` `(feature): Add correct desctiptions for BGP neighbors` -- {vytask}`T2850` `(feature): Add BGP template for FRR` - -## 2021-01-14 - -- {vytask}`T3218` `(feature): Replace Intel out-of-tree drivers with Linux Kernel stock drivers.` - -## 2021-01-13 - -- {vytask}`T3186` `(bug): NAT: Commit failed when applying negated(!) addresses` - -## 2021-01-12 - -- {vytask}`T3205` `(bug): Does not possible to configure tunnel mode gre-bridge` - -## 2021-01-11 - -- {vytask}`T3208` `(bug): Does not possible to change user password` -- {vytask}`T3198` `(bug): OSPF database filtering issue` -- {vytask}`T3206` `(bug): Unable to delete destination NAT rule` -- {vytask}`T3193` `(bug): DHCPv6 PD verification issues` -- {vytask}`T3201` `(bug): Operational command "show log all" is not working for RADIUS users` - -## 2021-01-10 - -- {vytask}`T3178` `(feature): Migrate vyatta-op-quagga to vyos-1x` - -## 2021-01-09 - -- {vytask}`T2467` `(bug): Restarting flow accounting fails with systemd error` -- {vytask}`T3199` `(feature): Update Linux Kernel to v5.4.88 / 5.10.6` - -## 2021-01-07 - -- {vytask}`T3192` `(feature): login: radius: add support for IPv6 RADIUS servers` - -## 2021-01-05 - -- {vytask}`T3169` `(enhancment): Reimplement smoke test of span (mirror)` -- {vytask}`T3161` `(default): Consider removing ConfigLoad.pm` -- {vytask}`T1398` `(default): Remove vyatta-config-migrate package` -- {vytask}`T805` `(enhancment): Drop config compatibility with Vyatta Core older than 6.5` - -## 2021-01-04 - -- {vytask}`T3185` `(bug): [conf-mode] Wrong CompletionHelp for Tunnel local-ip` -- {vytask}`T2601` `(bug): pppoe-server: Cannot disable CCP` - -## 2021-01-03 - -- {vytask}`T3180` `(bug): DHCP server raises NameError` - -## 2021-01-02 - -- {vytask}`T2321` `(feature): VRF support for SSH, NTP, SNMP service` -- {vytask}`T3177` `(bug): Rolling Release no longer reports VMware UUID` - -## 2021-01-01 - -- {vytask}`T3171` `(feature): Add CLI option to enable RPS (Receive Packet Steering)` - -## 2020-12-31 - -- {vytask}`T3162` `(bug): Wrong PPPoE server pado-delay parameter added to config` -- {vytask}`T3160` `(bug): PPPoE server called-sid option defined in wrong section` -- {vytask}`T3168` `(feature): Update Linux Kernel to v5.4.86` - -## 2020-12-29 - -- {vytask}`T3082` `(bug): multi_to_list must distinguish between values and defaults` -- {vytask}`T1466` `(feature): Add EAPOL login support` - -## 2020-12-28 - -- {vytask}`T1732` `(feature): Removing vyatta-webproxy module` -- {vytask}`T2666` `(feature): Packet Processing with eBPF and XDP` -- {vytask}`T2581` `(default): webproxy: implement proxy chaining` -- {vytask}`T563` `(feature): webproxy: migrate 'service webproxy' to get_config_dict()` - -## 2020-12-27 - -- {vytask}`T3150` `(bug): When configuring QoS, the setting procedure of port mirroring is wrong` - -## 2020-12-23 - -- {vytask}`T3143` `(bug): OpenVPN server: Push route config format is wrong` -- {vytask}`T3146` `(feature): Upgrade FRR from 7.4 -> 7.5 version incl. new libyang` -- {vytask}`T3145` `(feature): Update Linux Kernel to v5.4.85` -- {vytask}`T3147` `(feature): Upgrade to SaltStack version 3002.2` - -## 2020-12-22 - -- {vytask}`T3142` `(bug): OpenVPN op-command completion fails due to missing status file` -- {vytask}`T2940` `(feature): Update FRR to 7.4` -- {vytask}`T2573` `(bug): BFD op-mode commands are broken` -- {vytask}`T2495` `(feature): Add xml for ISIS [conf_mode]` -- {vytask}`T1316` `(feature): Support for IS-IS` - -## 2020-12-21 - -- {vytask}`T2619` `(bug): Bug: Changes in NAT or ZONES from 1.2 to 1.3` - -## 2020-12-20 - -- {vytask}`T3131` `(bug): Typo in ipsec preshared-secret help` -- {vytask}`T3134` `(bug): DHCPv6 DUID configuration node missing` -- {vytask}`T3140` `(feature): Relax "ethernet offload-options" CLI definition` -- {vytask}`T3132` `(feature): Enable egress flow accounting` - -## 2020-12-17 - -- {vytask}`T2810` `(default): Docs for vpn anyconnect-server` -- {vytask}`T2036` `(default): Open Connect VPN Server () support` - -## 2020-12-14 - -- {vytask}`T3128` `(bug): pppoe smoke test failed` -- {vytask}`T3129` `(feature): Update Linux Kernel to v5.4.83` -- {vytask}`T3089` `(feature): Migrate port mirroring to vyos-1x and support two-way traffic mirroring` -- {vytask}`T3130` `(feature): Replace vyos-netplug with upstream debian version` - -## 2020-12-13 - -- {vytask}`T3114` `(bug): When the bridge member is a non-ethernet interface, setting VLAN-aware bridge parameters fails` - -## 2020-12-11 - -- {vytask}`T3123` `(bug): Configuration of vti interface impossible` - -## 2020-12-10 - -- {vytask}`T3117` `(bug): OpenVPN config migration errors upgrading from 1.3-rolling-202010280217 to 1.3-rolling-202012060217` - -## 2020-12-09 - -- {vytask}`T3122` `(feature): Update Linux Kernel to v4.19.162` -- {vytask}`T3121` `(bug): get_config_dict() and key_mangling=('-', '_') Broke PowerDNS dns_forwarding config file` - -## 2020-12-08 - -- {vytask}`T2562` `(bug): VyOS can't be used as a DHCP server for a DHCP relay` - -## 2020-12-07 - -- {vytask}`T3120` `(bug): Python error when deleting nat rule` -- {vytask}`T3119` `(feature): migrate "system ip" to get_config_dict() and provide smoketest` - -## 2020-12-05 - -- {vytask}`T2744` `(bug): igmp-proxy issue: Address already in use` - -## 2020-12-04 - -- {vytask}`T3108` `(bug): Section config overlapped match with FRRConfig` -- {vytask}`T3112` `(feature): PPPoE IPv6: remove "enable" node` -- {vytask}`T3100` `(feature): Migrate DHCP/DHCPv6 server to get_config_dict()` - -## 2020-12-03 - -- {vytask}`T3105` `(bug): static-host-mapping writing in one line` -- {vytask}`T3107` `(feature): Update Linux Kernel to v4.19.161` -- {vytask}`T3104` `(bug): LLDP Traceback error` - -## 2020-12-01 - -- {vytask}`T3102` `(bug): Destination NAT fails to commit` -- {vytask}`T2713` `(bug): VyOS must not change permissions on files in /config/auth` - -## 2020-11-30 - -- {vytask}`T3091` `(feature): Add "tag" for static route` -- {vytask}`T1207` `(feature): DMVPN behind NAT` - -## 2020-11-29 - -- {vytask}`T3095` `(feature): Migrate dhcp-relay and dhcpv6-relay to get_config_dict()` - -## 2020-11-28 - -- {vytask}`T2890` `(bug): NAT error adding translation address range` -- {vytask}`T2868` `(bug): Tcp-mss option in policy calls kernel-panic` -- {vytask}`T3092` `(feature): nat: migrate to get_config_dict()` - -## 2020-11-27 - -- {vytask}`T2715` `(feature): Duplicate address detection option supporting ARP` -- {vytask}`T2714` `(feature): A collection of utilities supporting IPv6 or ipv4` -- {vytask}`T3088` `(feature): Migrate IGMP-Proxy over to get_config_dict() and add smoketests` - -## 2020-11-24 - -- {vytask}`T3087` `(feature): Update Linux Kernel to v4.19.160` - -## 2020-11-23 - -- {vytask}`T2177` `(default): Commit fails on adding disabled interface to bridge` -- {vytask}`T3066` `(bug): reboot in - Invalid time` -- {vytask}`T2802` `(bug): Tunnel interface does not apply EUI-64 IPv6 Address` -- {vytask}`T2359` `(bug): Adding IPIP6 tun interface to bridge [conf_mode] errors` -- {vytask}`T2357` `(bug): GRE-bridge conf_mode errors` -- {vytask}`T2259` `(feature): Support for bind vif-c interfaces into VRFs` -- {vytask}`T2205` `(bug): "set interface ethernet" fails on Hyper-V` -- {vytask}`T2182` `(bug): Failure to commit an IPv6 address on a tunnel interface` -- {vytask}`T2155` `(bug): Cannot set anything on Intel 82599ES 10-Gigabit SFI/SFP+` -- {vytask}`T2153` `(bug): traceroute circular reference` -- {vytask}`T3081` `(bug): get_config_dict() does not honor whitespaces in the CLI values field` -- {vytask}`T3080` `(bug): OpenVPN failing silently for a number of reasons in rolling post Nov/02` -- {vytask}`T3074` `(bug): OpenVPN site-to-site creates wrong peer address` -- {vytask}`T2542` `(bug): OpenVPN client tap interfaces not coming up` -- {vytask}`T3084` `(bug): wifi: TypeError on "show interfaces wireless info"` - -## 2020-11-21 - -- {vytask}`T3079` `(bug): Fix the problem that VLAN 1 will be deleted in VLAN-aware bridge` -- {vytask}`T3060` `(bug): OpenVPN virtual interface not coming up after upgrade` - -## 2020-11-20 - -- {vytask}`T3078` `(feature): CLI cleanup: rename "system options" -> "system option"` -- {vytask}`T2997` `(feature): DHCP: disallow/do-not-request certain options when requesting IP address from server` -- {vytask}`T3077` `(feature): WireGuard: automatically create link-local IPv6 adresses` -- {vytask}`T2550` `(default): OpenVPN: IPv4 not working in client mode` -- {vytask}`T3072` `(feature): Migrate tunnel interfaces to new get_config_dict() approach` -- {vytask}`T3065` `(feature): Add "interfaces wirelessmodem" IPv6 support` -- {vytask}`T3048` `(feature): Drop static smp-affinity for a more dynamic way using tuned` - -## 2020-11-19 - -- {vytask}`T3067` `(bug): Wireless interface can no longer be added to the bridge after bridge VLAN support` -- {vytask}`T3075` `(feature): Update Linux Kernel to v4.19.158` - -## 2020-11-16 - -- {vytask}`T3003` `(enhancment): Extend smoketest framework to allow loading an arbitrary config file` - -## 2020-11-15 - -- {vytask}`T3069` `(bug): OpenVPN routed networks not available` -- {vytask}`T3038` `(feature): Supporting AZERTY keyboards` -- {vytask}`T2993` `(bug): op-mode: lldp: show lldp neighbors - AttributeError: 'str' object has no attribute 'items'` - -## 2020-11-14 - -- {vytask}`T3041` `(bug): Intel QAT: vyos-1.3-rolling-202011020217-amd64 kernel panic during configure` - -## 2020-11-13 - -- {vytask}`T3063` `(feature): Add support for Huawei LTE Module ME909s-120` -- {vytask}`T3059` `(bug): L2TPv3 interface: Enforced to shutdown but no command to enable interface permanently` - -## 2020-11-12 - -- {vytask}`T3064` `(feature): Update Linux Kernel to v4.19.157` - -## 2020-11-10 - -- {vytask}`T2103` `(bug): Abnormal interface names if VIF present` - -## 2020-11-08 - -- {vytask}`T3050` `(bug): Broken address/subnet validation on NAT configuration` - -## 2020-11-07 - -- {vytask}`T2914` `(bug): OpenVPN: Fix for IPv4 remote-host hostname in client mode:` -- {vytask}`T2653` `(feature): "set interfaces" Python handler code improvements - next iteration` -- {vytask}`T311` `(feature): DHCP: set client-hostname via CLI` - -## 2020-11-06 - -- {vytask}`T3051` `(bug): OpenVPN: multiple client routes do not work in server mode` -- {vytask}`T3046` `(bug): openvpn directory is not auto-created` -- {vytask}`T3052` `(feature): Update Linux firmware files to 20201022 version` -- {vytask}`T2731` `(bug): "show interfaces" returns invalid state when link is down` - -## 2020-11-05 - -- {vytask}`T3049` `(feature): Update Linux Kernel to v4.19.155` -- {vytask}`T2994` `(feature): Migrate OpenVPN interfaces to get_config_dict() syntax` - -## 2020-11-03 - -- {vytask}`T3043` `(feature): Wireless: Refactor CLI` -- {vytask}`T3034` `(feature): Add WiFi WPA 3 support` -- {vytask}`T2967` `(bug): Duplicate IPv6 BFD peers created` -- {vytask}`T2483` `(bug): DHCP most likely not restarting pdns_recursor` - -## 2020-11-02 - -- {vytask}`T3024` `(bug): DHCPv6 PD configuration doesn't really render an expected behavior` - -## 2020-11-01 - -- {vytask}`T3036` `(feature): OpenVPN remote-address does not accept IPv6 address` -- {vytask}`T2193` `` (feature): Display disabled VRRP instances in a `show vrrp` output `` - -## 2020-10-30 - -- {vytask}`T2790` `(feature): Add ability to set ipv6 protocol route-map for OSPFv3` -- {vytask}`T3033` `(feature): Update Linux Kernel to v4.19.154` -- {vytask}`T2969` `(bug): OpenVPN: command_set on interface is not applied, if interface doesn't come up in commit` - -## 2020-10-28 - -- {vytask}`T2631` `(default): l2tp, sstp, pptp add option to disable radius accounting` -- {vytask}`T2630` `(feature): Allow Interface MTU over 9000` -- {vytask}`T3027` `(bug): Unable to update system Signature check FAILED` -- {vytask}`T2995` `(bug): Enhancements/bugfixes for vyos_dict_search()` -- {vytask}`T2968` `(feature): Add support for Intel Atom C2000 series QAT` - -## 2020-10-27 - -- {vytask}`T3026` `(default): qemu: update script for deprecated ssh_host_port_min/max` -- {vytask}`T2938` `(feature): Adding remote Syslog RFC5424 compatibility` -- {vytask}`T2924` `(bug): Using 'set src' in a route-map invalidates it as part of a subsequent boot-up` -- {vytask}`T2587` `(bug): Cannot enable the interface when the MTU is set to less than 1280` -- {vytask}`T2885` `(default): configd: print commit errors to config session terminal` -- {vytask}`T2808` `(default): Add smoketest to ensure script consistency with config daemon` -- {vytask}`T2582` `(default): Script daemon to offload processing during commit` -- {vytask}`T1721` `(bug): Recursive Next Hop not updated for static routes` - -## 2020-10-24 - -- {vytask}`T3007` `(default): HTTP-API should use config load script, not backend config load` -- {vytask}`T3009` `(bug): vpn l2tp remoteaccess require option broken` -- {vytask}`T3010` `(bug): ttl option of gre-bridge` -- {vytask}`T3005` `(bug): Intel: update out-of-tree drivers, i40e driver warning` -- {vytask}`T3004` `(feature): ConfigSession should (optionally) use config load script` -- {vytask}`T2723` `(feature): Support tcptraceroute` - -## 2020-10-22 - -- {vytask}`T2978` `(bug): IPoE service does not work on shared mode` -- {vytask}`T2906` `(bug): OpenVPN: tls-auth missing key direction` - -## 2020-10-21 - -- {vytask}`T2828` `(bug): BGP conf_mode error enforce-first-as` -- {vytask}`T2749` `(bug): Setting ethx configuration takes a long time` -- {vytask}`T2138` `(default): Can't load archived configs as they are gzipped` - -## 2020-10-20 - -- {vytask}`T2987` `(bug): VxLAN not working properly after upgrading to latest October build and with a new installation` -- {vytask}`T2989` `(default): MPLS documentation expansion` - -## 2020-10-19 - -- {vytask}`T1588` `(bug): VRRP failed to start if any of its interaces not exist` -- {vytask}`T1385` `(feature): Allow bonding interfaces to have pseudo-ethernet interfaces` -- {vytask}`T3000` `(bug): Mismatch between "prefix-length" and "preference" in dhcp6-server syntax` -- {vytask}`T2992` `(feature): Automatically verify sha256 checksum on ISO download` -- {vytask}`T752` `(feature): Add an option to disable IPv4 forwarding on specific interface only` - -## 2020-10-18 - -- {vytask}`T2965` `(feature): Brief BFD Peer Info` -- {vytask}`T2907` `(feature): OpenVPN: Option to disable encryption` -- {vytask}`T2985` `(feature): Add glue code to create bridge interface on demand` - -## 2020-10-17 - -- {vytask}`T2980` `(bug): FRR bfdd crash due to invalid length` -- {vytask}`T2991` `(feature): Update WireGuard to 1.0.20200908` -- {vytask}`T2990` `(feature): Update Linux Kernel to v4.19.152` -- {vytask}`T2981` `(feature): MPLS LDP neighbor session clear capability` -- {vytask}`T2792` `` (default): Failed to run `sudo make qemu` with vyos-build container due to the change of packer `` - -## 2020-10-13 - -- {vytask}`T2976` `(bug): Client IP pool does not work for PPPoE local users` - -## 2020-10-12 - -- {vytask}`T2951` `(bug): Cannot enable logging for monitor nat` -- {vytask}`T2782` `(bug): Changing timezone, does not restart rsyslog` - -## 2020-10-06 - -- {vytask}`T2957` `(bug): show openvpn not printing anything` - -## 2020-10-05 - -- {vytask}`T2963` `(bug): Wireless: WIFI is not password protected when security wpa mode is not defined but passphrase is` - -## 2020-10-04 - -- {vytask}`T2953` `(feature): Accel-PPP services CLI config cleanup (SSTP, L2TP, PPPoE, IPoE)` -- {vytask}`T2829` `(bug): PPPoE server: mppe setting is implemented as node instead of leafNode` -- {vytask}`T2960` `(feature): sstp: migrate to get_config_dict()` - -## 2020-10-03 - -- {vytask}`T2956` `(feature): Add support for list of defaultValues` -- {vytask}`T2955` `(feature): Update Linux Kernel to v4.19.149` - -## 2020-10-02 - -- {vytask}`T2952` `(bug): configd: timeout breaks synchronization of messages, causing freeze` - -## 2020-10-01 - -- {vytask}`T2945` `(bug): Interface removed from bridge on setting change` -- {vytask}`T2948` `(bug): NAT: OSError when configuring translation address range` -- {vytask}`T2936` `(feature): Migrate PPPoE server to get_config_dict() do reduce boilerplate code` - -## 2020-09-30 - -- {vytask}`T2939` `(bug): Wireguard Remove Peer Fails` - -## 2020-09-29 - -- {vytask}`T2919` `(feature): PPPoE server: Called-Station-Id attribute` -- {vytask}`T2918` `(feature): Accounting interim jitter for pppoe, l2tp, pptp, ipoe` -- {vytask}`T2917` `(feature): PPPoE server: Preallocate NAS-Port-Id` -- {vytask}`T2937` `(feature): Update Linux Kernel to v4.19.148` - -## 2020-09-27 - -- {vytask}`T2930` `(feature): Support configuration of MAC address for VXLAN and GENEVE tunnel` - -## 2020-09-26 - -- {vytask}`T2856` `` (bug): equuleus: `show version all` throws broken pipe exception on abort `` -- {vytask}`T2929` `(bug): Upgrading from 1.2 (crux) to 1.3 rolling causes vyos.configtree.ConfigTreeError for RADIUS settings` -- {vytask}`T2928` `(bug): MTU less then 1280 bytes and IPv6 will raise FileNotFoundError` -- {vytask}`T2926` `(bug): snmp.py missing an import` -- {vytask}`T2912` `(feature): When setting MTU check for hardware maximum supported MTU size` - -## 2020-09-25 - -- {vytask}`T2915` `(bug): Lost "proxy-arp-pvlan" option for vlan` -- {vytask}`T2925` `(feature): Update Linux Kernel to v4.19.147` -- {vytask}`T2921` `(feature): Migrate "service dns forwarding" to get_config_dict() for ease of source maintenance` - -## 2020-09-24 - -- {vytask}`T2896` `(bug): set ip route 0.0.0.0/0 dhcp-interface eth0` -- {vytask}`T2923` `(bug): Configuring DHCPv6-PD without a interface to delegate to raises TypeError` - -## 2020-09-23 - -- {vytask}`T2846` `(bug): ip route doesn't show longer-prefixes` - -## 2020-09-20 - -- {vytask}`T2904` `(feature): 802.1ad / Q-in-Q ethertype default not utilized` -- {vytask}`T2905` `(feature): Sync CLI nodes between PPPoE and WWAN interface` -- {vytask}`T2903` `(feature): Q-in-Q (802.1.ad) ethertype should be defined explicitly and not via its raw value` - -## 2020-09-19 - -- {vytask}`T2894` `(bug): bond: lacp: member interfaces get removed once bond interface has vlans configured` -- {vytask}`T2901` `(feature): Update Linux Kernel to v4.19.146` -- {vytask}`T2900` `(bug): DNS forwarding: invalid warning is shown for "system name-server" or "system name-servers-dhcp" even if present` - -## 2020-09-18 - -- {vytask}`T945` `(bug): Unable to change configuration after changing it from script (vbash + script-template)` - -## 2020-09-16 - -- {vytask}`T2886` `(bug): RADIUS authentication broken only returns operator level` -- {vytask}`T2887` `(bug): WiFi ht40+ channel width is not set in hostaptd.conf` - -## 2020-09-15 - -- {vytask}`T2515` `(bug): Ethernet interface is automatically disabled when removing it from bond` - -## 2020-09-14 - -- {vytask}`T2872` `(bug): "Show log" for nat and openvpn got intermixed` -- {vytask}`T2301` `(bug): Cannot delete PBR` -- {vytask}`T2880` `(feature): Update Linux Kernel to v4.19.145` -- {vytask}`T2879` `(feature): Cleanup 4.19.144 kernel configuration` - -## 2020-09-13 - -- {vytask}`T2858` `(feature): Rewrite dynamic dns client to get_config_dict()` -- {vytask}`T2857` `(feature): Cleanup Intel QAT configuration script` -- {vytask}`T2877` `(feature): LACP / bonding: support configuration of minimum number of links` - -## 2020-09-12 - -- {vytask}`T2863` `(default): Wireguard IPv6 Link-Local Addresses Are Not Unique` -- {vytask}`T2876` `(feature): Update Linux Kernel to v4.19.144` - -## 2020-09-10 - -- {vytask}`T2870` `(feature): Update Linux Kernel to v5.8.8` - -## 2020-09-09 - -- {vytask}`T2728` `(bug): Protocol option ignored for IPSec peers in transport mode` -- {vytask}`T1934` `(default): Change default hostname when deploy from OVA without params.` -- {vytask}`T1953` `(bug): DDNS service name validation rejects valid service names` - -## 2020-09-07 - -- {vytask}`T1729` `(default): PIM (Protocol Independent Multicast) implementation` - -## 2020-09-06 - -- {vytask}`T2860` `(bug): Update Accel-PPP to fix l2tp CVE` - -## 2020-09-02 - -- {vytask}`T2833` `(bug): RIP outgoing update filter list no longer operational` -- {vytask}`T2849` `(bug): vyos.xml.defaults should return a list on multi nodes, by default` - -## 2020-08-31 - -- {vytask}`T2636` `(bug): get_config_dict() shall always return a list on nodes` - -## 2020-08-30 - -- {vytask}`T2843` `(feature): Upgrade Linux Kernel to 5.8 series` -- {vytask}`T2814` `` (default): kernel 5.1+ : NAT : module `nft_chain_nat_ipv4` renamed `` -- {vytask}`T2839` `(feature): Upgrade WireGuard user-space tools and Kernel module` -- {vytask}`T2842` `(feature): Replace custom "wireguard, wireguard-tools" package with debian-backports version` - -## 2020-08-29 - -- {vytask}`T2836` `(default): show system integrity broken in 1.3` - -## 2020-08-28 - -- {vytask}`T2126` `(bug): show vpn ipsec sa IPSec - Process NOT Running` -- {vytask}`T2813` `(bug): NAT: possible to commit illegal source nat without translation` -- {vytask}`T1463` `` (bug): Missing command `show ip bgp scan` appears in command completion `` - -## 2020-08-27 - -- {vytask}`T2832` `(feature): Migrate vyos-smoketest content into vyos-1x` - -## 2020-08-26 - -- {vytask}`T2830` `(default): Migrate "service https" to use get_config_dict()` -- {vytask}`T2831` `(feature): Update Linux Kernel to v4.19.142` - -## 2020-08-25 - -- {vytask}`T2826` `(bug): frr: frr python lib error in replace_section` - -## 2020-08-24 - -- {vytask}`T2423` `(bug): Loadkey scp ssh key errors` - -## 2020-08-23 - -- {vytask}`T2811` `(bug): Cannot delete vpn anyconnect` -- {vytask}`T2823` `(bug): VXLAN has state A/D after configuration` -- {vytask}`T2812` `(default): Add basic smoketest for anyconnect` - -## 2020-08-22 - -- {vytask}`T2822` `(feature): Update Linux Kernel to v4.19.141` -- {vytask}`T2821` `(feature): Support DHCPv6-PD without "address dhcpv6"` -- {vytask}`T2677` `(feature): Proposal for clearer DHCPv6-PD configuration options` - -## 2020-08-20 - -- {vytask}`T2209` `(bug): Documentation has reference to the old 'user x level admin' option` -- {vytask}`T1665` `(default): prefix-list and prefix-list6 rules incorrectly accept a host address where prefix is required` -- {vytask}`T2815` `(default): Move certbot config directory under /config/auth` - -## 2020-08-19 - -- {vytask}`T2794` `(bug): op-mode: lldp: "show lldp neighbors" IndexError: list index out of range` -- {vytask}`T2791` `(feature): "monitor traceroute" has no explicit IPv4/IPv6 support` -- {vytask}`T1515` `(bug): FRR ospf6d crashes when performing: "show ipv6 ospfv3 database"` - -## 2020-08-16 - -- {vytask}`T2277` `(bug): dhclient-script-vyos does not support VRFs` -- {vytask}`T2090` `(default): Deleting 'service salt-minion' causes python TypeError` - -## 2020-08-15 - -- {vytask}`T2797` `(feature): Update Linux Kernel to v4.19.139` -- {vytask}`T2796` `(bug): PPPoE-Server: listen interface is mandatory but validation check is missing` - -## 2020-08-14 - -- {vytask}`T2795` `(bug): console server fails to commit` - -## 2020-08-12 - -- {vytask}`T2786` `(bug): OSPF Interface Cost` -- {vytask}`T2325` `(bug): NHRP op-mode errors with missing daemon socket` -- {vytask}`T2227` `(feature): MPLS documentation` -- {vytask}`T2767` `(bug): The interface cannot be disabled for network enabled configuration` -- {vytask}`T2316` `(bug): DHCP-server op-mode errors` - -## 2020-08-11 - -- {vytask}`T2779` `(bug): LLDP: "show lldp neighbors interface" does not yield any result` -- {vytask}`T2379` `(bug): DHCPv6 address for interface deletion triggers a script error` -- {vytask}`T2784` `(default): Remove unused arg from host_name.py functions verify and get_config` - -## 2020-08-10 - -- {vytask}`T2780` `(feature): Update Linux Kernel to v4.19.138` - -## 2020-08-08 - -- {vytask}`T2716` `(bug): Shaper-HFSC shapes but does not control latency correctly` -- {vytask}`T2497` `(default): Cache config string during commit` -- {vytask}`T2501` `(bug): Cannot recover from failed boot config load` -- {vytask}`T1974` `(feature): Allow route-map to set administrative distance` -- {vytask}`T1949` `(bug): Multihop IPv6 BFD is unconfigurable` - -## 2020-08-04 - -- {vytask}`T2758` `(bug): router-advert: 'infinity' is not a valid integer number` -- {vytask}`T2637` `(bug): Vlan is not removed from the system` -- {vytask}`T1287` `(bug): No DHCPv6 leases reported for "show dhcpv6 client leases"` - -## 2020-08-03 - -- {vytask}`T2241` `(default): Changing settings on an interface causes it to fall out of bridge` -- {vytask}`T2757` `(bug): "show system image version" contains additional new-line character breaking output` -- {vytask}`T1826` `(bug): Misleading message on "reboot at" command` -- {vytask}`T1511` `(default): Rewrite ethernet setup scripts to python` -- {vytask}`T1600` `(default): Convert 'ping' operation from vyatta-op to new syntax` -- {vytask}`T1486` `(bug): Unknown LLDP version reported to peers` -- {vytask}`T1414` `(enhancment): equuleus: buster: 10-unmountfs.chroot fail under apply` -- {vytask}`T1076` `(bug): SSH: make configuration (sshd_config) volatile and store it to /run` -- {vytask}`T2724` `(feature): Support for IPv6 Toolset` -- {vytask}`T2323` `(bug): LLDP: "show lldp neighbors detail" returns warnings when service is not configured` -- {vytask}`T1754` `(bug): DHCPv6 client is impossible to restart` - -## 2020-08-02 - -- {vytask}`T2756` `(feature): Accel-PPP: make RADIUS accounting port configurable` - -## 2020-08-01 - -- {vytask}`T2752` `(bug): Exception when configuring unavailable ethernet interface` -- {vytask}`T2751` `(feature): Update Linux Kernel to v4.19.136` -- {vytask}`T2753` `(feature): Rewrite "add system image" op mode commands in XML` -- {vytask}`T2690` `(feature): Add VRF support to the add system image command` - -## 2020-07-30 - -- {vytask}`T2746` `(feature): IPv6 link-local addresses not configured` -- {vytask}`T2678` `(bug): High RAM usage on SSH logins with lots of IPv6 routes in the routing table.` -- {vytask}`T2701` `` (bug): `vpn ipsec pfs enable` doesn't work with IKE groups `` -- {vytask}`T2745` `(feature): router-advert: migrate to get_config_dict()` - -## 2020-07-29 - -- {vytask}`T2743` `(feature): WireGuard: move key migration from config script to migration script` -- {vytask}`T2742` `(feature): mDNS repeater: migrate to get_config_dict()` - -## 2020-07-28 - -- {vytask}`T1117` `(feature): 'show ipv6 bgp route-map' missing` -- {vytask}`T928` `(feature): Add support for PIM (Protocol-Independent Multicast)` - -## 2020-07-27 - -- {vytask}`T2729` `(feature): Pseudo-ethernet replace fail message` -- {vytask}`T1249` `(feature): multiple PBR rules can set to a single interface` -- {vytask}`T1956` `(feature): PPPoE server: support PADO-delay` -- {vytask}`T1295` `(feature): FRR: update documentation` -- {vytask}`T1222` `(bug): OSPF routing problem - route looping` -- {vytask}`T1158` `(bug): Route-Map configuration dropped updating rc11 to epa2` -- {vytask}`T1130` `(bug): Deleting BGP communities from prefix does not work` -- {vytask}`T2067` `(feature): pppoe-server: Add possibility set multiple service-name` - -## 2020-07-26 - -- {vytask}`T2734` `(feature): WireGuard: fwmark CLI definition is inconsistent` -- {vytask}`T2733` `(feature): Support MTU configuration on pseudo ethernet devices` -- {vytask}`T2644` `(default): Bonding interfaces cannot be disabled` -- {vytask}`T2476` `(bug): Bond member description change leads to network outage` -- {vytask}`T2443` `(feature): NHRP: Add debugging information to syslog` -- {vytask}`T2021` `(bug): OSPFv3 doesn't support decimal area syntax` -- {vytask}`T1901` `(bug): Semicolon in values is interpreted as a part of the shell command by validators` -- {vytask}`T2000` `(bug): strongSwan does not install routes to table 220 in certain cases` -- {vytask}`T2091` `(bug): swanctl.conf file is not generated properly if more than one IPsec profile is used` -- {vytask}`T1983` `(feature): Expose route-map when BGP routes are programmed in to FIB` -- {vytask}`T1973` `(feature): Allow route-map to match on BGP local preference value` -- {vytask}`T1853` `(bug): wireguard - disable peer doesn't work` -- {vytask}`T1985` `(feature): pppoe: Enable ipv6 modules without configured ipv6 pools` - -## 2020-07-25 - -- {vytask}`T2730` `(feature): Update Linux Kernel to v4.19.134` -- {vytask}`T2106` `(bug): Wrong interface states after reboot` -- {vytask}`T1507` `(default): cli: logical redundancy with boolean type` - -## 2020-07-24 - -- {vytask}`T2097` `(bug): Problems when using as completion helper in op-mode` -- {vytask}`T2092` `(bug): dhcp-server rfc3442 static route should add default route` -- {vytask}`T1817` `(bug): BGP next-hop-self not working.` -- {vytask}`T1462` `(bug): Upgrade path errors 1.1.8 to 1.2.1-S2` -- {vytask}`T1372` `(bug): Diff functionality behaves incorrectly in some cases` -- {vytask}`T2073` `(feature): ipoe-server: reset op-mode command for sessions` -- {vytask}`T1715` `(bug): System DNS Server Order Incorrect` - -## 2020-07-23 - -- {vytask}`T2673` `(bug): After the bridge is configured with Mac, bridge is automatically disabled` -- {vytask}`T2626` `(bug): Changing pseudo-ethernet mode, throws CLI error` -- {vytask}`T2608` `(bug): delete pseudo-ethernet failed (another error type)` -- {vytask}`T2527` `(bug): bonding: the last slave interface is not deleted` -- {vytask}`T2358` `(bug): ip6ip6 bridge conf_mode errors` -- {vytask}`T2346` `(bug): Setting hostname yields temporary file error` -- {vytask}`T2330` `(bug): Vpn op-mode syntax` -- {vytask}`T2188` `(default): NTP op-mode commands don't work` - -## 2020-07-22 - -- {vytask}`T2718` `(bug): ntp.conf updated incorrectly` -- {vytask}`T2658` `(bug): Interface description comment display error` -- {vytask}`T2643` `(bug): show interfaces does not scale with terminal width` -- {vytask}`T2725` `(bug): Config fails to load if user has no password` -- {vytask}`T2707` `(default): Allow alternative initialization data for Config` - -## 2020-07-20 - -- {vytask}`T2709` `(bug): Destination NAT translation port without address fails to commit` -- {vytask}`T2519` `(bug): Broadcast address does not add automatically` - -## 2020-07-19 - -- {vytask}`T2708` `(bug): "show flow-accounting" should not display script's "usage" help` -- {vytask}`T2592` `(default): dhcp-relay discarding packets on valid interfaces` -- {vytask}`T2712` `(feature): udp-broadcast-relay: serivce no longer starts` -- {vytask}`T2706` `(feature): Support NDP protocol monitoring` - -## 2020-07-18 - -- {vytask}`T2704` `(bug): connect/disconnect Missing newline in op-mode tab completion helper` -- {vytask}`T2689` `(feature): Add helper functions to query changes between session and effective configs` -- {vytask}`T2585` `(bug): Unable to access the Internet after opening PPPoE on-demand dialing` - -## 2020-07-15 - -- {vytask}`T2675` `(bug): DNS service failed to start` -- {vytask}`T2596` `(feature): Allow specifying source IP for 'add system image'` - -## 2020-07-12 - -- {vytask}`T1575` `` (default): `show snmp mib ifmib` crashes with IndexError `` -- {vytask}`T2696` `(bug): Some bugfixes of vyatta-wanloadbalance` - -## 2020-07-11 - -- {vytask}`T2687` `(feature): SNMP: change logic on v3 password encryption` -- {vytask}`T2693` `(bug): Dhcp6c cannot be restarted after PPPoE link is reset` - -## 2020-07-08 - -- {vytask}`T2692` `(bug): Evaluate Setting Default Hash Policy to L3+L4` -- {vytask}`T2646` `(bug): Sysctl for IPv4 ECMP Hash Policy Not Set` - -## 2020-07-07 - -- {vytask}`T2691` `(bug): Upgrade from 1.2.5 to 1.3-rolling-202007040117 results in broken config due to case mismatch` -- {vytask}`T2389` `(bug): BGP community-list unknown command` -- {vytask}`T2686` `(bug): FRR: BGP: large-community configuration is not applied properly after upgrading FRR to 7.3.x series` - -## 2020-07-06 - -- {vytask}`T2680` `(bug): dhcp6c service cannot recover when it fails` - -## 2020-07-05 - -- {vytask}`T2684` `(feature): Update Linux Kernel to v4.19.131` -- {vytask}`T2685` `(feature): Update Accel-PPP to fix SSTP client issues` -- {vytask}`T2681` `(bug): PPPoE stops negotiating IPv6` - -## 2020-07-04 - -- {vytask}`T2682` `(bug): VRF aware services - connection no longer possible after system reboot` - -## 2020-07-03 - -- {vytask}`T2670` `(default): Remove dependency on show_config from get_config_dict` -- {vytask}`T2676` `(feature): NTP: migrate to get_config_dict() implementation` - -## 2020-07-02 - -- {vytask}`T2668` `(default): get_config_dict: add get_first_key arg to utility function get_sub_dict` - -## 2020-07-01 - -- {vytask}`T2662` `(default): get_config_dict includes node name as key only for tag and leaf nodes` -- {vytask}`T2667` `(feature): get_config_dict: Use utility function for non-empty path argument` - -## 2020-06-28 - -- {vytask}`T2660` `(bug): XML: Python default dictionary does not obey underscore (_) when flat is False` - -## 2020-06-27 - -- {vytask}`T2656` `(bug): XML: Python default dictionary returns wrong dictionary level(s)` - -## 2020-06-26 - -- {vytask}`T2642` `(bug): sshd fails to start due to configuration error` -- {vytask}`T2588` `(default): Add support for default values to the interface-definition format` -- {vytask}`T2622` `(bug): Pseudo-ethernet interface config disappears across versions` -- {vytask}`T2057` `(feature): Generalised Interface configuration` -- {vytask}`T2625` `(feature): Provide generic Library for package builds` - -## 2020-06-25 - -- {vytask}`T2487` `(bug): VRRP does not display info when group disabled` -- {vytask}`T2329` `(bug): Show remote config openvpn` -- {vytask}`T2165` `(bug): When trying to add route to ripng it complains that ip address should be IPv4 format` -- {vytask}`T2159` `(default): webproxy log read from wrong file` -- {vytask}`T2101` `(feature): Fix VXLAN config option parsing` -- {vytask}`T2062` `(bug): Wrong dhcp-server static route subnet bytes` -- {vytask}`T1986` `(bug): Python configuration manipulation library leaks open files` -- {vytask}`T1762` `(bug): VLAN interface configuration fails after internal representation of edit level was switched from a string to a list` -- {vytask}`T1538` `(bug): Update conntrack-sync packages to fix VRRP issues` -- {vytask}`T1808` `(feature): add package nftables` - -## 2020-06-24 - -- {vytask}`T2634` `(feature): remove autogeneration of interface "ip section" from vyatta-cfg-system` -- {vytask}`T2633` `(bug): Error with arp_accept on tun interface` -- {vytask}`T2595` `(feature): Update Linux Kernel to v4.19.128` -- {vytask}`T1938` `(bug): syslog doesn't start automatically` - -## 2020-06-23 - -- {vytask}`T2632` `(bug): WireGuard: Cannot use only one preshared-key for one peer` -- {vytask}`T1829` `(bug): Install Image script does not respect size of partition greater than 2G but less than disk size` -- {vytask}`T2635` `(feature): SSH: migrate to get_config_dict()` - -## 2020-06-22 - -- {vytask}`T2486` `(bug): DNS records set via 'system static-host-mapping' return NXDOMAIN from 'service dns forwarding' after a request to a forwarded zone` -- {vytask}`T2463` `(bug): DHCP-received nameserver not added to vyos-hostsd` -- {vytask}`T2534` `(bug): pdns-recursor override.conf error` -- {vytask}`T2054` `(bug): Changing "system name-server" doesn't update dns forwarding config, neither does "restart dns forwarding"` -- {vytask}`T2225` `(default): PIM/IGMP documentation` - -## 2020-06-21 - -- {vytask}`T2624` `(feature): Serial Console: fix migration script for configured powersave and no console` -- {vytask}`T2610` `(bug): default-lifetime is not reflected in the RA message` -- {vytask}`T2299` `(feature): login radius-server priority` -- {vytask}`T1739` `(bug): Serial interface seems not to be deleted properly` -- {vytask}`T480` `(bug): Error if no serial interface is present (/dev/ttyS0: not a tty)` - -## 2020-06-20 - -- {vytask}`T2621` `(bug): show interfaces repeats interface description if it is longer then an arbitrary number of characters` -- {vytask}`T2618` `(default): Conversion from 1.2 to 1.3 lost RADVD prefix autonomous-flag setting` - -## 2020-06-19 - -- {vytask}`T2589` `(bug): delete pseudo-ethernet failed` -- {vytask}`T2490` `(feature): Add serial (rs232) to ssh bridge service` - -## 2020-06-18 - -- {vytask}`T2614` `(default): Add an option to mangle dict keys to vyos.config.get_config_dict()` -- {vytask}`T2026` `(default): Make cli-shell-api correctly exit with non-zero code on failures` -- {vytask}`T1868` `(default): Add opportunity to get current values from API` - -## 2020-06-17 - -- {vytask}`T2478` `(feature): login radius: use NAS-IP-Address if defined source address` -- {vytask}`T2141` `(bug): Static ARP is not applied on boot` -- {vytask}`T2609` `(bug): router-advert: radvd does not start when lifetime is improperly configured` -- {vytask}`T1720` `(feature): support for more 'show ip route' commands` - -## 2020-06-16 - -- {vytask}`T2604` `(default): Remove use of is_tag in system-syslog.py` -- {vytask}`T2605` `(bug): SNMP service is not disabled by default` -- {vytask}`T2568` `(bug): Add some missing checks in config` -- {vytask}`T2156` `(default): PIM op-mode commands` - -## 2020-06-15 - -- {vytask}`T2600` `(bug): RADIUS system login configuration rendered wrongly` -- {vytask}`T2599` `(bug): "show interfaces" does not list VIF interfaces in ascending order` -- {vytask}`T2591` `(bug): show command has wrong interfaces ordering` -- {vytask}`T2576` `(bug): "show interfaces" does not return VTI` - -## 2020-06-14 - -- {vytask}`T2354` `(bug): Wireless conf_mode errors` -- {vytask}`T2593` `(bug): source NAT translation port can not be set when translation address is set to masquerade` -- {vytask}`T2594` `(default): Missing firmware for iwlwifi` - -## 2020-06-11 - -- {vytask}`T2578` `(bug): ipaddrcheck unaware of /31 host addresses - can no longer assign /31 mask to interface addresses` -- {vytask}`T2571` `(bug): NAT destination port with ! results in error` -- {vytask}`T2570` `(feature): Drop support for "system console device modem"` -- {vytask}`T2586` `(bug): WWAN default route is not installed into VRF` -- {vytask}`T2561` `(feature): Drop support for "system console netconsole"` -- {vytask}`T2569` `(feature): Migrate "set system console" to XML and Python representation` - -## 2020-06-10 - -- {vytask}`T2575` `(bug): pppoe-server: does not possibly assign IP address` -- {vytask}`T2565` `(bug): Cannot connect to l2tp server with radius auth` -- {vytask}`T2553` `(bug): set interface ethN vif-s nnnn does not commit` - -## 2020-06-08 - -- {vytask}`T2559` `(feature): Add operational mode command to retrieve hardware sensor data` - -## 2020-06-07 - -- {vytask}`T2529` `(feature): WWAN: migrate from ttyUSB device to new device in /dev/serial/by-bus` -- {vytask}`T2560` `(feature): New op-mode command to display information about USB interfaces` - -## 2020-06-05 - -- {vytask}`T2548` `(bug): Interfaces allowing inappropriate network addresses to be assigned` -- {vytask}`T1958` `(default): Include only firmware we actually need` - -## 2020-06-04 - -- {vytask}`T2514` `(enhancment): "mac" setting for bond members` - -## 2020-06-02 - -- {vytask}`T2129` `(feature): XML schema: tagNode not allowed on first level in new XML op-mode definition` -- {vytask}`T2545` `(feature): Show physical device offloading capabilities for specified ethernet interface` -- {vytask}`T2544` `(feature): Enable Kernel KONFIG_KALLSYMS` -- {vytask}`T2543` `(feature): Kernel: always build perf binary but ship as additional deb package to not bloat the image` -- {vytask}`T1096` `(bug): BGP process memory leak` - -## 2020-06-01 - -- {vytask}`T2535` `(feature): Update Intel QAT drivers to 1.7.l.4.9.0-00008` -- {vytask}`T2537` `(feature): Migrate "show log dns" from vyatta-op to vyos-1x` -- {vytask}`T2536` `(bug): "show log dns forwarding" still refers to dnsmasq` -- {vytask}`T2538` `(feature): Update Intel NIC drivers to recent release (preparation for Kernel >=5.4)` -- {vytask}`T2526` `(feature): Wake-On-Lan CLI implementation` - -## 2020-05-31 - -- {vytask}`T2532` `(feature): VRF aware OpenVPN` - -## 2020-05-30 - -- {vytask}`T2388` `(feature): template rendering should create folder and set permission` -- {vytask}`T2531` `(feature): Update Linux Kernel to v4.19.125` -- {vytask}`T2530` `(bug): Error creating VRF with a name of exactly 16 characters` - -## 2020-05-29 - -- {vytask}`T2528` `(bug): "update dns dynamic" throws FileNotFoundError excepton` - -## 2020-05-28 - -- {vytask}`T1291` `(default): Under certain conditions the VTI will stay forever down` - -## 2020-05-27 - -- {vytask}`T2395` `(feature): HTTP API move to flask/flask-restx as microframework` -- {vytask}`T1121` `(bug): Can't search for prefixes by community: Community malformed: AA:NN` - -## 2020-05-26 - -- {vytask}`T2520` `(bug): show conntrack fails with Perl error` -- {vytask}`T2502` `(bug): PPPoE default route not installed for IPv6 when "default-route auto"` -- {vytask}`T2458` `(feature): Update FRR to 7.3.1` -- {vytask}`T2506` `(feature): DHCPv6-PD add prefix hint CLI option` - -## 2020-05-25 - -- {vytask}`T2391` `(bug): pppoe-server session-control does not work` -- {vytask}`T2269` `(feature): SSTP specify tunnels names` -- {vytask}`T1137` `(bug): 'sh ip bgp sum' being truncated` - -## 2020-05-22 - -- {vytask}`T2491` `(feature): MACsec: create CLI for replay protection` -- {vytask}`T2489` `(feature): Add MACsec interfaces to "show interfaces" output` -- {vytask}`T2201` `(feature): Rewrite protocol BGP [op-mode] to new XML/Python style` -- {vytask}`T2492` `(feature): Do not set encrypted user password when it is not changed` -- {vytask}`T2496` `(feature): Set default to new syntax for config file component versions` -- {vytask}`T2493` `(feature): Update Linux Kernel to v4.19.124` -- {vytask}`T2380` `(bug): After PPPoE 0 is restarted, the default static route is lost` - -## 2020-05-21 - -- {vytask}`T1876` `(bug): IPSec VTI tunnels are deleted after rekey and dangling around as A/D` -- {vytask}`T2488` `(feature): Remove logfile for dialup interfaces like pppoe and wwan` -- {vytask}`T2475` `(bug): linting` -- {vytask}`T1820` `(bug): VRRP transition scripts for sync-groups are not supported in VyOS (anymore)` -- {vytask}`T2364` `(default): Add CLI command for mroute` -- {vytask}`T2023` `(feature): Add support for 802.1ae MACsec` - -## 2020-05-20 - -- {vytask}`T2480` `(bug): NAT: after rewrite commit tells that dnat IP address is not locally connected` - -## 2020-05-19 - -- {vytask}`T2481` `(feature): WireGuard: support tunnel via IPv6 underlay` -- {vytask}`T421` `(bug): Add Pv6 prefix delegation support` -- {vytask}`T815` `(feature): Add DHCPv6 server prefix-delegation support` - -## 2020-05-17 - -- {vytask}`T2471` `(feature): PPPoE server: always add AdvAutonomousFlag when IPv6 is configured` -- {vytask}`T2409` `(default): At boot, effective config should not be equal to current config` - -## 2020-05-16 - -- {vytask}`T2466` `(bug): live-build encounters apt dependency problem when building with local packages` -- {vytask}`T2470` `(feature): Update to PowerDNS recursor 4.3` -- {vytask}`T2469` `(feature): Update Linux Kernel to v4.19.123` -- {vytask}`T2198` `(default): Rewrite NAT in new XML/Python style` - -## 2020-05-15 - -- {vytask}`T2449` `(bug): 'ipv6 address autoconf' and 'address dhcpv6' don't work because interfaces have accept_ra=1 (they should have accept_ra=2 when forwarding=1)` - -## 2020-05-14 - -- {vytask}`T2456` `(bug): netflow source-ip cannot be configured` - -## 2020-05-13 - -- {vytask}`T2435` `(bug): Pseudo-ethernet Interfaces Broken` -- {vytask}`T2294` `(bug): ipoe-server broken (jinja2 template issue)` - -## 2020-05-12 - -- {vytask}`T2454` `(feature): Update Linux Kernel to v4.19.122` -- {vytask}`T2392` `(bug): SSTP with ipv6` - -## 2020-05-10 - -- {vytask}`T2445` `(bug): VRF route leaking for ipv4 not working` -- {vytask}`T2372` `(bug): VLAN: error on commit if main interface is disabled` -- {vytask}`T2439` `(bug): Configuration dependency problem, unable to load complex configuration after reboot` - -## 2020-05-09 - -- {vytask}`T2427` `(default): Interface addressing broken since fix for T2372 was merged` -- {vytask}`T2438` `(default): isc-dhcp-server(6).service reports startup success immediately even if dhcpd fails to start up` -- {vytask}`T2367` `(default): Flush addresses from bridge members` - -## 2020-05-08 - -- {vytask}`T2441` `(bug): TZ validator has a parse error` -- {vytask}`T2429` `(bug): Vyos cannot apply VLAN sub interface to bridge` - -## 2020-05-06 - -- {vytask}`T2402` `(bug): Live ISO should warn when configuring that changes won't persist` - -## 2020-05-05 - -- {vytask}`T1899` `(bug): Unionfs metadata folder is copied to the active configuration directory` - -## 2020-05-04 - -- {vytask}`T2412` `(bug): ping flood does not work as unprivileged user` -- {vytask}`T701` `(bug): LTE interface dosen't come up` -- {vytask}`T951` `(bug): command 'isolate-stations true/false' does not make any changes in the hostapd.conf` - -## 2020-05-03 - -- {vytask}`T2420` `(feature): Update Linux Kernel to v4.19.120` -- {vytask}`T2406` `(feature): DHCPv6 CLI improvements` -- {vytask}`T2421` `(feature): Update WireGuard to Debian release 1.0.20200429-2_bpo10+1` - -## 2020-05-02 - -- {vytask}`T2414` `(feature): Improve runtime from Python numeric validator` -- {vytask}`T2413` `(feature): Update Linux Kernel to v4.19.119` - -## 2020-05-01 - -- {vytask}`T2411` `(feature): op-mode: make "monitor traceroute" VRF aware` -- {vytask}`T2347` `(bug): During commit, any script output directed to stdout will contain path` -- {vytask}`T2239` `(default): build-vmware-image script ignores the predefined file path, uses the environment variable unconditionally.` - -## 2020-04-29 - -- {vytask}`T2399` `(bug): op-mode "dhcp client leases" does not return leases` -- {vytask}`T2398` `(bug): op-mode "dhcp client leases interface" completion helper misses interfaces` -- {vytask}`T2394` `(feature): dhcpv6 client does not start` -- {vytask}`T2393` `(feature): dhclient: migrate from SysVinit to systemd` -- {vytask}`T2268` `(bug): DHCPv6 is broken` - -## 2020-04-28 - -- {vytask}`T1227` `(bug): rip PW can't be set at interface config` - -## 2020-04-27 - -- {vytask}`T2373` `(feature): Required auth options for pppoe-server` -- {vytask}`T1381` `(feature): Enable DHCP option 121 processing` -- {vytask}`T2010` `(bug): Reboot at reports wrong time or missing timezone` - -## 2020-04-26 - -- {vytask}`T2386` `(bug): salt: upgrade to 2019.2 packages` -- {vytask}`T2385` `(bug): salt-minion: improve completion helpers` -- {vytask}`T2384` `(bug): salt-minion: log to syslog and remove custom logging option` -- {vytask}`T2383` `(feature): Update Linux Kernel to v4.19.118` -- {vytask}`T2382` `(bug): salt-minion: Throws KeyError on commit` -- {vytask}`T2350` `(bug): Interface geneve conf-mode error` - -## 2020-04-25 - -- {vytask}`T2304` `(feature): "system login" add RADIUS VRF support` -- {vytask}`T1842` `(bug): Equuleus: "reboot at 04:00" command not working` - -## 2020-04-24 - -- {vytask}`T2375` `(feature): WireGuard: throw exception if address and port are not given as both are mandatory` -- {vytask}`T2348` `(bug): On IPv6 address distribution and DHCPv6 bugs` - -## 2020-04-23 - -- {vytask}`T2369` `(feature): VRF: can not leak interface route from default VRf to any other VRF` -- {vytask}`T2368` `(bug): VRF: missing completion helper when leaking to default table` -- {vytask}`T2374` `(bug): Tunnel interface can not be disabled` -- {vytask}`T2362` `(default): IPv6 link-local addresses missing due to EUI64 address code, causing router-advert not to work` -- {vytask}`T2345` `(default): IPv6 router-advert not working` - -## 2020-04-22 - -- {vytask}`T2361` `(bug): Unable to delete VLAN vif interface` -- {vytask}`T2339` `(bug): OpenVPN: IPv4 no longer working after adding IPv6 support` -- {vytask}`T2331` `(bug): VRRP op-mode errors` -- {vytask}`T2320` `(bug): Wireguard creates non-existing interfaces in [op-mode].` -- {vytask}`T2096` `(feature): Provide "generate" and "show" commands via the http API` -- {vytask}`T2351` `(feature): Cleanup PPTP server implementation and CLI commands` - -## 2020-04-21 - -- {vytask}`T2341` `(bug): Pseudo-ethernet Interfaces Not Loaded on Boot` -- {vytask}`T2270` `(bug): using load with scp/sftp and a username and password does not work` -- {vytask}`T2255` `(bug): DNS forwarding op-mode error` -- {vytask}`T1907` `(bug): Traceback on a non-existent interface.` -- {vytask}`T2204` `(feature): Support tunnel source-interface` - -## 2020-04-20 - -- {vytask}`T2335` `(bug): Unable to assign IPv6 from ISP` -- {vytask}`T2317` `(bug): l2tp overwriting ipsec config files` -- {vytask}`T2292` `(bug): Ensure graceful shutdown of vyos-http-api` -- {vytask}`T2344` `(bug): PPPoE server client static IP assignment silently fails` - -## 2020-04-19 - -- {vytask}`T2337` `(default): hw-id gone missing from interfaces after upgrade to 1.3-rolling-202004191028` -- {vytask}`T2340` `(feature): Remove informational "sg" messages from syslog` -- {vytask}`T2338` `(bug): Can't delete static IPv6 route on vrf` -- {vytask}`T2336` `(bug): OpenVPN service fails to start` -- {vytask}`T2308` `(default): openvpn op-mode scripts broken after migrating to systemd service` -- {vytask}`T2185` `(default): Start daemons with systemd units instead of with start-stop-daemon` - -## 2020-04-18 - -- {vytask}`T2318` `(bug): dns-forwarding migration script breaks with invalid interface name` -- {vytask}`T2319` `(feature): Update Linux Kernel to v4.19.116` -- {vytask}`T2314` `(feature): Cleanup PPPoE server implementation and CLI commands` -- {vytask}`T2313` `(bug): Accel-PPP / PPPoEserver raises "Floating point exception" when not all limits are defined` -- {vytask}`T2312` `(feature): Use LED modules to enable more visible feedback on VyOS hardware chassis` -- {vytask}`T2306` `(feature): Add new cipher suites to the WiFi configuration` -- {vytask}`T2286` `(default): IPoE server vulnerability` -- {vytask}`T2224` `(feature): Update Linux Kernel to v4.19.114` -- {vytask}`T2110` `(feature): RADIUS: supply include file for radius config to have a uniform CLI` -- {vytask}`T2324` `(feature): Cleanup IPoE server implementation and CLI commands` - -## 2020-04-17 - -- {vytask}`T2275` `(bug): flow-accounting broken in rolling` -- {vytask}`T2256` `(feature): Accel-ppp op-mode syntax` - -## 2020-04-16 - -- {vytask}`T2295` `(bug): Passwords with Special Characters Broken` -- {vytask}`T2305` `(feature): Add release name to "show version" command` -- {vytask}`T2235` `(default): OpenVPN server client IP doesn't reserve that IP in the pool` -- {vytask}`T149` `(feature): IPv6 support in OpenVPN tunnel` - -## 2020-04-15 - -- {vytask}`T2293` `(bug): OpenVPN: UnboundLocalError after merging server_network PullRequest` -- {vytask}`T2298` `(bug): Errors PDNS with name-server set` - -## 2020-04-14 - -- {vytask}`T2213` `(bug): vyos-1x: WiFi mode ieee80211ac should also activate ieee80211n` - -## 2020-04-13 - -- {vytask}`T2283` `(default): openvpn not starting: ccd path in template not moved to /run/openvpn/ccd` -- {vytask}`T2236` `(bug): DMVPN broken after tunnel rewrite to XML/Python` -- {vytask}`T2284` `(default): Upgrade ddclient to 3.9.1 which also brings systemd files` -- {vytask}`T2282` `(feature): Clarify hw-id in ethernet and wireless interface nodes` -- {vytask}`T611` `` (feature): Static route syntax should reflect `ip` command routing capabilities, if possible. `` - -## 2020-04-12 - -- {vytask}`T2273` `(default): OpenVPN no longer starts in latest rolling, migrate to systemd` -- {vytask}`T2263` `(feature): Reset feature for SSTP sessions` -- {vytask}`T2262` `(bug): Broken reset commands for pptp and l2tp` -- {vytask}`T2031` `(bug): pseudo-ethernet link interface cannot be changed` - -## 2020-04-11 - -- {vytask}`T2264` `(feature): l2tp: cleanup CLI definition` -- {vytask}`T2233` `(bug): Typos in wlanX.cfg` -- {vytask}`T2238` `(bug): After re-writing list_interfaces.py to use Interfaces() pseudo-ethernet is missing` - -## 2020-04-10 - -- {vytask}`T2265` `(feature): DHCP to be an attribute of the class instead of a inheritance` -- {vytask}`T2261` `(bug): "client-config-dir" not being set for openvpn` -- {vytask}`T2248` `(bug): PPPoE Broken in Latest 1.3 Rolling (1.3-rolling-202004070629)` -- {vytask}`T1629` `(bug): IP addresses configured on vif-s interfaces are not added to the system` -- {vytask}`T2266` `(default): openvpn bridged client-server doesn't work (validation error)` -- {vytask}`T2253` `(default): Fix use of cmd in merge config and remote function helpers` - -## 2020-04-09 - -- {vytask}`T2260` `(feature): vxlan, pseudo-ethernet: convert link nodes to source-interface` -- {vytask}`T2172` `(feature): Enable conf VXLAN without remote address` -- {vytask}`T2237` `(bug): l2tp, pptp, pppoe wrong chap-secrets file` - -## 2020-04-08 - -- {vytask}`T2244` `(feature): WireGuard: cleanup Python implementation and reduce amount of boilerplate code` -- {vytask}`T2186` `(feature): Provide more information to the user when a traceback is reported to the user` -- {vytask}`T2246` `(bug): LLDP op-mode error` -- {vytask}`T2240` `(feature): Support for bind vif-c interfaces into VRFs` -- {vytask}`T2160` `(feature): Allow restricting HTTP API to specific virtual hosts` -- {vytask}`T2247` `(feature): WireGuard: add VRF support` - -## 2020-04-05 - -- {vytask}`T2212` `(bug): vyos-1x: WiFi card antenna count not set accordingly` -- {vytask}`T2230` `(feature): Split out inlined Jina2 template to data/templates folder` -- {vytask}`T2206` `(feature): Split WireGuard endpoint into proper host and port nodes` - -## 2020-04-04 - -- {vytask}`T2158` `(bug): Commit fails if ethernet interface doesn't support flow control (pause)` -- {vytask}`T2221` `(bug): Ability to remove a VRF that has a next-hop-vrf as target` -- {vytask}`T2211` `(bug): vyos-1x: VHT channel width not set accordingly` -- {vytask}`T2208` `(bug): vyos-1x: commit on interfaces wireless wlanX capabilities vht link-adaptation (both|unsolicited) fails` -- {vytask}`T2183` `(bug): A number of bugs with wireguard script due to interface rearrangement` -- {vytask}`T2104` `(default): ifconfig.py size` -- {vytask}`T2028` `(feature): Convert "interfaces tunnel" to new XML/Python representation` -- {vytask}`T2219` `(bug): VRF default route of PPPoE and WWAN interfaces do not get added into proper routing table` -- {vytask}`T2222` `(default): openvpn: requires "multihome" option to listen on all addresses with udp protocol` - -## 2020-04-02 - -- {vytask}`T2072` `(bug): Shell autocomplete of option (config node) with quoted value doesn't work` -- {vytask}`T1823` `(feature): l2tpv3 interface migration fails` -- {vytask}`T2202` `(feature): Update PowerDNS recursor to 4.2 series` -- {vytask}`T2200` `(feature): Add VRF support on wirelessmodem interfaces` - -## 2020-03-31 - -- {vytask}`T2166` `(bug): Broken proxy-arp on vif` -- {vytask}`T2180` `(bug): get_config_dict should be independent of CLI edit level` -- {vytask}`T2053` `(default): Update vyos-load-config.py for version string syntax change` -- {vytask}`T2052` `(default): Update vyos-merge-config.py for version string syntax change` -- {vytask}`T2144` `(default): vyos-build: docker: selection of text in the terminal still selects it in vim (mouse isn't completely disabled)` - -## 2020-03-30 - -- {vytask}`T2176` `(default): 'WiFiIf' object has no attribute 'set_state'` -- {vytask}`T2029` `(feature): Switch to new syntax for config file component versions` - -## 2020-03-29 - -- {vytask}`T2178` `(bug): VRF interface don't get removed when VRF is deleted` -- {vytask}`T2170` `(feature): Add ability to create static route from default to VRF` -- {vytask}`T1831` `(feature): Denest IPv6 router-advert from Interfaces to general service` - -## 2020-03-28 - -- {vytask}`T2167` `(bug): vyos.ifconfig.get_mac() broken` -- {vytask}`T2151` `(default): wireless: can't delete interface present in config but not present in system` -- {vytask}`T1988` `(feature): Migrate wirelessmodem to new XML/Python style interface` - -## 2020-03-27 - -- {vytask}`T2164` `(bug): Package libstrongswan-standard-plugins missing from image` -- {vytask}`T2105` `(bug): wireless: not possible to disabled wlan0` -- {vytask}`T2169` `(default): Remove redundant use of show_config in vyos-merge-config` - -## 2020-03-26 - -- {vytask}`T2162` `(default): migration script for router-advert sets link-mtu 0 on bridge interfaces` -- {vytask}`T1735` `(bug): Issue in "show vpn ipsec/ike sa" output with ipsec encryption algorithm aes128gcm128/aes256gcm128/chacha etc` - -## 2020-03-25 - -- {vytask}`T2148` `(default): openvpn: setting "server client" config without "server client ip" results in ValueError: '' does not appear to be an IPv4 or IPv6 address` -- {vytask}`T2146` `(default): openvpn: "delete server client" doesn't delete the corresponding ccd configs` - -## 2020-03-24 - -- {vytask}`T2157` `(default): Organize service https listen-address/listen-port/server-name under 'virtual-host' node` -- {vytask}`T1845` `(bug): syslog host no longer accepts a port` - -## 2020-03-22 - -- {vytask}`T2150` `(feature): SSTP ssl certificates can only be stored in /config/user-data/sstp` -- {vytask}`T2149` `(feature): Update Linux Kernel to v4.19.112` -- {vytask}`T476` `(enhancment): Update the base system to Debian 10 (Buster)` - -## 2020-03-21 - -- {vytask}`T2142` `(bug): vyos-build: Add required packages and step to build-GCE-image script` -- {vytask}`T1870` `(feature): Extend Pipeline scripts to support PullRequests` - -## 2020-03-20 - -- {vytask}`T2006` `(bug): SSTP RADIUS CLI accepts invalid values` -- {vytask}`T2140` `(default): openvpn: tls file check function checkCertHeader returns True even when no match is found` -- {vytask}`T2007` `(feature): SSTP accepts client MTU up to 16384 bytes` -- {vytask}`T2008` `(feature): Adjustment of SSTP CLI to be more consistent to the rest of VyOS` - -## 2020-03-19 - -- {vytask}`T2135` `(bug): Login banner missing spacing now` -- {vytask}`T2132` `(feature): Document kernel boot parameter 'vyos-config-debug'` -- {vytask}`T1744` `(default): Config load fails in ConfigTree with ValueError: Failed to parse config: lexing: empty token` - -## 2020-03-17 - -- {vytask}`T2134` `` (bug): VXLAN: `NameError: name 'config' is not defined` `` - -## 2020-03-16 - -- {vytask}`T2131` `(feature): Improve syslog remote host CLI definition` - -## 2020-03-15 - -- {vytask}`T2122` `(feature): Update Intel out-of-tree drivers to latest version(s)` -- {vytask}`T2121` `(feature): Update Linux Kernel to v4.19.109` -- {vytask}`T2119` `(bug): Error on boot when removing ethernet interface from VM` - -## 2020-03-14 - -- {vytask}`T834` `(feature): New L2TP server implementation based on accel-ppp` - -## 2020-03-13 - -- {vytask}`T1622` `(default): Add failsafe and back trace to boot config loader` - -## 2020-03-11 - -- {vytask}`T1961` `(bug): VXLAN - fails to commit due to non-existent variable, broken MTU` -- {vytask}`T2084` `(default): conntrack-tools package build error for current/equuleus` - -## 2020-03-10 - -- {vytask}`T1331` `(bug): DNS stops working` - -## 2020-03-09 - -- {vytask}`T2111` `(feature): VRF add route leaking support` -- {vytask}`T2109` `(bug): Ping by name broken in VyOS 1.3-rolling-202003080217` -- {vytask}`T2065` `(bug): VyOS 1.3 Don't set daemon in openvpn-{intf}.conf file` -- {vytask}`T31` `(feature): Add VRF support` - -## 2020-03-08 - -- {vytask}`T1954` `` (bug): Having `system login radius` configured causes exponentially long boot times `` -- {vytask}`T1760` `(bug): RADIUS shared secret is not redacted from "show configuration" op mode command` - -## 2020-03-07 - -- {vytask}`T2107` `(bug): Wireless interfaces do not work in station mode without security` - -## 2020-03-05 - -- {vytask}`T2074` `(bug): VyOS docker container: Cannot configure ethernet interface` - -## 2020-03-04 - -- {vytask}`T2098` `(bug): Wrong call to cli-shell-api in generated op-mode templates for path completion helper` - -## 2020-03-03 - -- {vytask}`T2095` `(bug): Copy command errors out` - -## 2020-03-01 - -- {vytask}`T2082` `(bug): WireGuard broken after merging T2057` -- {vytask}`T2089` `(feature): RADIUS: do not query servers when commit is running started from a non RADIUS user` -- {vytask}`T2086` `(feature): Move sudo session open/close log entries to auth.log` - -## 2020-02-29 - -- {vytask}`T2046` `(feature): allowing sub-classes of Interface to redefine how the interface is created` - -## 2020-02-28 - -- {vytask}`T2083` `(default): vyos-build: build-packages fails at mdns-repeater due to wrong branch` -- {vytask}`T2080` `(default): traffic-policy shaper error when setting bandwidth` - -## 2020-02-27 - -- {vytask}`T2075` `(feature): Add support for OpenVPN tls-crypt file option` -- {vytask}`T2068` `(feature): Update Linux Kernel to v4.19.105` -- {vytask}`T1703` `(default): Macvlan PPPoE support` -- {vytask}`T2078` `(feature): Kernel: remove unused RAID functions 5,6,10,jbod,dm` - -## 2020-02-25 - -- {vytask}`T2070` `(feature): Rewrite (dis-)connect op-mode commands in XML and Python` -- {vytask}`T2071` `(feature): Add possibility to temporary disable a RADIUS server used for system login` - -## 2020-02-23 - -- {vytask}`T2055` `(feature): Remove IPv6 router-advert options for PPPoE` -- {vytask}`T1318` `(feature): PPPoE client CLI redesign` - -## 2020-02-22 - -- {vytask}`T2063` `(feature): vyos-salt-minion package is missing from vyos-world` - -## 2020-02-20 - -- {vytask}`T1969` `(default): OSPF with WireGuard cause Route Inactive` - -## 2020-02-18 - -- {vytask}`T2034` `(default): Removal of interfaces loopback lo removed 127.0.0.1 and ::1` - -## 2020-02-17 - -- {vytask}`T2047` `(feature): Update Linux Kernel to v4.19.104` -- {vytask}`T2048` `(bug): ISO boot fails when wireless adapter is present` - -## 2020-02-16 - -- {vytask}`T2043` `(bug): Bond VLANs can't be extended on the fly` -- {vytask}`T2030` `(bug): Bond doesn't survive reboot` -- {vytask}`T1992` `(bug): Adding vlan on a bond resets all BGP connections on same bond` -- {vytask}`T1908` `(feature): Add zone option for Cloudflare DDNS` -- {vytask}`T1246` `(bug): VyOS 1.2.0 "openvpn-options" configuration does not allow quotes in values` - -## 2020-02-15 - -- {vytask}`T2042` `(bug): Error on reboot after deleting "service snmp" and not "service lldp snmp enable"` -- {vytask}`T2041` `(bug): Adding non existent bond interface raises exception` - -## 2020-02-14 - -- {vytask}`T2039` `(bug): Wrong system type displayed in show version` -- {vytask}`T2040` `(bug): vyos-http-api-server should reload Config in all routes` - -## 2020-02-13 - -- {vytask}`T2033` `(feature): Drop vyos-replace package` -- {vytask}`T1635` `(feature): Rewrite interface pseudo-ethernet in new XML/Python style` - -## 2020-02-10 - -- {vytask}`T2024` `(feature): Migrate "system login banner" to XML/Python` - -## 2020-02-09 - -- {vytask}`T2022` `(bug): When RADIUS config is active, local logins won't work` -- {vytask}`T2020` `(default): Unable to log in after upgrade to 1.3-rolling-202002080217` -- {vytask}`T1931` `(bug): Enabling SNMP commit error` - -## 2020-02-05 - -- {vytask}`T1948` `(bug): RADIUS login broken in 1.3` -- {vytask}`T1990` `(feature): Migrate "system login" to XML/Python representation` -- {vytask}`T1585` `(default): Add letsencrypt/certbot support for 'service https'` - -## 2020-02-04 - -- {vytask}`T1965` `(bug): VyOS-1.3: ping no longer supports specifying interface or source` - -## 2020-02-02 - -- {vytask}`T2011` `(feature): Update Linux Kernel to v4.19.101` -- {vytask}`T640` `(bug): Images no longer work when built without "recommended" packages` - -## 2020-02-01 - -- {vytask}`T2009` `(bug): Ethernet Interface always stays down` -- {vytask}`T1989` `(bug): conf.get_config_dict() throws exception` - -## 2020-01-31 - -- {vytask}`T1768` `(bug): PPtP - vyos.config rewrite` -- {vytask}`T2002` `(bug): VLAN interfaces try to be enabled even if parent interface is A/D` - -## 2020-01-30 - -- {vytask}`T1994` `(default): lldpd not bound to specified interfaces - Fix jinja template` -- {vytask}`T1896` `(enhancment): Remove LLDP-MED civic_based location information` -- {vytask}`T1724` `(feature): wireguard - add endpoint check in verify()` - -## 2020-01-29 - -- {vytask}`T1996` `(feature): Update Linux Kernel to 4.19.99` -- {vytask}`T1862` `(default): Use regex pattern \s+ to split strings on whitespace in Python 3.7` -- {vytask}`T1755` `(bug): Python KeyError exceptions raised with 'show vpn ipsec sa' command under use of certain IPSEC cipher suites` -- {vytask}`T1747` `(bug): L2TP breaks after upgrading to VyOS 1.2-rolling-201910180117 [issue report and proposed solution]` -- {vytask}`T1664` `(bug): Ipoe with bond per vlan don't work` -- {vytask}`T1895` `(feature): There is not restriction on selection of syslog facility` -- {vytask}`T1670` `(feature): OpenVPN option for tls-auth` - -## 2020-01-26 - -- {vytask}`T1937` `(bug): snmpd throwing a tremendous amount of errors` -- {vytask}`T1767` `(bug): IPoE - vyos.config rewrite` -- {vytask}`T1765` `(bug): wireguard - vyos.config rewrite` - -## 2020-01-24 - -- {vytask}`T1975` `(bug): OpenVPN tap devices won't come up automatically` - -## 2020-01-23 - -- {vytask}`T1766` `(bug): service-pppoe - vyos.config rewrite` - -## 2020-01-21 - -- {vytask}`T1784` `(bug): DMVPN with IPSec does not work in HUB mode` -- {vytask}`T1977` `(bug): webproxy error on fresh install` - -## 2020-01-18 - -- {vytask}`T1830` `(feature): 1.3-rolling boots to GRUB prompt post-install on UEFI systems` -- {vytask}`T1940` `(bug): EFI Fresh Install fails to boot, 4K Sector Drives Fail to boot EFI` - -## 2020-01-16 - -- {vytask}`T1880` `(default): "A stop job is running for live-tools - System Support Scripts" hangs, times out when shutting down equuleus live iso` - -## 2020-01-15 - -- {vytask}`T1959` `(bug): Error message when adding IPSec VPN` - -## 2020-01-09 - -- {vytask}`T1955` `(feature): snmp - cli config val_help missing` -- {vytask}`T1813` `(bug): error in generated /etc/hosts file` - -## 2020-01-08 - -- {vytask}`T1946` `(bug): Recovery ifname for PPtP remote-access` - -## 2020-01-03 - -- {vytask}`T1939` `(feature): Provide abstraction for interface "ip" options` - -## 2020-01-01 - -- {vytask}`T1779` `(bug): Tunnel interfaces aren't suggested as being available for bridging` - -## 2019-12-31 - -- {vytask}`T1654` `(bug): sFlow: multiple "sflow server" not work, and "disable-imt" could break configuration` -- {vytask}`T1923` `(feature): Migrate L2TPv3 interface to XML/Python` - -## 2019-12-30 - -- {vytask}`T1920` `(bug): beep: Error: Running under sudo, which is not supported for security reasons.` -- {vytask}`T1918` `(bug): l2tp / ipsec config broken in latest daily` -- {vytask}`T1897` `(bug): IPSec - 1.2 to 1.3 migration failed` -- {vytask}`T1921` `(bug): snmp: VyOS options no longer recognized` -- {vytask}`T1922` `(feature): Add VXLAN IPv6 support` -- {vytask}`T1919` `(feature): Migrate "system options" to XML/Python representation` - -## 2019-12-28 - -- {vytask}`T1916` `(feature): Update Linux Kernel to v4.19.91` -- {vytask}`T1915` `(bug): Remove "system ipv6 blacklist" option` -- {vytask}`T1912` `(feature): Migrate "system (ip|ipv6)" to XML/Python representation` - -## 2019-12-27 - -- {vytask}`T1910` `(bug): Invalid parmissions on latest 1.3 rolling ISO images` - -## 2019-12-26 - -- {vytask}`T1794` `(bug): Interface description can't contain a colon` -- {vytask}`T1906` `(feature): Migrate "system time-zone" configuration to XML/Python` - -## 2019-12-23 - -- {vytask}`T1898` `(enhancment): Support multiple IPv4/IPv6 LLDP management addresses` -- {vytask}`T1878` `(bug): accel-ppp: pppoe single-session option implementation` - -## 2019-12-22 - -- {vytask}`T393` `(enhancment): Migrate vyatta-lldpd to vyos-1x` - -## 2019-12-20 - -- {vytask}`T1892` `(default): vyos-build: Do not install recommends in docker image [enhancement]` -- {vytask}`T1411` `(enhancment): equuleus: buster: vyatta-ravpn: libfreeradius-client2 is missing in buster` - -## 2019-12-19 - -- {vytask}`T1873` `(default): DHCP server fails to start due to a change in isc-dhcp-server init scripts` - -## 2019-12-18 - -- {vytask}`T1889` `(bug): Error building docker build image` -- {vytask}`T1132` `(default): Build on Debian Buster` - -## 2019-12-17 - -- {vytask}`T1886` `(feature): Update Linux Kernel to v4.19.89` -- {vytask}`T1887` `(feature): Update WireGuard to Debian release 0.0.20191212-1` - -## 2019-12-13 - -- {vytask}`T1861` `(default): hosts lost after modified static-host-mapping` - -## 2019-12-10 - -- {vytask}`T1843` `(feature): Add GCC preprocessor support for XML files` - -## 2019-12-08 - -- {vytask}`T1566` `(feature): Extend L2TP/IPSec server with IPv6` - -## 2019-12-07 - -- {vytask}`T1714` `(bug): Disable DHCP Nameservers Not Working` - -## 2019-12-06 - -- {vytask}`T1860` `(feature): Update WireGuard to Debian release 0.0.20191127-2` -- {vytask}`T1859` `(feature): Update Linux Kernel to v4.19.88` -- {vytask}`T1854` `(bug): Dynamic DNS configuration cannot be deleted` -- {vytask}`T1849` `(bug): DHCPv6 client does not start` -- {vytask}`T1169` `(bug): LLDP potentially broken` -- {vytask}`T586` `(bug): Cannot add ethernet vif-s vif-c interface to bridge-group` - -## 2019-12-05 - -- {vytask}`T1847` `(bug): set_level incorrectly handles path given as empty string` - -## 2019-12-04 - -- {vytask}`T1787` `(default): Failed config migration from V1.2.3 to 1.2-rolling-201911030217` -- {vytask}`T1212` `(bug): IPSec Tunnel to Cisco ASA drops reliably after 4.2GB transferred` -- {vytask}`T1704` `(feature): OpenVPN - Add support for ncp-ciphers` - -## 2019-12-03 - -- {vytask}`T1782` `(bug): pppoe0: showing as "Coming up"` -- {vytask}`T1801` `(bug): Unescaped backslashes in config values cause configuration failure` - -## 2019-12-02 - -- {vytask}`T1840` `(bug): PPPoE doesn't not rename pppX to pppoeX` - -## 2019-11-25 - -- {vytask}`T1824` `(bug): Permission denied: '/opt/vyatta/etc/config/vyos-migrate.log'` - -## 2019-11-24 - -- {vytask}`T1673` `(bug): vif bridge-group not migrated to bridge member interface` -- {vytask}`T1799` `(feature): Add support for GENEVE (Generic Network Virtualization Encapsulation)` - -## 2019-11-23 - -- {vytask}`T1627` `(feature): Rewrite wireless interface in new style XML syntax` - -## 2019-11-21 - -- {vytask}`T1818` `(default): Print name of migration script on failure` -- {vytask}`T1814` `(default): Add log of migration scripts run during config migration` - -## 2019-11-14 - -- {vytask}`T1710` `(default): [equuleus] buster: add patch to fix live-build missing key error` -- {vytask}`T1804` `(default): Add python3-psutil to docker image` -- {vytask}`T1736` `(default): Decide on best practice for patching live-team packages for VyOS build system` -- {vytask}`T1424` `(default): Rewrite the config load script` - -## 2019-11-11 - -- {vytask}`T1793` `(feature): Editing description on an interface causes BGP sessions to reset on commit` - -## 2019-11-10 - -- {vytask}`T1791` `(feature): Update Linux Kernel to 4.19.82` - -## 2019-11-08 - -- {vytask}`T1789` `(bug): ddclient not working with generated RFC2136 / nsupdate config` - -## 2019-11-03 - -- {vytask}`T1777` `(bug): Bonding interface MAC address mismatch after reboot` -- {vytask}`T1752` `(bug): PPPoE does not automatically start on boot` - -## 2019-11-02 - -- {vytask}`T1783` `(bug): Interface can't unpin from bridge` - -## 2019-10-22 - -- {vytask}`T1756` `(feature): Modify output to be more useful - Wireguard` - -## 2019-10-21 - -- {vytask}`T1741` `(feature): Add system wide proxy setting` - -## 2019-10-19 - -- {vytask}`T1746` `(bug): 201910180117 fails startup with 'Permission Denied' errors` -- {vytask}`T1743` `(default): equuleus: remove references to SSH key type "rsa1" deprecated in Debian Buster` - -## 2019-10-18 - -- {vytask}`T1712` `(default): DHCP client sometimes doesn't start` -- {vytask}`T1604` `(enhancment): equuleus: buster: vbash: tab completion breaks` - -## 2019-10-11 - -- {vytask}`T1723` `(bug): wireguard - Interface wg01 could not be brought up in time` - -## 2019-10-09 - -- {vytask}`T1719` `(feature): ssh deprecated options` -- {vytask}`T1718` `(bug): ISO check in /opt/vyatta/sbin/install-image faulty` -- {vytask}`T1682` `(feature): Migrate to new Jenkins Pipeline script` - -## 2019-10-08 - -- {vytask}`T1717` `(bug): disable multiple daemons to autostart at boot` - -## 2019-10-06 - -- {vytask}`T1713` `(feature): Remove deprecated packages no longer required after migration to Accel-PPP` - -## 2019-10-03 - -- {vytask}`T1689` `(feature): "reset openvpn" op-mode command should terminate and restart OpenVPN process` - -## 2019-10-01 - -- {vytask}`T1706` `(bug): wireguard broken in latest rolling` - -## 2019-09-30 - -- {vytask}`T1688` `(feature): OpenVPN - Add new cipher aes-(128|192|256)-gcm` - -## 2019-09-28 - -- {vytask}`T1696` `(bug): NTP - Tests fail when building vyos-1x` -- {vytask}`T1512` `(bug): vyos 1.2 openvpn client names with spaces created incorrectly` - -## 2019-09-27 - -- {vytask}`T1681` `(feature): cleanup wireguard code since tagnodes are now visible` -- {vytask}`T1695` `(bug): Syntax error in interface-dummy.py` - -## 2019-09-26 - -- {vytask}`T1692` `(bug): ipoe-server verify function error` -- {vytask}`T1691` `(bug): OpenVPN - Commiting config when OpenVPN peer/server not available makes commit hang` -- {vytask}`T1690` `(feature): restart op-mode commands for 'service (pppoe|ipoe)-server'` - -## 2019-09-25 - -- {vytask}`T1672` `(bug): Wireguard keys not automatically moved` - -## 2019-09-23 - -- {vytask}`T1679` `(bug): during bootup: invalid literal for int() with base 10` -- {vytask}`T1680` `(feature): DHCP client does not release IP address on exit/deletion` - -## 2019-09-21 - -- {vytask}`T1676` `(default): [equuleus] buster: update GRUB boot parameters during upgrade` -- {vytask}`T1637` `(feature): Rewrite ethernet interface in new style XML syntax` -- {vytask}`T1675` `(feature): OpenVPN - Specify minimum TLS version` - -## 2019-09-20 - -- {vytask}`T1602` `(default): equuleus: buster: add live build apt options for choosing vyos packages` - -## 2019-09-19 - -- {vytask}`T1666` `(feature): Deleting a bond will place member interfaces into A/D state` - -## 2019-09-17 - -- {vytask}`T239` `(bug): Improve documentation for the firewall all-ping setting` - -## 2019-09-16 - -- {vytask}`T1040` `(default): rc.local is executed too early` - -## 2019-09-15 - -- {vytask}`T1662` `(default): openvpn: 'show openvpn client' error` -- {vytask}`T1661` `(default): openvpn: wrong checking for existence cert files` -- {vytask}`T1630` `(bug): OpenVPN after changing it from root to nobody (unprivileged user) cant add routes` - -## 2019-09-13 - -- {vytask}`T1660` `(bug): Bonding dont’t work on VyOS 1.2-rolling-201909120338` -- {vytask}`T1655` `(enhancment): equuleus: buster: arm: vyos-accel-ppp build failes because of filename hardcoded as x86_64 in debian/rules` - -## 2019-09-12 - -- {vytask}`T1572` `(feature): Wireguard keyPair per interface` -- {vytask}`T1545` `(bug): IPSEC vti issue` - -## 2019-09-10 - -- {vytask}`T1650` `(feature): implement wireguard default key removal` -- {vytask}`T1649` `(feature): feature documentation different keypairs per interface` -- {vytask}`T1648` `(feature): add cli command 'delete wireguard named-key '` - -## 2019-09-09 - -- {vytask}`T1639` `(bug): wireguard pubkey change error` - -## 2019-09-07 - -- {vytask}`T1640` `(feature): Update Linux Kernel to v4.19.70` - -## 2019-09-06 - -- {vytask}`T1624` `(bug): Failed to set up config session` -- {vytask}`T1636` `(feature): Rewrite VXLAN in new style XML/Python` -- {vytask}`T1479` `(bug): libvyosconfig error reporting doesn't include line numbers` -- {vytask}`T808` `(feature): replace lighthttpd with nginx` -- {vytask}`T1478` `(bug): libvyosconfig parser does not support escaped quotes inside single-quoted strings` - -## 2019-09-04 - -- {vytask}`T1632` `(bug): OpenVPN 'push' options with quotes` -- {vytask}`T1631` `(bug): Multiple push-route options cause error generating openvpn configuration` -- {vytask}`T1557` `(feature): Create generic abstraction for configuring interfaces e.g. IP address` -- {vytask}`T1628` `(feature): Adopt WireGuard configuration script to new vyos.ifconfig class` -- {vytask}`T1614` `(feature): Rewrite bonding interface in new style XML syntax` - -## 2019-09-02 - -- {vytask}`T1621` `(default): Rewrite the rest of trivial vyatta-op commands to new syntax` - -## 2019-08-31 - -- {vytask}`T1456` `(bug): Port group cannot be configured if the same port is configured as standalone and inside a range` - -## 2019-08-28 - -- {vytask}`T1615` `(feature): After migration to pyroute2 the address DHCP statement is no longer covered` - -## 2019-08-27 - -- {vytask}`T1617` `(default): OpenVPN push route failure` -- {vytask}`T1250` `(bug): FRR not setting default gateway from DHCP` - -## 2019-08-26 - -- {vytask}`T1591` `(bug): OpenVPN "run show openvpn client status" does not work` -- {vytask}`T1608` `(feature): bridge: Bridge adding non existing interfaces is allowed but does not work` -- {vytask}`T1548` `(feature): Rewrite OpenVPN interface/op-commands in new style XML/Python` -- {vytask}`T1607` `(default): Convert 'reset conntrack' and 'reset ip[v6] cache' operations from vyatta-op to new syntax` - -## 2019-08-25 - -- {vytask}`T1611` `(default): Migration to latest rolling fails with vyos.configtree.ConfigTreeError: Path [b'interfaces bridge br0 igmp-snooping querier'] doesn't exist` - -## 2019-08-23 - -- {vytask}`T1606` `(bug): Rolling release no longer boots after adding hostname daemon` - -## 2019-08-21 - -- {vytask}`T1601` `(feature): Rewrite loopback interface type with new style XML/Python interface` -- {vytask}`T1596` `(default): Convert 'telnet' and 'traceroute' vyatta-op commands to new syntax` - -## 2019-08-20 - -- {vytask}`T1595` `(feature): Migrate deprecated "service dns forwarding listen-on" to listen-address` - -## 2019-08-19 - -- {vytask}`T1580` `(feature): Rewrite dummy interface type with new style XML/Python interface` -- {vytask}`T1590` `(default): Convert 'show system' operations from vyatta-op to python/xml syntax` - -## 2019-08-17 - -- {vytask}`T1592` `(feature): Update Linux Kernel to v4.19.67` - -## 2019-08-15 - -- {vytask}`T1584` `(default): equuleus: buster: add consistent grub options for predictable interface names` - -## 2019-08-13 - -- {vytask}`T1556` `(feature): Rewrite Bridge in new style XML syntax` - -## 2019-08-09 - -- {vytask}`T1569` `(feature): interfaceconfig class documetation` - -## 2019-08-05 - -- {vytask}`T1562` `(feature): Change version scheme on current branch used for rolling releases` - -## 2019-08-04 - -- {vytask}`T1561` `(bug): VyOS rolling ISO cluttered with vyatta-ravpn Git Repo` - -## 2019-08-02 - -- {vytask}`T853` `(feature): Add SSTP server support` -- {vytask}`T742` `(feature): Replace poptop and xl2tpd with accel-ppp` - -## 2019-08-01 - -- {vytask}`T1544` `(feature): L2TP documentation` - -## 2019-07-31 - -- {vytask}`T1552` `(feature): accel-ppp: SSTP documentation` -- {vytask}`T1553` `(default): equuleus: buster: add 'noautologin' to boot parameters` - -## 2019-07-29 - -- {vytask}`T1532` `(default): [equuleus] buster: GPG error on vyos package repository` - -## 2019-07-28 - -- {vytask}`T1547` `(feature): accel-ppp/L2TP restructure CLI` -- {vytask}`T1546` `(bug): accel-ppp/L2TP radius-source address is not honored` - -## 2019-07-23 - -- {vytask}`T1533` `(bug): Rolling builds broken!` -- {vytask}`T1489` `(feature): Add vlan_mon usage at Accel` - -## 2019-07-22 - -- {vytask}`T1435` `(enhancment): Make ip-address [OPTIONAL] (in dhcp-server -> static-mapping) to cope with "unfriendly" client-hostnames of IoT-Devices` - -## 2019-07-21 - -- {vytask}`T823` `(feature): Rewrite DHCP op mode in the new style` - -## 2019-07-18 - -- {vytask}`T1497` `(bug): "set system name-server" generates invalid/incorrect resolv.conf` -- {vytask}`T533` `(feature): Support for PPPoE MTU greater than 1492` - -## 2019-07-08 - -- {vytask}`T1510` `(feature): [IPoE] vlan-mon option implementation` -- {vytask}`T1508` `(feature): [pppoe] migration script for service pppoe-server interface` -- {vytask}`T1494` `(feature): accel-ppp: IPoE update documentation` -- {vytask}`T989` `(feature): Add support for IPoE server` - -## 2019-07-03 - -- {vytask}`T1502` `(feature): Add build sanity checking tools to the dev builds` - -## 2019-07-02 - -- {vytask}`T1099` `(default): Openvpn: use config files instead of one long command.` -- {vytask}`T1495` `(feature): accel-ppp: IPoE implement IPv6 PD` - -## 2019-07-01 - -- {vytask}`T1498` `(bug): Nameservers are not propagated into resolv.conf` - -## 2019-06-24 - -- {vytask}`T1482` `(feature): Add OpenVPN SHA384 hashing algorithm` - -## 2019-06-23 - -- {vytask}`T1476` `(bug): Update PowerDNS recursor to 4.2 series` - -## 2019-06-22 - -- {vytask}`T1313` `(feature): Add support for reusable build flavours` -- {vytask}`T1202` `` (bug): Add `hvinfo` to the packages directory `` - -## 2019-06-20 - -- {vytask}`T1413` `(enhancment): equuleus: buster: vyos-xe-guest-utilities is not installable and breaks live-build` -- {vytask}`T1412` `(enhancment): equuleus: buster: vyos-netplug is not installable and breaks live-build` - -## 2019-06-19 - -- {vytask}`T1334` `(feature): Migration script runner rewrite` -- {vytask}`T1327` `(bug): Set the serial console speed to 115200 by default` - -## 2019-06-18 - -- {vytask}`T1451` `(bug): Intel e1000e driver missing in lates rolling release` - -## 2019-06-17 - -- {vytask}`T1408` `(feature): pppoe-server - implement local-ipv6 for pure IPv6 based deployments` - -## 2019-06-12 - -- {vytask}`T1397` `(default): Rewrite the config merge script` - -## 2019-06-05 - -- {vytask}`T1426` `(default): Update the script that checks conntrack hash-size on reboot` - -## 2019-06-03 - -- {vytask}`T1423` `(default): When merging remote config files, create known_hosts file if not present.` - -## 2019-05-28 - -- {vytask}`T1410` `(feature): Upgrade Linux Kernel to 4.19.46` - -## 2019-05-26 - -- {vytask}`T1404` `(feature): Update iproute2 package to 4.19` - -## 2019-05-24 - -- {vytask}`T1407` `(bug): pppoe IPv6 PD documention by practical example` - -## 2019-05-23 - -- {vytask}`T1402` `(feature): Update Linux Kernel to 4.19.45` - -## 2019-05-22 - -- {vytask}`T1399` `(bug): accel-ppp kernel modules missing in rolling build 20190522` -- {vytask}`T1393` `(bug): pppoe IPv6 pool doesn't work` - -## 2019-05-21 - -- {vytask}`T592` `` (bug): lldpcli: unknown command from argument 1: `#` `` - -## 2019-05-16 - -- {vytask}`T1267` `(feature): FRR: Add interface name for static routes` -- {vytask}`T1148` `(bug): epa2 BGP peers initiate before config is fully loaded, routes leak.` - -## 2019-05-06 - -- {vytask}`T1368` `(feature): Enable MPLS support in Linux Kernel` - -## 2019-05-04 - -- {vytask}`T1365` `(bug): Cannot configure syslog on 1.2.0-rolling+201904260337` - -## 2019-04-29 - -- {vytask}`T1352` `(feature): vyos-documentaion: accel-pppoe adding CIDR based IP pool option` - -## 2019-04-21 - -- {vytask}`T1348` `(feature): Upgrade WireGuard to 0.0.20190406-1` -- {vytask}`T1347` `(feature): Upgrade Linux Kernel to 4.19.36` - -## 2019-04-20 - -- {vytask}`T1344` `(feature): Unclutter "system login radius" configuration nodes` - -## 2019-04-19 - -- {vytask}`T1325` `(default): GRE tunnel to Cisco router fails in 1.2.0 - works in 1.1.8` - -## 2019-04-16 - -- {vytask}`T1184` `(feature): wireguard - extend documentation with the show interface wireguard commands` - -## 2019-04-15 - -- {vytask}`T1260` `(feature): VICI-based implementation of "run show vpn ipsec sa"` -- {vytask}`T1248` `(default): Add a function for copying nodes to the vyos.configtree library` - -## 2019-04-05 - -- {vytask}`T1324` `(feature): update documtation for 'set system login user level'` - -## 2019-04-04 - -- {vytask}`T1323` `(feature): migrate operator accounts to admin accounts and remove the option to setup an operator account` - -## 2019-03-20 - -- {vytask}`T405` `(feature): Add binaries for lcdproc` - -## 2019-03-12 - -- {vytask}`T1284` `(feature): accel-ppp: pptp implementation documention` -- {vytask}`T833` `(feature): New PPTP server implementation based on accel-ppp` - -## 2019-02-22 - -- {vytask}`T1257` `(bug): implement 'set system static-host-mapping' in host_name.py and remove old function calls` - -## 2019-02-21 - -- {vytask}`T1214` `` (bug): Add `ipaddrcheck` to the packages directory `` - -## 2019-02-10 - -- {vytask}`T1154` `(default): use of local cache to build iso` - -## 2019-02-09 - -- {vytask}`T1236` `(feature): Update Linux Kernel` diff --git a/docs/changelog/md-1.4.md b/docs/changelog/md-1.4.md deleted file mode 100644 index cd50127e..00000000 --- a/docs/changelog/md-1.4.md +++ /dev/null @@ -1,4457 +0,0 @@ -# 1.4 Sagitta - -% Please don't add anything by hand. -% This file is managed by the script: -% _ext/releasenotes.py - -## 2024-04-25 - -- {vytask}`T6263` `(bug): Multicast: Could not commit multicast config with multicast join group using source-address` -- {vytask}`T5833` `(bug): Not all AFIs compatible with VRF` - -## 2024-04-24 - -- {vytask}`T6255` `(bug): Static table description should not contain white-space` -- {vytask}`T6226` `` (feature): add HAPROXY `tcp-request content accept` related block to load-balancing reverse proxy config `` -- {vytask}`T6109` `(bug): remote syslog do not get all the logs` -- {vytask}`T6217` `(feature): VRRP contrack-sync script change name of the logger` -- {vytask}`T6244` `(feature): Spacing of "Show System Uptime" hard to parse` - -## 2024-04-23 - -- {vytask}`T6260` `(bug): image-tools: remove failed image directory if 'No space left on device' error` -- {vytask}`T6261` `(default): Typo in op_mode connect_disconnect print statement for check_ppp_running` -- {vytask}`T6237` `(feature): IPSec remote access VPN: ability to set EAP ID of clients` - -## 2024-04-22 - -- {vytask}`T5996` `(bug): unescape backslashes for config save, compare commands` -- {vytask}`T6103` `(bug): DHCP-server bootfile-name double slash syntax weird behaviour` -- {vytask}`T6080` `(default): Default NTP server settings` -- {vytask}`T5986` `(bug): Container: Error on commit when environment variable value contains \n line break` - -## 2024-04-21 - -- {vytask}`T6191` `(bug): Policy Route TCP-MSS Behavior Different from 1.3.x` -- {vytask}`T5535` `(feature): disable-directed-broadcast should be moved to firewall global-options` - -## 2024-04-20 - -- {vytask}`T6252` `(bug): gre tunnel - doesn't allow configure jumbo frame more than 8024` - -## 2024-04-19 - -- {vytask}`T6221` `(bug): Enabling VRF breaks connectivity` -- {vytask}`T6035` `(bug): QoS policy shaper queue-type random-detect requires limit avpkt` -- {vytask}`T6246` `(feature): Enable basic haproxy http-check configuration options` -- {vytask}`T6242` `(feature): Loadbalancer reverse-proxy: SSL backend skip CA certificate verification` - -## 2024-04-17 - -- {vytask}`T6168` `(bug): add system image does not set default boot to current console type in compatibility mode` -- {vytask}`T6243` `(bug): Update vyos-http-api-tools for package idna security advisory` -- {vytask}`T6154` `(enhancment): Installer should ask for password twice` -- {vytask}`T5966` `(default): Adjust dynamic dns configuration address subpath to be more intuitive and other op-mode adjustments` -- {vytask}`T5723` `(default): mdns repeater: Always reload systemd daemon before applying changes` -- {vytask}`T5722` `(bug): Failing to add route in failover if gateway not in the same interface network` -- {vytask}`T5612` `(default): Miscellaneous improvements and fixes for dynamic DNS configuration` -- {vytask}`T5574` `(default): Support per-service cache management for dynamic dns providers` -- {vytask}`T5360` `(bug): ddclient generating abuse` - -## 2024-04-15 - -- {vytask}`T6100` `(bug): NAT config migration error in 1.4.0-epa1 if invalid address/network defined in 1.3.6 version` -- {vytask}`T5734` `(bug): OpenVPN server dh-params that are not in PKI error` - -## 2024-04-14 - -- {vytask}`T6210` `(feature): Add container ability to configure capability sys-nice` - -## 2024-04-13 - -- {vytask}`T6173` `(bug): Build Causes Errors When "--version" Contains Slashes ("/")` -- {vytask}`T2518` `(feature): Support NAT for ipv6(NPT)` -- {vytask}`T6238` `(default): vyos-build Check pull request title requires the python script` -- {vytask}`T6235` `(default): Git check PR status: conflicts and resolution` - -## 2024-04-12 - -- {vytask}`T5872` `(default): ipsec remote access VPN: support dhcp-interface` -- {vytask}`T6216` `(bug): Upgrade error from 1.3 to 1.4 - Firewall using character '+'` -- {vytask}`T6214` `(bug): Error when using some constraints` -- {vytask}`T6213` `(bug): Firewall group constraints` -- {vytask}`T6148` `(bug): Reset vpn ipsec command breaks tunnel and does not reset SAs that are down` -- {vytask}`T1487` `(default): DNS (pdns_recursor) stats logs not saved to disk` -- {vytask}`T6222` `(bug): VRRP rfc3768-compatibility not working correctly when resulting interface name is over 15 characters` -- {vytask}`T6218` `(bug): Container network interface in VRF fails to generate IPv6 link-local address` -- {vytask}`T5959` `(default): Streamline dns forwarding service` -- {vytask}`T5846` `(default): Refactor and simplify DUID definition in conf-mode` -- {vytask}`T5631` `(feature): Ability to export the current configuration in JSON format` -- {vytask}`T5615` `(default): Narrow down spurious name conflict with mdns` -- {vytask}`T5530` `(default): Add LFA to IS-IS` -- {vytask}`T5195` `(default): Break up the vyos.util module` -- {vytask}`T5124` `(bug): Python3 deprecation distutils.version import LooseVersion` -- {vytask}`T1871` `(feature): add MTU option when configure limiter traffic-policy` -- {vytask}`T874` `(feature): Support for Two Factor Authentication for CLI access via Google Authenticator/OTP` -- {vytask}`T6204` `(default): Remove shebang lines from Python modules` -- {vytask}`T6166` `(bug): Tech support generation error for custom output location` -- {vytask}`T6062` `(feature): container: add support for image manipulation based on tag name` -- {vytask}`T5877` `(default): Reduce unnecessary nesting in system domain-search path and improve smoketest` -- {vytask}`T5871` `(default): ipsec remote access VPN: specify "cacerts" to disambiguate mulitple remote access configurations` -- {vytask}`T5870` `(default): ipsec remote access VPN: add x509 ("pubkey") authentication` -- {vytask}`T5772` `(default): Require HTTPS API server configurations to include at least one key if key-based auth is used` -- {vytask}`T5447` `(feature): Allow static MACsec keys with peers` -- {vytask}`T4221` `(default): Add a template filter for converting scalars to single-item lists` -- {vytask}`T3766` `(feature): containers: Expanding options for networking and building containers` - -## 2024-04-11 - -- {vytask}`T4516` `(feature): Rewrite system image manipulation tools in Python` -- {vytask}`T4548` `(feature): GRUB loader configuration rework` -- {vytask}`T3774` `(bug): atop logs are not limited in size` -- {vytask}`T3574` `(default): Add constraintGroup for combining validators with logical AND` -- {vytask}`T3474` `(default): Revisit storing syntax version of interface definitions in XML file` -- {vytask}`T160` `(feature): Support NAT64` -- {vytask}`T6228` `(bug): Cleanup of not existing units` - -## 2024-04-10 - -- {vytask}`T6207` `(bug): image-tools: restore ability to copy config.boot.default on image install` -- {vytask}`T5750` `(bug): Upgrade from 1.3.4 to 1.4 Rolling fails QoS` -- {vytask}`T5858` `(bug): Show conntrack statistics formatting is all over the place` -- {vytask}`T4734` `(feature): Feature Request: openvpn: add OTP 2FA support` - -## 2024-04-09 - -- {vytask}`T3409` `(feature): Add back TCP-MSS Clamp to PMTU` -- {vytask}`T6121` `(feature): Extend service config-sync for sections vpn, policy, vrf` - -## 2024-04-08 - -- {vytask}`T6197` `(bug): IPoE-server interface client-subnet looks broken or works with the wrong logic` -- {vytask}`T6196` `(bug): Route-map and summary-only do not work in BGP aggregation at the same time` -- {vytask}`T6068` `(feature): dhcp server: allow switching between load-balanced and hotspare mode` - -## 2024-04-07 - -- {vytask}`T6205` `(bug): ipoe: error in migration script logic while renaming mac-address to mac node` -- {vytask}`T6039` `(bug): cloud-init DNS search-domain causes configuration migration/validation error` -- {vytask}`T5862` `(bug): Default MTU is not acceptable in some environments` -- {vytask}`T6208` `(feature): container: rename "cap-add" CLI node to "capability"` -- {vytask}`T6188` `(feature): Add Firewall Rule Description to "show firewall" commands` -- {vytask}`T1244` `(default): Support for StartupResync in conntrackd` - -## 2024-04-06 - -- {vytask}`T6203` `(enhancment): Remove obsoleted xml lib` -- {vytask}`T6202` `(bug): Multi-Protocol BGP is broken by 6PE patch in upstream FRR 9.1` - -## 2024-04-05 - -- {vytask}`T6089` `(bug): [1.3.6->1.4.0-epa1 Migration] "ospf passive-interface default" incorrectly added` -- {vytask}`T2590` `(bug): DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c` -- {vytask}`T6199` `(feature): spring cleaning - drop unused Python imports` - -## 2024-04-04 - -- {vytask}`T6119` `(default): Use a compliant TOML parser` -- {vytask}`T6171` `(feature): dhcp server fail-over - Rename fail-over node` -- {vytask}`T6115` `(bug): Build from Git tags fail` -- {vytask}`T5122` `(feature): Move "archive-areas" to defaults.toml to support "non-free-firmware" repository` -- {vytask}`T5121` `(bug): Incorrect "architecture" config loaded` -- {vytask}`T4951` `(default): Add an op mode exception for cases when operations fail due to insufficient system resources` -- {vytask}`T4883` `(default): Add a description field for routing tables` -- {vytask}`T4796` `(bug): build-vyos-image ignores multiple options` -- {vytask}`T4795` `(feature): Cleanup custom python validators` -- {vytask}`T4761` `(default): Add a generic URL validator` -- {vytask}`T3843` `(bug): l2tp configuration not cleared after delete` -- {vytask}`T3681` `(default): The VMware Tools resume script did not run successfully in this virtual machine.` -- {vytask}`T1991` `(feature): Rework time services` -- {vytask}`T5711` `(default): Put the version data file inside the ISO image` -- {vytask}`T5672` `(default): Remove the old-style command definition importer` -- {vytask}`T5639` `(default): Group vyos-1x dependencies by their VyOS components and specify their purpose` -- {vytask}`T5638` `(default): Add support for requiring numeric values to be ranges rather than single numbers` -- {vytask}`T5634` `(default): Remove support for Blowfish and DES from OpenVPN` -- {vytask}`T5605` `(default): Do not generate keysize option in OpenVPN configs` -- {vytask}`T5582` `(default): Add a command to force NTP sync` -- {vytask}`T5449` `(default): Add options for TCP MSS probing` -- {vytask}`T4440` `(default): Add OCI compliant image labels to vyos-build and vyos containers` -- {vytask}`T671` `(enhancment): Identify and remove dead code` -- {vytask}`T5109` `(feature): Improve OCaml XML validator` -- {vytask}`T1449` `(feature): Add opportunity to include custom default configs (few) at building` - -## 2024-04-03 - -- {vytask}`T6198` `(feature): configverify: add common helper for PKI certificate validation` -- {vytask}`T6192` `(feature): Multi VRF support for SSH` - -## 2024-04-02 - -- {vytask}`T6167` `(bug): VNI not set on VRF after reboot` -- {vytask}`T6151` `(default): BGP VRF - Route-leaking not work when the next-hop is a recursive route.` -- {vytask}`T6033` `(bug): hsflowd fails to start when using a tunnel interface` - -## 2024-04-01 - -- {vytask}`T6195` `(feature): dropbear: package upgrade 2022.83-1 -> 2022.83-1+deb12u1` -- {vytask}`T6193` `(bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP name-server option" for VLAN interfaces` -- {vytask}`T6178` `(bug): Reverse-proxy should check that certificate exists during commit` - -## 2024-03-31 - -- {vytask}`T6186` `(bug): Fix regression in 'set system image default-boot'` -- {vytask}`T5832` `(feature): Keepalived: Allow using the 'dev' statement on excluded-addresses` - -## 2024-03-28 - -- {vytask}`T6147` `(bug): Conntrack not working as expected with global state-policy` -- {vytask}`T6175` `(bug): op-mode: "renew dhcp interface " does not check if it's an actual DHCP interface` - -## 2024-03-26 - -- {vytask}`T6066` `(bug): Setting same network in different ospf area will raise exception` - -## 2024-03-25 - -- {vytask}`T6145` `(bug): Service config-sync does not rely on priorities but must` - -## 2024-03-24 - -- {vytask}`T6161` `(feature): Output container images as JSON` -- {vytask}`T6165` `(bug): grub: vyos-grub-update failed to start on "slow" systems` -- {vytask}`T6085` `(bug): VTI interfaces are in UP state by default` -- {vytask}`T6152` `(bug): Kernel panic for ZimaBoard 232` - -## 2024-03-23 - -- {vytask}`T6160` `(bug): isis: NameError: name 'process' is not defined` -- {vytask}`T6131` `(bug): Disabling openvpn interface(s) causes OSPF to fail to load on reboot` -- {vytask}`T4022` `(feature): Add package nat-rtsp-dkms` - -## 2024-03-22 - -- {vytask}`T6136` `(bug): Configuring a dynamic address group, config script did not check whether the group was created` -- {vytask}`T6130` `(bug): [1.3.6->1.4.0-epa2 Migration] BGP "set community" missing` -- {vytask}`T6090` `(bug): [1.3.6->1.4.0-epa1 Migration] policy route fails due tcp flag case sensitivity` -- {vytask}`T6155` `(default): ixgbe: failed to initialize because an unsupported SFP+ module type was detected.` -- {vytask}`T6125` `(feature): Support 802.1ad (0x88a8) vlan filtering for bridge` -- {vytask}`T5624` `(default): Remove /etc/debian_version from the image` - -## 2024-03-21 - -- {vytask}`T6143` `(feature): Increase configuration timeout range for service config-sync` - -## 2024-03-20 - -- {vytask}`T6133` `(feature): Add domain-name to commit-archive` -- {vytask}`T6129` `(feature): bgp: add route-map option "as-path exclude all"` - -## 2024-03-19 - -- {vytask}`T6127` `(bug): Ability to view logs for rules with Offload not functional` -- {vytask}`T6138` `(bug): Conntrack table op-mode fails with flowtable offload entries` - -## 2024-03-15 - -- {vytask}`T6118` `(feature): radvd: RFC8781: add nat64prefix support` - -## 2024-03-12 - -- {vytask}`T6020` `(bug): VRRP health-check script is not applied correctly in keepalived.conf` -- {vytask}`T5646` `(bug): QoS policy limiter broken if class without match` -- {vytask}`T2433` `(feature): Improve CLI value validator performance` -- {vytask}`T1436` `(bug): Config entries with default values do not correctly show as changed` - -## 2024-03-11 - -- {vytask}`T6098` `(bug): Description doesnt seem to allow for non international characters` -- {vytask}`T6070` `(bug): bnx2x NIC causes a commit error due to incorrect implementation of EEE status reading` -- {vytask}`T2998` `(bug): SNMP v3 oid "exclude" option doesn't work` -- {vytask}`T6107` `(bug): Nginx does not allow big config queries for configure endpoint API` -- {vytask}`T6096` `(bug): Config commits are not synced properly because 00vyos-sync is deleted by vyos-router` -- {vytask}`T6093` `(bug): Incorrect dhcp-options vendor-class-id regex` -- {vytask}`T6083` `(feature): ethtool: move string parsing to JSON parsing` -- {vytask}`T6069` `(bug): HTTP API segfault during concurrent configuration requests` -- {vytask}`T6057` `(feature): Add ability to disable syslog for conntrackd` -- {vytask}`T5504` `(feature): Keepalived VRRP ability to set more than one peer-address` -- {vytask}`T5717` `(feature): ospfv3 - add allow to set metric-type to ospf redistribution while frr docs says its possible.` -- {vytask}`T6071` `(bug): firewall: CLI description limit of 256 characters cause config upgrade issues` - -## 2024-03-08 - -- {vytask}`T6086` `(bug): NAT does not work with network-groups` -- {vytask}`T6094` `(bug): Destination Nat not Making Firewall Rules` -- {vytask}`T6061` `(bug): connection-status nat destination firewall filter not working in 1.4.0-epa1` -- {vytask}`T6075` `(bug): Applying firewall rules with a non-existent interface group` - -## 2024-03-07 - -- {vytask}`T6104` `(bug): Regression in commit-archive for non-interactive configuration` -- {vytask}`T6084` `(bug): OpenNHRP DMVPN configuration file clean after reboot if we have any IPSec configuration` -- {vytask}`T5348` `(bug): Service config-sync can freeze the secondary router if it has commit-archive location` -- {vytask}`T6073` `(bug): Conntrack/NAT not being disabled when VRFs are defined` -- {vytask}`T6095` `(default): Tab completion for "set interfaces wireless wlan0 country-code" incorrect country "uk"` - -## 2024-03-06 - -- {vytask}`T6079` `(bug): dhcp: migration fails for duplicate static-mapping` - -## 2024-03-05 - -- {vytask}`T5903` `(bug): NHRP don´t start on reboot from version 1.5-rolling-202401010026` -- {vytask}`T2447` `(feature): Additional Boot Argument Configuration to limit CPU C-States` - -## 2024-03-04 - -- {vytask}`T6054` `(bug): load-balancing wan - doesn't configure a list of ports` -- {vytask}`T6087` `(feature): ospfv3: add support to redistribute IS-IS routes` - -## 2024-03-02 - -- {vytask}`T6081` `(bug): QoS policy shaper target and interval wrong calcuations` - -## 2024-02-29 - -- {vytask}`T6078` `(feature): Update ethtool to 6.6` -- {vytask}`T6077` `(feature): banner: implement ASCII contest winner default logo` -- {vytask}`T6074` `(feature): container: do not allow deleting images which have a container running` - -## 2024-02-28 - -- {vytask}`T6055` `(bug): PKI error: "failed to install x value" when executed the command from conf mode` -- {vytask}`T4270` `(bug): dns forwarding - When "ignore-hosts-file" is unset, local hostname of router resolves to 127.0.1.1` - -## 2024-02-27 - -- {vytask}`T6065` `(bug): Duplicate lines in build-vyos-image script cause sagitta build to fail` -- {vytask}`T5080` `(bug): Conntrack enabled by default` - -## 2024-02-26 - -- {vytask}`T6064` `(bug): Can not build VyOS if repository it not cloned to a branch` -- {vytask}`T5754` `(default): Update to StrongSwan 5.9.11` - -## 2024-02-25 - -- {vytask}`T6060` `(feature): op-mode: container: support removing all container images at once` - -## 2024-02-24 - -- {vytask}`T5909` `(bug): Container registry with authentication prevents config load (section container) after reboot` - -## 2024-02-23 - -- {vytask}`T5376` `(bug): Conntrack FTP helper does not work properly` -- {vytask}`T970` `(feature): Hostname Support in NAT and Firewall Rules` -- {vytask}`T4940` `(feature): Interface debugging` - -## 2024-02-22 - -- {vytask}`T6048` `(bug): Exception in event handler script` -- {vytask}`T3902` `(bug): Firewall does not load on boot, address-group not found, even though it exists` - -## 2024-02-21 - -- {vytask}`T6050` `(bug): Wrong scripting commands descriptions in accel-ppp services` - -## 2024-02-19 - -- {vytask}`T5971` `(default): Create the same view of ppp section for all accel-ppp services` -- {vytask}`T6029` `(default): Rewrite Accel-PPP services to an identical feature set` -- {vytask}`T3722` `(bug): op-mode IPSec show vpn ike sa always shows L-TIME 0` - -## 2024-02-18 - -- {vytask}`T6043` `(bug): VxLAN and bridge error bug` -- {vytask}`T6041` `(bug): image-tools: install fails from PXE boot into live iso due to restrictive logic` - -## 2024-02-17 - -- {vytask}`T5972` `(feature): login: add possibility to disable individual local user accounts` - -## 2024-02-16 - -- {vytask}`T6009` `(bug): Firewall - Time not working properly when not using UTC` -- {vytask}`T6005` `(bug): Error on adding a wireguard interface to OSPFv3` -- {vytask}`T2113` `(bug): OpenVPN Options error: you cannot use --verify-x509-name with --compat-names or --no-name-remapping` -- {vytask}`T6019` `(feature): Bump nftables and libnftnl version` -- {vytask}`T3471` `(bug): DHCP hook is not able to detect all running DHCP instances` -- {vytask}`T6015` `(default): "journalctl_charon" file does not contain data in the generated "ipsec debug-archive" file` -- {vytask}`T6001` `(default): Add option to enable resolve-via-default` -- {vytask}`T5965` `(bug): WWAN modems using raw-ip do not work with dhclient/dhcp6c` -- {vytask}`T5418` `(bug): PPPoE-Server Client IP pool Subnet` -- {vytask}`T5245` `(bug): Wireless interfaces do not get IPv6 link-local address assigned` - -## 2024-02-15 - -- {vytask}`T5977` `(bug): nftables: Operation not supported when using match-ipsec in outbound firewall` -- {vytask}`T2612` `(bug): HTTPS API, changing API key fails but goes through` -- {vytask}`T5989` `(bug): IP subnets not usable in UPnP ACLs` -- {vytask}`T5890` `(default): OTP key generation is broken` -- {vytask}`T5719` `(default): mdns repeater: Add op-mode commands` -- {vytask}`T4839` `(feature): Dynamic Firewall groups` -- {vytask}`T4801` `(feature): Support for building AWS-ready ISO` -- {vytask}`T3993` `(enhancment): Extend HTTP API GraphQL support` -- {vytask}`T3991` `(bug): PKI operational command return traceback` -- {vytask}`T3780` `(bug): VTI not being brought down when tunnel is down` -- {vytask}`T3001` `(feature): Disable spectre mitigation patches from CLI` -- {vytask}`T562` `(feature): PDNS: Add support for authoritative dns server` -- {vytask}`T71` `(feature): Add virtual IP and route installation policy options for IPsec` -- {vytask}`T5496` `` (default): `show firewall` error `` -- {vytask}`T4038` `` (default): Rewrite `vyatta-image-tools.pl` in Python `` -- {vytask}`T4997` `(default): Add DHCP client user hooks dir` -- {vytask}`T775` `(feature): Config Sync between two VyOS routers` -- {vytask}`T381` `(feature): config nodes for EasyRSA CAs` -- {vytask}`T118` `(feature): Native Zabbix Support` - -## 2024-02-14 - -- {vytask}`T6034` `(feature): rpki: move file based SSH keys for authentication to PKI subsystem` -- {vytask}`T5981` `(bug): IPsec site-to-site migrated PKI ca certificates are created with an '@'` -- {vytask}`T5930` `(bug): vrf - route-leak not work using route-target both command.` -- {vytask}`T5709` `(bug): IPoE-server fails if next pool mentioned but not defined` -- {vytask}`T4119` `(bug): Issue with l2tp remote-access ipv6 configuration` -- {vytask}`T2044` `(bug): RPKI doesn't boot properly` -- {vytask}`T6032` `(feature): bgp: add EVPN MAC-VRF Site-of-Origin support` -- {vytask}`T5960` `(default): Rewriting authentication section in accel-ppp services` - -## 2024-02-13 - -- {vytask}`T5928` `(bug): Configuration fails to load on boot if offloading has VLAN interfaces defined` -- {vytask}`T5482` `(bug): Chrony NTP Server Fails To Sync Time` -- {vytask}`T5064` `(bug): Value validation for domain-groups seems to be broken` - -## 2024-02-12 - -- {vytask}`T6010` `(bug): Support setting multiple values in BGP path-attribute` -- {vytask}`T6004` `(bug): RPKI is not configured` -- {vytask}`T5952` `(default): DHCP allow same MAC Address on same subnet` -- {vytask}`T5849` `(feature): Add SRv6 route commands` - -## 2024-02-10 - -- {vytask}`T6023` `(bug): rpki: add support for CLI knobs expire-interval and retry-interval` -- {vytask}`T1090` `(default): Webproxy overhaul` - -## 2024-02-09 - -- {vytask}`T6028` `(bug): QoS policy shaper wrong class_id_max and default_minor_id` -- {vytask}`T6026` `(bug): QoS hide attempts to delete qdisc from devices` -- {vytask}`T5788` `(feature): frr: update to 9.1 release` -- {vytask}`T5703` `(bug): QoS config on pppoe interface resets back to fq_codel after tunnel reboots` -- {vytask}`T5685` `(feature): Keepalived VRRP prefix is not necessary for the virtual address` - -## 2024-02-08 - -- {vytask}`T6014` `(feature): Bump keepalived version` -- {vytask}`T5910` `(bug): Grub problem(?) Serial Console no longer working` -- {vytask}`T6021` `(bug): QoS r2q wrong calculation` - -## 2024-02-07 - -- {vytask}`T6017` `(bug): Update vyos-http-api-tools for security advisory` -- {vytask}`T6016` `(bug): Resolve intermittent failures in cleanup function after failed image install` -- {vytask}`T6024` `(feature): bgp: add additional missing FRR features` -- {vytask}`T6011` `(feature): rpki: known-hosts-file is no longer supported by FRR CLI - remove VyOS CLI node` -- {vytask}`T5998` `(feature): replay_window setting under vpn in config` - -## 2024-02-06 - -- {vytask}`T6018` `(default): smoketest: updating http-api framework requires a pause before test` -- {vytask}`T5921` `(bug): Trying to commit an OpenConnect configuration without any local users results in an exception` -- {vytask}`T5687` `(feature): Implement ECS settings for PowerDNS recursor` - -## 2024-02-05 - -- {vytask}`T5974` `(bug): QoS policy shaper is currently miscalculating bandwidth and ceil values for the default class` -- {vytask}`T5865` `(feature): Rewrite ipv6 pool section to ipv6 named pools in Accel-ppp services` - -## 2024-02-02 - -- {vytask}`T5739` `(bug): Password recovery does not work if public keys are configured` -- {vytask}`T5955` `(feature): Rootless containers/set uid/gid for container` -- {vytask}`T5941` `(bug): [1.3.5 -> 1.4.0-RC1 Migration] Orphaned Configuration Nodes Cause Issues` -- {vytask}`T6003` `(feature): Add 'show rpki as-number' and 'show rpki prefix'` -- {vytask}`T5848` `(feature): Add triple-isolate flow isolation option to CAKE QoS policy` - -## 2024-02-01 - -- {vytask}`T5995` `(bug): Kernel NIC-drivers for Huawei NICs are not properly enabled` -- {vytask}`T5978` `(bug): ethernet: hw-tc-offload does not actually get enabled on the NIC` -- {vytask}`T5979` `(enhancment): Add configurable kernel boot parameters` -- {vytask}`T5973` `(bug): vrf: RTNETLINK answers: File exists` -- {vytask}`T5967` `(bug): Multi-hop BFD connections can't be established; please add minimum-ttl option.` -- {vytask}`T5619` `(default): Update the Intel ixgbe driver due to issues with Intel X533` - -## 2024-01-31 - -- {vytask}`T6000` `(bug): [1.3.x -> 1.5.x] migrating threw exception in /opt/vyatta/etc/config-migrate/migrate/https/5-to-6, performed workaround` -- {vytask}`T5999` `(bug): load-balancing reverse-proxy can't configure root as a redirect` - -## 2024-01-30 - -- {vytask}`T5980` `(feature): Add image-tools support for configurable kernel boot options` - -## 2024-01-29 - -- {vytask}`T5988` `(bug): image-tools: a check of valid image name is missing from 'add image'` -- {vytask}`T5994` `(bug): Fix typo in 'remote' module preventing 'add system image' via ftp` - -## 2024-01-26 - -- {vytask}`T5957` `(bug): Firewall fails to delete inbound-interface name` -- {vytask}`T5779` `(bug): custom conntrack timeout rule not applicable` -- {vytask}`T5984` `(feature): Add user util numactl` - -## 2024-01-25 - -- {vytask}`T5983` `(bug): image-tools: minor regression in pruning version files in compatibility mode` -- {vytask}`T5927` `` (bug): QoS policy shaper-hfsc class does not have a `bandwidth` node but requires one in the check `` -- {vytask}`T5834` `(bug): Rename 'enable-default-log' to 'default-log'` - -## 2024-01-22 - -- {vytask}`T5968` `(feature): hsflowd: add VRF support` -- {vytask}`T5975` `(bug): GraphQL expects script otp.py that does not exists in 1.4` -- {vytask}`T5961` `(bug): QoS policy shaper vif with ceiling fails on commit` -- {vytask}`T5958` `(bug): QoS policy shaper-hfsc is not implemented` -- {vytask}`T5160` `(feature): Firewall refactor` -- {vytask}`T5969` `(feature): op-mode: list multicast group membership` - -## 2024-01-21 - -- {vytask}`T5799` `(bug): vyos unbootable after 1.4-rolling-202308240020 to 1.5-rolling-202312010026 upgrade` -- {vytask}`T5787` `(bug): dhcp-server allows duplicate static-mapping for the same IP address` -- {vytask}`T5692` `(enhancment): NTP leap smear` -- {vytask}`T5954` `(feature): Enable nvme_hwmon and drivetemp in KERNEL` - -## 2024-01-20 - -- {vytask}`T5915` `(bug): Firewall zone - Re add op-mode commands` -- {vytask}`T5805` `(bug): Missed per-interface statistic in telegraf` -- {vytask}`T5724` `(feature): About dhcp client hooks` -- {vytask}`T5577` `(bug): Optimize PAM configs for RADIUS/TACACS+` -- {vytask}`T5550` `(bug): Source validation on interface does not work properly` -- {vytask}`T5267` `(bug): Another corruption on upgrade` -- {vytask}`T5239` `(bug): frr 'hostname' missing or incorrect, and domain-name missing totally` -- {vytask}`T5219` `(bug): ddclient: Cloudflare doesn't require login` -- {vytask}`T5217` `(feature): Add firewall SYNPROXY` -- {vytask}`T5203` `(feature): load-balancing wan add systemd unit instead of old vyatta-wanloadbalance.init` -- {vytask}`T5199` `(bug): Salt-minion cannot connect to server in python 3.10 and up` -- {vytask}`T5138` `(feature): Add patch to accel-ppp build L2TP LNS use Calling-Number as RADIUS Calling-Station-ID` -- {vytask}`T5054` `(bug): ipsec: "show vpn ipsec remote-access" does not list active connections` -- {vytask}`T5053` `(bug): Vyatta-cfg Post-Removal Hook Tries to Disable Deleted Service` -- {vytask}`T5035` `(feature): Add more actions to policy route rule` -- {vytask}`T4990` `(bug): Commit results may not be properly saved if power is cut immediately after a successful commit` -- {vytask}`T4988` `(default): Expose time and size conversion functions as Jinja2 filters` -- {vytask}`T4986` `(feature): Ability to filter traffic originating from the router itself via firewall` -- {vytask}`T4963` `(default): vyos.ethtool: improve/fix driver name detection` -- {vytask}`T4935` `(bug): ospfv3: "not-advertise" and "advertise" conflict` -- {vytask}`T4897` `` (bug): Setting 'source-address' or `source-interface` on existing vxlan interface doesn't work `` -- {vytask}`T4888` `(default): Rewrite the conntrack sync script using vyos.opmode` -- {vytask}`T4863` `(feature): need an option for route policy to apply to dynamic interfaces l2tp*/ipoe*/pppoe* (for TCP MSS setting)` -- {vytask}`T4817` `(feature): Please add support for RFC 9234` -- {vytask}`T4765` `(default): Normalize field names in op mode JSON outputs` -- {vytask}`T4751` `(enhancment): Feature Request: system login: 2FA OTP key generator in VyOS CLI` -- {vytask}`T4726` `(default): Add completion and validation for the accel-ppp RADIUS vendor option` -- {vytask}`T4722` `(default): Improve abbreviation/acronym consistency` -- {vytask}`T4172` `(feature): Patch ndppd to not read route table if there are no auto prefixes` -- {vytask}`T4085` `(feature): Rewrite L2TP/PPTP/SSTP/PPPoE services to get_config_dict` -- {vytask}`T4031` `(feature): Ability to configure DMVPN in vrf` -- {vytask}`T4030` `(bug): SR-IOV and interface renaming bug` -- {vytask}`T4014` `(feature): Add “command” and “arg” configuration options for containers` -- {vytask}`T3965` `(default): arm: Extend configure scripts to allow for arm builds` -- {vytask}`T3813` `(bug): Some custom sysctl parameters can't be applied bug` -- {vytask}`T3778` `(bug): Abnormal network communication and settings` -- {vytask}`T3591` `(bug): OpenVPN with/without VRF not working (NordVPN)` -- {vytask}`T3372` `(feature): Support public HTTPS repos in live-build` -- {vytask}`T5963` `(bug): QoS policy shaper rate calculations could be wrong for some ethernet devices` -- {vytask}`T5962` `(feature): QoS policy set default speed to 100mbit or 1gbit instead of 10mbit` -- {vytask}`T5697` `(bug): event-handler keep failing` -- {vytask}`T4779` `(default): Make raw op mode command outputs use bytes for data amount values` - -## 2024-01-19 - -- {vytask}`T5897` `(bug): VyOS with Cloud-init and VRF stucks at reboot/shutdown process` -- {vytask}`T5554` `(bug): Disable sudo for PAM RADIUS` -- {vytask}`T4754` `(default): Improvement: system login: show configured 2FA OTP key` -- {vytask}`T5857` `(bug): show interfaces wireless info` -- {vytask}`T5841` `(default): Remove old ssh-session-cleanup.service` -- {vytask}`T5543` `(bug): Fix source address handling in static joins` -- {vytask}`T5884` `(default): Minor description fix (op-mode: generate wireguard)` -- {vytask}`T5781` `(default): Add ability to add additional minisign keys` - -## 2024-01-18 - -- {vytask}`T5863` `(bug): Failure to Load Config on Recent 1.5 Versions` -- {vytask}`T4638` `(bug): Deleting a parent interface does not delete its underlying VLAN interfaces` -- {vytask}`T5953` `` (default): Rename 'close_action' value from `hold` to `trap` in IPSEC IKE `` -- {vytask}`T905` `(bug): The command show remote-config does not work for remote-platform openvpn` - -## 2024-01-17 - -- {vytask}`T5923` `(bug): Config mode system_console.py is not aware of revised GRUB file structure` -- {vytask}`T4658` `` (feature): Rename DPD action `hold` to `trap` `` -- {vytask}`T5932` `(bug): 1.4-rolling-202304120317 to 1.4.0-rc1: dynamic dns migration fail` - -## 2024-01-16 - -- {vytask}`T5951` `(bug): [1.4.0-RC2] show hardware dmi Operational Mode Command Broken` -- {vytask}`T5937` `(bug): [1.3.5 -> 1.4.0-RC1 Migration] IPv6 BGP Neighbor Peer Groups Missing / Not Migrated` -- {vytask}`T5889` `(bug): Migration NAT 5-to-6 bug` -- {vytask}`T5859` `(bug): Invalid format of pool range in accel-ppp services` -- {vytask}`T5842` `(feature): Rewrite PPTP service to get_config_dict` -- {vytask}`T5801` `(feature): Rewrite L2TP service to get_config_dict` -- {vytask}`T5688` `(default): Create the same view of pool configuration for all accel-ppp services` - -## 2024-01-15 - -- {vytask}`T5944` `(bug): "reboot in 1" not working` -- {vytask}`T5936` `(bug): [1.3.5 -> 1.4.0-RC1 Migration] OSPF Passive Interface Configuration Not Working Correctly` -- {vytask}`T5247` `(bug): the bug of the command "show interfaces system"` -- {vytask}`T5901` `(bug): Cloud-init and DHCP exit hook errors` -- {vytask}`T4856` `(bug): DHCP-client exit hook for IPsec is incorrect` -- {vytask}`T2556` `(bug): "show interfaces vrrp" does not return any interface` - -## 2024-01-14 - -- {vytask}`T4428` `(feature): Update ddclient to newer version` - -## 2024-01-12 - -- {vytask}`T5925` `(feature): Containers change systemd KillMode` -- {vytask}`T5920` `(bug): Quick Start documentation contains error` -- {vytask}`T5919` `(bug): Firewall - opmode for ipv6` -- {vytask}`T5306` `(default): bgp config migration failed with v6only option configured with peer-group` -- {vytask}`T3429` `(bug): Hyper-V integration services not working on VyOS 1.4 (sagitta/current)` - -## 2024-01-11 - -- {vytask}`T5896` `(bug): Config Error on Boot with Podman and Firewall` -- {vytask}`T5532` `(bug): After add system image the boot stuck and works again after the second reboot` -- {vytask}`T5512` `(bug): build linux-firmware script cannot expand asterisks if firmware name is a glob string` -- {vytask}`T5379` `(bug): show system updates doesnt seem to be working` -- {vytask}`T5275` `(default): Add op mode commands for exporting certificates to PEM files with correct headers` -- {vytask}`T5274` `(default): Add a deprecation warning for OpenVPN site-to-site with pre-shared secret` -- {vytask}`T5262` `(default): Warn the user about unsaved config on reboot/shutdown attempts` -- {vytask}`T5257` `(feature): Cannont assign netflow source ip to ip in non default VRF` -- {vytask}`T5026` `(feature): Python3 modules crypt and spwd are deprecated` -- {vytask}`T5814` `(bug): VyOS 1.3 to 1.4 LTS Firewall ruleset migration script breaks configuration` -- {vytask}`T4610` `(bug): Firewall with 20K entries cannot load after reboot` -- {vytask}`T3191` `(bug): PAM RADIUS freezing when accounting does not configured on RADIUS server` -- {vytask}`T5917` `(feature): Restore annotations of (running)/(default boot) in select image list` -- {vytask}`T5916` `(default): Added segment routing check for index size and SRGB size` -- {vytask}`T5913` `(feature): Allow for Peer-Groups in ipv4-labeled-unicast SAFI` - -## 2024-01-10 - -- {vytask}`T5918` `` (bug): Verification problem for `set vpn ipsec interface` `` -- {vytask}`T5911` `(bug): pki: service update ignored if certificate name contains a hyphen (-)` -- {vytask}`T5886` `(feature): Add support for ACME protocol (LetsEncrypt)` -- {vytask}`T5766` `(bug): http: rewrite conf-mode script to get_config_dict()` -- {vytask}`T5144` `(default): Modernize dynamic dns operation` -- {vytask}`T4689` `(feature): Support RFS(Receive Flow Steering)` -- {vytask}`T4659` `(feature): Use vtysh to display bridge and some interface parameter information` -- {vytask}`T4646` `(bug): USB serial output console does not work` -- {vytask}`T4577` `(bug): WWAN commit failed which simple config` -- {vytask}`T4502` `(feature): Consider implementing (NAT/other) flow table offload` -- {vytask}`T4446` `(default): Unified CLI for displaying neithbors (ARP, IP, and NDP)` -- {vytask}`T4427` `(default): Remove the vyos-utils package list from vyos-build` -- {vytask}`T4300` `(feature): Extend list of supported interfaces for Cloud-init Network Configuration` -- {vytask}`T4250` `(bug): Organize logrotate settings to avoid duplicates` -- {vytask}`T4236` `(feature): Generate ovpn openvpn client configuration files` -- {vytask}`T4222` `(feature): Support for TWAMP as round-trip metric` -- {vytask}`T3833` `(bug): Cloud-init not finding data source in OpenStack` -- {vytask}`T5902` `(bug): http: remove virtual-host configuration in webserver` -- {vytask}`T3499` `(bug): Podman is not compatible with nat rules` -- {vytask}`T3430` `(bug): Cloud-init failing with “Unable to render networking” on VyOS 1.3` -- {vytask}`T3011` `(bug): router becomes unreachable for few minutes when vti interfaces goes down` -- {vytask}`T5791` `(default): Update dynamic dns configuration path to be consistent with other areas of VyOS` -- {vytask}`T5708` `(default): Additional dynamic dns improvements to align with ddclient 3.11.1 release` -- {vytask}`T5573` `(bug): Fix ddclient cache entries` -- {vytask}`T5012` `(feature): Control network configuration from Cloud-Init config` -- {vytask}`T3116` `(feature): Support back-end L4 level load balancing` -- {vytask}`T5614` `(default): Add conntrack helper matching on firewall` -- {vytask}`T4782` `(enhancment): Allow multiple CA certificates (on e.g. EAPoL)` -- {vytask}`T2199` `(default): Rewrite firewall in new XML/Python style` - -## 2024-01-09 - -- {vytask}`T5898` `(bug): Replace partprobe with partx due to unable to install VyOS` -- {vytask}`T5838` `(feature): Add Infiniband kernel modules` -- {vytask}`T5785` `(bug): API output of show container image broken` -- {vytask}`T5410` `` (feature): Improve `utils.convert.convert_data()` to process all stdtypes `` -- {vytask}`T5269` `(default): OpenVPN non-TLS site-to-site mode deprecation` -- {vytask}`T5249` `(feature): Add rollback-soft feature to rollback without a reboot` -- {vytask}`T4944` `(default): Prevent op mode functions from returning bare literals in raw output` -- {vytask}`T4910` `(default): Rewrite the remote access VPN op mode in the new style` -- {vytask}`T4470` `(feature): Rewrite load-balancing wan to XML/Python` -- {vytask}`T3763` `(bug): wireguard checks if port already binding` -- {vytask}`T3489` `(bug): NUMA has been disabled for the past few years and no-one has noticed` -- {vytask}`T3476` `(feature): Update availability check` -- {vytask}`T2845` `(bug): BGP conf_mode unable to delete configuration with peer-group` -- {vytask}`T2844` `(bug): BGP conf_mode errors disable-send-community` -- {vytask}`T2755` `(default): Requirements for partial interface setup` -- {vytask}`T2721` `(enhancment): Set FQ-CoDel as the default queueing mechanism for every class in Shaper` -- {vytask}`T2511` `(feature): Migrate vyatta-op-quagga to new XML format` -- {vytask}`T2302` `(default): Convert configuration scripts from executables to modules and use a script runner` -- {vytask}`T2281` `(feature): DHCP and Static IPs on Same Interface` -- {vytask}`T2216` `(default): Containerized third-party applications for VyOS` -- {vytask}`T2171` `(feature): Unify creation and manipulation of interfaces` -- {vytask}`T1759` `(feature): Replacing Vyatta::Interface perl` -- {vytask}`T2408` `(enhancment): DHCP Relay upstream and downstream interfaces` -- {vytask}`T1297` `(feature): Add GARP settings to VRRP/keepalived` - -## 2024-01-08 - -- {vytask}`T5888` `(bug): Firewall upgrade fails because of icmpv6` -- {vytask}`T5844` `(bug): HTTPS API doesn't start without configured keys even when GraphQL authentication type is set to token` -- {vytask}`T5664` `(bug): 1.4 user has no permissions?` -- {vytask}`T5215` `(default): Add a built-in ICMP health check for VRRP groups` -- {vytask}`T5045` `(bug): BFD is not starting after upgrade to 1.4-rolling-202302150317` -- {vytask}`T4193` `(default): Add support for transparent firewall` -- {vytask}`T3754` `(default): Make config scripts more testable` -- {vytask}`T3663` `(default): Use inotify file watching where applicable` -- {vytask}`T3480` `(bug): Does not possible to change console baud-rate` -- {vytask}`T2897` `(default): Remove cluster command` -- {vytask}`T5904` `(feature): op-mode: add "show ipv6 route vrf " command` - -## 2024-01-07 - -- {vytask}`T5891` `(bug): OpenVPN IPv6 config issue with 1.4-rc1` -- {vytask}`T5887` `(feature): Upgrade Linux Kernel to 6.6.y (2023 LTS edition)` - -## 2024-01-06 - -- {vytask}`T3670` `(feature): Option to disable HTTP port 80 redirect` - -## 2024-01-05 - -- {vytask}`T3642` `(feature): PKI configuration` -- {vytask}`T5894` `(feature): Extend get_config_dict() with additional parameter with_pki that defaults to False` - -## 2024-01-04 - -- {vytask}`T4072` `(feature): Feature Request: Firewall on bridge interfaces` -- {vytask}`T3459` `(default): Inform the user when unable to install outdated image` - -## 2024-01-03 - -- {vytask}`T5880` `(bug): verify_source_interface should not allow dynamic interfaces like ppp, l2tp, ipoe or sstpc client interfaces` -- {vytask}`T5879` `(bug): tunnel: sourceing from dynamic pppoe0 interface will fail on reboots` -- {vytask}`T4500` `(bug): Missing firewall logs` - -## 2024-01-02 - -- {vytask}`T5885` `(default): image-tools: relax restriction on image-name length from 32 to 64` - -## 2024-01-01 - -- {vytask}`T5883` `(bug): Preserve file ownership in /config subdirs on add system image` -- {vytask}`T5474` `(feature): Establish common file name pattern for XML conf mode commands` - -## 2023-12-30 - -- {vytask}`T5875` `(bug): login: removing and re-adding a user keeps the home directory but UID will change, thus SSH keys no longer work` -- {vytask}`T5653` `(feature): Command to display fingerprint` - -## 2023-12-29 - -- {vytask}`T5829` `(bug): Can't Add IPv6 Address to Containers` -- {vytask}`T5852` `(bug): Reboots fail with eapol WAN interface` -- {vytask}`T5869` `(bug): vyos.template.first_host_address() does not honor RFC4291 section 2.6.1` - -## 2023-12-28 - -- {vytask}`T4163` `(feature): [BMP-BGP] Routing monitoring feature` -- {vytask}`T5867` `(feature): Upgrade podman to Debian Trixie version 4.7.x` -- {vytask}`T5866` `(feature): Add op-mode command to restart IPv6 RA daemon` -- {vytask}`T5861` `(bug): Flavor build system fails with third-party packages` -- {vytask}`T5854` `(feature): Extend override-default script to allow embedded defaultValue settings` -- {vytask}`T5792` `(default): Upgrade ddclient 3.11.2 release` - -## 2023-12-25 - -- {vytask}`T5855` `` (feature): Migrate "set service lldp snmp enable" -> `set service lldp snmp" `` -- {vytask}`T5837` `(bug): vyos.configdict.node_changed does not return keys per adding` -- {vytask}`T5856` `(bug): SNMP service removal fails` - -## 2023-12-24 - -- {vytask}`T5853` `(default): Typo interfaces-virtual-ethernet.xml.in` - -## 2023-12-22 - -- {vytask}`T5804` `(bug): SNAT "any" interface error` -- {vytask}`T4760` `(bug): VyOS does not support running multiple instances of DHCPv6 clients` - -## 2023-12-21 - -- {vytask}`T5778` `(bug): The show dhcp server leases operation mode command does not work as expected` -- {vytask}`T5775` `(default): Migrated Firewall Global State Policy ineffective on latest firewall zone config` -- {vytask}`T5637` `(bug): Firewall default-action log` -- {vytask}`T5796` `(bug): Openconnect - HTTPS security headers are missing` -- {vytask}`T3580` `(feature): Refactoring firewall ipv6 rule icmpv6` -- {vytask}`T2898` `(feature): Support NDP proxy` -- {vytask}`T2229` `(feature): PPPOE Default Queue type selection` - -## 2023-12-20 - -- {vytask}`T5823` `(feature): Protocol BGP add default values for config dictionary` -- {vytask}`T5798` `(enhancment): reverse-proxy load-balancing service should support multiple certificates for frontend` - -## 2023-12-19 - -- {vytask}`T5828` `(default): Fix GRUB installation on arm64` - -## 2023-12-18 - -- {vytask}`T5751` `(feature): Adjust new image tools for non-interactive use` -- {vytask}`T5831` `(feature): show system image should reverse order by addition date` -- {vytask}`T5825` `(bug): image-tools: restore authentication on 'add system image'` -- {vytask}`T5821` `(bug): image-tools: restore vrf-aware 'add system image'` -- {vytask}`T5819` `(bug): Don't echo password on install image` -- {vytask}`T5806` `(bug): Clear old raid data on new install image` -- {vytask}`T5789` `(bug): image-tools should copy ssh host keys on image update` -- {vytask}`T5758` `(default): Restore scanning configs when live installing` - -## 2023-12-15 - -- {vytask}`T5824` `(bug): busybox cannot connect some websites from initramfs` -- {vytask}`T5803` `(default): git/github: Adjust configuration for safe and baseline defaults` - -## 2023-12-14 - -- {vytask}`T5773` `(bug): Unable to load config via HTTP` -- {vytask}`T5816` `(bug): BGP Large Community List Validation Broken` -- {vytask}`T5812` `(bug): rollback check max revision number does not work` -- {vytask}`T5749` `(feature): Show MAC address VRF and MTU by default for "show interfaces"` -- {vytask}`T5774` `(bug): commit-archive to FTP server broken after update (VyOS 1.5-rolling)` -- {vytask}`T5826` `(default): Add dmicode as an explicit dependency` -- {vytask}`T5793` `(default): mdns-repeater: Cleanup avahi-daemon configuration in /etc` - -## 2023-12-13 - -- {vytask}`T591` `(feature): Support SRv6` - -## 2023-12-12 - -- {vytask}`T4704` `(feature): Allow to set metric (MED) to rtt with rtt,+rtt or -rtt` -- {vytask}`T5815` `(enhancment): Add load_config module` -- {vytask}`T5413` `(default): Deny the opportunity to use one public/private key pair on both wireguard peers.` - -## 2023-12-11 - -- {vytask}`T5741` `(bug): WAN Load Balancing failover route tables aren't created` - -## 2023-12-10 - -- {vytask}`T5658` `(default): Add VRF support for mtr` - -## 2023-12-09 - -- {vytask}`T5808` `(bug): op-mode: ipv6 ospfv3 graceful-restart description contains incorrect info` -- {vytask}`T5802` `(bug): ping (ip or hostname) interface produces error` -- {vytask}`T5747` `(feature): op-mode add MAC VRF and MTU for show interfaces summary` -- {vytask}`T3983` `(bug): show pki certificate Doesnt show x509 certificates` - -## 2023-12-08 - -- {vytask}`T5782` `(enhancment): Use a single config mode script for https and http-api` -- {vytask}`T5768` `(enhancment): Remove auxiliary http-api.conf for simplification of http-api config mode script` -- {vytask}`T5809` `(default): Enable GRUB support for gzip compressed kernels` - -## 2023-12-04 - -- {vytask}`T5769` `(bug): VTI tunnels lose their v6 Link Local addresses when set down/up` - -## 2023-12-03 - -- {vytask}`T5753` `(feature): Add VXLAN vnifilter support` -- {vytask}`T5759` `(feature): Change VXLAN default MTU to 1500 bytes` - -## 2023-11-30 - -- {vytask}`T4601` `(bug): dhcp : relay agent IP address issue.` - -## 2023-11-28 - -- {vytask}`T4276` `(bug): IPsec peers dh-group negotiation issue with pfs enabled and multiple proposals configured with IKEv1` - -## 2023-11-27 - -- {vytask}`T5763` `(bug): Fix imprecise check for remote file name in vyos-load-config.py` -- {vytask}`T5783` `(feature): frr: smoketests must notice any daemon crash` - -## 2023-11-26 - -- {vytask}`T5760` `(feature): DHCP client custom dhcp-options` -- {vytask}`T2405` `(feature): archive to GIT or other platform` - -## 2023-11-25 - -- {vytask}`T5655` `(bug): commit-archive: Ctrl+C should not eror out with stack trace, signal should be cought` -- {vytask}`T4946` `(default): Rewrite "add system image" in the new op-mode` -- {vytask}`T4454` `` (default): `install-image` should check free storage `` - -## 2023-11-24 - -- {vytask}`T5776` `(feature): Enable VFIO support` -- {vytask}`T5402` `(bug): VRRP router with rfc3768-compatibility sends multiple ARP replies` -- {vytask}`T3895` `(default): VYOS firewall rules do not adhere to time schedule unless placed in UTC mode.` - -## 2023-11-23 - -- {vytask}`T4891` `(bug): BFD flapping loop` -- {vytask}`T4867` `(bug): "show bgp neighbors ... advertised-routes" and some other commands fail for IPv4 neighbors` - -## 2023-11-22 - -- {vytask}`T5767` `(feature): Add reboot and poweroff the system via API` -- {vytask}`T5729` `(bug): Firewall, nat and policy route - Switch to valueless` -- {vytask}`T5681` `(feature): Interface match - Simplified and unified cli` -- {vytask}`T4877` `(bug): Need verification in using import vrf and import vpn, export vpn commands` -- {vytask}`T4021` `(bug): Long commit time on bridge interface with 1-4094 allowed VLAN tags` -- {vytask}`T5338` `(feature): Add 'mpls bgp forwarding' feature` -- {vytask}`T3818` `(bug): BGP export route-map only works after bgpd restart` -- {vytask}`T5590` `(default): Firewall "log enable" logs every packet` -- {vytask}`T5426` `(default): Add exceptions in vici functions calls` - -## 2023-11-21 - -- {vytask}`T5762` `(bug): http: api: smoketests fail as they can not establish IPv6 connection to uvicorn backend server` - -## 2023-11-20 - -- {vytask}`T2816` `(default): Rewrite IPsec scripts with the new XML/Python approach` - -## 2023-11-18 - -- {vytask}`T1354` `(feature): Add support for VLAN-Aware bridges` - -## 2023-11-16 - -- {vytask}`T5726` `(bug): HTTPS API image cannot be updated` -- {vytask}`T5738` `(feature): Extend XML building blocks` -- {vytask}`T5736` `(feature): igmp: migrate "protocols igmp" to "protocols pim"` -- {vytask}`T5733` `(feature): pim(6): rewrite FRR PIM daemon configuration to get_config_dict() and add missing IGMP features` -- {vytask}`T5689` `(default): FRR 9.0.1 in VyOS current segfaults on show rpki prefix $prefix` -- {vytask}`T5595` `(feature): Multicast - PIM bfd feature enable` -- {vytask}`T3638` `(bug): Passwords With Dollar Sign Set Incorrectly` - -## 2023-11-15 - -- {vytask}`T5695` `(feature): Build FRR with LUA scripts --enable-scripting option` -- {vytask}`T5665` `(bug): radius user not working` -- {vytask}`T5728` `(bug): Improve compatibility between OpenVPN on VyOS 1.5 and OpenVPN Connect Client` -- {vytask}`T5732` `(bug): generate firewall rule-resequence drops geoip country-code from output` -- {vytask}`T5661` `(enhancment): Add show show ssh dynamic-protection attacker and show log ssh dynamic-protection` -- {vytask}`T1276` `(bug): dhcp relay + VLAN fails` - -## 2023-11-13 - -- {vytask}`T5698` `(feature): EVPN ESI Multihoming` -- {vytask}`T5563` `(bug): container: Container environment variable cannot be set` -- {vytask}`T5706` `(bug): Systemd-udevd high CPU utilization for multiple dynamic ppp/l2tp/ipoe interfaces` - -## 2023-11-10 - -- {vytask}`T5727` `(bug): validator: Use native URL validator instead of regex-based validator` - -## 2023-11-08 - -- {vytask}`T5720` `(bug): PPPoE-server adding new interface does not work` -- {vytask}`T5716` `(bug): PPPoE-server shaper template bug down-limiter option does not rely on fwmark` -- {vytask}`T5702` `(feature): Add ability to set include_ifmib_iface_prefix and ifmib_max_num_ifaces for SNMP` -- {vytask}`T5648` `(bug): ldpd neighbour template errors` -- {vytask}`T5564` `(bug): Both show firewall group and show firewall summary fails` -- {vytask}`T5559` `(feature): Selective proxy-arp/proxy-ndp when doing SNAT/DNAT` -- {vytask}`T5541` `(bug): Zone-Based Firewalling in VyOS Sagitta 1.4` -- {vytask}`T5513` `(bug): Anomalies in show firewall command after refactoring` -- {vytask}`T4864` `` (bug): `show firewall` command errors `` - -## 2023-11-07 - -- {vytask}`T5586` `(feature): Disable by default SNMP for Keepalived VRRP` - -## 2023-11-06 - -- {vytask}`T5705` `(bug): rsyslog - Not working when using facility=all` -- {vytask}`T5704` `(feature): PPPoE-server add max-starting option` -- {vytask}`T5707` `(bug): Wireguard peer public key update leaves redundant peers and breaks connectivity` -- {vytask}`T4269` `(feature): node.def generator should automatically add default values` - -## 2023-11-05 - -- {vytask}`T4020` `(feature): Add ability to control FRR daemons options` - -## 2023-11-03 - -- {vytask}`T5700` `(bug): Monitoring telegraf deprecated plugins inputs outputs` -- {vytask}`T5018` `(bug): Redirect to IFB removed after change in qos policy` - -## 2023-11-02 - -- {vytask}`T5701` `(feature): Update telegraf package` - -## 2023-11-01 - -- {vytask}`T5690` `(bug): Change to definition of environment variable 'vyos_rootfs_dir' is incorrect` - -## 2023-10-31 - -- {vytask}`T5699` `(feature): vxlan: migrate "external" CLI know to "parameters external"` -- {vytask}`T5668` `(feature): Disable VXLAN bridge learning and enable neigh_suppress when using EVPN` - -## 2023-10-27 - -- {vytask}`T5652` `(bug): Config migrate to image upgrade does not properly generate home directory` -- {vytask}`T4057` `(bug): Commit time for deleting sflow configuration ~1.5 min` - -## 2023-10-26 - -- {vytask}`T5683` `(bug): reverse-proxy pki filenames mismatch` -- {vytask}`T4903` `(bug): conntrack ignore does not suppotr IPv6 addresses` -- {vytask}`T4309` `(feature): Support network/address-groups and ipv6-network/ipv6-address-groups in conntrack ignore` -- {vytask}`T5606` `(feature): IPSec VPN: Allow multiple CAs certificates` -- {vytask}`T5650` `(default): Progressbars suffer from staircasing effect` -- {vytask}`T5568` `(default): Install image from live ISO always defaults boot to KVM entry` -- {vytask}`T3509` `(default): No BCP38 for IPv6 on VyOS` - -## 2023-10-23 - -- {vytask}`T5299` `(bug): QoS shaper ceiling does not work` -- {vytask}`T5667` `(feature): BGP label-unicast - enable ecmp` -- {vytask}`T5337` `(bug): MPLS/BGP: Route leak does not happen from the VPNv4 table to specific vrf` - -## 2023-10-22 - -- {vytask}`T5254` `(bug): Modification of any interface setting sets MTU back to default when MTU has been inherited from a bond` -- {vytask}`T5671` `(feature): vxlan: change port to IANA assigned default port` - -## 2023-10-21 - -- {vytask}`T5670` `(bug): bridge: missing member interface validator` -- {vytask}`T5617` `(feature): Add an option to exclude single values to the numeric validator` -- {vytask}`T5414` `(bug): dhcp-server does not allow valid bootfile-names` -- {vytask}`T5261` `(feature): Add AWS gateway load-balanceing tunnel handler (gwlbtun)` -- {vytask}`T5260` `(bug): Python3 module crypt is deprecated` -- {vytask}`T5191` `(default): Replace underscores with hyphens in command-line options generated by vyos.opmode` -- {vytask}`T5172` `(default): Set Python3 version dependency for vyos-1x to 3.10` -- {vytask}`T4956` `(default): 'show hardware cpu' issue on arm64` -- {vytask}`T4837` `(default): Expose "show ip route summary" in the op mode API` -- {vytask}`T4770` `(feature): Rewrite OpenVPN op-mode to vyos.opmode format` -- {vytask}`T4657` `` (bug): op-mode scripts with type hints in `return` do not work `` -- {vytask}`T4604` `(bug): bgpd eats huge amount of memory (about 500Megs a day)` -- {vytask}`T4432` `(default): Display load average normalized according to the number of CPU cores` -- {vytask}`T4416` `(default): Convert 'traceroute' operation to the new syntax and expand available options using python` -- {vytask}`T4402` `(bug): OpenVPN client-ip-pool option is broken` -- {vytask}`T3433` `(default): A review of the use of racist language in VyOS` -- {vytask}`T2719` `(feature): Standardized op mode script structure` - -## 2023-10-20 - -- {vytask}`T5233` `(bug): Op-mode flow-accounting netflow with disable-imt errors` -- {vytask}`T5232` `(bug): Flow-accounting uacctd.service cannot restart correctly` - -## 2023-10-19 - -- {vytask}`T4913` `(default): Rewrite the wireless op mode in the new style` - -## 2023-10-18 - -- {vytask}`T5642` `(bug): op cmd: generate tech-support archive: does not work` -- {vytask}`T5521` `(bug): Home owner directory changed to vyos for the user after reboot` - -## 2023-10-17 - -- {vytask}`T5662` `(bug): Fix indexing error in configdep script organization` -- {vytask}`T5235` `(bug): SSH keys with special characters cannot be applied via Cloud-init` - -## 2023-10-16 - -- {vytask}`T5165` `(feature): Policy local-route ability set protocol and port` - -## 2023-10-14 - -- {vytask}`T5629` `(bug): Policy local-route bug after migration to destination node address` - -## 2023-10-13 - -- {vytask}`T5227` `(feature): mDNS reflector should allow additional domains to browse and allow filtering services` -- {vytask}`T5166` `(feature): Remove local minisign package from build repo for 1.4` -- {vytask}`T5118` `(bug): Cleanup vestigial ntp completion script` -- {vytask}`T5115` `(default): Support custom port for name servers for forwarding zones` -- {vytask}`T5113` `(default): PDNS: Support custom port for DNS forwarders` -- {vytask}`T5112` `(feature): Enable support for Network Time Security (NTS) for chrony` -- {vytask}`T5143` `(enhancment): Apply constraint on powerdns forward-zones configuration` - -## 2023-10-12 - -- {vytask}`T5649` `(bug): vyos-1x should generate XML cache after building command templates for less cryptic error on typo` - -## 2023-10-10 - -- {vytask}`T5489` `(feature): Change to BBR as TCP congestion control, or at least make it an config option` -- {vytask}`T5479` `(bug): Helper leftovers found in nftables (firewall) even with all helpers disabled` -- {vytask}`T5436` `(bug): vyos-preconfig-bootup.script is missing` -- {vytask}`T5014` `(feature): Destination NAT - Add Load Balancing capabilities` - -## 2023-10-08 - -- {vytask}`T5630` `(feature): pppoe: allow to specify MRU in addition to already configurable MTU` - -## 2023-10-06 - -- {vytask}`T5096` `(feature): Change 'accept' firewall rule action from 'return' to 'accept'` -- {vytask}`T5576` `(feature): Add bgp remove-private-as all option` -- {vytask}`T3506` `(default): Migrate loadkey command to op-mode` - -## 2023-10-05 - -- {vytask}`T4320` `(default): Remove legacy version files in vyatta-cfg-system/cfg-version` - -## 2023-10-04 - -- {vytask}`T5632` `(feature): Add jq package to parse JSON files` -- {vytask}`T3655` `(bug): NAT Problem with VRF` -- {vytask}`T5585` `(bug): Fix file access mode for dynamic dns configuration` - -## 2023-10-03 - -- {vytask}`T5618` `(bug): Flow-accounting crushes when IMT is enabled` -- {vytask}`T5561` `(feature): NAT - Inbound or outbound interface should not be mandatory` -- {vytask}`T5553` `(feature): Firewall - Add action continue` -- {vytask}`T5250` `(bug): Firewall - show firewall group` -- {vytask}`T4383` `(bug): Flow Accounting returns permission error and fails to start` -- {vytask}`T5626` `(feature): Only select required Kernel CGROUP controllers` -- {vytask}`T5628` `(feature): op-mode: login: DeprecationWarning: 'spwd'` - -## 2023-10-01 - -- {vytask}`T936` `(feature): Reimplementation of tech-support diagnostic file generation` - -## 2023-09-30 - -- {vytask}`T5048` `(bug): QoS doesn't work correctly root task` -- {vytask}`T4989` `(bug): QoS Policy Limiter - classes for marked traffic do not work` - -## 2023-09-28 - -- {vytask}`T5596` `(feature): bgp: add new features from FRR 9` -- {vytask}`T5412` `(feature): Add support for extending config-mode dependencies in supplemental package` - -## 2023-09-26 - -- {vytask}`T5480` `(bug): Ability to disable SNMP for VRRP keepalived service` - -## 2023-09-25 - -- {vytask}`T5533` `(bug): Keepalived VRRP IPv6 group enters in FAULT state` - -## 2023-09-24 - -- {vytask}`T5511` `(feature): Cleanup of unused directories (and files) in order to shrink image-size` - -## 2023-09-23 - -- {vytask}`T5518` `(default): Add MLD protocol support` - -## 2023-09-22 - -- {vytask}`T5602` `(feature): For reverse-proxy type of load-balancing feature, support "backup" option in backends configuration` -- {vytask}`T5609` `(enhancment): Add util to get drive device name from id` -- {vytask}`T5608` `(enhancment): Rewrite add/delete raid member to Python and remove from vyatta-op` -- {vytask}`T5607` `(bug): Adjust RAID smoketest for non-deterministic SCSI device probing` - -## 2023-09-20 - -- {vytask}`T5588` `(bug): Add kernel conntrack_bridge module` -- {vytask}`T5271` `(default): Add support for peer-fingerprint to OpenVPN` -- {vytask}`T5241` `(feature): Support veth interfaces to working with netns` -- {vytask}`T5238` `(default): interface virtual-etherne - error when it doesn't use a peer` -- {vytask}`T5592` `(feature): salt: upgrade minion to 3005.2` - -## 2023-09-19 - -- {vytask}`T5597` `(feature): isis: add new features from FRR 9.` -- {vytask}`T4284` `(feature): QoS: rewrite to XML and Python` - -## 2023-09-18 - -- {vytask}`T5419` `(feature): Software/Hardware fastpath with nftables flowtable` - -## 2023-09-15 - -- {vytask}`T5581` `(feature): Add "show ip nht" op-mode command (IPv4 nexthop tracking table)` - -## 2023-09-11 - -- {vytask}`T5567` `(bug): vyos-1x: webproxy: maximum-object-size allowed ranges not in sync with Equuleus` -- {vytask}`T5551` `(bug): Missing check for boot_configuration_complete raises error in vyos-save-config.py` -- {vytask}`T5353` `(bug): config-mgmt: normalize archive updates and commit log entries` -- {vytask}`T3424` `(default): PPPoE IA-PD doesn't work in VRF` -- {vytask}`T2773` `(feature): EIGRP support for VRF` - -## 2023-09-10 - -- {vytask}`T5565` `(bug): Builds as vyos-999-timestamp instead of vyos-1.4-rolling-timestamp` -- {vytask}`T5555` `(bug): Fix timezone migrator (system 13-to-14)` -- {vytask}`T5529` `(bug): Missing symbolic link in linux-firmware package.` - -## 2023-09-09 - -- {vytask}`T5540` `(bug): vyos-1x: Wrong VHT configuration for WiFi 802.11ac` -- {vytask}`T5423` `(bug): ipsec: no output for op-cmd "show vpn ike secrets"` -- {vytask}`T3700` `(feature): Support VLAN tunnel mapping of VLAN aware bridges` - -## 2023-09-08 - -- {vytask}`T5502` `(bug): Firewall - wrong parser for inbound and/or outbound interface` -- {vytask}`T5460` `(feature): Firewall - remove config-trap` -- {vytask}`T5450` `(feature): Firewall interface group - Allow inverted matcher` -- {vytask}`T4426` `(default): Add arpwatch to the image` -- {vytask}`T4356` `(bug): DHCP v6 client only supports single interface configuration` - -## 2023-09-07 - -- {vytask}`T5510` `(feature): Shrink imagesize and improve read performance by changing mksquashfs syntax` - -## 2023-09-06 - -- {vytask}`T5542` `(bug): ipoe-server: external-dhcp(dhcp-relay) not woking / not implemented` -- {vytask}`T5548` `(bug): HAProxy renders timeouts incorrectly` -- {vytask}`T5544` `(feature): Allow CAP_SYS_MODULE to be set on containers` - -## 2023-09-05 - -- {vytask}`T5524` `(feature): Add config directory to liveCD` -- {vytask}`T5519` `` (bug): Function `call` sometimes hangs `` -- {vytask}`T5508` `(bug): Configuration Migration Fails to New Netfilter Firewall Syntax` -- {vytask}`T5495` `(feature): Enable snmp module also for frr/ldpd` -- {vytask}`T2958` `(bug): DHCP server doesn't work from a live CD` -- {vytask}`T5428` `(bug): dhcp: client renewal fails when running inside VRF` - -## 2023-09-04 - -- {vytask}`T5536` `(bug): show dhcp client leases caues No module named 'vyos.validate'` -- {vytask}`T5506` `(bug): Container bridge interfaces do not have a link-local address` - -## 2023-09-03 - -- {vytask}`T5538` `(bug): Change order within variable lb_config_tmpl to fit order of manpage and fix some typos` -- {vytask}`T4612` `(feature): Support arbitrary netmasks in firewall rules` - -## 2023-08-31 - -- {vytask}`T5190` `(feature): Cloud-Init cannot fetch Meta-data on machines where the main Ethernet interface is not eth0` -- {vytask}`T4895` `(bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data` -- {vytask}`T4776` `(bug): NVME storage is not detected properly during installation` -- {vytask}`T5531` `(feature): Containers add label option` -- {vytask}`T5525` `(default): Change dev.packages.vyos.net repo to rolling-packages.vyos.net vyos-build:current uses` - -## 2023-08-30 - -- {vytask}`T4933` `(default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a nondescript error` -- {vytask}`T4790` `(bug): RADIUS login does not work if sum of timeouts more than 50s` -- {vytask}`T4113` `(bug): Incorrect GRUB configuration parsing` -- {vytask}`T5520` `(bug): Likely source of corruption on system update exposed by change in coreutils for Bookworm` -- {vytask}`T4151` `(feature): IPV6 local PBR Support` -- {vytask}`T4485` `(default): OpenVPN: Allow multiple CAs certificates` - -## 2023-08-29 - -- {vytask}`T3940` `(bug): DHCP client does not remove IP address when stopped by the 02-vyos-stopdhclient hook` -- {vytask}`T3713` `(default): Create a meta-package for user utilities` -- {vytask}`T3339` `(bug): Cloud-Init domain search setting not applied` -- {vytask}`T3577` `(bug): Generating vpn x509 key pair fails with command not found` - -## 2023-08-28 - -- {vytask}`T4745` `(bug): CLI TAB issue with values with '-' at the beginning in conf mode` -- {vytask}`T5472` `(bug): NAT redirect should not require port` - -## 2023-08-27 - -- {vytask}`T4759` `(bug): domain-group on policy route not working` -- {vytask}`T1097` `(feature): Make firewall groups work everywhere that's appropropriate` - -## 2023-08-26 - -- {vytask}`T5039` `(bug): Can't add new local user` -- {vytask}`T5023` `(bug): PKI commit fails to update dependents` -- {vytask}`T4512` `(feature): enable-default-log on zone-policy` -- {vytask}`T5003` `(default): Upgrade base system to Debian 12 "Bookworm"` - -## 2023-08-25 - -- {vytask}`T5468` `(feature): Remove unused manpages to free up space` -- {vytask}`T5463` `(feature): Containers allow publish IPv6 address port` -- {vytask}`T4412` `(bug): commit archive: reboot not working with sftp` -- {vytask}`T3702` `(feature): Policy: Allow routing by fwmark` -- {vytask}`T3536` `(default): Unable to list all available routes` - -## 2023-08-24 - -- {vytask}`T5448` `(feature): Add service zabbix-agent` -- {vytask}`T5006` `(bug): Http api segfault with concurrent requests` -- {vytask}`T5505` `(feature): system: zebra route-map is not removed from FRR` -- {vytask}`T5305` `(bug): REST API configure operation should not be defined as async` -- {vytask}`T4292` `(feature): Rewrite vyatta-save-config.pl to Python` - -## 2023-08-23 - -- {vytask}`T5478` `(bug): Cannot configure resolver-cache options for firewall` -- {vytask}`T5466` `(feature): L3VPN - label allocation mode` -- {vytask}`T5453` `(bug): Fix nat66 - broken after load-balance was introduced in nat` -- {vytask}`T5446` `(bug): bgp: validity check for bestpath med option` -- {vytask}`T5500` `(feature): Minor fixes to configtree render` -- {vytask}`T5469` `(default): Incorrect dependency set in the openvpn-dco package when building VyOS for arm64` -- {vytask}`T5387` `(feature): dhcp6c: add a no release option` -- {vytask}`T5491` `(feature): Hostapd - AP-Mode - allow white-/blacklisting of Clients` -- {vytask}`T4889` `(default): Add nftables NAT REDIRECT [to localhost] to CLI` - -## 2023-08-22 - -- {vytask}`T5407` `(bug): Static routes pointed to container networks fail to persist after reboot` - -## 2023-08-20 - -- {vytask}`T5470` `(bug): wlan: can not disable interface if SSID is not configured` - -## 2023-08-18 - -- {vytask}`T5488` `(bug): System conntrack ignore does not take any effect` - -## 2023-08-17 - -- {vytask}`T4202` `(bug): NFT: Zone policies fail to apply when "l2tp+" is in the interface list` -- {vytask}`T5409` `(feature): Add 'set interfaces wireguard wgX threaded'` -- {vytask}`T5476` `(feature): netplug: replace Perl helper scripts with a Python equivalent` -- {vytask}`T5223` `(bug): tunnel key doesn't clear` -- {vytask}`T5490` `(feature): login: add missing regex for home direcotry and radius server key` - -## 2023-08-16 - -- {vytask}`T5483` `(bug): Residual dhcp-server test file causing zabbix-agent smoketest to fail` - -## 2023-08-15 - -- {vytask}`T5293` `(feature): Support for Floating Rules (Global Firewall-Rules that are automatically applied before all other Zone Rules)` -- {vytask}`T5273` `(default): Add op mode commands for displaying certificate details and fingerprints` -- {vytask}`T5270` `` (default): Make OpenVPN `tls dh-params` optional `` - -## 2023-08-14 - -- {vytask}`T5477` `(bug): op-mode pki.py should use Config for defaults` -- {vytask}`T5461` `(feature): Improve rootfs directory variable` -- {vytask}`T5457` `(feature): Add environmental variable pointing to current rootfs directory` -- {vytask}`T5440` `(bug): Restore pre/postconfig scripts if user deleted them` - -## 2023-08-12 - -- {vytask}`T5467` `(bug): ospf(v3): removing an interface from the OSPF process does not clear FRR configuration` - -## 2023-08-11 - -- {vytask}`T5465` `(feature): adjust-mss: config migration fails if applied to a VLAN or Q-in-Q interface` -- {vytask}`T2665` `(bug): vyos.xml.defaults for tag nodes` -- {vytask}`T5434` `(enhancment): Replace remaining calls of vyos.xml library` -- {vytask}`T5319` `(enhancment): Remove remaining workarounds for incorrect defaults` -- {vytask}`T5464` `(feature): ipv6: add support for per-interface dad (duplicate address detection) setting` - -## 2023-08-10 - -- {vytask}`T5416` `(bug): Ignoring "ipsec match-none" for firewall` -- {vytask}`T5329` `(bug): Wireguard interface as GRE tunnel source causes configuration error on boot` - -## 2023-08-09 - -- {vytask}`T5452` `(bug): Uncaught error in generate_cache during vyos-1x build` -- {vytask}`T5443` `(enhancment): Add merge_defaults as Config method` -- {vytask}`T5435` `(enhancment): Expose utility function for default values at path` - -## 2023-08-07 - -- {vytask}`T5406` `(bug): "update webproxy blacklists" fails when vrf is being configured` -- {vytask}`T5302` `(bug): QoS class with multiple matches generates one filter rule but expects several rules` -- {vytask}`T5266` `(bug): QoS- HTB error when match with a dscp parameter for queue-type 'priority'` -- {vytask}`T5071` `(bug): QOS-Rewrite: DSCP match missing` - -## 2023-08-06 - -- {vytask}`T5420` `(feature): nftables - upgrade to latest 1.0.8` -- {vytask}`T5445` `(feature): dyndns: add possibility to specify update interval (timeout)` - -## 2023-08-05 - -- {vytask}`T5291` `(bug): vyatta-cfg-cmd-wrapper missing ${vyos_libexec_dir} variable` -- {vytask}`T5290` `(bug): Failing commits for SR-IOV interfaces using ixgbevf driver due to change speed/duplex settings` -- {vytask}`T5439` `(bug): Upgrade to FRR version 9.0 added new daemons which must be adjusted` - -## 2023-08-04 - -- {vytask}`T5427` `(bug): Change migration script len arguments checking` - -## 2023-08-03 - -- {vytask}`T5301` `(bug): NTP: chrony only allows one bind address` -- {vytask}`T5154` `(bug): Chrony - multiple listen addresses` - -## 2023-08-02 - -- {vytask}`T5374` `(feature): Ability to set 24-hour time format` -- {vytask}`T5350` `(bug): Confusing warning message when committing VRRP config` -- {vytask}`T5430` `(bug): bridge: vxlan interfaces are not listed as bridgable in completion helpers` -- {vytask}`T5429` `(bug): vxlan: source-interface is not honored and throws config error` -- {vytask}`T5415` `(feature): Upgrade FRR to version 9.0` -- {vytask}`T5422` `(feature): Support LXD Agent` - -## 2023-08-01 - -- {vytask}`T5399` `(bug): "show ntp" fails when vrf is being configured` -- {vytask}`T5346` `(bug): MPLS sysctl not persistent for L2TP interfaces` -- {vytask}`T5343` `(feature): BGP peer group VPNv4 & VPNv6 Address Family Support` -- {vytask}`T5339` `(feature): Geneve interface - option to use IPv4 as inner protocol` -- {vytask}`T5335` `(bug): ISIS: error when loading config from file` - -## 2023-07-31 - -- {vytask}`T5421` `(feature): Add arg to completion helper 'list_interfaces' to filter out vlan subinterfaces` - -## 2023-07-29 - -- {vytask}`T5403` `(feature): Add support for extending xml cache` - -## 2023-07-28 - -- {vytask}`T4602` `` (bug): DHCP `ping-check` enabled by default `` -- {vytask}`T5411` `(feature): Remove old background monitoring implementation` -- {vytask}`T5317` `(enhancment): configtree: remove mutable references` -- {vytask}`T5316` `(enhancment): configtree: use a single pass of the diff algorithm` - -## 2023-07-27 - -- {vytask}`T5368` `(feature): FastNetmon service ids ddos-protection add support sflow mode` - -## 2023-07-26 - -- {vytask}`T5398` `(bug): FRR mangles container network interface names` -- {vytask}`T5365` `(bug): Container systemd units require authentication` -- {vytask}`T4974` `(feature): OpenVPN- Data Channel Offload(DCO)` - -## 2023-07-25 - -- {vytask}`T5377` `(feature): ospf: add graceful restart FRR feature (RFC 3623)` - -## 2023-07-21 - -- {vytask}`T5373` `(bug): LLDP seems to be running even if its disabled on all interfaces` -- {vytask}`T5328` `(default): bgp: Incorrect warning showed for address-family configured with neighbor as interface` -- {vytask}`T5363` `(bug): Bash history file does not exists after reboot and ony other file in home directory` -- {vytask}`T5385` `(bug): reference_tree: catch parse error on non-transcluded files` -- {vytask}`T5361` `(bug): "monitor log" behaves like "show log"` - -## 2023-07-20 - -- {vytask}`T5362` `` (bug): `set high-availability vrrp global-parameters version 3` seems to have no effect `` -- {vytask}`T5355` `(bug): IPSec: OP cmd : "show vpn ike sa" does not show output` -- {vytask}`T5330` `(enhancment): Keep track of source of config dict value when merging defaults` -- {vytask}`T4497` `(feature): ping cannot force ipv4 or ipv6` -- {vytask}`T4288` `(bug): IPsec tunnel will break when ESP timeout` - -## 2023-07-19 - -- {vytask}`T5340` `(bug): SNMP and VRF` -- {vytask}`T5059` `(feature): add 'disable' option to DHCP relay config` - -## 2023-07-17 - -- {vytask}`T2051` `(bug): Throughput anomalies` - -## 2023-07-16 - -- {vytask}`T141` `(feature): TACACS+ Support` - -## 2023-07-15 - -- {vytask}`T5341` `(feature): Improve CLI for high-availability virtual-server to work with multiple ports` - -## 2023-07-14 - -- {vytask}`T5358` `(bug): 99-ipsec-dhclient-hook prevents DHCP stateless routes from being installed in VRF table` -- {vytask}`T4376` `(bug): DNAT with multiwan and policy routing, incoming connections only work on primary interface` -- {vytask}`T305` `(default): loadbalancing does not work with one pppoe connection and another connection of either dhcp or static` - -## 2023-07-13 - -- {vytask}`T4713` `(bug): vyos@vyos:~$ show nat destination rules | doesn't work` -- {vytask}`T2315` `(feature): Ability to have right address-family for BGP peers.` - -## 2023-07-12 - -- {vytask}`T5347` `(bug): Compare commit revision bug` -- {vytask}`T5161` `(default): BFD Static Route Monitoring` -- {vytask}`T5105` `(bug): DHCP Server - Wrong error message` -- {vytask}`T4927` `(bug): Need to change restart to reload-or-restart in Webproxy module` -- {vytask}`T3835` `(bug): vyos router 1.2.7 snmp Dos bug` -- {vytask}`T5352` `(default): Fix missing dependency for netavark` -- {vytask}`T4959` `(feature): Add container registry authentication config for containers` - -## 2023-07-11 - -- {vytask}`T5314` `(bug): QOS Default classes are not configured with correct qdisc` -- {vytask}`T4862` `(bug): webproxy domain-block does not work` -- {vytask}`T4844` `(bug): Incorrect permissions of the safeguard DB directory` -- {vytask}`T4815` `(bug): Fix various name server config issues` -- {vytask}`T4810` `(bug): Op-mode show/monitor log pppoe interface does not show any logs` -- {vytask}`T4758` `(feature): Rewrite show dhcp server to vyos.opmode format` -- {vytask}`T4262` `(bug): install image doesn't respect chosen root partition size` -- {vytask}`T3810` `(bug): webproxy squidguard rules don't work properly after rewriting to python.` -- {vytask}`T1928` `(bug): Is the 'Welcome to VyOS' message when using SSH an information leak?` -- {vytask}`T1877` `(default): Feature Request: Allow NAT to use network and address groups` -- {vytask}`T4813` `(feature): L3VPN over GRE Tunnels` -- {vytask}`T4943` `(bug): Radius SSH login displays "permission denied" on 1.4 rolling release` -- {vytask}`T4542` `(default): route-map: "match prefix-len" incorrect behavior` -- {vytask}`T4392` `(default): Multiline login banner text reports error on commit` - -## 2023-07-10 - -- {vytask}`T5345` `(bug): Error incorrectly raised in revised multi_to_list when tag node value name == tag node name` -- {vytask}`T3578` `(bug): Prefix-List(6) update cause empty prefix-list(6)` -- {vytask}`T762` `(feature): Include rulseset in firewall` - -## 2023-07-06 - -- {vytask}`T5336` `(feature): Add Swedish keyboard-layout` - -## 2023-07-04 - -- {vytask}`T5333` `(bug): Policy base routing PBR generetes incorrect rules with name POSTROUTING` -- {vytask}`T5081` `(feature): ISIS and OSPF syncronization with IGP-LDP sync` - -## 2023-07-03 - -- {vytask}`T5295` `(bug): QoS shaper incorrect rate limit the traffic` -- {vytask}`T5334` `(feature): ospf: add support for External Route Summarisation Type-5 and Type-7` - -## 2023-07-02 - -- {vytask}`T5332` `(bug): Show policy route not working when no interface is configured` - -## 2023-07-01 - -- {vytask}`T5304` `(feature): Containers add bind-propagation option rshared` -- {vytask}`T5296` `(bug): QoS class cannot calculate correctly the default bandwidth auto` -- {vytask}`T5210` `(bug): IPSec cosmetic bug for Warning vti inrerface` -- {vytask}`T5277` `(bug): Dhcpv6-relay does not start on boot` - -## 2023-06-30 - -- {vytask}`T5315` `(feature): vrrp: add support for version 3` -- {vytask}`T5283` `(bug): IPoE server assigns network address` -- {vytask}`T5313` `(bug): UDP broadcast relay - missing verify() that relay interfaces have an IP address assigned` - -## 2023-06-29 - -- {vytask}`T5320` `(enhancment): Add warning when entering config mode after a boot configuration error` - -## 2023-06-28 - -- {vytask}`T1237` `(feature): Static Route Path Monitoring, failover` - -## 2023-06-26 - -- {vytask}`T5159` `(bug): DHCPv6-server leases op-command shows warning message even if configured` - -## 2023-06-25 - -- {vytask}`T5240` `(bug): Service router-advert failed to start radvd with more then 3 name-servers` -- {vytask}`T5312` `(bug): Nonescaped special character in help text` - -## 2023-06-24 - -- {vytask}`T5303` `(bug): Rsyslog.service is not working` -- {vytask}`T5298` `(bug): Add RFKILL support into kernel.` -- {vytask}`T5308` `(enhancment): Remove workarounds for incorrect defaults in get_interface_dict` -- {vytask}`T5228` `(enhancment): Simplify get_config_dict and add argument with_defaults` -- {vytask}`T5310` `(bug): Need some help troubleshooting NIC detection.` - -## 2023-06-22 - -- {vytask}`T5297` `(default): Utility function to check if config under node has been changed between revisions` - -## 2023-06-20 - -- {vytask}`T5300` `(bug): verification of port availability can return false negative on boot` -- {vytask}`T5248` `(feature): Ability to load config via API in JSON format` - -## 2023-06-19 - -- {vytask}`T5281` `(feature): Add kernel options for vhost-net` -- {vytask}`T5072` `(default): QOS-Rewrite: protocol name used literally` -- {vytask}`T4969` `(bug): QoS Policy - Unable to set class match mark number` - -## 2023-06-18 - -- {vytask}`T5256` `(bug): QoS expects protocol number but not protocol name` - -## 2023-06-13 - -- {vytask}`T5258` `(bug): git Actions use ubuntu-22.04 instead of deprecated ubuntu-18.04 for PR conflicts checker` -- {vytask}`T5222` `(feature): Add load-balancing reverse-proxy based on haproxy` -- {vytask}`T5213` `(feature): Accel-ppp sending accounting interim updates acct-interim-interval option` -- {vytask}`T5171` `(feature): Use XML for conf-mode "load-balancing wan" instead of legacy templates` - -## 2023-06-12 - -- {vytask}`T5282` `(bug): Poweroff now does not work` -- {vytask}`T5264` `(feature): Add Mellanox Technologies firmware flash module mlxfw to kernel` -- {vytask}`T5286` `(feature): Remove XDP support` - -## 2023-06-10 - -- {vytask}`T5231` `(feature): Add op-mode for load-balancing reverse-proxy` - -## 2023-06-09 - -- {vytask}`T5253` `(bug): MPLS config removed at boot when wireguard interfaces present` - -## 2023-06-05 - -- {vytask}`T5259` `(bug): Openconnect cannot pass migration 1-to-2` - -## 2023-06-02 - -- {vytask}`T5252` `(bug): Route distinguisher and route targets changing upon adding interface to new VRF` -- {vytask}`T5251` `(bug): Uncaught errors for functions delete/delete_value in Python module configtree.py` - -## 2023-06-01 - -- {vytask}`T5127` `(bug): VPNv4/VPNv6 routes are not reinstalled following link flap` - -## 2023-05-28 - -- {vytask}`T5244` `(feature): dropbear: update to 2022.83` -- {vytask}`T5242` `(feature): interfaces: smoketest: automatically detect "capabilities"` -- {vytask}`T5234` `(feature): Add bash identifier for given VRF instance` - -## 2023-05-25 - -- {vytask}`T5237` `(feature): interfaces virtual-ethernet - Extend capabilitys of Vlans/QinQ` -- {vytask}`T4686` `(feature): Provides support for veth` - -## 2023-05-24 - -- {vytask}`T4605` `(feature): Firewall change default table names` -- {vytask}`T4550` `(feature): router-advert: Add deprecate-prefix & decrement-lifetimes options` - -## 2023-05-23 - -- {vytask}`T4916` `(feature): Rewrite IPsec authentication` - -## 2023-05-22 - -- {vytask}`T5214` `(bug): PPPoE-server incorrect warning if a named pool is defined` -- {vytask}`T4977` `(feature): Babel routing protocol support` - -## 2023-05-21 - -- {vytask}`T4733` `(default): Feature Request: dhcp server: add VRF support` -- {vytask}`T5218` `(enhancment): Revise vyos xml lib for bug fixes and extensions` - -## 2023-05-17 - -- {vytask}`T5226` `(default): Deduplicate and standardize validators and constraints for hostname and IP address` -- {vytask}`T5225` `(bug): BGP allowas-in unusable` -- {vytask}`T5208` `(bug): Failed to start nvmf-autoconnect.service during the boot` - -## 2023-05-16 - -- {vytask}`T5194` `(default): Add reference tree to vyos1x-config` - -## 2023-05-15 - -- {vytask}`T3896` `(feature): Extend ocserv support to allow for per-group configs` - -## 2023-05-12 - -- {vytask}`T2778` `(feature): Migrate "system syslog" to get_config_dict() to support new features` -- {vytask}`T2769` `(feature): Add VRF support for syslog` - -## 2023-05-10 - -- {vytask}`T5209` `(bug): dhclient load-balancing exit hook 04-dhcp-wanlb returned non-zero exit status` -- {vytask}`T5065` `` (bug): Mixing `destination port xxx` and `destination group port-group yyy` in firewall rules doesn't work, but can be commited `` -- {vytask}`T5060` `(feature): add a VRRP 'maintenance mode'` - -## 2023-05-09 - -- {vytask}`T5202` `(bug): After removal load-balancing a pid remained which used in dhclient-exit-hooks` - -## 2023-05-06 - -- {vytask}`T5206` `(bug): ethtool.py:Ethtool.__init__ has always true conditional due to typo` - -## 2023-05-05 - -- {vytask}`T5082` `(feature): container: switch to netavark network stack` - -## 2023-05-04 - -- {vytask}`T5193` `(feature): Ability to specify NS records to specify NS servers for subdomains` -- {vytask}`T3891` `(bug): X550-T2/Possibly other X550/X540 cards no link on VyOS` -- {vytask}`T5010` `(bug): bgp: EVPN route-target not honored` -- {vytask}`T5196` `(feature): wwan: op-mode should inform user if there is no WWAN interface` - -## 2023-05-03 - -- {vytask}`T5163` `(feature): Policy route-map add match source-protocol` - -## 2023-05-02 - -- {vytask}`T5042` `(bug): Command 'show vpn ipsec remote-access' does not work` - -## 2023-04-27 - -- {vytask}`T5185` `(bug): Static IPv6 route with blackhole fails` -- {vytask}`T5175` `(bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0` -- {vytask}`T5183` `(bug): IPv6 route6 problem` -- {vytask}`T5181` `(bug): Wrong dependencies or priorities for zebra vni vrf interfaces and bgpd` -- {vytask}`T5128` `(feature): Policy route - Allow wildcard interfaces` -- {vytask}`T5055` `(feature): Firewall - Add packet type matcher (pkttype)` -- {vytask}`T5050` `(feature): Firewall - Add options for logging packets` -- {vytask}`T5037` `(feature): Firewall - Add queue action` -- {vytask}`T5176` `(bug): http-api: update vyos-http-api-tools for FastAPI security vulnerability` -- {vytask}`T5174` `(bug): vrf: ensure no duplicate VNIs can be created` -- {vytask}`T5123` `(default): Display route originator in show ospf table command` - -## 2023-04-25 - -- {vytask}`T5179` `(bug): multi nodes defined in XML are not properly represented as list in get_config_dict()` - -## 2023-04-17 - -- {vytask}`T5052` `(bug): Error displaying dhcpv6 prefix delegation leases` -- {vytask}`T5150` `(feature): Rework CLI definitions to apply route-maps between routing daemons and zebra/kernel` -- {vytask}`T3734` `(bug): Move EVPN VRF up in FRR config` - -## 2023-04-13 - -- {vytask}`T5152` `(bug): Telegraf agent hostname isn't qualified` -- {vytask}`T4727` `(feature): Add RADIUS rate limit support to PPTP server` -- {vytask}`T4939` `(bug): VRRP command no-preempt not work as expected` -- {vytask}`T4791` `(default): Consistent normalization of 'raw' output of op-mode scripts for CLI and API` -- {vytask}`T3608` `(default): Standardize warnings from configure scripts` - -## 2023-04-11 - -- {vytask}`T4924` `(bug): Systemctl strongswan.service for some reason is not disabled` -- {vytask}`T4197` `(bug): Vyos arm64-latest build issue with telegraf pkg` -- {vytask}`T4051` `(bug): Connected routes strange / not working` - -## 2023-04-10 - -- {vytask}`T5151` `(bug): EAP-TLS TLSv1.0/1.1 regression after T5003` -- {vytask}`T5148` `(bug): OpenVPN cannot start due to could not load plugin shared object /openvpn-otp.so` -- {vytask}`T5110` `(bug): Show frr op-mode vtysh_pam: Failed in account validation` -- {vytask}`T5078` `(feature): VyOS BGP does not support 'show bgp neighbors $NB filtered-routes'` -- {vytask}`T5070` `(feature): show bgp nexthop unavailable in VRF` -- {vytask}`T5061` `(bug): All containers restart on config change` - -## 2023-04-07 - -- {vytask}`T5149` `(bug): op-mode openvpn should not raise error in case interface is disabled` - -## 2023-04-06 - -- {vytask}`T5147` `(bug): Can't Commit with Container Network` -- {vytask}`T5142` `(feature): One of the requirements is to use a system auditing tool to monitor and log all security-relevant events.` -- {vytask}`T5125` `(feature): Add op-mode commands for hsflowd based sflow` - -## 2023-04-05 - -- {vytask}`T5145` `(feature): Add maxsyslogins maximum number of all logins on system` -- {vytask}`T5135` `(default): Rewrite opennhrp script using vyos.ipsec library` -- {vytask}`T4975` `(bug): CLI does not work after cutting off the power or reset` -- {vytask}`T5136` `(bug): Possible config corruption on upgrade` - -## 2023-04-04 - -- {vytask}`T5141` `(feature): Add numbers for dhclient-exit-hooks.d to enforce script order execution` -- {vytask}`T5093` `(bug): Command 'reset vpn ipsec-profile' doesn't work` -- {vytask}`T4362` `(bug): Wan Load Balancing - Can't create routing tables` - -## 2023-04-03 - -- {vytask}`T5139` `(feature): IKE life-time should start from 0 for disable rekey` -- {vytask}`T4173` `(bug): Wan Load Balancing - Error on firewall NAT rules` - -## 2023-04-02 - -- {vytask}`T5134` `(feature): Try if netavark networks can be moved to a VRF instance` - -## 2023-04-01 - -- {vytask}`T5047` `(bug): Recreate only a specific container` -- {vytask}`T5132` `(default): Operational command "show isis vrf XXX route | neighbord" aren't working` - -## 2023-03-31 - -- {vytask}`T5129` `(feature): Add AWS build flavour` -- {vytask}`T5126` `(feature): http-api: add 'allow-client' to restrict IP address of client connections` - -## 2023-03-30 - -- {vytask}`T5130` `(bug): op-mode: drop remaining reference to obsoleted 'show_interfaces.py'` -- {vytask}`T4866` `(feature): Rewrite show_interfaces to standardized form` -- {vytask}`T366` `(bug): SNMP Query for BGP Tunnels Returns IPv4 Tunnels Only` - -## 2023-03-29 - -- {vytask}`T5100` `(feature): Update FRR to 8.5` -- {vytask}`T5094` `(bug): FRR systemd logs unknow key LimitNOFILESoft` -- {vytask}`T5085` `(bug): ospfv3 route-map not applied in FRR configuration` -- {vytask}`T5056` `(bug): IPoE server vlan-mon is not working` -- {vytask}`T5033` `(bug): generate-public-key command fails for address with multiple public keys like GitHub` -- {vytask}`T4876` `(bug): mpls - LSP broken on FRR 8.4.1` -- {vytask}`T5097` `(bug): the operational command "show interfaces ethernet ethx" doesn't reflect a call to 'clear counters'` -- {vytask}`T5089` `(enhancment): Add unit test of config_diff` -- {vytask}`T5088` `(enhancment): Add lexicographical-numeric compare function for vytree/configtree` -- {vytask}`T5087` `(enhancment): Add support for lexical ordering of nodes in config_tree` -- {vytask}`T4885` `(feature): Rewrite 'clear interfaces counters' from Perl to Python` -- {vytask}`T4846` `(bug): L3VPN- network command doesn't install direct connected prefix` - -## 2023-03-28 - -- {vytask}`T5043` `(feature): Need to create reset command for IKEv2 remote-access vpn connections` - -## 2023-03-27 - -- {vytask}`T5099` `(feature): IPoE server add option 'next-pool' for named ip pools` -- {vytask}`T5106` `(feature): Extend generation of API client requests to configsession native functions and composite requests` -- {vytask}`T5104` `(bug): DHCP default route issues with static routes in VRFs` -- {vytask}`T5079` `(feature): xml: schema extension to support defaultValues on tagNodes` -- {vytask}`T5114` `(feature): bgp: implement new CLI commands introduced in FRR 8.5` - -## 2023-03-23 - -- {vytask}`T5108` `(feature): Get rate limit for L2TP/PPTP/SSTP/IPoE in raw format` -- {vytask}`T5086` `(feature): Integrate hsflowd for sflow accounting` -- {vytask}`T5107` `(bug): Raise error in op-mode dns.py instead of calling exit` - -## 2023-03-22 - -- {vytask}`T5068` `(feature): Generate op-mode API client requests along with schema generation` - -## 2023-03-21 - -- {vytask}`T5098` `(feature): PPPoE client holdoff configuration` -- {vytask}`T3694` `(bug): Static routes not installed into kernel nor frr` -- {vytask}`T5102` `(feature): ospf: "redistribute babel" is always set` - -## 2023-03-20 - -- {vytask}`T5057` `(bug): IPoE server incorrect interface regex` -- {vytask}`T5095` `(feature): Return list instead of dict for 'raw' output of op-mode openvpn` - -## 2023-03-19 - -- {vytask}`T4925` `(feature): Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2` - -## 2023-03-17 - -- {vytask}`T5092` `(bug): IPoE-server named pool must not rely on the authentication type` -- {vytask}`T5091` `(bug): IPoE server with RADIUS authentication does not verify radius configuration` - -## 2023-03-16 - -- {vytask}`T5073` `(bug): IPoE-server interface option failed to parse` -- {vytask}`T5063` `(bug): IPoE-server ethX vlan must not be used with client-subnet` -- {vytask}`T5058` `(feature): Extend template filter range_to_regex` -- {vytask}`T3083` `(feature): Add feature event-handler` -- {vytask}`T2516` `(bug): vyos-container: cannot configure ethernet interface` - -## 2023-03-13 - -- {vytask}`T5074` `(bug): Show IPSEC SA failed if remote access IKEv2 vpn is used.` -- {vytask}`T4973` `(bug): show dhcp server leases error for lease time 4294967295` - -## 2023-03-11 - -- {vytask}`T5076` `(feature): CI/CD: Docker container is bloated by legacy and conflicting dependencies` - -## 2023-03-09 - -- {vytask}`T5066` `(bug): Different GRE tunnel but same tunnel keys error` -- {vytask}`T4952` `(feature): Improve interface completion helper CLI experience` - -## 2023-03-08 - -- {vytask}`T4381` `(default): OpenVPN: Add "Tunnel IP" column in "show openvpn server" operational command` -- {vytask}`T4872` `(bug): Op-mode show openvpn misses a case when parsing for tunnel IP` - -## 2023-03-07 - -- {vytask}`T2838` `(bug): Ethernet device names changing, multiple hw-id being added` -- {vytask}`T5051` `(feature): Use Literal types to provide op-mode CLI choices and API enums` -- {vytask}`T4900` `(default): Cache intermediary results of get_config_diff in Config instance` - -## 2023-03-05 - -- {vytask}`T5040` `(default): Generate API GraphQL schema on installation, rather than dynamically` - -## 2023-03-03 - -- {vytask}`T4625` `(enhancment): Update ocserv to current revision (1.1.6)` - -## 2023-03-02 - -- {vytask}`T4967` `(feature): Ability to set hostname for the container` - -## 2023-03-01 - -- {vytask}`T5015` `(bug): Invalid format character error at hfsc class settings help text` - -## 2023-02-28 - -- {vytask}`T5029` `(feature): Nginx change default root directory and fix regex` -- {vytask}`T5025` `(bug): Time-zone validation failed` -- {vytask}`T4955` `(bug): Openconnect radiusclient.conf generating with extra authserver` -- {vytask}`T4843` `(feature): Command-line arguments in container config` -- {vytask}`T4219` `(feature): support incoming-interface (iif) in local PBR` -- {vytask}`T3903` `(bug): Containers: after command "reboot" the host system will reboot after 1.5 minutes` - -## 2023-02-27 - -- {vytask}`T5028` `(feature): Add package exfatprogs to VyOS` -- {vytask}`T4985` `(bug): reset vpn ipsec-peer command with peer name does not work` - -## 2023-02-26 - -- {vytask}`T4979` `(feature): Add API request 'show_user_info' for UI` - -## 2023-02-25 - -- {vytask}`T5008` `(bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine` -- {vytask}`T5007` `(bug): Interface multicast setting is invalid` -- {vytask}`T5027` `(bug): OpenVPN options and site-to-site cannot pass smoketest` -- {vytask}`T4978` `(bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.4-rolling-202302041536` -- {vytask}`T5034` `(bug): Migrate multicast CLI node to valueLess` -- {vytask}`T4948` `(feature): pppoe: add CLI option to allow definition of host-uniq flag` - -## 2023-02-24 - -- {vytask}`T5030` `(bug): HTTPS-API delete key without id error` - -## 2023-02-23 - -- {vytask}`T5013` `(feature): Extend accelppp.py op-mode to get subnet start stop info from config` -- {vytask}`T5002` `(feature): Add uk (United Kingdom) keymap` - -## 2023-02-22 - -- {vytask}`T5024` `(bug): check-qemu-install VM is not shutdown the first time` -- {vytask}`T5011` `(bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu check should be skipped` - -## 2023-02-21 - -- {vytask}`T5021` `(bug): IPsec SA is closed before negotiating a new one or it is negotiated on every second if big life-time is set in swanctl.conf` -- {vytask}`T5020` `(feature): Extend openvpn.py op-mode to get a list of configured clients` - -## 2023-02-20 - -- {vytask}`T5005` `(feature): Skip user authentication for PPPoE Server with noauth option` - -## 2023-02-16 - -- {vytask}`T4971` `(feature): Radius attribute "Framed-Pool" for PPPoE` - -## 2023-02-15 - -- {vytask}`T4991` `(bug): Restore path level information to compare output` - -## 2023-02-14 - -- {vytask}`T4968` `(bug): VPN IPsec check dpd and close action for empty values` -- {vytask}`T1993` `(feature): Extended pppoe rate-limiter` - -## 2023-02-13 - -- {vytask}`T4905` `(feature): Convert show nhrp tunnel to tabulate format` -- {vytask}`T4153` `(bug): Monitor bandwidth-test initiate not working` - -## 2023-02-12 - -- {vytask}`T4998` `(bug): pppoe username validation too restrictive (regression)` - -## 2023-02-11 - -- {vytask}`T2603` `(feature): pppoe-server: reduce min MTU` - -## 2023-02-10 - -- {vytask}`T4857` `(feature): SNMP - Implement FRR SNMP recommendations` -- {vytask}`T4995` `(feature): pppoe, wwan and sstp-client - rename user -> username on authentication` - -## 2023-02-07 - -- {vytask}`T4980` `(bug): chrony not listening as a server` -- {vytask}`T4868` `(bug): L2TP ppp-options ipv6 does not work without ipv6 pool but should` -- {vytask}`T4117` `(bug): Does not possible to configure PoD/CoA for L2TP vpn` - -## 2023-02-01 - -- {vytask}`T4970` `(default): pin OCaml pcre package to avoid JIT support` - -## 2023-01-31 - -- {vytask}`T4964` `(bug): FRR bgp address-family l2vpn-evpn route-target export/import not working` -- {vytask}`T4780` `(feature): Firewall - Add interface group` -- {vytask}`T4157` `(default): Add jinja2 to pip test requirements` - -## 2023-01-30 - -- {vytask}`T4958` `(feature): Add OpenConnect RADIUS Accounting support` -- {vytask}`T4954` `(bug): DNS cannot be configured via Network-Config v1 received from ConfigDrive / Cloud-Init` -- {vytask}`T4118` `(default): IPsec syntax overhaul` - -## 2023-01-29 - -- {vytask}`T4965` `(default): empty description in firewall group causes configuration error on migration` - -## 2023-01-28 - -- {vytask}`T4961` `(bug): Uncaught configtree error allows ntp migration 1-to-2 to fail silentlly on config.boot.default` - -## 2023-01-27 - -- {vytask}`T4960` `` (bug): Bugs in `cc_vyos.py` code (Cloud-Init) `` - -## 2023-01-26 - -- {vytask}`T4886` `(feature): Firewall and Policy - Add connection mark` -- {vytask}`T4957` `(bug): config-mgmt should not attempt to archive config at boot` -- {vytask}`T4962` `(bug): Fix typo in regex in vyos.config_mgmt compare function` -- {vytask}`T4912` `(default): Rewrite the IGMP op mode in the new style` - -## 2023-01-25 - -- {vytask}`T4941` `(bug): Accel-ppp IPoE incompatibility with kernel 6.1` - -## 2023-01-24 - -- {vytask}`T4947` `(feature): Support mounting container volumes as ro or rw` - -## 2023-01-23 - -- {vytask}`T4798` `(default): Migrate the file-exists validator away from Python` -- {vytask}`T4683` `(enhancment): Add kitty-terminfo package to build` -- {vytask}`T4953` `(bug): Remove convert_kwargs_to_snake_case decorator in dynamic generation of GraphQL resolvers` -- {vytask}`T4875` `(default): Replace Python validator 'interface-name' to avoid Python startup cost` -- {vytask}`T4664` `(bug): Add validation to reject whitespace in tag node value names` - -## 2023-01-22 - -- {vytask}`T4906` `(bug): ipsec connections shows only one connection as up` - -## 2023-01-21 - -- {vytask}`T4799` `(bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd` -- {vytask}`T4878` `(bug): Any interface bonding changes cause interface flapping` -- {vytask}`T4387` `(default): Create additional smoketests for multiwan PBR & load-balanced configurations` - -## 2023-01-20 - -- {vytask}`T4551` `(bug): IPsec rekeying collisions bug` -- {vytask}`T4942` `(feature): Rewrite vyatta-config-mgmt to Python/XML` - -## 2023-01-17 - -- {vytask}`T4938` `(bug): Interface input ifb does not work` -- {vytask}`T4902` `(bug): snmpd: exclude container storage from monitoring` -- {vytask}`T4140` `(bug): Lack of SNMP IANA mibs` - -## 2023-01-15 - -- {vytask}`T4832` `(feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)` -- {vytask}`T4937` `(feature): ocserv: upgrade package to version 1.1.6` -- {vytask}`T4918` `(bug): Odd show interface behavior` -- {vytask}`T3008` `(feature): Migrate from ntpd to chronyd` - -## 2023-01-13 - -- {vytask}`T4911` `(default): Rewrite the LLDP op mode in the new format` -- {vytask}`T4928` `(feature): Upgrade Linux Kernel to 6.1.y (2022 LTS edition)` - -## 2023-01-12 - -- {vytask}`T4934` `(bug): ospf: Fix inter-area route summarization` -- {vytask}`T4929` `(feature): Update Intel QAT drivers to 4.20.0-00001` - -## 2023-01-10 - -- {vytask}`T4880` `(feature): Expose 'add/delete container image' in HTTP-API` - -## 2023-01-09 - -- {vytask}`T4922` `(feature): Add ssh-client source-interface CLI option` -- {vytask}`T4524` `(bug): Squid webproxy not working properly` - -## 2023-01-08 - -- {vytask}`T4920` `` (bug): ospf: Fix `passive-interface default` option `` - -## 2023-01-07 - -- {vytask}`T4884` `(bug): Missing a community6 in snmpd config` - -## 2023-01-05 - -- {vytask}`T4904` `(feature): Allow multiple ports for high-availability virtual-server` -- {vytask}`T4789` `(feature): Ability to get L2TP/PPTP/SSTP sessions info in a machine readable format` -- {vytask}`T3937` `(default): Rewrite "show system memory" in Python to make it usable as a library function` - -## 2023-01-04 - -- {vytask}`T4848` `(bug): Minor bug in OpenConnect server with default route` -- {vytask}`T4656` `(feature): Support the listen-host config field of openconnect server` - -## 2023-01-03 - -- {vytask}`T4907` `(bug): nat source translations couldn't show metrics` - -## 2023-01-02 - -- {vytask}`T4893` `(feature): l2tp add ppp-options IPv6 interface identifier` -- {vytask}`T4717` `(feature): Connect to console server by name` -- {vytask}`T725` `(feature): Cake and FQ-PIE` - -## 2022-12-31 - -- {vytask}`T4898` `(feature): Add mtu config option for dummy interfaces` - -## 2022-12-30 - -- {vytask}`T4834` `(bug): Limit container network name to 15 characters` -- {vytask}`T4901` `(bug): Update Podman to v4.3.1` -- {vytask}`T4899` `(bug): Podman systemd services not being installed correctly` - -## 2022-12-28 - -- {vytask}`T4593` `(feature): Upgrade strongswan to 5.9.8` - -## 2022-12-26 - -- {vytask}`T4511` `(bug): IPv6 DNS lookup` -- {vytask}`T4809` `(feature): radvd: Allow use of AdvRASrcAddress` - -## 2022-12-25 - -- {vytask}`T3579` `(feature): Rewrite vyatta-conntrack in new XML and Python flavour` - -## 2022-12-24 - -- {vytask}`T4890` `(bug): show conntrack table ipv4 fail` -- {vytask}`T4879` `(bug): IPSec migration failed with missing remote-id` -- {vytask}`T4870` `(feature): Containers switch to using overlay driver for podman storage` - -## 2022-12-23 - -- {vytask}`T4792` `(feature): Add SSTP VPN client` - -## 2022-12-21 - -- {vytask}`T4887` `(bug): Schema generation from op-mode functions should set default 'false' on boolean arguments` - -## 2022-12-18 - -- {vytask}`T4882` `(bug): Missing ICMPv6 type names in firewall configuration` - -## 2022-12-15 - -- {vytask}`T4671` `(bug): linux-firmware package is missing symlinks defined in WHENCE file` - -## 2022-12-14 - -- {vytask}`T4881` `(bug): Return opmode.Error on openconnect.py show_sessions` - -## 2022-12-12 - -- {vytask}`T4861` `(feature): Openconnect restart on adding users - Aborts all active connections` - -## 2022-12-09 - -- {vytask}`T4865` `(bug): container impossible to generate local image from a file if it requires install some pkgs` - -## 2022-12-05 - -- {vytask}`T4860` `(bug): Openconnect server incorrect unconfigured check` -- {vytask}`T4804` `(bug): PPPoE server incorrect unconfigured check` -- {vytask}`T4854` `(feature): BGP-route reflector allows to apply route-maps` - -## 2022-12-04 - -- {vytask}`T4825` `(feature): interfaces veth/veth-pairs -standalone used` -- {vytask}`T4805` `(bug): PPPoE server does not restart service if pool was changed` - -## 2022-12-02 - -- {vytask}`T4830` `(bug): nat66 - Error in port translation rules` -- {vytask}`T4859` `(bug): Correct calling of config mode script dependencies from http-api.py` -- {vytask}`T4820` `(enhancment): Support for inter-config-mode script dependencies` -- {vytask}`T4858` `(bug): L3VPN- Route Distinguisher notations` -- {vytask}`T1024` `(feature): Policy Based Routing by DSCP` - -## 2022-12-01 - -- {vytask}`T4841` `(feature): add fan control` -- {vytask}`T4847` `(bug): Correct calling of config mode script dependencies from pki.py` - -## 2022-11-29 - -- {vytask}`T4842` `(bug): Routing config broken if mpls config exists` -- {vytask}`T4845` `(default): Add smoketest to detect cycles in config-mode script dependency calls` - -## 2022-11-27 - -- {vytask}`T4739` `(feature): ISIS and OSPF segment routing being refactored` - -## 2022-11-24 - -- {vytask}`T4794` `(bug): show firewall name - Can't use .items() on a list` -- {vytask}`T4714` `(feature): Delete unused ipset from the filecaps` -- {vytask}`T3541` `(bug): Route Map large community set additive is missing` - -## 2022-11-23 - -- {vytask}`T4836` `(feature): Kernel: enable new features like switchdev, ESP in TCP and HSR` -- {vytask}`T4835` `(bug): SNMPD configuration incorrect for IPv6` -- {vytask}`T4819` `(feature): Allow printing Warning messages in multiple lines with \n` -- {vytask}`T4807` `(feature): Need to fix traceroute help completion` -- {vytask}`T4660` `(feature): Reorganize route map set community CLI` -- {vytask}`T4526` `(bug): keepalived-fifo.py unable to load config` -- {vytask}`T4793` `(feature): Create warning message about disable-route-autoinstall when ipsec vti is used` -- {vytask}`T4492` `(bug): Incorrect list of neighbors in help for "show bgp vrf VRF neighbors"` -- {vytask}`T4496` `(feature): ping vrf help does not list VRFs` - -## 2022-11-22 - -- {vytask}`T4823` `(bug): swanctl.conf is broken when ipsec site-to-site peer set.` -- {vytask}`T4706` `(bug): NAT and NAT66 issues` -- {vytask}`T4670` `(feature): policy route - Update matching criteria` - -## 2022-11-21 - -- {vytask}`T4812` `(feature): IPsec ability to show all configured connections` -- {vytask}`T4829` `(default): Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional` - -## 2022-11-20 - -- {vytask}`T4827` `(bug): route-map issues , not load configuration FRR` - -## 2022-11-19 - -- {vytask}`T4826` `(bug): Wrong key type is used for SSH SK public keys` -- {vytask}`T4720` `(feature): Ability to configure SSH HostKeyAlgorithms` -- {vytask}`T4828` `(default): Raise appropriate op-mode errors in ipsec.py 'reset_peer'` - -## 2022-11-18 - -- {vytask}`T4821` `(bug): Correct calling of config mode script dependencies from firewall.py` - -## 2022-11-17 - -- {vytask}`T4750` `(feature): Support of higher level SSH keys (sk-ssh-ed25519)` - -## 2022-11-15 - -- {vytask}`T4808` `(feature): Add details of configtree operations to migration log` - -## 2022-11-12 - -- {vytask}`T4814` `(bug): Regression in bundled powerdns version` - -## 2022-11-09 - -- {vytask}`T4800` `(bug): undefined var includes_chroot_dir in build-vyos-image` - -## 2022-11-08 - -- {vytask}`T4771` `(feature): Rewrite protocol BGP op-mode to vyos.opmode format` -- {vytask}`T4806` `(default): Update FRR to 8.4 in 1.4 version` - -## 2022-11-06 - -- {vytask}`T4803` `(bug): The header 'Authorization' needs to be explictly allowed in http-api CORS middleware` - -## 2022-11-05 - -- {vytask}`T4802` `(feature): Ability to define per container shared-memory size` - -## 2022-11-01 - -- {vytask}`T4764` `(bug): NAT tables vyos_nat and vyos_static_nat not deleting after deleting nat` -- {vytask}`T4177` `(bug): Strip-private doesn't work for service monitoring` - -## 2022-10-31 - -- {vytask}`T4786` `(feature): Add package python3-pyhumps` -- {vytask}`T1875` `(feature): Add the ability to use network address as BGP neighbor (bgp listen range)` -- {vytask}`T4785` `(feature): snmp: Allow !, @, * and # in community name` -- {vytask}`T4787` `(feature): ipsec: add support for road-warrior/remote-access RADIUS timeout` - -## 2022-10-29 - -- {vytask}`T4783` `(default): Add support for stunnel` -- {vytask}`T4784` `(feature): Add description node for static route/route6 tagNodes` - -## 2022-10-28 - -- {vytask}`T4291` `(default): Consolidate component version read/write functions` - -## 2022-10-27 - -- {vytask}`T4763` `(feature): Change XML for Show nat destination statistics` -- {vytask}`T4762` `(bug): Show nat rules with empty rules incorrect error` -- {vytask}`T4778` `(bug): Raise error UnconfiguredSubsystem if op-mode ipsec.py fails initialization` - -## 2022-10-26 - -- {vytask}`T4773` `(default): Add camel_case to snake_case conversion utility` - -## 2022-10-25 - -- {vytask}`T4574` `(default): Add token based authentication to GraphQL API` - -## 2022-10-24 - -- {vytask}`T4772` `(default): Return list of dicts in 'raw' output of route.py instead of dict with redundant information` - -## 2022-10-23 - -- {vytask}`T3723` `(bug): op-mode IPSec show vpn ipsec sa output with underscores` - -## 2022-10-21 - -- {vytask}`T4768` `(default): Change name of api child node from 'gql' to 'graphql'` - -## 2022-10-18 - -- {vytask}`T4684` `(feature): Rewrite show ip route by protocol to vyos.opmode format` -- {vytask}`T4533` `(bug): Radius clients don’t have simple permissions` -- {vytask}`T4753` `(enhancment): Extend automatic generation of schema to query SystemStatus` - -## 2022-10-17 - -- {vytask}`T4725` `(bug): Unable to reset vpn IPsec peer` - -## 2022-10-14 - -- {vytask}`T4672` `(bug): RADIUS server disable does not work` -- {vytask}`T4749` `(enhancment): Use config_dict for conf_mode http-api.py` - -## 2022-10-13 - -- {vytask}`T4746` `(bug): Monitoring nft. table vyos_filter by default does not exist but telegraf checks this table` -- {vytask}`T4744` `(bug): BGP directly connected neighbors don't compatible with ebgp-multihop` -- {vytask}`T4716` `(feature): SSH ability to configure RekeyLimit` -- {vytask}`T4343` `(default): Expose powerdns network-timeout for service dns forwarding` -- {vytask}`T4312` `(bug): Telegraf configuration doesn't accept IPs for URL` -- {vytask}`T4274` `(default): Extend OpenConnect RADIUS Timeout to Permit 2FA Entry` - -## 2022-10-12 - -- {vytask}`T4747` `(bug): Monitoring influxdb template input exec plugin does not work` -- {vytask}`T4740` `(bug): Show conntrack table ipv6 fail` -- {vytask}`T4730` `(bug): Conntrack-sync error - listen-address is not the correct type in config as it should be` - -## 2022-10-11 - -- {vytask}`T4742` `(bug): Autocomplete in policy route rule x set table / does not show the tables created in the static protocols` -- {vytask}`T4741` `(bug): set firewall zone Local local-zone failed` -- {vytask}`T4680` `(bug): Telegraf prometheus-client listen-address invalid format` - -## 2022-10-10 - -- {vytask}`T538` `(feature): Support for network mapping in NAT` - -## 2022-10-09 - -- {vytask}`T4738` `(enhancment): Extend automatic generation of schema definition files to native configsession functions; use single resolver/directive` - -## 2022-10-08 - -- {vytask}`T4707` `(feature): Enable OSPF segment routing` - -## 2022-10-07 - -- {vytask}`T4736` `(bug): Error on JSON output of API query ShowConfig` - -## 2022-10-04 - -- {vytask}`T4708` `(bug): 'show nat destination rules' throwing an error` -- {vytask}`T4700` `(feature): Firewall - Add interface match criteria` -- {vytask}`T4699` `(feature): Firewall - Add jump action - Add return action` -- {vytask}`T4651` `(feature): Firewall - Add options to match packet size` -- {vytask}`T4702` `(bug): Wireguard peers configuration is not synchronized with CLI` -- {vytask}`T4685` `(bug): Interface does not exist on boot when used as inbound-interface for local policy route` -- {vytask}`T4652` `(feature): Upgrade PowerDNS recursor to 4.7 series` -- {vytask}`T4582` `(default): Router-advert: Preferred lifetime cannot equal valid lifetime in PIOs` - -## 2022-09-29 - -- {vytask}`T4715` `(feature): Auto logout user after a period of inactivity` -- {vytask}`T4697` `(bug): policy route: Generating ConfigError failes when tcp flag is missing on set tcp-mss rule commit` - -## 2022-09-27 - -- {vytask}`T4711` `(feature): Ability to terminate user TTY and PTS sessions` -- {vytask}`T4557` `(feature): fastnetmon: allow configure limits per protocol (tcp, udp, icmp)` - -## 2022-09-21 - -- {vytask}`T4678` `(feature): Rewrite service ipoe-server to get_config_dict` -- {vytask}`T4703` `(feature): accel-ppp: combine vlan-id and vlan-range into single CLI node` - -## 2022-09-20 - -- {vytask}`T4693` `(bug): ISIS segment routing was broken...` - -## 2022-09-17 - -- {vytask}`T4666` `(bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584` -- {vytask}`T4665` `(bug): Keepalived cannot use same VRID for VRRPv2 and VRRPv3` - -## 2022-09-16 - -- {vytask}`T4698` `(enhancment): Drop validator name="range" and replace it with numeric` -- {vytask}`T4695` `(feature): Add 'es' and 'jp106' keymap option keyboard-layout` -- {vytask}`T4669` `(enhancment): Extend numeric.ml for inversion of values and range values` - -## 2022-09-15 - -- {vytask}`T4679` `(bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address` -- {vytask}`T4691` `(feature): Upgrade Linux Kernel to latest 5.15.y train` -- {vytask}`T4630` `(bug): Prevent attempts to use the same interface as a source interface for pseudo-ethernet and MACsec at the same time` -- {vytask}`T4696` `(default): Extend bgp parameters for bgp bestpath peer-type multipath-relax` - -## 2022-09-12 - -- {vytask}`T4617` `(feature): VRF specification is needed for telegraf prometheus-client listen-address
` -- {vytask}`T4690` `(bug): Update GraphQL resolver for 'SystemStatus' following changes to 'show_uptime' op-mode script` -- {vytask}`T4647` `(feature): Add Google Virtual NIC (gVNIC) support` -- {vytask}`T4170` `(feature): Rename "policy ipv6-route" -> "policy route6"` - -## 2022-09-09 - -- {vytask}`T4682` `(feature): Rewrite 'show system storage' in standardized format` -- {vytask}`T4681` `(feature): Complete standardization of show_uptime.py` - -## 2022-09-06 - -- {vytask}`T4640` `(enhancment): Integrate op-mode exception hierarchy into API` -- {vytask}`T4597` `(bug): Check bind port before assign service HTTPS API and openconnect` -- {vytask}`T4674` `(bug): API should show op-mode error message, if present` -- {vytask}`T4673` `(bug): op-mode bridge.py should raise error on show_fdb for nonexistent bridge interface` - -## 2022-09-05 - -- {vytask}`T4668` `(bug): Adding/removing members from bond doesn't work/results in incorrect interface state` -- {vytask}`T4663` `(bug): Interface pseudo-ethernet does not change mode` -- {vytask}`T4655` `(bug): Firewall in 1.4 sets the default action 'accept' instead of 'drop'` -- {vytask}`T4628` `(bug): ConfigTree() throws ValueError() if tagNode contains whitespaces` - -## 2022-09-01 - -- {vytask}`T4606` `(bug): monitor nat destination translation shows missing script` -- {vytask}`T4435` `(bug): Policy route and firewall - error when using undefined group` -- {vytask}`T4147` `(bug): New Firewall Implementation - proposed changes on group implementation` - -## 2022-08-31 - -- {vytask}`T4650` `(feature): Rewire show nat translation to vyos.opmode format` -- {vytask}`T4644` `(bug): Check bind port before assign vpn sstp` -- {vytask}`T4643` `(bug): Smoketest exclude either sstp or openconnect from pki-misc default listen port` -- {vytask}`T4569` `(feature): Rewrite show bridge to new format` -- {vytask}`T4547` `(bug): Show vpn ipsec sa show unexpected prefix 'B' in packets` -- {vytask}`T4367` `(bug): NAT - Config tmp file not available` - -## 2022-08-29 - -- {vytask}`T4645` `(bug): show nat source statistics lack argument --family` -- {vytask}`T4634` `(bug): Bgp neighbor disable-connected-check does not work` -- {vytask}`T4631` `(feature): Add port and protocol to nat66` -- {vytask}`T4623` `(feature): Add show conntrack statistics` -- {vytask}`T4595` `(bug): DPD interval and timeout do not work in DMVPN` -- {vytask}`T4594` `(feature): Rewrite op-mode IPsec to vyos.opmode format` -- {vytask}`T4508` `(bug): Problem with values of the same environment in different event handlers` -- {vytask}`T4653` `(bug): Interface offload options are not applied correctly` -- {vytask}`T4546` `(bug): Does not connect Cisco spoke to VyOS hub.` -- {vytask}`T4061` `(default): Add util function to check for completion of boot config` -- {vytask}`T4654` `(bug): RPKI cache incorrect description` -- {vytask}`T4572` `(bug): Add an option to force interface MTU to the value received from DHCP` - -## 2022-08-26 - -- {vytask}`T4642` `(bug): proxy: hyphen not allowed in proxy URL` - -## 2022-08-25 - -- {vytask}`T4626` `(bug): Error showing nat66 source and destination` -- {vytask}`T4622` `(feature): Firewall allow drop packets by TCP MSS size` - -## 2022-08-24 - -- {vytask}`T4641` `(bug): prefix-list allows ipv6 prefix as input` -- {vytask}`T4633` `(feature): Change keepalived to v2.2.7` - -## 2022-08-23 - -- {vytask}`T4618` `(bug): Traffic policy not set on virtual interfaces` -- {vytask}`T4538` `(bug): Macsec does not work correctly when the interface status changes.` - -## 2022-08-22 - -- {vytask}`T4089` `(bug): Show nat destination rules shows ip address instead of interface 'any'` -- {vytask}`T4632` `(bug): VLAN-aware bridge not working` -- {vytask}`T4637` `(feature): Upgrade to podman 4.2.0` - -## 2022-08-20 - -- {vytask}`T4596` `(bug): "show openconnect-server sessions" command does not work in the openconnect module` - -## 2022-08-19 - -- {vytask}`T4620` `(bug): UPnP does not work due to incorrect template` -- {vytask}`T4619` `(bug): Static arp is not set if another entry is present` -- {vytask}`T4611` `(bug): UPnP rule IP should be a prefix instead of an address` -- {vytask}`T4614` `(feature): OpenConnect split-dns directive` - -## 2022-08-18 - -- {vytask}`T4613` `(bug): UPnP configuration without listen option fail` -- {vytask}`T4570` `(bug): Exception when trying to set up VXLAN over Wireguard` - -## 2022-08-17 - -- {vytask}`T4598` `(feature): nat66 - Add exclude options` -- {vytask}`T4480` `(default): add an ability to configure squid acl safe ports and acl ssl safe ports` - -## 2022-08-16 - -- {vytask}`T4592` `(bug): macsec: can not create two interfaces using the same source-interface` -- {vytask}`T4584` `(bug): hostap: create custom package build` -- {vytask}`T4413` `(default): Add an API endpoint with basic system stats` -- {vytask}`T4537` `(bug): MACsec not working with cipher gcm-aes-256` - -## 2022-08-15 - -- {vytask}`T4609` `(bug): Unable to Restart Container VyOS 1.4` -- {vytask}`T4565` `(bug): vlan aware bridge not working with - Kernel: T3318: update Linux Kernel to v5.4.205 #249` -- {vytask}`T3988` `(default): Feature Request: IPsec Multiple local/remote prefix for the tunnel` -- {vytask}`T2763` `(feature): New SNMP resource request - SNMP over TCP` - -## 2022-08-14 - -- {vytask}`T4579` `(bug): bridge: can not delete member interface CLI option when VLAN is enabled` -- {vytask}`T4421` `(default): Add support for floating point numbers in the numeric validator` -- {vytask}`T3507` `(bug): Bond with mode LACP show u/u in show interfaces even if peer is not configured` - -## 2022-08-12 - -- {vytask}`T4603` `(feature): Need a config option to specify NAS-IP-Address for vpn l2tp` - -## 2022-08-10 - -- {vytask}`T4408` `(feature): Add sshguard to protect against brut-forces` - -## 2022-08-08 - -- {vytask}`T4586` `(feature): Add to NAT66: SNAT destination address and DNAT source address.` - -## 2022-08-04 - -- {vytask}`T4257` `(feature): Discussion on changing BGP autonomous system number syntax` - -## 2022-08-02 - -- {vytask}`T4585` `(feature): Rewrite op-mode containers to vyos.opmode` -- {vytask}`T4515` `(default): Reduce telegraf binary size` - -## 2022-08-01 - -- {vytask}`T4581` `(bug): 'show system cpu' not working` -- {vytask}`T4578` `(feature): Rewrite show dns forwarding statistics to new format` - -## 2022-07-31 - -- {vytask}`T4580` `(bug): Handle the case of op-mode file names with hyphens in GraphQL schema/resolver generation` - -## 2022-07-30 - -- {vytask}`T4575` `(feature): vyos.utill add new wrapper "rc_cmd" to get the return code and output` -- {vytask}`T4562` `(feature): Rewrite show vrf to new format` -- {vytask}`T4545` `(feature): Rewrite show nat source rules` -- {vytask}`T4543` `(bug): Show source nat statistics shows incorrect interface` -- {vytask}`T4503` `(default): Prevent op mode scripts from restarting services if there's a commit in progress` -- {vytask}`T4411` `(feature): Add migration for service monitoring telegraf influxdb` - -## 2022-07-29 - -- {vytask}`T4554` `(enhancment): Implement GraphQL resolvers for standardized op-mode scripts` -- {vytask}`T4518` `(feature): Add XML for CLI conf mode load-balancing wan` -- {vytask}`T4544` `(enhancment): Generate schema definitions from standardized op-mode scripts` - -## 2022-07-28 - -- {vytask}`T4531` `(bug): NAT op-mode errors with exclude rules` -- {vytask}`T3435` `(bug): NAT rules show corruption` - -## 2022-07-27 - -- {vytask}`T4571` `(bug): Sflow with vrf configured does not use vrf to validate agent-address IP from vrf-configured interfaces` -- {vytask}`T4552` `(bug): Unable to reset IPsec IPv6 peer` - -## 2022-07-26 - -- {vytask}`T4568` `(bug): show vpn debug peer doesn't work` -- {vytask}`T4556` `(feature): fastnetmon: Allow configure white_list_path and populate with hosts/networks that should be ignored.` -- {vytask}`T4495` `(feature): Combine BGP reset op commands` - -## 2022-07-25 - -- {vytask}`T4567` `(default): Merge experimental branch of GraphQL development` -- {vytask}`T4560` `(bug): VRF and BGP neighbor local-as error` -- {vytask}`T4493` `(bug): Incorrect help for "show bgp neighbors"` -- {vytask}`T1233` `(bug): ipsec vpn sa showing down` - -## 2022-07-22 - -- {vytask}`T4145` `(bug): Conntrack table not showing after firewall rewriting` - -## 2022-07-21 - -- {vytask}`T4555` `(feature): fastnetmon: add IPv6 support` -- {vytask}`T4553` `(default): Allow to set ban time on ddos-protection configuration` - -## 2022-07-20 - -- {vytask}`T4056` `(bug): Traffic policy not set in live configuration` - -## 2022-07-18 - -- {vytask}`T4523` `(feature): OP-mode Extend conntrack output to get marks, zones and directions` -- {vytask}`T4228` `(bug): bond: OS error thrown when two bonds use the same member` -- {vytask}`T4539` `(feature): qat: update Intel QuickAssist release version 1.7.L.4.16.0-00017` -- {vytask}`T4534` `(bug): bond: bridge: error out if member interface is assigned to a VRF instance` -- {vytask}`T4525` `(bug): Delete interface from VRF and add it to bonding error` -- {vytask}`T4522` `(feature): bond: add ability to specify mii monitor interval via CLI` -- {vytask}`T4535` `(feature): FRR: upgrade to stable/8.3 version` -- {vytask}`T4521` `(bug): bond: ARP monitor interval is not configured despite set via CLI` -- {vytask}`T4540` `(feature): firmware: update to Linux release 20220708` - -## 2022-07-17 - -- {vytask}`T4028` `(bug): FRR 8.1 routes not being applied to routing table after reboot if an interface has 2 ip addresses` - -## 2022-07-15 - -- {vytask}`T4494` `(bug): Cannot reset BGP peer within VRF` -- {vytask}`T4536` `(feature): FRR: move to systemd for daemon control` - -## 2022-07-14 - -- {vytask}`T4491` `(bug): Use empty string for internal name of root node of config_tree` - -## 2022-07-13 - -- {vytask}`T1375` `(feature): Add clear dhcp server lease function` - -## 2022-07-12 - -- {vytask}`T4527` `(bug): Prevent to create VRF name default` -- {vytask}`T4084` `(default): Dehardcode the default login banner` -- {vytask}`T3948` `(feature): IPSec VPN: Add a new option "none" for the connection-type` -- {vytask}`T235` `(feature): Ability to configure manual IP Rules` - -## 2022-07-10 - -- {vytask}`T3836` `(bug): Setting a default IPv6 route while getting IPv4 gateway via DHCP removes the IPv4 gateway` - -## 2022-07-09 - -- {vytask}`T4507` `(feature): IPoE-server add multiplier option for shaper` -- {vytask}`T4499` `(bug): NAT source translation not showing a single output` -- {vytask}`T4468` `(bug): web-proxy source group cannot start with a number bug` -- {vytask}`T4373` `(feature): PPPoE-server add multiplier option for shaper` -- {vytask}`T3353` `(bug): PPPoE server wrong vlan-range generating config` -- {vytask}`T3648` `(bug): op-mode: nat rules broken` -- {vytask}`T4517` `(feature): ip: Add options to enable directed broadcast forwarding` - -## 2022-07-07 - -- {vytask}`T4456` `(bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many messages` -- {vytask}`T4509` `(feature): Feature Request: DNS64` - -## 2022-07-06 - -- {vytask}`T4513` `(bug): Webproxy monitor commands do not work` -- {vytask}`T4299` `(feature): Firewall - GeoIP filtering` - -## 2022-07-05 - -- {vytask}`T4378` `(bug): Unable to submit wildcard ("*.example.com") A or AAAA records in dns forwarder` -- {vytask}`T2683` `(default): no dual stack in system static-host-mapping host-name` -- {vytask}`T478` `(feature): Firewall address group (multi and nesting)` - -## 2022-07-04 - -- {vytask}`T4501` `(bug): Syslog-identifier does not work in event handler` -- {vytask}`T3600` `(bug): DHCP Interface static route breaks PBR` -- {vytask}`T4498` `(feature): bridge: Add option to enable/disable IGMP/MLD snooping` - -## 2022-07-01 - -- {vytask}`T2455` `(bug): No support for the IPv6 VTI` -- {vytask}`T4490` `(feature): BGP- warning message that AFI/SAFI is needed to establish the neighborship` -- {vytask}`T4489` `(bug): MPLS sysctl not persistent for tunnel interfaces` - -## 2022-06-29 - -- {vytask}`T4477` `(feature): router-advert: support RDNSS lifetime option` - -## 2022-06-28 - -- {vytask}`T4486` `(bug): Container can't be deleted` -- {vytask}`T4473` `(bug): Use container network without network declaration error` -- {vytask}`T4458` `(feature): Firewall - add support for matching ip ttl in firewall rules` -- {vytask}`T3907` `(feature): Firewall - Set log levels` - -## 2022-06-27 - -- {vytask}`T4484` `(default): Firewall op-mode summary doesn't correctly handle address group containing ranges` - -## 2022-06-25 - -- {vytask}`T4482` `(bug): dhcp: toggle of "dhcp-options no-default-route" has no effect` -- {vytask}`T4483` `(feature): Upgrade fastnetmon to v1.2.2 community edition` - -## 2022-06-22 - -- {vytask}`T1748` `(feature): vbash: beautify tab completion output/line breaks` - -## 2022-06-20 - -- {vytask}`T1856` `(feature): Support configuring IPSec SA bytes` - -## 2022-06-18 - -- {vytask}`T4467` `(bug): Validator Does Not Accept Signed Numbers` - -## 2022-06-17 - -- {vytask}`T4209` `(bug): Firewall incorrect handler for recent count and time` - -## 2022-06-16 - -- {vytask}`T4352` `(bug): wan-load balance - priority traffic rule doesn't work` - -## 2022-06-15 - -- {vytask}`T4450` `(feature): Route-map - Extend options for ip|ipv6 address match` -- {vytask}`T4449` `(feature): Route-map - Extend options for ip next-hop match` -- {vytask}`T990` `(feature): Make DNAT/SNAT a valid state in firewall rules.` - -## 2022-06-12 - -- {vytask}`T4420` `(feature): Feature Request: ocserv: show configured 2FA OTP key` -- {vytask}`T4380` `(default): Feature Request: ocserv: 2FA OTP key generator in VyOS CLI` - -## 2022-06-10 - -- {vytask}`T4365` `(bug): NAT - Error on setting up tables` -- {vytask}`T4465` `(feature): node.def generation misses whitespace on multiple use of ` - -## 2022-06-09 - -- {vytask}`T4444` `(default): sstp: Feature request. Port number changing support` -- {vytask}`T2580` `(feature): Support for ip pools for ippoe` - -## 2022-06-08 - -- {vytask}`T4447` `` (bug): DHCPv6 prefix delegation `sla-id` limited to 128 `` - -## 2022-05-31 - -- {vytask}`T4212` `(default): PermissionError when generating/installing server Certificate (generate pki certificate sign ...)` -- {vytask}`T4199` `(bug): Commit failed when setting icmpv6 type any` -- {vytask}`T4148` `(bug): Firewall - Error messages not that clear as it were in old firewall` -- {vytask}`T3659` `(bug): Configuration won't accept IPv6 addresses for site-to-site VPN tunnel prefixes/traffic selectors` - -## 2022-05-30 - -- {vytask}`T4315` `(feature): Telegraf - Output to prometheus` - -## 2022-05-29 - -- {vytask}`T2473` `(feature): Xml for EIGRP [conf_mode]` - -## 2022-05-28 - -- {vytask}`T4448` `(feature): rip: add support for explicit version selection` - -## 2022-05-26 - -- {vytask}`T4442` `(feature): HTTP API add action "reset"` - -## 2022-05-25 - -- {vytask}`T4410` `(feature): Telegraf - Output to Splunk` -- {vytask}`T4382` `(bug): Replacing legacy loadFile exposes missing steps in migration scripts and other errors` - -## 2022-05-21 - -- {vytask}`T4437` `(bug): flow-accounting: support IPv6 flow collectors` - -## 2022-05-20 - -- {vytask}`T4418` `(feature): Telegraf - output Plugin azure-data-explorer` - -## 2022-05-19 - -- {vytask}`T4434` `(bug): DMVPN: cisco-authentication password length is 8 characters` -- {vytask}`T3938` `(default): Rewrite the uptime script in Python to allow using it as a library` -- {vytask}`T4334` `(default): Make the config lexer reentrant` - -## 2022-05-17 - -- {vytask}`T4424` `(bug): policy local-route6 shows ipv4 format` - -## 2022-05-16 - -- {vytask}`T4377` `(default): generate tech-support archive includes previous archives` - -## 2022-05-12 - -- {vytask}`T4417` `(bug): VRRP doesn't start with conntrack-sync` -- {vytask}`T4100` `(feature): Firewall increase maximum number of rules` - -## 2022-05-11 - -- {vytask}`T4405` `` (bug): DHCP client sometimes ignores `no-default-route` option of an interface `` - -## 2022-05-10 - -- {vytask}`T4156` `(default): Adding DHCP Option 13 (bootfile-size)` -- {vytask}`T1972` `(feature): Allow setting interface name for virtual_ipaddress in VRRP VRID` - -## 2022-05-07 - -- {vytask}`T4361` `` (bug): `vyos.config.exists()` does not work for nodes with multiple values `` -- {vytask}`T4354` `(bug): Slave interfaces fall out from bonding during configuration change` -- {vytask}`T4419` `(feature): vrf: support to disable IP forwarding within a given VRF` - -## 2022-05-06 - -- {vytask}`T4385` `(bug): bgp: peer-group member cannot override remote-as of peer-group` - -## 2022-05-05 - -- {vytask}`T4414` `(feature): Add route-map "as-path prepend last-as x" option` - -## 2022-05-03 - -- {vytask}`T4395` `(feature): Extend show vpn debug` - -## 2022-05-01 - -- {vytask}`T4369` `(bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node` -- {vytask}`T4363` `(bug): salt-minion: default mine_interval option is not set` -- {vytask}`T4353` `(feature): Add Jinja2 linter to vyos-1x build process` - -## 2022-04-29 - -- {vytask}`T4388` `(bug): dhcp-server: missing constraint on tftp-server-name option` -- {vytask}`T4366` `(bug): geneve: interface is removed on changes to e.g. description` - -## 2022-04-28 - -- {vytask}`T4400` `(bug): Container OP mode has delete where show and update should be` - -## 2022-04-27 - -- {vytask}`T4398` `(bug): IPSec site-to-site generates unexpected passthrough option` -- {vytask}`T4397` `(feature): arp: migrate static ARP entry configuration to get_config_dict() and make it VRF aware` -- {vytask}`T4357` `(feature): Allow free-form setting of DHCPv6 server options` - -## 2022-04-26 - -- {vytask}`T4210` `(bug): NAT source/destination negated ports throws an error` -- {vytask}`T4235` `(default): Add config tree diff algorithm` - -## 2022-04-25 - -- {vytask}`T4390` `(feature): op-mode: extend "show log" and "monitor log" with additional daemons/subsystems to read journalctl logs` -- {vytask}`T4391` `(bug): PPPoE: IPv6 not working after system boot` - -## 2022-04-24 - -- {vytask}`T4342` `(bug): "show ip ospf neighbor address x.x.x.x" gives "unknown command" error` - -## 2022-04-23 - -- {vytask}`T4386` `(default): Applying limiter on traffic-policy "in" fails, incorrectly reports mirror or redirect policy in use` - -## 2022-04-22 - -- {vytask}`T4389` `(feature): dhcp: add vendor option support for Ubiquity Unifi controller` - -## 2022-04-21 - -- {vytask}`T4384` `(feature): pppoe: replace default-route CLI option with common CLI nodes already present for DHCP` - -## 2022-04-20 - -- {vytask}`T4345` `(bug): New firewall code does not accept "rate/time interval" syntax used in old config` -- {vytask}`T4231` `(feature): Feature Request: ocserv: 2FA (password+OTP) support in Openconnect` - -## 2022-04-19 - -- {vytask}`T4379` `(bug): PPPoE: default-route lost after applying additional static routes` -- {vytask}`T4344` `(bug): DHCP statistics not matching, conf-mode generates incorrect pool name with dash` -- {vytask}`T4268` `(bug): Elevated LA while using VyOS monitoring feature` - -## 2022-04-18 - -- {vytask}`T4351` `(bug): Openvpn conf-mode "openvpn-option" is not respected` -- {vytask}`T4278` `(default): vyos-vm-images: fix vagrant libvirt box` -- {vytask}`T4368` `(bug): bgp: AS specified for local as is the same as the remote as and this is not allowed.` -- {vytask}`T4370` `(feature): vxlan: geneve: support configuration of df bit option` - -## 2022-04-15 - -- {vytask}`T4327` `(default): Ethernet interface configuration fails on Hyper-V due to speed/duplex/autoneg ethtool command error` -- {vytask}`T4364` `(feature): salt-minion: Upgrade to 3004 and migrate to get_config_dict()` - -## 2022-04-13 - -- {vytask}`T4333` `(feature): Jinja2: add plugin to test if a variable is defined and not none to reduce template complexity` - -## 2022-04-08 - -- {vytask}`T4331` `(bug): IPv6 link local addresses are not configured when an interface is in a VRF` -- {vytask}`T4347` `(default): Return complete and consistent error codes from HTTP API` -- {vytask}`T4339` `(bug): wwan: tab-completion results in "No such file or directory" if there is no WWAN interface` -- {vytask}`T4338` `(bug): wwan: changing interface description should not trigger reconnect` -- {vytask}`T4324` `(bug): wwan: check alive script should only be run via cron if a wwan interface is configured at all` - -## 2022-04-07 - -- {vytask}`T4330` `(bug): MTU settings cannot be applied when IPv6 is disabled` -- {vytask}`T4346` `(feature): Deprecate "system ipv6 disable" option to disable address family within OS kernel` -- {vytask}`T4319` `(bug): The command "set system ipv6 disable" doesn't work as expected.` -- {vytask}`T4341` `(feature): login: disable user-account prior to deletion and wait until deletion is complete` -- {vytask}`T4336` `(feature): isis: add support for MD5 authentication password on a circuit` - -## 2022-04-06 - -- {vytask}`T4308` `(feature): Op-comm "Show log frr" to view specific protocol logs` - -## 2022-04-04 - -- {vytask}`T4329` `(bug): Bgp policy route-map bug with set several extcommunity rt` - -## 2022-04-02 - -- {vytask}`T4335` `(bug): open-vmdk fails to build under gcc-10.+` - -## 2022-04-01 - -- {vytask}`T4332` `(bug): bgp: deterministic-med cannot be disabled while addpath-tx-bestpath-per-AS is in use` - -## 2022-03-31 - -- {vytask}`T4326` `(feature): Add bgp option no-suppress-duplicates` -- {vytask}`T4323` `(default): ospf6d crashes on latest vyos nightly` - -## 2022-03-29 - -- {vytask}`T3686` `(bug): Bridging OpenVPN tap with no local-address breaks` -- {vytask}`T3635` `(default): Add ability to use mDNS repeater with VRRP` - -## 2022-03-26 - -- {vytask}`T4321` `(default): Allow BGP neighbors between different VIFs on the same VyOS` - -## 2022-03-24 - -- {vytask}`T4301` `(bug): The "arp-monitor" option in bonding interface settings does not work` -- {vytask}`T4294` `(bug): Adding a new openvpn-option does not restart the OpenVPN process` -- {vytask}`T4290` `(bug): BGP source-interface fails to commit` -- {vytask}`T4230` `(bug): OpenVPN server configuration deleted after reboot when using a VRRP virtual-address` - -## 2022-03-23 - -- {vytask}`T4314` `(bug): Latest 1.4 Rolling release config migration error` - -## 2022-03-21 - -- {vytask}`T4304` `(feature): [OSPF]import/export filter inter-area prefix` - -## 2022-03-20 - -- {vytask}`T4298` `(default): vyos-vm-images: fix ansible group name and remove obsolete empty command` - -## 2022-03-18 - -- {vytask}`T4286` `(bug): Fix for firewall ipv6 name address validator` - -## 2022-03-15 - -- {vytask}`T4302` `(feature): FRRouting upgrade to release 8.2.2` -- {vytask}`T4293` `(default): Add "set ip-next-hop unchanged" in route-map` - -## 2022-03-14 - -- {vytask}`T4275` `(default): Incorrect val_help for local/remote prefix in ipsec vpn` - -## 2022-03-12 - -- {vytask}`T4296` `(bug): Interface config injected by Cloud-Init may interfere with VyOS native` -- {vytask}`T4265` `(feature): Add op-mode for bgp flowspec state and routes` - -## 2022-03-11 - -- {vytask}`T4297` `(bug): Interface configuration saving fails for ice/iavf based interfaces because they can't change speed/duplex settings` - -## 2022-03-09 - -- {vytask}`T3981` `(feature): VRF support for flow-accounting` - -## 2022-03-05 - -- {vytask}`T4259` `(bug): The conntrackd daemon can be started wrongly` - -## 2022-03-03 - -- {vytask}`T4283` `(feature): Add support to "reject" routes - emit an ICMP unreachable when matched` - -## 2022-03-01 - -- {vytask}`T4277` `(feature): flow-accounting: support sending flow-data via VRF interface` - -## 2022-02-28 - -- {vytask}`T4273` `(bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config` -- {vytask}`T4115` `(bug): reboot in not working as expected` -- {vytask}`T3656` `(bug): IPSec 1.4 : "show vpn ike sa" does not show the correct default ike version` - -## 2022-02-26 - -- {vytask}`T4272` `(feature): lldp: migrate Python script to use get_config_dict()` - -## 2022-02-24 - -- {vytask}`T4267` `(bug): Error - Missing required "ip key" parameter` - -## 2022-02-23 - -- {vytask}`T4194` `(bug): prefix-list no check for duplicate entries` -- {vytask}`T4264` `(bug): vxlan: interface is destroyed and rebuild on description change` -- {vytask}`T4263` `(bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes` - -## 2022-02-21 - -- {vytask}`T4120` `(feature): [VXLAN] add ability to set multiple unicast-remotes` - -## 2022-02-20 - -- {vytask}`T4254` `(feature): VPN IPSec charon add options cisco_flexvpn and install_virtual_ip_on` -- {vytask}`T4249` `(feature): Add support for device mapping in containers` -- {vytask}`T3617` `(bug): IPSec 1.4 generate invalid configuration` -- {vytask}`T4261` `(feature): MACsec: add DHCP client support` -- {vytask}`T4203` `(bug): Reconfigure DHCP client interface causes brief outages` - -## 2022-02-19 - -- {vytask}`T4258` `(bug): [DHCP-SERVER] error parameter on Failover` - -## 2022-02-17 - -- {vytask}`T4255` `(bug): Unexpected print of dict bridge on delete` -- {vytask}`T4240` `(bug): Cannot add wlan0 to bridge via configure` -- {vytask}`T4154` `(bug): Error add second gre tunnel with the same source interface` - -## 2022-02-16 - -- {vytask}`T4237` `(bug): Conntrack-sync error - error adding listen-address command` - -## 2022-02-15 - -- {vytask}`T4160` `(bug): Firewall - Error in rules that matches everything except something` -- {vytask}`T3006` `(bug): Accel-PPP & vlan-mon config get invalid VLAN` -- {vytask}`T3494` `(bug): DHCPv6 leases traceback when PD using` -- {vytask}`T1292` `(bug): Issues while deleting all rules from a firewall` - -## 2022-02-13 - -- {vytask}`T4242` `(bug): ethernet speed/duplex can never be switched back to auto/auto` -- {vytask}`T4191` `(bug): Lost access to host after VRF re-creating` - -## 2022-02-11 - -- {vytask}`T3872` `(feature): Add configurable telegraf monitoring service` - -## 2022-02-08 - -- {vytask}`T4227` `(bug): Typo in help completion of hello-time option of bridge interface` - -## 2022-02-07 - -- {vytask}`T4233` `(bug): ssh: sync regex for allow/deny usernames to "system login"` - -## 2022-02-06 - -- {vytask}`T4223` `(bug): policy route cannot have several entries with the same table` -- {vytask}`T4216` `(bug): Firewall: can't use negated groups in firewall rules` -- {vytask}`T4178` `(bug): policy based routing tcp flags issue` -- {vytask}`T4164` `` (bug): PBR: network groups (as well as address and port groups) don't resolve in `nftables_policy.conf` `` -- {vytask}`T3970` `(feature): Add support for op-mode PKI direct install into an active config session` -- {vytask}`T3828` `(bug): ipsec: Subtle change in "pfs enable" behavior from equuleus -> sagitta` - -## 2022-02-05 - -- {vytask}`T4226` `(bug): VRRP transition-script does not work for groups name which contains -(minus) sign` - -## 2022-02-04 - -- {vytask}`T4196` `(bug): DHCP server client-prefix-length parameter results in non-functional leases` - -## 2022-02-03 - -- {vytask}`T4218` `(bug): firewall: rule name is not allowed to start with a number` -- {vytask}`T3643` `(bug): show vpn ipsec sa doesn't show tunnels in "down" state` - -## 2022-02-01 - -- {vytask}`T4224` `(bug): Ethernet interfaces configured for DHCP not working on latest rolling snapshot (vyos-1.4-rolling-202201291849-amd64.iso)` -- {vytask}`T4225` `(bug): Performance degration with latest rolling release` -- {vytask}`T4220` `(bug): Commit broke dhclient 78b247b724f74bdabab0706aaa7f5b00e5809bc1` -- {vytask}`T4138` `(bug): NAT configuration allows to set incorrect port range and invalid port` - -## 2022-01-28 - -- {vytask}`T4184` `(bug): NTP allow-clients address doesn't work it allows to use ntp server for all addresses` -- {vytask}`T4217` `(bug): firewall: port-group requires protocol to be set - but not in VyOS 1.3` - -## 2022-01-27 - -- {vytask}`T4213` `(default): ipv6 policy routing not working anymore` -- {vytask}`T4188` `(bug): Firewall does not correctly handle conntracking` -- {vytask}`T3762` `(feature): Support network and address groups for policy ipv6-route` -- {vytask}`T3560` `(feature): Ability to create groups of MAC addresses` -- {vytask}`T3495` `(feature): Modernising port/protocol definitions` - -## 2022-01-25 - -- {vytask}`T4205` `(feature): Disable Debian Version in SSH (DebianBanner->no)` -- {vytask}`T4131` `(bug): Show firewall group incorrect format members` - -## 2022-01-24 - -- {vytask}`T4204` `(feature): Update Accel-PPP to a newer revision` -- {vytask}`T1795` `(default): Commit rollback by timeout` - -## 2022-01-23 - -- {vytask}`T4186` `(bug): Firewall icmp type - Offered options not supported` -- {vytask}`T4181` `(bug): Firewall ipv6-network-group - incorrect description on helper` - -## 2022-01-21 - -- {vytask}`T4200` `(bug): Assigning ipv6-name to interface is not generating nftables rules` -- {vytask}`T4144` `(bug): Firewall address-group - Improve error messages` -- {vytask}`T4137` `(bug): Firewall group configuration allows to set incorrect port range and invalid port` -- {vytask}`T4133` `(bug): Firewall network group error with zone-based firewall rules` - -## 2022-01-20 - -- {vytask}`T4171` `(bug): Interface config migration error on 1.2.8 -> 1.4 upgrade` - -## 2022-01-19 - -- {vytask}`T4195` `(feature): [OSPF-ECMP]enable set maximun-path` - -## 2022-01-18 - -- {vytask}`T4159` `(bug): Empty firewall group (address, network & port) generates invalid nftables config, commit fails` -- {vytask}`T4155` `` (bug): PBR: `set table main` fails in `firewall.py` with newer rolling releases `` -- {vytask}`T3873` `(feature): Zone based Firewall - Filter traffic in same zone` -- {vytask}`T3286` `(feature): Switch the firewall from iptables to nftables` -- {vytask}`T292` `(feature): [ZBF] Allow filtering intra zone traffic` - -## 2022-01-17 - -- {vytask}`T3164` `(bug): console-server ssh does not work with RADIUS PAM auth` - -## 2022-01-15 - -- {vytask}`T4183` `(feature): IPv6 link-local address not accepted as wireguard peer` -- {vytask}`T4150` `(bug): VRRP with conntrack-sync does not work` -- {vytask}`T4110` `(feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0` - -## 2022-01-14 - -- {vytask}`T4182` `(bug): Show vrrp if vrrp not configured bug` -- {vytask}`T4179` `(feature): Add op-mode CLI for show high-availability virtual-server` - -## 2022-01-13 - -- {vytask}`T4175` `(bug): BGP configuration failed` -- {vytask}`T4109` `(feature): Extend high-availability/keepalived for support virtual-server lb` - -## 2022-01-12 - -- {vytask}`T4174` `(bug): Validation fails when entering port range with upper port 65535` -- {vytask}`T4162` `(bug): VPN ipsec ike-group - Incorrect value help for ikev2-reauth` -- {vytask}`T4161` `(bug): Policy route-map - Incorrect value help for local preference` -- {vytask}`T4152` `(bug): NHRP shortcut-target holding-time does not work` - -## 2022-01-11 - -- {vytask}`T4149` `(bug): [Firewall-IPV6] Error delete Fw rules on VIF/INT` -- {vytask}`T3950` `(bug): CLI backtrace on update if DNS not defined` -- {vytask}`T4166` `(bug): Debug output missing when frr.py called under vyos-configd` - -## 2022-01-10 - -- {vytask}`T3299` `(bug): Allow the web proxy service to listen on all IP addresses` -- {vytask}`T3115` `(feature): Add support for firewall on L3 VIF bridge interface` - -## 2022-01-09 - -- {vytask}`T4142` `(bug): Input ifbX interfaces not displayed in op-mode` -- {vytask}`T3914` `(bug): VRRP rfc3768-compatibility doesn't work with unicast peers` - -## 2022-01-08 - -- {vytask}`T4116` `(bug): Webproxy/Squid not working with IPv6 listen-address` - -## 2022-01-07 - -- {vytask}`T3924` `(bug): VRRP stops working with VRF` - -## 2022-01-06 - -- {vytask}`T4135` `(bug): Declare zone policy firewall without local zone errors` -- {vytask}`T4130` `(bug): Firewall state policy errors chain` -- {vytask}`T4141` `(bug): Set high-availability vrrp sync-group without members error` - -## 2022-01-04 - -- {vytask}`T4134` `(bug): Incorrect firewall protocol completion help uppercase and duplicates` -- {vytask}`T4132` `(bug): Impossible to show a specific firewall group` - -## 2022-01-03 - -- {vytask}`T4126` `(feature): Ability to set priority to site to site IPSec vpn tunnels` -- {vytask}`T4052` `(bug): Validator return traceback on VRRP configuration with the script path not in config dir` -- {vytask}`T4128` `(bug): keepalived: Upgrade package to add VRF support` - -## 2021-12-31 - -- {vytask}`T4081` `(bug): VRRP health-check script stops working when setting up a sync group` - -## 2021-12-30 - -- {vytask}`T4124` `(feature): snmp: migrate to get_config_dict()` - -## 2021-12-29 - -- {vytask}`T4111` `(bug): IPSec generates wrong configuration colons for IPv6 peers` -- {vytask}`T4023` `(feature): Add grepcidr or similar functionality` -- {vytask}`T4086` `(default): system login banner is not removed on deletion.` - -## 2021-12-28 - -- {vytask}`T3380` `(bug): "show vpn ike sa" does not display IPv6 peers` - -## 2021-12-27 - -- {vytask}`T3979` `(bug): vyos-hostd unable to hostfile-update` -- {vytask}`T2566` `(bug): sstp not able to run tunnels ipv6 only` -- {vytask}`T4093` `(bug): SNMPv3 snmpd.conf generation bug` -- {vytask}`T2764` `(enhancment): Increase maximum number of NAT rules` - -## 2021-12-26 - -- {vytask}`T4104` `(bug): RAID1: "add raid md0 member sda1" does not restore boot sector` -- {vytask}`T4108` `(default): OSPFv3: add support for auto-cost parameter` -- {vytask}`T4107` `(default): OSPFv3: add support for "default-information originate"` - -## 2021-12-25 - -- {vytask}`T4101` `(bug): commit-archive: Use of uninitialized value $source_address in concatenation` -- {vytask}`T4099` `(feature): flow-accounting: sync "source-ip" and "source-address" between netflow and sflow ion CLI` -- {vytask}`T4097` `(feature): flow-accounting: migrate implementation to get_config_dict()` -- {vytask}`T4105` `(feature): flow-accounting: drop "sflow agent-address auto"` -- {vytask}`T4106` `(feature): flow-accounting: support specification of capture packet lenght` -- {vytask}`T4102` `(feature): OSPFv3: add support for NSSA area-type` -- {vytask}`T4055` `(feature): Add VRF support for HTTP(S) API service` - -## 2021-12-24 - -- {vytask}`T3854` `(bug): Missing op-mode commands for conntrack-sync` - -## 2021-12-23 - -- {vytask}`T3354` `(default): Convert strip-private script from Perl to Python` - -## 2021-12-22 - -- {vytask}`T3678` `(bug): VyOS 1.4: Invalid error message while deleting ipsec vpn configuration` -- {vytask}`T3356` `(feature): Script for remote file transfers` - -## 2021-12-21 - -- {vytask}`T4083` `(bug): Cluster heartbeat doesn't start b.c lack of directory /run/heartbeat/` -- {vytask}`T4070` `(bug): NATv4 : inbound-interface type "any" is missing.` -- {vytask}`T4053` `(bug): VRRP impossible to set scripts out of the /config directory` -- {vytask}`T3931` `(bug): SSTP doesn't work after rewriting to PKI` - -## 2021-12-20 - -- {vytask}`T4088` `(default): Fix typo in login banner` - -## 2021-12-19 - -- {vytask}`T3912` `(default): Use a more informative default post-login banner` - -## 2021-12-17 - -- {vytask}`T4059` `(bug): VRRP sync-group transition script does not persist after reboot` - -## 2021-12-16 - -- {vytask}`T4046` `(feature): Sflow - Add Source address parameter` -- {vytask}`T3556` `(bug): Commit-archive via scp causes 100% CPU on boot` -- {vytask}`T4076` `(enhancment): Allow setting CORS options in HTTP API` -- {vytask}`T4037` `(default): HTTP transfers do not follow redirects` -- {vytask}`T4029` `(default): Broken SFTP uploads` - -## 2021-12-15 - -- {vytask}`T4077` `(bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"` -- {vytask}`T4073` `(bug): "show protocols bfd peer <>" shows incorrect peer information.` - -## 2021-12-14 - -- {vytask}`T4071` `(feature): Allow HTTP API to bind to unix domain socket` - -## 2021-12-12 - -- {vytask}`T4069` `(feature): BGP: add additional available parameters to VyOS CLI` -- {vytask}`T4036` `(bug): VXLAN incorrect raiseError if set multicast network instead of singe address` - -## 2021-12-10 - -- {vytask}`T4068` `(feature): Python: ConfigError should insert line breaks into the error message` - -## 2021-12-09 - -- {vytask}`T4033` `(bug): VRRP - Error security when setting scripts` -- {vytask}`T4064` `(bug): IP address for vif is not removed from the system when deleted in configuration` -- {vytask}`T4060` `(enhancment): Extend configquery for use before boot configuration is complete` -- {vytask}`T4058` `(bug): BFD: add BGP and OSPF "bfd profile" support` -- {vytask}`T4054` `(bug): BFD profiles configuration incorrect behavior.` - -## 2021-12-07 - -- {vytask}`T4041` `(servicerequest): "transition-script" doesn't work on "sync-group"` - -## 2021-12-06 - -- {vytask}`T4012` `(feature): Add VRF support for TFTP` - -## 2021-12-04 - -- {vytask}`T4049` `(feature): support command-style output with compare command` -- {vytask}`T4047` `(bug): Wrong regex validation in XML definitions` -- {vytask}`T4042` `(bug): BGP L2VPN / EVPN and RD type 0 set` -- {vytask}`T4048` `(bug): BGP: L2VPN/EVPN and individual RD and RT settings for each VNI` -- {vytask}`T4045` `(bug): Unable to "format disk like "` -- {vytask}`T4044` `(feature): BFD: add vrf support` -- {vytask}`T4043` `(feature): BFD: add support for passive mode` - -## 2021-12-02 - -- {vytask}`T4035` `(bug): Geneve interfaces aren't displayed by operational mode commands` - -## 2021-12-01 - -- {vytask}`T3695` `(bug): OpenConnect reports commit success when ocserv fails to start due to SSL cert/key file issues` - -## 2021-11-30 - -- {vytask}`T4010` `(bug): DMVPN generates incorrect configuration life_time for swanctl.conf` -- {vytask}`T3725` `(feature): show configuration in json format` - -## 2021-11-29 - -- {vytask}`T3946` `(enhancment): Automatically resize the root partition if the drive has extra space` - -## 2021-11-28 - -- {vytask}`T3999` `(bug): show lldp neighbor Traceback error` -- {vytask}`T3928` `(feature): Add OSPFv3 VRF support` - -## 2021-11-27 - -- {vytask}`T3755` `(feature): ospf: adjust to new FRR 8 syntax where "no passive-interface " moved to interface section` -- {vytask}`T3753` `(feature): frr: upgrade to stable/8.1 release train` - -## 2021-11-26 - -- {vytask}`T3978` `(bug): containers add network without declaring prefix raise ConfigError` - -## 2021-11-25 - -- {vytask}`T4006` `(default): Add additional Linux capabilities to container configuration` -- {vytask}`T3986` `(bug): Incorrect description for vpn ipsec site-to-site authentication and connection` - -## 2021-11-24 - -- {vytask}`T4015` `(feature): Update Accel-PPP to a newer revision` -- {vytask}`T3865` `(bug): loadkey command help text missing escape sequence` -- {vytask}`T1083` `(feature): Implement persistent/random address and port mapping options for NAT rules` - -## 2021-11-23 - -- {vytask}`T3990` `(bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to files left behind in /var/tmp/frr/ after reboot)` - -## 2021-11-20 - -- {vytask}`T3998` `(bug): route-target completion incorrect description` - -## 2021-11-19 - -- {vytask}`T4003` `(bug): API for "show interfaces ethernet" does not include the interface description` -- {vytask}`T4011` `(bug): ethernet: deleting interface should place interface in admin down state` - -## 2021-11-18 - -- {vytask}`T3612` `(bug): IPoE Server address pool issues.` -- {vytask}`T3995` `(feature): OpenVPN: do not stop/start service on configuration change` -- {vytask}`T4008` `(feature): dhcp: change client retry interval form 300 -> 60 seconds` -- {vytask}`T3795` `(bug): WWAN: issues with non connected interface / no signal` -- {vytask}`T3510` `(bug): RADIUS usersname is not shown on CLI` - -## 2021-11-17 - -- {vytask}`T3350` `(bug): OpenVPN config file generation broken` -- {vytask}`T3996` `(bug): SNMP service error in log` - -## 2021-11-15 - -- {vytask}`T3994` `(bug): VRF: unable to delete vrf when name contains numbers, hyphen or underscore` -- {vytask}`T3960` `(bug): FRR Misconfig when using multiple VRF VNI` -- {vytask}`T3724` `(feature): Allow setting host-name in l2tp section of accel-ppp` -- {vytask}`T645` `(feature): Allow multiple prefixes in ipsec tunnel` - -## 2021-11-10 - -- {vytask}`T3966` `(default): OpenVPN fix the smoketests` -- {vytask}`T3834` `(default): [OPENVPN] Support for Two Factor Authentication totp.` -- {vytask}`T3982` `(bug): DHCP server commit fails if static-mapping contains + or .` - -## 2021-11-09 - -- {vytask}`T3962` `(bug): Image cannot be built without open-vm-tools` - -## 2021-11-07 - -- {vytask}`T3626` `(bug): Configuring and disabling DHCP Server` - -## 2021-11-06 - -- {vytask}`T3514` `(bug): NIC flap at any interface change` - -## 2021-11-05 - -- {vytask}`T3972` `(bug): Removing vif-c interface raises KeyError` - -## 2021-11-04 - -- {vytask}`T3969` `(bug): Container incorrect raiseError format if network doesn't exist` -- {vytask}`T3662` `(bug): Container configuration upgrade destroys system` -- {vytask}`T3964` `(bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses` - -## 2021-11-03 - -- {vytask}`T3952` `(default): Add sh bgp ipv4/ipv6 vpn command` -- {vytask}`T3610` `(bug): DHCP-Server creation for not primary IP address fails` - -## 2021-11-01 - -- {vytask}`T3958` `(default): OpenVPN breaks the smoketests` -- {vytask}`T3956` `(bug): GRE tunnel - unable to move from source-interface to source-address, commit error` - -## 2021-10-31 - -- {vytask}`T3945` `(feature): Add route-map for bgp aggregate-address` -- {vytask}`T3954` `(bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated, config system error` -- {vytask}`T3943` `(bug): "netflow source-ip" prevents image upgrades if IP address does not exist locally` - -## 2021-10-29 - -- {vytask}`T3942` `(feature): Generate IPSec debug archive from op-mode` - -## 2021-10-28 - -- {vytask}`T3951` `(bug): After resetting vti ipsec tunnel old child SA still active` -- {vytask}`T3941` `(bug): "show vpn ipsec sa" shows established time of parent SA not child SA's` -- {vytask}`T3916` `(feature): Add additional Linux capabilities to container configuration` - -## 2021-10-27 - -- {vytask}`T3944` `(bug): VRRP fails over when adding new group to master` - -## 2021-10-22 - -- {vytask}`T3897` `(feature): Dynamic DNS doesn't work with IPv6 addresses` -- {vytask}`T3832` `(feature): Allow to set DHCP client-id in hexadecimal format` -- {vytask}`T3188` `(bug): Tunnel local-ip to dhcp-interface Change Fails to Update` -- {vytask}`T3917` `(default): Use Avahi as mDNS repeater for IPv6 support` - -## 2021-10-21 - -- {vytask}`T3926` `(bug): strip-private does not sanitize "cisco-authentication" from NHRP configuration` -- {vytask}`T3925` `(feature): Tunnel: dhcp-interface not implemented - use source-interface instead` -- {vytask}`T3923` `(feature): Kernel: Enable TLS/IPSec offload support for Mellanox ConnectX NICs` -- {vytask}`T3927` `(feature): Kernel: Enable kernel support for HW offload of the TLS protocol` - -## 2021-10-20 - -- {vytask}`T3918` `(bug): DHCPv6 prefix delegation incorrect verify error` -- {vytask}`T3921` `(bug): tunnel: KeyError when using dhcp-interface` - -## 2021-10-19 - -- {vytask}`T3396` `(bug): syslog can't be configured with an ipv6 literal destination in 1.2.x` - -## 2021-10-18 - -- {vytask}`T3002` `(default): VRRP change on IPSec interface causes packet routing issues` - -## 2021-10-17 - -- {vytask}`T3786` `(bug): GRE tunnel source address 0.0.0.0 error` -- {vytask}`T3217` `(default): Save FRR configuration on each commit` -- {vytask}`T3381` `(bug): Change GRE tunnel failed` -- {vytask}`T3254` `(bug): Dynamic DNS status shows incorrect last update time` -- {vytask}`T1243` `(bug): BGP local-as accept wrong values` -- {vytask}`T697` `(bug): Clean up and sanitize package dependencies` -- {vytask}`T578` `(feature): Support Linux Container` - -## 2021-10-16 - -- {vytask}`T3879` `(bug): GPG key verification fails when upgrading from a 1.3 beta version` - -## 2021-10-15 - -- {vytask}`T3748` `(bug): Container deletion bug` -- {vytask}`T3693` `(feature): ISIS Route redistribution ipv6 support missing` -- {vytask}`T3676` `(feature): Container option to add Linux capabilities` -- {vytask}`T3613` `(feature): Selectors for route-based IPsec tunnel (vti)` -- {vytask}`T3692` `(bug): VyOS build failing due to repo.saltstack.com` -- {vytask}`T3673` `(feature): BGP large-community del operation missing` - -## 2021-10-14 - -- {vytask}`T3811` `(bug): NAT (op_mode): NAT op_mode command fails.` -- {vytask}`T3801` `(feature): containers: do not use podman CLI to create container networks` - -## 2021-10-13 - -- {vytask}`T3904` `(bug): NTP pool associations silently fail` -- {vytask}`T3277` `(feature): DNS Forwarding - reverse zones` - -## 2021-10-12 - -- {vytask}`T3216` `(bug): Removal of restricted-shell broke configure mode for RADIUS users` -- {vytask}`T3881` `(bug): Wrong description for container section restart` -- {vytask}`T3868` `(bug): Regex and/or wildcard not accepted with large-community-list` -- {vytask}`T3701` `(bug): ipoe server fails to start when configuring radius dynamic-author on ipoe` - -## 2021-10-10 - -- {vytask}`T3750` `(bug): pdns-recursor 4.4 issue with dont-query and private DNS servers` -- {vytask}`T3885` `(default): dhcpv6-pd: randomly generated DUID is not persisted` -- {vytask}`T3899` `(enhancment): Add support for hd44780 LCD displays` - -## 2021-10-09 - -- {vytask}`T3894` `` (bug): Tunnel Commit Failed if system does not have `eth0` `` - -## 2021-10-08 - -- {vytask}`T3893` `(bug): MGRE Tunnel commit crash If sit tunnel available` - -## 2021-10-05 - -- {vytask}`T3741` `(feature): [BGP] default no-ipv4-unicast - by default` - -## 2021-10-04 - -- {vytask}`T3888` `(bug): Incorrect warning when poweroff command executed from configure mode.` -- {vytask}`T3890` `(feature): dhcp(v6): provide op-mode commands to retrieve both server and client logfiles` -- {vytask}`T3889` `(feature): Migrate to journalctl when reading daemon logs` - -## 2021-10-03 - -- {vytask}`T3880` `(bug): EFI boot shows error on display` - -## 2021-10-02 - -- {vytask}`T3882` `(feature): Upgrade PowerDNs recursor to 4.5 series` -- {vytask}`T3883` `(bug): VRF - Delette vrf config on interface` - -## 2021-09-30 - -- {vytask}`T3874` `(bug): D-Link Ethernet Interface not working.` -- {vytask}`T3869` `(default): Rewrite vyatta_net_name/vyatta_interface_rescan in Python` - -## 2021-09-28 - -- {vytask}`T3853` `(default): nat66 rules gets deleted on reboot in 1.4-rolling-202109240217` - -## 2021-09-27 - -- {vytask}`T3863` `(default): nat66: commit fails/hangs on non existing interface` - -## 2021-09-26 - -- {vytask}`T3860` `(bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64 addresses` -- {vytask}`T3857` `(feature): reboot: send wall message to all users for information` -- {vytask}`T3867` `(bug): vxlan: multicast group address is not validated` -- {vytask}`T3859` `(bug): Add "log-adjacency-changes" to ospfv3 process` -- {vytask}`T3826` `(bug): PKI: op-mode - do input validation when listing certificates` - -## 2021-09-25 - -- {vytask}`T3657` `(default): BGP neighbors ipv6 not able to establish with IPv6 link-local addresses` - -## 2021-09-23 - -- {vytask}`T3850` `(bug): Dots are no longer allowed in SSH public key names` - -## 2021-09-21 - -- {vytask}`T3847` `(feature): keepalived/vrrp: migrate to get_config_dict() - cleanup` - -## 2021-09-20 - -- {vytask}`T3823` `(bug): strip-private does not filter public IPv6 addresses` - -## 2021-09-19 - -- {vytask}`T3841` `(feature): dhcp-server: add ping-check option to CLI` -- {vytask}`T2738` `(bug): Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization` -- {vytask}`T3840` `(feature): dns forwarding: Cache size should allow values > 10k` -- {vytask}`T3672` `(bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.conf configuration file output` - -## 2021-09-18 - -- {vytask}`T3831` `(bug): External traffic stops routing when IPSEC tunnel comes up with interface vti0` -- {vytask}`T1968` `(default): Allow multiple static routes in dhcp-server` -- {vytask}`T3838` `(feature): dhcp-server - sync cli for name-servers to other subsystems` -- {vytask}`T3839` `(feature): dhcp-server: Allow configuration of a DNS server and domain name on the shared-network level` - -## 2021-09-17 - -- {vytask}`T3830` `(bug): ipsec: remote-id no longer included in IKE AUTH if not explicitly specified` - -## 2021-09-11 - -- {vytask}`T3402` `(feature): Add VyOS programming library for operational level commands` - -## 2021-09-10 - -- {vytask}`T3802` `(bug): Commit fails if ethernet interface doesn't support flow control` -- {vytask}`T3819` `(bug): Upgrade Salt Stack 3002.3 -> 3003 release train` -- {vytask}`T915` `(feature): MPLS Support` - -## 2021-09-09 - -- {vytask}`T3812` `(bug): Vyos and frr route-map config out of sync` -- {vytask}`T3814` `(bug): wireguard: commit error showing incorrect peer name from the configured name` -- {vytask}`T3805` `(bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP interface` -- {vytask}`T3815` `(bug): pki : the file command 'generate pki wireguard key-pair file' is not working` - -## 2021-09-07 - -- {vytask}`T1894` `(bug): FRR config not loaded after daemons segfault or restart` -- {vytask}`T3807` `(bug): Op Command "show interfaces wireguard" does not show the output` - -## 2021-09-06 - -- {vytask}`T3806` `(bug): Don't set link local ipv6 address if MTU less then 1280` -- {vytask}`T3803` `(default): Add source-address option to the ping CLI` -- {vytask}`T3431` `(bug): Show version all bug` -- {vytask}`T2920` `(bug): Commit crash when adding the second mGRE tunnel with the same key` - -## 2021-09-05 - -- {vytask}`T3804` `(feature): cli: Migrate and merge "system name-servers-dhcp" into "system name-server"` - -## 2021-09-04 - -- {vytask}`T3619` `(bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage` - -## 2021-09-03 - -- {vytask}`T3788` `(bug): Keys are not allowed with ipip and sit tunnels` -- {vytask}`T3634` `(feature): Add op command option for ping for do not fragment bit to be set` -- {vytask}`T3798` `(feature): bgp: add support for "neighbor local-as replace-as" option` - -## 2021-09-02 - -- {vytask}`T3792` `(bug): login: A hypen present in a username from "system login user" is replaced by an underscore` -- {vytask}`T3790` `(bug): Does not possible to configure PPTP static ip-address to users` -- {vytask}`T2947` `(bug): Nat translation many-many with prefix does not map 1-1.` - -## 2021-08-31 - -- {vytask}`T3789` `(feature): Add custom validator for base64 encoded CLI data` -- {vytask}`T3782` `(default): Ingress Shaping with IFB No Longer Functional with 1.3` - -## 2021-08-30 - -- {vytask}`T3768` `(default): Remove early syntaxVersion implementation` -- {vytask}`T2941` `(default): Using a non-ASCII character in the description field causes UnicodeDecodeError in configsource.py` -- {vytask}`T3787` `(bug): Remove deprecated UDP fragmentation offloading option` - -## 2021-08-29 - -- {vytask}`T3708` `(bug): isisd and gre-bridge commit error` -- {vytask}`T3783` `(bug): "set protocols isis spf-delay-ietf" is not working` -- {vytask}`T2750` `(default): Use m4 as a template processor` - -## 2021-08-28 - -- {vytask}`T3743` `(bug): l2tp doesn't work after reboot if outside-address not 0.0.0.0` - -## 2021-08-27 - -- {vytask}`T3182` `(bug): Main blocker Task for FRR 7.4/7.5 series update` -- {vytask}`T3568` `(feature): Add XML for firewall conf-mode` -- {vytask}`T2108` `(default): Use minisign/signify instead of GPG for release signing` - -## 2021-08-26 - -- {vytask}`T3776` `(default): Rename FRR daemon restart op-mode commands` -- {vytask}`T3739` `(feature): policy: route-map: add EVPN match support` - -## 2021-08-25 - -- {vytask}`T3773` `(bug): Delete the "show system integrity" command (to prepare for a re-implementation)` -- {vytask}`T3775` `(bug): Typo in generated Strongswan VPN-config` - -## 2021-08-24 - -- {vytask}`T3772` `(bug): VRRP virtual interfaces are not shown in show interfaces` - -## 2021-08-23 - -- {vytask}`T3769` `(feature): Containers: Network Bridging` - -## 2021-08-22 - -- {vytask}`T3090` `(feature): Move 'adjust-mss' firewall options to the interface section.` -- {vytask}`T3765` `(default): container: additional op-mode commands` - -## 2021-08-20 - -- {vytask}`T1950` `(default): Store VyOS configuration syntax version data in JSON file` - -## 2021-08-19 - -- {vytask}`T3751` `(bug): pki generate ca add new line after passphrase` -- {vytask}`T3764` `(bug): Unconfigurable IKE and ESP lifetime` -- {vytask}`T3234` `(bug): multi_to_list fails in certain cases, with root cause an element redundancy in XML interface-definitions` -- {vytask}`T3732` `(feature): override-default helper should support adding defaultValues to default less nodes` -- {vytask}`T3759` `(default): [L3VPN] VPNv4/VPNv6 add commands` - -## 2021-08-18 - -- {vytask}`T3752` `(bug): generate pki certificate file xxx doesn't touch file` - -## 2021-08-16 - -- {vytask}`T3738` `(default): openvpn fails if server and authentication are configured` -- {vytask}`T1594` `(bug): l2tpv3 error on IPv6 local-ip` - -## 2021-08-15 - -- {vytask}`T3756` `(default): VyOS generates invalid QR code for wireguard clients` -- {vytask}`T3757` `(default): OSPF: add support to configure the area at an interface level` - -## 2021-08-14 - -- {vytask}`T3745` `(feature): op-mode IPSec show vpn ipse sa sorting` - -## 2021-08-13 - -- {vytask}`T3749` `(bug): V4/V6 Counters in network container validation aren't being reset` -- {vytask}`T3728` `(bug): FRR not respect configured RD and RT for L3VNI` -- {vytask}`T3727` `(bug): VPN IPsec ESP proposal and ESP presented in config missmatch` -- {vytask}`T3740` `(bug): HTTPs API breaks when the address is IPv6` - -## 2021-08-12 - -- {vytask}`T3731` `(bug): verify_accel_ppp_base_service return wrong config error for SSP` -- {vytask}`T3405` `(feature): PPPoE server unit-cache` -- {vytask}`T2432` `(default): dhcpd: Can't create new lease file: Permission denied` -- {vytask}`T3746` `(feature): Inform users logging into the system about a pending reboot` -- {vytask}`T3744` `(default): Dns forwarding statistics formatting missing a new line` - -## 2021-08-11 - -- {vytask}`T3709` `(feature): Snmp: Allow enable MIDs/OIDs ipCidrRouteTable` - -## 2021-08-09 - -- {vytask}`T3720` `(bug): IPSec set vti secondary address cause interface disable` - -## 2021-08-08 - -- {vytask}`T3705` `(bug): IPSec: VTI interface does not honor default-esp-group` -- {vytask}`T2027` `(bug): get_config_dict is failing when the configuration section is empty/missing` - -## 2021-08-05 - -- {vytask}`T3719` `(bug): Restart vpn shows some missed files` - -## 2021-08-04 - -- {vytask}`T3704` `(feature): Add ability to interact with Areca RAID adapers` -- {vytask}`T3718` `(bug): VPN IPsec IKE group by default not use DH-group 2` - -## 2021-08-02 - -- {vytask}`T3601` `(default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.` - -## 2021-08-01 - -- {vytask}`T3707` `(bug): Ping incorrect ip host checks` - -## 2021-07-31 - -- {vytask}`T3716` `(feature): Linux kernel parameters ignore_routes_with_link_down- ignore disconnected routing connections` - -## 2021-07-30 - -- {vytask}`T1176` `(default): FRR - BGP replicating routes` -- {vytask}`T1210` `(feature): About IKEv2 IPSec VPN remote access` - -## 2021-07-23 - -- {vytask}`T3699` `(bug): login: verify selected "system login user" name is not already used by the base system.` -- {vytask}`T3698` `(default): Support bridge monitoring` - -## 2021-07-13 - -- {vytask}`T3679` `(default): Point the unexpected exception message link to the new rolling release location` - -## 2021-07-11 - -- {vytask}`T3665` `(bug): Missing VRF support for VxLAN but already documented` - -## 2021-07-10 - -- {vytask}`T3636` `(feature): SSTP / L2TP ipv6 support broken` - -## 2021-07-09 - -- {vytask}`T3667` `(bug): brctl is damaged` - -## 2021-07-06 - -- {vytask}`T3660` `(feature): Conntrack-Sync configuration command to specify destination udp port for peer` - -## 2021-07-03 - -- {vytask}`T57` `(enhancment): Make it possible to disable the entire IPsec peer` - -## 2021-07-01 - -- {vytask}`T3658` `(feature): Add support for dhcpdv6 fixed-prefix6` -- {vytask}`T2035` `(bug): Executing vyos-smoketest multiple times makes ssh test fail on execution` - -## 2021-06-29 - -- {vytask}`T3593` `(bug): PPPoE server called-sid format does not work` -- {vytask}`T1441` `(feature): Add support for IPSec XFRM interfaces` - -## 2021-06-25 - -- {vytask}`T3641` `(feature): Upgrade base system from Debian Buster -> Debian Bullseye` -- {vytask}`T3649` `(feature): Add bonding additional hash-policy` - -## 2021-06-23 - -- {vytask}`T3647` `(feature): Bullseye: gcc defaults to passing --as-needed to linker` - -## 2021-06-22 - -- {vytask}`T3629` `(bug): IPoE server shifting address in the range` -- {vytask}`T3645` `(feature): Bullseye: ethtool changed output for ring-buffer information` - -## 2021-06-21 - -- {vytask}`T3563` `(default): commit-archive breaks with IPv6 source addresses` - -## 2021-06-20 - -- {vytask}`T3637` `(bug): vrf: bind-to-all didn't work properly` -- {vytask}`T3639` `(default): GCC preprocessor clobbers C comments` - -## 2021-06-19 - -- {vytask}`T3633` `(feature): Add LRO offload for interface ethernet` - -## 2021-06-18 - -- {vytask}`T3599` `(default): Migrate NHRP to XML/Python` - -## 2021-06-17 - -- {vytask}`T3624` `(feature): BGP: add support for extended community bandwidth definition` - -## 2021-06-16 - -- {vytask}`T3623` `(default): Fix for dummy interface option in the operational command "clear interfaces dummy"` -- {vytask}`T3630` `(feature): op-mode: add "show version kernel" command` - -## 2021-06-13 - -- {vytask}`T3620` `(feature): Rename WWAN interface from wirelessmodem to wwan to use QMI interface` -- {vytask}`T2173` `(feature): Add the ability to use VRF on VTI interfaces` -- {vytask}`T3622` `(feature): WWAN: add support for APN authentication` -- {vytask}`T3606` `(bug): SNMP unknown notification OID` -- {vytask}`T3621` `(bug): PPPoE interface does not validate if password is supplied when username is set` - -## 2021-06-12 - -- {vytask}`T3611` `(bug): WWAN interface (MC7710) no longer works on Kernel 5.10` -- {vytask}`T1534` `(bug): IPSec w/ IKEv2 Invalid local-address "any"` -- {vytask}`T3616` `(bug): Update to FastAPI causes regression in vyos-http-api-server` - -## 2021-06-11 - -- {vytask}`T3614` `(bug): Container network name with hyphen fail` - -## 2021-06-10 - -- {vytask}`T3250` `(bug): PPPoE server: wrong local usernames` -- {vytask}`T3138` `(bug): ddclient improperly updated when apply rfc2136 config` -- {vytask}`T2645` `(default): Editing route-map action requires adding a new rule` - -## 2021-06-08 - -- {vytask}`T3605` `(default): Allow to set prefer-global for ipv6-next-hop` -- {vytask}`T3607` `(feature): [route-map] set ipv6 next-hop prefer-global` -- {vytask}`T3289` `(bug): No description for node "service" conf-mode` - -## 2021-06-07 - -- {vytask}`T3461` `(bug): OpenConnect Server redundancy check` -- {vytask}`T3455` `(bug): system users can not be added in "edit"` -- {vytask}`T3588` `(default): IPSec: migrate no longer available options from CLI which are now hardcoded/enabled in strongSwan` - -## 2021-06-06 - -- {vytask}`T842` `(feature): Adopt VyOS CLI to latest StrongSwan options and deprecated Keywords` - -## 2021-06-04 - -- {vytask}`T3595` `(default): Cannot create new VTI interface` -- {vytask}`T3592` `(feature): Set default TTL 64 for tunnels` - -## 2021-06-03 - -- {vytask}`T3384` `(feature): Support UDP bandwidth testing` - -## 2021-06-02 - -- {vytask}`T3233` `(bug): Interface redirect to dum0` - -## 2021-06-01 - -- {vytask}`T3585` `(default): Fix NHRP module for updated interfaces tunnel syntax` -- {vytask}`T3594` `(bug): Disable by default service strongswan-starter` - -## 2021-05-30 - -- {vytask}`T3518` `(bug): Warning messages when using SCP commit-archive` -- {vytask}`T3093` `(default): Add xml for vpn ipsec` -- {vytask}`T1866` `(bug): Commit archive over SFTP doesn't work with non-standard ports` -- {vytask}`T3590` `(feature): bgp: add option for limiting maximum number of prefixes to be sent to a peer` -- {vytask}`T3589` `(feature): op-mode: support clearing out logfiles from CLI` -- {vytask}`T2641` `(feature): Rewrite vpn ipsec OP commands in new style XML syntax` -- {vytask}`T3351` `(feature): Installer checking MD5 checksums on the ISO image` - -## 2021-05-29 - -- {vytask}`T1944` `(bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure of Zebra` -- {vytask}`T1888` `(feature): Update to StrongSwan 5.9.1` - -## 2021-05-27 - -- {vytask}`T3561` `(feature): router-advert: support advertising specific routes` -- {vytask}`T2669` `(bug): DHCP-server overlapping ranges.` - -## 2021-05-26 - -- {vytask}`T3540` `(bug): Keepalived memory utilisation issue when constantly getting its state in JSON format` - -## 2021-05-24 - -- {vytask}`T3575` `(bug): pseudo-ethernet: must check source-interface MTU` -- {vytask}`T3571` `(bug): Broken Show Tab Complete` -- {vytask}`T3555` `(bug): GRE TAP tunnel does not silent fragment packets / kernel fix available` -- {vytask}`T3576` `(bug): ISIS does not support IPV6` - -## 2021-05-23 - -- {vytask}`T3570` `(default): Prevent setting of a larger MTU on child interfaces` -- {vytask}`T3573` `(bug): as-path-prepend Description Invalid` -- {vytask}`T3572` `(feature): Basic Drive Diagnostic Tools` - -## 2021-05-22 - -- {vytask}`T3564` `(default): Multiple BGP Confederation Peers Not Allowed` - -## 2021-05-21 - -- {vytask}`T3551` `(bug): QoS control failure of VLAN sub interface` - -## 2021-05-20 - -- {vytask}`T3554` `(feature): Add area-type stub for ospfv3` -- {vytask}`T3565` `(feature): sysctl: rewrite in XML and Python and drop from vyatta-cfg-system` - -## 2021-05-19 - -- {vytask}`T3562` `(feature): Update Accel-PPP to a newer revision` -- {vytask}`T3559` `(feature): Add restart op-command for OpenConnect Server` - -## 2021-05-18 - -- {vytask}`T3525` `(default): VMWare resume script syntax errors` - -## 2021-05-15 - -- {vytask}`T3549` `(bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not correctly exported to dhcpdv6.conf when multiple name-server entries are present` -- {vytask}`T3532` `(bug): Not possible to change ethertype after interface creation` -- {vytask}`T3550` `(bug): Router-advert completion typo` -- {vytask}`T3547` `(feature): conntrackd: remove deprecated config options` -- {vytask}`T3535` `(feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor` - -## 2021-05-14 - -- {vytask}`T3346` `(bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node exists but there are no rules` -- {vytask}`T3248` `(default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3` -- {vytask}`T3426` `(default): add support for script arguments to vyos-configd` - -## 2021-05-13 - -- {vytask}`T3539` `(bug): Typo in RPKI interface definition` -- {vytask}`T439` `(feature): local PBR support` -- {vytask}`T3544` `(feature): DHCP server should validate configuration before applying it` -- {vytask}`T3543` `(feature): Support for setting lacp_rate on LACP bonded interfaces` - -## 2021-05-12 - -- {vytask}`T3302` `(default): Make vyos-configd relay stdout from scripts to the user's console` -- {vytask}`T3542` `(bug): udev net.rules not installed in image since may 2nd` - -## 2021-05-10 - -- {vytask}`T3374` `(bug): IPv6 GRE Tunnel issues` - -## 2021-05-09 - -- {vytask}`T3530` `(bug): BGP peer-group can't contain a hyphen` - -## 2021-05-06 - -- {vytask}`T3523` `(bug): VRF BGP daemon route-map command missing` -- {vytask}`T3519` `(bug): Cannot add / assign L2TPv3 to vrf` - -## 2021-05-05 - -- {vytask}`T3520` `(bug): Cannot add tunnel interface to isis within vrf` -- {vytask}`T3335` `(bug): Some OSPFv3 show commands do not work` - -## 2021-05-04 - -- {vytask}`T3504` `(feature): BGP Per Peer Graceful Restart` - -## 2021-05-02 - -- {vytask}`T3511` `(bug): Update libnss-mapuser and libpam-radius packages from CUMULUS Linux` - -## 2021-05-01 - -- {vytask}`T3379` `(feature): Add global-parameters name-server for dhcpv6-server` -- {vytask}`T3491` `(default): Change Kernel HZ to 1000` - -## 2021-04-29 - -- {vytask}`T3503` `(bug): "route-reflector-client" fails when "remote-as" is "internal"` -- {vytask}`T3502` `(bug): "system ip multipath layer4-hashing" doesn't work` - -## 2021-04-28 - -- {vytask}`T3473` `(bug): IPSec op-mode show sa error` - -## 2021-04-27 - -- {vytask}`T2946` `(bug): Calling 'stty_size' causes show interfaces API to fail` - -## 2021-04-25 - -- {vytask}`T3490` `(bug): priority inversion on PBR "policy route" create, breaks default route from dhcp (live iso)` -- {vytask}`T3468` `(bug): Tunnel interfaces aren't suggested as being available for bridging (regression)` -- {vytask}`T3497` `(bug): Prefix list with rule containing only action is not detected as error during parse` -- {vytask}`T3492` `(bug): BGP Configuration Migration failed (badly!) from rolling 202102240218 to rolling 202104221210` -- {vytask}`T1802` `(feature): Wireguard QR code in cli for mobile devices` - -## 2021-04-24 - -- {vytask}`T3472` `(bug): commit-confirm script not found` -- {vytask}`T3439` `(bug): Commit-archive location not working for scp` - -## 2021-04-23 - -- {vytask}`T3395` `(bug): WAN load-balancing fails with nexthop dhcp` -- {vytask}`T3290` `(bug): Disabling GRE conntrack module fails` - -## 2021-04-20 - -- {vytask}`T3488` `(bug): Specifying an invalid "interface address" like dhcph leads to commit error` - -## 2021-04-18 - -- {vytask}`T3481` `(default): Exclude tag node values from key mangling` -- {vytask}`T3475` `(bug): XML dictionary cache unable to process syntaxVersion elements` - -## 2021-04-17 - -- {vytask}`T3470` `(bug): as-override isn't applied to frr` - -## 2021-04-15 - -- {vytask}`T3386` `(bug): PPPoE-server don't start with local authentication` -- {vytask}`T3190` `(feature): Unable to subtract value from local-preference in route-map` - -## 2021-04-14 - -- {vytask}`T3398` `(bug): Can't commit` -- {vytask}`T3055` `(bug): op-mode incorrect naming for ipsec policy-based tunnels` - -## 2021-04-13 - -- {vytask}`T3436` `(feature): Refactoring ospf op-mode for support vrf` -- {vytask}`T3434` `(feature): Refactoring bgp op-mode for support vrf` - -## 2021-04-12 - -- {vytask}`T3454` `(enhancment): dhclient reject option` -- {vytask}`T3328` `(bug): Bgp not possible to delete bgp route-map` - -## 2021-04-10 - -- {vytask}`T3460` `(bug): bgp, Configuration FRR failed while commiting code` - -## 2021-04-09 - -- {vytask}`T3464` `(bug): OSPF: route-map names containing a hypen are not "found"` - -## 2021-04-08 - -- {vytask}`T3462` `(default): show ipv6 bgp -- missing` -- {vytask}`T3463` `(bug): Prevent IPv4 Route exchange with IPv6 neighbors` - -## 2021-04-05 - -- {vytask}`T3438` `(bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf from the operating system` -- {vytask}`T3418` `(bug): BGP: system wide known interface can not be used as neighbor` - -## 2021-04-04 - -- {vytask}`T3457` `(feature): Output the "monitor log" command in a colorful way` - -## 2021-03-31 - -- {vytask}`T3445` `(bug): vyos-1x build include not all nodes` - -## 2021-03-30 - -- {vytask}`T3448` `(bug): Loading vyos on a system without xdp installed fails` - -## 2021-03-29 - -- {vytask}`T3415` `(feature): bridge: add support for isolated interfaces (private-vlan)` -- {vytask}`T1711` `(feature): BGP - migrate from tagNode to node (remove ASN from tagNode)` - -## 2021-03-28 - -- {vytask}`T3440` `(bug): HTTP API: give uvicorn time to initialize before restarting Nginx proxy` - -## 2021-03-27 - -- {vytask}`T3423` `(bug): Cannot create ipv4 static route for default gateway in vrf` - -## 2021-03-26 - -- {vytask}`T3412` `(default): HTTP API: move to FastAPI as web framework` -- {vytask}`T2397` `(feature): HTTP API: export OpenAPI definition` - -## 2021-03-24 - -- {vytask}`T3419` `(bug): show interfaces | strip-private fails` - -## 2021-03-22 - -- {vytask}`T3284` `(bug): merge/load fail silently if unable to resolve host` - -## 2021-03-21 - -- {vytask}`T3417` `(default): ISIS: provide per VRF instance support` -- {vytask}`T3416` `(bug): NTP: when running inside a VRF op-mode commands do not work` - -## 2021-03-20 - -- {vytask}`T3392` `(bug): vrrp over dhcp default route bug (unexpected vrf)` -- {vytask}`T3373` `(feature): Upgrade to SaltStack version 3002.5` -- {vytask}`T3329` `(default): "system conntrack ignore" rules can no longer be created due to an iptables syntax change` -- {vytask}`T3300` `(feature): Add DHCP default route distance` -- {vytask}`T3306` `(feature): Extend set route-map aggregator as to 4 Bytes` - -## 2021-03-18 - -- {vytask}`T3411` `(default): Extend the redirect_stdout context manager in vyos-configd to redirect stdout from subprocesses` -- {vytask}`T3271` `(bug): qemu-kvm grub issue` - -## 2021-03-17 - -- {vytask}`T3413` `(bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP address string passed to inet_pton"` - -## 2021-03-14 - -- {vytask}`T3345` `(default): BGP: add per VRF instance support` -- {vytask}`T3344` `(default): Per VRF dynamic routing support` -- {vytask}`T3325` `(bug): Bgp listen-range wrong commit message` -- {vytask}`T1513` `(default): Move OSPF and RIP interface configuration under protocols` - -## 2021-03-13 - -- {vytask}`T3406` `(bug): tunnel: interface no longer supports specifying encaplimit none - or migrator is missing` -- {vytask}`T3407` `(bug): console-server: do not allow to spawn a console-server session on serial port used by "system console"` - -## 2021-03-11 - -- {vytask}`T3305` `(bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot` -- {vytask}`T2927` `(bug): isc-dhcpd release and expiry events never execute` - -## 2021-03-09 - -- {vytask}`T3382` `(bug): Error creating Console Server` - -## 2021-03-08 - -- {vytask}`T3387` `(bug): Command "Monitor vpn ipsec" is not working` - -## 2021-03-07 - -- {vytask}`T3388` `(bug): show interfaces doesn't display pppoeX` -- {vytask}`T3211` `(feature): ability to redistribute ISIS into other routing protocols` - -## 2021-03-04 - -- {vytask}`T3377` `(bug): show interfaces throws error` - -## 2021-03-02 - -- {vytask}`T3375` `(bug): Interface becomes up at boot even when disabled` - -## 2021-02-28 - -- {vytask}`T3370` `(bug): dhcp: Invalid domain name "private"` -- {vytask}`T3369` `(feature): VXLAN: add IPv6 underlay support` -- {vytask}`T3363` `(bug): VyOS-Build interactive prompt when using Podman` -- {vytask}`T3320` `(bug): Bgp neighbor peer-group without peer-group fail` - -## 2021-02-27 - -- {vytask}`T3365` `(bug): Bgp neighbor interface ordering for remote-as` -- {vytask}`T3225` `(bug): Adding a BGP neighbor with an address on a local interface throws a vyos.frr.CommitError: Configuration FRR failed while committing code: ''` -- {vytask}`T3368` `(feature): macsec: add support for gcm-aes-256 cipher` -- {vytask}`T3173` `(feature): Need 'nopmtudisc' option for tunnel interface` - -## 2021-02-26 - -- {vytask}`T3324` `(bug): Bgp space in the password` -- {vytask}`T3357` `(default): HTTP-API redirect from http correct https port` -- {vytask}`T3323` `(bug): Bgp ttl-security and ebgp-multihop fail` - -## 2021-02-24 - -- {vytask}`T3303` `(feature): Change welcome message on boot` - -## 2021-02-22 - -- {vytask}`T3322` `(bug): Bgp neighbor timers not applyed to FRR config` -- {vytask}`T3327` `(bug): OSPFv3: Cannot add dummy interface` - -## 2021-02-21 - -- {vytask}`T3331` `(bug): Bgp unsuppress-map should be as "value leafNode"` -- {vytask}`T3330` `(bug): Bgp capability orf prefix-list fail` -- {vytask}`T3163` `(feature): ethernet ring-buffer can be set with an invalid value` - -## 2021-02-19 - -- {vytask}`T3326` `(bug): OSPFv3: Cannot add L2TPv3 interface` -- {vytask}`T3332` `(bug): BGP unnumbered - UnboundLocalError: local variable 'peer_group' referenced before assignment` - -## 2021-02-18 - -- {vytask}`T3259` `(default): many dnat rules makes the vyos http api crash, even showConfig op timeouts` - -## 2021-02-17 - -- {vytask}`T3312` `(feature): SolarFlare NICs support` - -## 2021-02-16 - -- {vytask}`T3313` `(bug): ospfv3 interface missing options` -- {vytask}`T3318` `(feature): Update Linux Kernel to v5.4.208 / 5.10.142` - -## 2021-02-15 - -- {vytask}`T3311` `(bug): BGP Error: Remote AS must be set for neighbor or peer-group` - -## 2021-02-14 - -- {vytask}`T2848` `(feature): bgp-add-path configuration options` - -## 2021-02-12 - -- {vytask}`T3301` `(bug): Wrong format and valueHelp for policy as-path-list regex` - -## 2021-02-11 - -- {vytask}`T3281` `(default): Rewrite protocol RIPng [conf-mode] to new XML/Python style` -- {vytask}`T3282` `(default): Add XML for [conf-mode] RIPng` -- {vytask}`T3279` `(default): Rewrite protocol STATIC [op-mode] to new XML/Python style` -- {vytask}`T3297` `(bug): Optimize irrelevant error stack hints` - -## 2021-02-08 - -- {vytask}`T3295` `(feature): Update Linux Kernel to v5.4.96 / 5.10.14` - -## 2021-02-05 - -- {vytask}`T3030` `(feature): Support ERSPAN Tunnel Protocol` - -## 2021-02-04 - -- {vytask}`T3283` `(feature): Support for IPv4 neigh tables` -- {vytask}`T3280` `(default): Add XML for [conf-mode] STATIC` - -## 2021-02-03 - -- {vytask}`T3278` `(feature): Add XML for "protocols vrf" [conf-mode]` -- {vytask}`T3239` `(default): XML: override 'defaultValue' for mtu of certain interfaces; remove workarounds` -- {vytask}`T2910` `(feature): XML: generator should support override of variables` - -## 2021-02-02 - -- {vytask}`T3018` `(bug): Unclear behaviour when configuring vif and vif-s interfaces` -- {vytask}`T3255` `(default): Rewrite protocol RPKI to new XML/Python style` -- {vytask}`T3263` `(feature): OSPF Hello subsecond timer` - -## 2021-01-31 - -- {vytask}`T3276` `(feature): Update Linux Kernel to v5.4.94 / 5.10.12` - -## 2021-01-30 - -- {vytask}`T3240` `(feature): Support per-interface DHCPv6 DUIDs` -- {vytask}`T3273` `(default): PPPoE static default-routes deleted on interface down when not added by interface up` - -## 2021-01-29 - -- {vytask}`T3261` `(bug): Does not possible to disable pppoe client interface.` -- {vytask}`T3272` `(default): OSPF: interface config is not removed` - -## 2021-01-27 - -- {vytask}`T3257` `(feature): tcpdump supporting complete protocol` -- {vytask}`T3244` `(default): Rewrite protocol OSPFv3 to new XML/Python style` - -## 2021-01-26 - -- {vytask}`T3251` `(bug): PPPoE client trying to authorize with the wrong username` -- {vytask}`T3256` `(default): Add XML for protocol RPKI [conf-mode]` - -## 2021-01-25 - -- {vytask}`T3249` `(feature): Support operation mode forwarding table output` - -## 2021-01-24 - -- {vytask}`T3227` `(bug): Latest releases don't work with RPKI (crash)` -- {vytask}`T3230` `(bug): RPKI can't be deleted` -- {vytask}`T3221` `(bug): FRR config` -- {vytask}`T3245` `(default): Add XML for protocol ospfv3 [conf-mode]` - -## 2021-01-23 - -- {vytask}`T3236` `(default): Add XML for [conf-mode] OSPF` - -## 2021-01-17 - -- {vytask}`T3222` `(bug): Typo in BGP dampening description` -- {vytask}`T3226` `(bug): Repair bridge smoke test damage` - -## 2021-01-16 - -- {vytask}`T3215` `(bug): Operational command "show ipv6 route" is broken` -- {vytask}`T3157` `(bug): salt-minion fails to start due to permission error accessing /root/.salt/minion.log` -- {vytask}`T3137` `(feature): Let VLAN aware bridge approach the behavior of professional equipment` - -## 2021-01-15 - -- {vytask}`T3210` `(feature): ISIS three-way-handshake` -- {vytask}`T3184` `(feature): Add correct desctiptions for BGP neighbors` - -## 2021-01-14 - -- {vytask}`T3213` `(bug): show interface command python error` - -## 2021-01-12 - -- {vytask}`T3205` `(bug): Does not possible to configure tunnel mode gre-bridge` - -## 2020-12-20 - -- {vytask}`T3132` `(feature): Enable egress flow accounting` - -## 2020-11-29 - -- {vytask}`T2297` `(feature): NTP add support for pool configuration` diff --git a/docs/changelog/md-1.5.md b/docs/changelog/md-1.5.md deleted file mode 100644 index 1471358f..00000000 --- a/docs/changelog/md-1.5.md +++ /dev/null @@ -1,32 +0,0 @@ -# 1.5 Circinus - -% Please don't add anything by hand. -% This file is managed by the script: -% _ext/releasenotes.py - -## 2023-09-11 - -- {vytask}`T5562` `(bug): Smoketests fail for vyos:current (test_netns.py)` -- {vytask}`T5551` `(bug): Missing check for boot_configuration_complete raises error in vyos-save-config.py` -- {vytask}`T5353` `(bug): config-mgmt: normalize archive updates and commit log entries` - -## 2023-09-10 - -- {vytask}`T5555` `(bug): Fix timezone migrator (system 13-to-14)` - -## 2023-09-09 - -- {vytask}`T5423` `(bug): ipsec: no output for op-cmd "show vpn ike secrets"` - -## 2023-09-08 - -- {vytask}`T5560` `(bug): VyOS version in current branch should be changed from 1.4 to 1.5` - -## 2023-09-07 - -- {vytask}`T5556` `(bug): reboot now and poweroff does not work` -- {vytask}`T5489` `(feature): Change to BBR as TCP congestion control, or at least make it an config option` - -## 2023-09-06 - -- {vytask}`T5548` `(bug): HAProxy renders timeouts incorrectly` diff --git a/docs/changelog/md-index.md b/docs/changelog/md-index.md deleted file mode 100644 index 82511ed6..00000000 --- a/docs/changelog/md-index.md +++ /dev/null @@ -1,19 +0,0 @@ -(release-notes)= - -# Changelog - -```{eval-rst} -.. toctree:: - :maxdepth: 1 - :includehidden: - - 1.5 - 1.4 - 1.3 - 1.2.6 - 1.2.5 - 1.2.4 - 1.2.3 - 1.2.2 - 1.2.1 -``` diff --git a/docs/changelog/rst-1.2.1.rst b/docs/changelog/rst-1.2.1.rst new file mode 100644 index 00000000..4f22dd0a --- /dev/null +++ b/docs/changelog/rst-1.2.1.rst @@ -0,0 +1,52 @@ +1.2.1 +===== + +VyOS 1.2.1 is a maintenance release made in April 2019. + +Resolved issues +--------------- + +* Package updates: kernel 4.19.32, open-vm-tools 10.3, latest Intel NIC drivers +* :vytask:`T1326` The kernel now includes drivers for various USB serial + adapters, which allows people to add a serial console to a machine without + onboard RS232, or connect to something else from the router +* The collection of network card firmware is now much more extensive +* :vytask:`T1271` VRRP now correctly uses a virtual rather than physical MAC + addresses in the RFC-compliant mode +* :vytask:`T1330` DHCP WPAD URL option works correctly again +* :vytask:`T1312` Many to many NAT rules now can use source/destination and + translation networks of non-matching size. If 1:1 network bits translation is + desired, it's now users responsibility to check if prefix length matches. +* :vytask:`T1290` IPv6 network prefix translation is fixed +* :vytask:`T1308` Non-alphanumeric characters such as ``>`` can now be safely + used in PPPoE passwords +* :vytask:`T1305` ``show | commands`` no longer fails when a config section ends + with a leaf node such as ``timezone`` in ``show system | commands`` +* :vytask:`T1235` ``show | commands`` correctly works in config mode now +* :vytask:`T1298` VTI is now compatible with the DHCP-interface IPsec option +* :vytask:`T1277` ``show dhcp server statistics`` command was broken in latest + Crux +* :vytask:`T1261` An issue with TFTP server refusing to listen on addresses + other than loopback was fixed +* :vytask:`T1224` Template issue that might cause UDP broadcast relay fail to + start is fixed +* :vytask:`T1067` VXLAN value validation is improved +* :vytask:`T1211` Blank hostnames in DHCP updates no longer can crash DNS + forwarding +* :vytask:`T1322` Correct configuration is now generated for DHCPv6 relays with + more than one upstream interface +* :vytask:`T1234` ``relay-agents-packets`` option works correctly now +* :vytask:`T1231` Dynamic DNS data is now cleaned on configuration change +* :vytask:`T1282` Remote Syslog can now use a fully qualified domain name +* :vytask:`T1279` ACPI power off works again +* :vytask:`T1247` Negation in WAN load balancing rules works again +* :vytask:`T1218` FRR staticd now starts on boot correctly +* :vytask:`T1296` The installer now correctly detects SD card devices +* :vytask:`T1225` Wireguard peers can be disabled now +* :vytask:`T1217` The issue with Wireguard interfaces impossible to delete + is fixed +* :vytask:`T1160` Unintended IPv6 access is fixed in SNMP configuration +* :vytask:`T1060` It's now possible to exclude hosts from the transparent + web proxy +* :vytask:`T484` An issue with rules impossible to delete from the zone-based + firewall is fixed \ No newline at end of file diff --git a/docs/changelog/rst-1.2.2.rst b/docs/changelog/rst-1.2.2.rst new file mode 100644 index 00000000..17ba941f --- /dev/null +++ b/docs/changelog/rst-1.2.2.rst @@ -0,0 +1,46 @@ +1.2.2 +===== + +1.2.2 is a maintenance release made in July 2019. + +New features +------------ + +* Options for per-interface MSS clamping. +* BGP extended next-hop capability +* Relaxed BGP multipath option +* Internal and external options for "remote-as" (accept any AS as long as it's + the same to this router or different, respectively) +* "Unnumbered" (interface-based) BGP peers +* BGP no-prepend option +* Additive BGP community option +* OSPFv3 network type option +* Custom arguments for VRRP scripts +* A script for querying values from config files + +Resolved issues +--------------- + +* Linux kernel 4.19.54, including a fix for the TCP SACK vulnerability +* :vytask:`T1371` VRRP health-check scripts now can use arguments +* :vytask:`T1497` DNS server addresses coming from a DHCP server are now + correctly propagated to resolv.conf +* :vytask:`T1469` Domain-specific name servers in DNS forwarding are now used + for recursive queries +* :vytask:`T1433` ``run show dhcpv6 server leases`` now display leases correctly +* :vytask:`T1461` Deleting ``firewall options`` node no longer causes errors +* :vytask:`T1458` Correct hostname is sent to remote syslog again +* :vytask:`T1438` Board serial number from DMI is correctly displayed in + ``show version`` +* :vytask:`T1358`, :vytask:`T1355`, :vytask:`T1294` Multiple corrections in + remote syslog config +* :vytask:`T1255` Fixed missing newline in ``/etc/hosts`` +* :vytask:`T1174` ``system domain-name`` is correctly included in + ``/etc/resolv.conf`` +* :vytask:`T1465` Fixed priority inversion in ``interfaces vti vtiX ip`` + settings +* :vytask:`T1446` Fixed errors when installing with RAID1 on UEFI machines +* :vytask:`T1387` Fixed an error on disabling an interfaces that has no address +* :vytask:`T1367` Fixed deleting VLAN interface with non-default MTU +* :vytask:`T1505` vyos.config ``return_effective_values()`` function now + correctly returns a list rather than a string \ No newline at end of file diff --git a/docs/changelog/rst-1.2.3.rst b/docs/changelog/rst-1.2.3.rst new file mode 100644 index 00000000..653beec1 --- /dev/null +++ b/docs/changelog/rst-1.2.3.rst @@ -0,0 +1,62 @@ +1.2.3 +===== + +1.2.3 is a maintenance and feature backport release made in September 2019. + +New features +------------ + +* HTTP API +* :vytask:`T1524` "set service dns forwarding allow-from " + option for limiting queries to specific client networks +* :vytask:`T1503` Functions for checking if a commit is in progress +* :vytask:`T1543` "set system contig-mangement commit-archive source-address" + option +* :vytask:`T1554` Intel NIC drivers now support receive side scaling and + multiqueue + +Resolved issues +--------------- + +* :vytask:`T1209` OSPF max-metric values over 100 no longer causes commit + errors +* :vytask:`T1333` Fixes issue with DNS forwarding not performing recursive + lookups on domain specific forwarders +* :vytask:`T1362` Special characters in VRRP passwords are handled correctly +* :vytask:`T1377` BGP weight is applied properly +* :vytask:`T1420` Fixed permission for log files +* :vytask:`T1425` Wireguard interfaces now support /31 addresses +* :vytask:`T1428` Wireguard correctly handles firewall marks +* :vytask:`T1439` DHCPv6 static mappings now work correctly +* :vytask:`T1450` Flood ping commands now works correctly +* :vytask:`T1460` Op mode "show firewall" commands now support counters longer + than 8 digits (T1460) +* :vytask:`T1465` Fixed priority inversion in VTI commands +* :vytask:`T1468` Fixed remote-as check in the BGP route-reflector-client option +* :vytask:`T1472` It's now possible to re-create VRRP groups with RFC + compatibility mode enabled +* :vytask:`T1527` Fixed a typo in DHCPv6 server help strings +* :vytask:`T1529` Unnumbered BGP peers now support VLAN interfaces +* :vytask:`T1530` Fixed "set system syslog global archive file" command +* :vytask:`T1531` Multiple fixes in cluster configuration scripts +* :vytask:`T1537` Fixed missing help text for "service dns" +* :vytask:`T1541` Fixed input validation in DHCPv6 relay options +* :vytask:`T1551` It's now possible to create a QinQ interface and a firewall + assigned to it in one commit +* :vytask:`T1559` URL filtering now uses correct rule database path and works + again +* :vytask:`T1579` "show log vpn ipsec" command works again +* :vytask:`T1576` "show arp interface " command works again +* :vytask:`T1605` Fixed regression in L2TP/IPsec server +* :vytask:`T1613` Netflow/sFlow captures IPv6 traffic correctly +* :vytask:`T1616` "renew dhcpv6" command now works from op mode +* :vytask:`T1642` BGP remove-private-as option iBGP vs eBGP check works + correctly now +* :vytask:`T1540`, :vytask:`T1360`, :vytask:`T1264`, :vytask:`T1623` Multiple + improvements in name servers and hosts configuration handling + +Internals +--------- + +``/etc/resolv.conf`` and ``/etc/hosts`` files are now managed by the +*vyos-hostsd* service that listens on a ZMQ socket for update messages. \ No newline at end of file diff --git a/docs/changelog/rst-1.2.4.rst b/docs/changelog/rst-1.2.4.rst new file mode 100644 index 00000000..3e228880 --- /dev/null +++ b/docs/changelog/rst-1.2.4.rst @@ -0,0 +1,77 @@ +1.2.4 +===== + +1.2.4 is a maintenance release made in December 2019. + +Resolved issues +--------------- + +* :vytask:`T258` Can not configure wan load-balancing on vyos-1.2 +* :vytask:`T818` SNMP v3 - remove required engineid from user node +* :vytask:`T1030` Upgrade ddclient from 3.8.2 to 3.9. + (support Cloudflare API v4) +* :vytask:`T1183` BFD Support via FRR +* :vytask:`T1299` Allow SNMPd to be extended with custom scripts +* :vytask:`T1351` accel-pppoe adding CIDR based IP pool option +* :vytask:`T1391` In route-map set community additive +* :vytask:`T1394` syslog systemd and host_name.py race condition +* :vytask:`T1401` Copying files with the FTP protocol fails if the passwor + contains special characters +* :vytask:`T1421` OpenVPN client push-route stopped working, needs added quotes + to fix +* :vytask:`T1430` Add options for custom DHCP client-id and hostname +* :vytask:`T1447` Python subprocess called without import in host_name.py +* :vytask:`T1470` improve output of "show dhcpv6 server leases" +* :vytask:`T1485` Enable 'AdvIntervalOpt' option in for radvd.conf +* :vytask:`T1496` Separate rolling release and LTS kernel builds +* :vytask:`T1560` "set load-balancing wan rule 0" causes segfault and prevent + load balancing from starting +* :vytask:`T1568` strip-private command improvement for additional masking o + IPv6 and MAC address +* :vytask:`T1578` completion offers "show table", but show table does not exist +* :vytask:`T1593` Support ip6gre +* :vytask:`T1597` /usr/sbin/rsyslogd after deleting "system syslog" +* :vytask:`T1638` vyos-hostsd not setting system domain name +* :vytask:`T1678` hostfile-update missing line feed +* :vytask:`T1694` NTPd: Do not listen on all interfaces by default +* :vytask:`T1701` Delete domain-name and domain-search won't work +* :vytask:`T1705` High CPU usage by bgpd when snmp is active +* :vytask:`T1707` DHCP static mapping and exclude address not working +* :vytask:`T1708` Update Rolling Release Kernel to 4.19.76 +* :vytask:`T1709` Update WireGuard to 0.0.20190913 +* :vytask:`T1716` Update Intel NIC drivers to recent versions +* :vytask:`T1726` Update Linux Firmware binaries to a more recen + version 2019-03-14 -> 2019-10-07 +* :vytask:`T1728` Update Linux Kernel to 4.19.79 +* :vytask:`T1737` SNMP tab completion missing +* :vytask:`T1738` Copy SNMP configuration from node to node raises exception +* :vytask:`T1740` Broken OSPFv2 virtual-link authentication +* :vytask:`T1742` NHRP unable to commit. +* :vytask:`T1745` dhcp-server commit fails with "DHCP range stop address + must be greater or equal to the range start address y!" when static mapping + has same IP as range stop +* :vytask:`T1749` numeric validator doesn't support multiple ranges +* :vytask:`T1769` Remove complex SNMPv3 Transport Security Model (TSM) +* :vytask:`T1772` constraints in XML are partially broken +* :vytask:`T1778` Kilobits/Megabits difference in configuration Vyos/FRR +* :vytask:`T1780` Adding ipsec ike closeaction +* :vytask:`T1786` disable-dhcp-nameservers is missed in current host_name.p + implementation +* :vytask:`T1788` Intel QAT (QuickAssist Technology ) implementation +* :vytask:`T1792` Update WireGuard to Debian release 0.0.20191012-1 +* :vytask:`T1800` Update Linux Kernel to v4.19.84 +* :vytask:`T1809` Wireless: SSID scan does not work in AP mode +* :vytask:`T1811` Upgrade from 1.1.8: Config file migratio + failed: module=l2tp +* :vytask:`T1812` DHCP: hostnames of clients not resolving afte + update v1.2.3 -> 1.2-rolling +* :vytask:`T1819` Reboot kills SNMPv3 configuration +* :vytask:`T1822` Priority inversion wireless interface dhcpv6 +* :vytask:`T1825` Improve DHCP configuration error message +* :vytask:`T1836` import-conf-mode-commands in vyos-1x/scripts fails + to create an xml +* :vytask:`T1839` LLDP shows "VyOS unknown" instead of "VyOS" +* :vytask:`T1841` PPP ipv6-up.d direcotry missing +* :vytask:`T1893` igmp-proxy: Do not allow adding unknown interface +* :vytask:`T1903` Implementation udev predefined interface naming +* :vytask:`T1904` update eth1 and eth2 link files for the vep4600 \ No newline at end of file diff --git a/docs/changelog/rst-1.2.5.rst b/docs/changelog/rst-1.2.5.rst new file mode 100644 index 00000000..438e84f2 --- /dev/null +++ b/docs/changelog/rst-1.2.5.rst @@ -0,0 +1,70 @@ +1.2.5 +===== + +1.2.5 is a maintenance release made in April 2020. + +Resolved issues +--------------- + +* :vytask:`T1020` OSPF Stops distributing default route after a while +* :vytask:`T1228` pppoe default-route force option not working (Rel 1.2.0-rc11) +* :vytask:`T1301` bgp peer-groups don't work when "no-ipv4-unicast" is enabled. +* :vytask:`T1341` Adding rate-limiter for pppoe server users +* :vytask:`T1376` Incorrect DHCP lease counting +* :vytask:`T1392` Large firewall rulesets cause the system to lose configuration + and crash at startup +* :vytask:`T1416` 2 dhcp server run in failover mode can't sync hostname with + each other +* :vytask:`T1452` accel-pppoe - add vendor option to shaper +* :vytask:`T1490` BGP configuration (is lost|not applied) when updating + 1.1.8 -> 1.2.1 +* :vytask:`T1780` Adding ipsec ike closeaction +* :vytask:`T1803` Unbind NTP while it's not requested... +* :vytask:`T1821` "authentication mode radius" has no effect for PPPoE server +* :vytask:`T1827` Increase default gc_thresh +* :vytask:`T1828` Missing completion helper for "set system syslog host + 192.0.2.1 facility all protocol" +* :vytask:`T1832` radvd adding feature DNSSL branch.example.com example.com to + existing package +* :vytask:`T1837` PPPoE unrecognized option 'replacedefaultroute' +* :vytask:`T1851` wireguard - changing the pubkey on an existing peer seems to + destroy the running config. +* :vytask:`T1858` l2tp: Delete depricated outside-nexthop and add gateway-address +* :vytask:`T1864` Lower IPSec DPD timeout lower limit from 10s -> 2s +* :vytask:`T1879` Extend Dynamic DNS XML definition value help strings and + validators +* :vytask:`T1881` Execute permissions are removed from custom SNMP scripts at + commit time +* :vytask:`T1884` Keeping VRRP transition-script native behaviour and adding + stop-script +* :vytask:`T1891` Router announcements broken on boot +* :vytask:`T1900` Enable SNMP for VRRP. +* :vytask:`T1902` Add redistribute non main table in bgp +* :vytask:`T1909` Incorrect behaviour of static routes with overlapping networks +* :vytask:`T1913` "system ipv6 blacklist" command has no effect +* :vytask:`T1914` IPv6 multipath hash policy does not apply +* :vytask:`T1917` Update WireGuard to Debian release 0.0.20191219-1 +* :vytask:`T1934` Change default hostname when deploy from OVA without params. +* :vytask:`T1935` NIC identification and usage problem in Hyper-V environments +* :vytask:`T1936` pppoe-server CLI control features +* :vytask:`T1964` SNMP Script-extensions allows names with spaces, but commit + fails +* :vytask:`T1967` BGP parameter "enforce-first-as" does not work anymore +* :vytask:`T1970` Correct adding interfaces on boot +* :vytask:`T1971` Missing modules in initrd.img for PXE boot +* :vytask:`T1998` Update FRR to 7.3 +* :vytask:`T2001` Error when router reboot +* :vytask:`T2032` Monitor bandwidth bits +* :vytask:`T2059` Set source-validation on bond vif don't work +* :vytask:`T2066` PPPoE interface can be created multiple times - last wins +* :vytask:`T2069` PPPoE-client does not works with service-name option +* :vytask:`T2077` ISO build from crux branch is failing +* :vytask:`T2079` Update Linux Kernel to v4.19.106 +* :vytask:`T2087` Add maxfail 0 option to pppoe configuration. +* :vytask:`T2100` BGP route adverisement wih checks rib +* :vytask:`T2120` "reset vpn ipsec-peer" doesn't work with named peers +* :vytask:`T2197` Cant add vif-s interface into a bridge +* :vytask:`T2228` WireGuard does not allow ports < 1024 to be used +* :vytask:`T2252` HTTP API add system image can return '504 Gateway Time-out' +* :vytask:`T2272` Set system flow-accounting disable-imt has syntax error +* :vytask:`T2276` PPPoE server vulnerability \ No newline at end of file diff --git a/docs/changelog/rst-1.2.6.rst b/docs/changelog/rst-1.2.6.rst new file mode 100644 index 00000000..70786d07 --- /dev/null +++ b/docs/changelog/rst-1.2.6.rst @@ -0,0 +1,108 @@ +1.2.6-S1 +======== + +1.2.6-S1 is a security release release made in September 2020. + +Resolved issues +--------------- + +VyOS 1.2.6 release was found to be suspectible to CVE-2020-10995. It's a low- +impact vulnerability in the PowerDNS recursor that allows an attacker to cause +performance degradation via a specially crafted authoritative DNS server reply. + +* :vytask:`T2899` remote syslog server migration error on update + +1.2.6 +===== + +1.2.6 is a maintenance release made in September 2020. + +.. _resovled issues 1.2.6: + +Resolved issues +--------------- + +* :vytask:`T103` DHCP server prepends shared network name to hostnames +* :vytask:`T125` Missing PPPoE interfaces in l2tp configuration +* :vytask:`T1194` cronjob is being setup even if not saved +* :vytask:`T1205` module pcspkr missing +* :vytask:`T1219` Redundant active-active configuration, asymmetric routing and + conntrack-sync cache +* :vytask:`T1220` Show transceiver information from plugin modules, e.g SFP+, + QSFP +* :vytask:`T1221` BGP - Default route injection is not processed by the specific + route-map +* :vytask:`T1241` Remove of policy route throws CLI error +* :vytask:`T1291` Under certain conditions the VTI will stay forever down +* :vytask:`T1463` Missing command `show ip bgp scan` appears in command + completion +* :vytask:`T1575` `show snmp mib ifmib` crashes with IndexError +* :vytask:`T1699` Default net.ipv6.route.max_size 32768 is too low +* :vytask:`T1729` PIM (Protocol Independent Multicast) implementation +* :vytask:`T1901` Semicolon in values is interpreted as a part of the shell + command by validators +* :vytask:`T1934` Change default hostname when deploy from OVA without params. +* :vytask:`T1938` syslog doesn't start automatically +* :vytask:`T1949` Multihop IPv6 BFD is unconfigurable +* :vytask:`T1953` DDNS service name validation rejects valid service names +* :vytask:`T1956` PPPoE server: support PADO-delay +* :vytask:`T1973` Allow route-map to match on BGP local preference value +* :vytask:`T1974` Allow route-map to set administrative distance +* :vytask:`T1982` Increase rotation for atop.acct +* :vytask:`T1983` Expose route-map when BGP routes are programmed in to FIB +* :vytask:`T1985` pppoe: Enable ipv6 modules without configured ipv6 pools +* :vytask:`T2000` strongSwan does not install routes to table 220 in certain + cases +* :vytask:`T2021` OSPFv3 doesn't support decimal area syntax +* :vytask:`T2062` Wrong dhcp-server static route subnet bytes +* :vytask:`T2091` swanctl.conf file is not generated properly is more than one + IPsec profile is used +* :vytask:`T2131` Improve syslog remote host CLI definition +* :vytask:`T2224` Update Linux Kernel to v4.19.114 +* :vytask:`T2286` IPoE server vulnerability +* :vytask:`T2303` Unable to delete the image version that came from OVA +* :vytask:`T2305` Add release name to "show version" command +* :vytask:`T2311` Statically configured name servers may not take precedence + over ones from DHCP +* :vytask:`T2327` Unable to create syslog server entry with different port +* :vytask:`T2332` Backport node option for a syslog server +* :vytask:`T2342` Bridge l2tpv3 + ethX errors +* :vytask:`T2344` PPPoE server client static IP assignment silently fails +* :vytask:`T2385` salt-minion: improve completion helpers +* :vytask:`T2389` BGP community-list unknown command +* :vytask:`T2398` op-mode "dhcp client leases interface" completion helper + misses interfaces +* :vytask:`T2402` Live ISO should warn when configuring that changes won't + persist +* :vytask:`T2443` NHRP: Add debugging information to syslog +* :vytask:`T2448` `monitor protocol bgp` subcommands fail with 'command + incomplete' +* :vytask:`T2458` Update FRR to 7.3.1 +* :vytask:`T2476` Bond member description change leads to network outage +* :vytask:`T2478` login radius: use NAS-IP-Address if defined source address +* :vytask:`T2482` Update PowerDNS recursor to 4.3.1 for CVE-2020-10995 +* :vytask:`T2517` vyos-container: link_filter: No such file or directory +* :vytask:`T2526` Wake-On-Lan CLI implementation +* :vytask:`T2528` "update dns dynamic" throws FileNotFoundError excepton +* :vytask:`T2536` "show log dns forwarding" still refers to dnsmasq +* :vytask:`T2538` Update Intel NIC drivers to recent release (preparation for + Kernel >=5.4) +* :vytask:`T2545` Show physical device offloading capabilities for specified + ethernet interface +* :vytask:`T2563` Wrong interface binding for Dell VEP 1445 +* :vytask:`T2605` SNMP service is not disabled by default +* :vytask:`T2625` Provide generic Library for package builds +* :vytask:`T2686` FRR: BGP: large-community configuration is not applied + properly after upgrading FRR to 7.3.x series +* :vytask:`T2701` `vpn ipsec pfs enable` doesn't work with IKE groups +* :vytask:`T2728` Protocol option ignored for IPSec peers in transport mode +* :vytask:`T2734` WireGuard: fwmark CLI definition is inconsistent +* :vytask:`T2757` "show system image version" contains additional new-line + character breaking output +* :vytask:`T2797` Update Linux Kernel to v4.19.139 +* :vytask:`T2822` Update Linux Kernel to v4.19.141 +* :vytask:`T2829` PPPoE server: mppe setting is implemented as node instead of + leafNode +* :vytask:`T2831` Update Linux Kernel to v4.19.142 +* :vytask:`T2852` rename dynamic dns interface breaks ddclient.cache permissions +* :vytask:`T2853` Intel QAT acceleration does not work \ No newline at end of file diff --git a/docs/changelog/rst-1.3.rst b/docs/changelog/rst-1.3.rst new file mode 100644 index 00000000..dc1b4620 --- /dev/null +++ b/docs/changelog/rst-1.3.rst @@ -0,0 +1,5978 @@ +############ +1.3 Equuleus +############ + +.. + Please don't add anything by hand. + This file is managed by the script: + _ext/releasenotes.py + + +2024-04-25 +========== + +* :vytask:`T6249` ``(default): ISO builder fails because of changed buster-backport repository`` + + +2024-04-23 +========== + +* :vytask:`T6261` ``(default): Typo in op_mode connect_disconnect print statement for check_ppp_running`` + + +2024-04-17 +========== + +* :vytask:`T6243` ``(bug): Update vyos-http-api-tools for package idna security advisory`` + + +2024-04-12 +========== + +* :vytask:`T3437` ``(bug): BGP Confederation Addition Causes Error`` + + +2024-04-10 +========== + +* :vytask:`T6124` ``(bug): Docker equuleus build image doesn't build due to fpm`` + + +2024-04-08 +========== + +* :vytask:`T6196` ``(bug): Route-map and summary-only do not work in BGP aggregation at the same time`` + + +2024-04-07 +========== + +* :vytask:`T1244` ``(default): Support for StartupResync in conntrackd`` + + +2024-04-05 +========== + +* :vytask:`T2590` ``(bug): DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c`` + + +2024-04-04 +========== + +* :vytask:`T4146` ``(bug): Nginx should not listen on port 80`` +* :vytask:`T1976` ``(default): deleting address-family under neighbor will disable neighbor`` +* :vytask:`T5625` ``(default): "restart vpn" does not work if ipsec-interfaces is not set`` +* :vytask:`T3020` ``(bug): The "scp" example is wrong in the bash-completion for "set system config-management commit-archive location"`` +* :vytask:`T2250` ``(default): vyos-build "make iso" error if configure was ran outside of the docker container`` +* :vytask:`T2139` ``(default): openvpn: allow "dh-file none" to disable DH for ECDH keys`` +* :vytask:`T2014` ``(default): Use vendor specific NTP Pool hostname`` +* :vytask:`T1118` ``(bug): Obsolete "utc" option in time selector in firewall`` +* :vytask:`T948` ``(feature): integrate aws cloud watch scripts into AMI`` + + +2024-04-02 +========== + +* :vytask:`T6150` ``(bug): Impossible to set a static IP address via Radius in IPoE`` + + +2024-04-01 +========== + +* :vytask:`T6193` ``(bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP name-server option" for VLAN interfaces`` + + +2024-03-22 +========== + +* :vytask:`T6110` ``(bug): dhcp server - If failover is defined, range is required`` +* :vytask:`T5624` ``(default): Remove /etc/debian_version from the image`` + + +2024-03-11 +========== + +* :vytask:`T2998` ``(bug): SNMP v3 oid "exclude" option doesn't work`` +* :vytask:`T6096` ``(bug): Config commits are not synced properly because 00vyos-sync is deleted by vyos-router`` +* :vytask:`T6057` ``(feature): Add ability to disable syslog for conntrackd`` +* :vytask:`T5504` ``(feature): Keepalived VRRP ability to set more than one peer-address`` + + +2024-03-07 +========== + +* :vytask:`T3992` ``(bug): Traceback on adding interface to bridge with configured ip address`` + + +2024-03-06 +========== + +* :vytask:`T6088` ``(bug): Configuration corrupted after saving and powercut or force reboot`` + + +2024-02-16 +========== + +* :vytask:`T2113` ``(bug): OpenVPN Options error: you cannot use --verify-x509-name with --compat-names or --no-name-remapping`` +* :vytask:`T5418` ``(bug): PPPoE-Server Client IP pool Subnet`` + + +2024-02-15 +========== + +* :vytask:`T2612` ``(bug): HTTPS API, changing API key fails but goes through`` +* :vytask:`T656` ``(enhancment): Rewrite wirelessmodem in new style XML interface definition`` + + +2024-02-14 +========== + +* :vytask:`T2044` ``(bug): RPKI doesn't boot properly`` + + +2024-02-08 +========== + +* :vytask:`T6014` ``(feature): Bump keepalived version`` + + +2024-02-07 +========== + +* :vytask:`T6017` ``(bug): Update vyos-http-api-tools for security advisory`` + + +2024-02-02 +========== + +* :vytask:`T5914` ``(bug): CVE-2023-48795 - Terrapin vulnerability`` +* :vytask:`T5739` ``(bug): Password recovery does not work if public keys are configured`` + + +2024-02-01 +========== + +* :vytask:`T5967` ``(bug): Multi-hop BFD connections can't be established; please add minimum-ttl option.`` + + +2024-01-22 +========== + +* :vytask:`T4721` ``(feature): Static IPv6 Route Tags Missing`` + + +2024-01-20 +========== + +* :vytask:`T5187` ``(bug): Update Realtek r8152 driver`` +* :vytask:`T5182` ``(bug): Update Intel ice driver`` +* :vytask:`T5180` ``(bug): initramfs-tools ignores firmware from updates directory`` +* :vytask:`T4990` ``(bug): Commit results may not be properly saved if power is cut immediately after a successful commit`` +* :vytask:`T4039` ``(feature): Rsyslog to use 'protocol23format' for protocol UDP`` +* :vytask:`T3813` ``(bug): Some custom sysctl parameters can't be applied bug`` +* :vytask:`T2579` ``(feature): The root task for VRF features`` +* :vytask:`T2546` ``(feature): The root task for rewriting [op-mode] to XML`` +* :vytask:`T2452` ``(default): Serial console related issues`` + + +2024-01-19 +========== + +* :vytask:`T5543` ``(bug): Fix source address handling in static joins`` + + +2024-01-14 +========== + +* :vytask:`T5715` ``(bug): IPSec VPN: restart vpn is not working`` + + +2024-01-13 +========== + +* :vytask:`T5924` ``(bug): Build cannot pass the smoketest dialup-router-medium-vpn`` + + +2024-01-11 +========== + +* :vytask:`T5275` ``(default): Add op mode commands for exporting certificates to PEM files with correct headers`` +* :vytask:`T5274` ``(default): Add a deprecation warning for OpenVPN site-to-site with pre-shared secret`` +* :vytask:`T3191` ``(bug): PAM RADIUS freezing when accounting does not configured on RADIUS server`` + + +2024-01-10 +========== + +* :vytask:`T4646` ``(bug): USB serial output console does not work`` +* :vytask:`T4466` ``(bug): intel i225-v nic does not detect link after boot`` +* :vytask:`T4222` ``(feature): Support for TWAMP as round-trip metric`` +* :vytask:`T1369` ``(bug): GCP Networking Failure`` + + +2024-01-09 +========== + +* :vytask:`T3242` ``(bug): PPPoE Server overhead on virtual interfaces creation`` +* :vytask:`T2755` ``(default): Requirements for partial interface setup`` +* :vytask:`T2494` ``(bug): systemd dependencies issues`` +* :vytask:`T2343` ``(feature): Disable memory ballooning in VM templates`` +* :vytask:`T2254` ``(default): Provide more information on the build branch in the version data`` +* :vytask:`T2223` ``(feature): convert operational show interfaces to python/XML`` +* :vytask:`T1925` ``(bug): DMVPN is always listed as down in "show vpn ipsec sa"`` +* :vytask:`T1297` ``(feature): Add GARP settings to VRRP/keepalived`` + + +2024-01-08 +========== + +* :vytask:`T5318` ``(bug): Security Vulnerabilities for VyOS 1.3.3`` +* :vytask:`T3980` ``(bug): vrrp transition-script validator makes warning fatal and also causes a python NameError exception`` +* :vytask:`T2799` ``(feature): VyOS Certificates Manager`` + + +2023-12-29 +========== + +* :vytask:`T5852` ``(bug): Reboots fail with eapol WAN interface`` + + +2023-12-22 +========== + +* :vytask:`T4760` ``(bug): VyOS does not support running multiple instances of DHCPv6 clients`` + + +2023-12-21 +========== + +* :vytask:`T5714` ``(bug): IPSec VPN: op-mode: "show log vpn" does not show results`` +* :vytask:`T3039` ``(feature): Resize a root partition and filesystem automatically during deployment in virtual environments`` +* :vytask:`T2404` ``(bug): Cannot change MTU`` +* :vytask:`T2353` ``(bug): Interface [conf_mode] errors parent task`` +* :vytask:`T5796` ``(bug): Openconnect - HTTPS security headers are missing`` + + +2023-12-19 +========== + +* :vytask:`T2116` ``(feature): Processing configuration via Cloud-init User-Data`` + + +2023-12-18 +========== + +* :vytask:`T2191` ``(feature): Using tallow to block sshd probes`` + + +2023-12-15 +========== + +* :vytask:`T5824` ``(bug): busybox cannot connect some websites from initramfs`` + + +2023-12-12 +========== + +* :vytask:`T5817` ``(bug): Show openvpn server fails in some cases`` +* :vytask:`T5413` ``(default): Deny the opportunity to use one public/private key pair on both wireguard peers.`` + + +2023-11-30 +========== + +* :vytask:`T4601` ``(bug): dhcp : relay agent IP address issue.`` + + +2023-11-28 +========== + +* :vytask:`T5777` ``(bug): frr: backport and upstream recent bgpd daemon crashes`` + + +2023-11-27 +========== + +* :vytask:`T5763` ``(bug): Fix imprecise check for remote file name in vyos-load-config.py`` + + +2023-11-25 +========== + +* :vytask:`T5655` ``(bug): commit-archive: Ctrl+C should not eror out with stack trace, signal should be cought`` + + +2023-11-24 +========== + +* :vytask:`T5402` ``(bug): VRRP router with rfc3768-compatibility sends multiple ARP replies`` + + +2023-11-22 +========== + +* :vytask:`T5578` ``(bug): "ikev2-reauth" description contains outdated information`` + + +2023-11-15 +========== + +* :vytask:`T5661` ``(enhancment): Add show show ssh dynamic-protection attacker and show log ssh dynamic-protection`` +* :vytask:`T1276` ``(bug): dhcp relay + VLAN fails`` + + +2023-11-07 +========== + +* :vytask:`T5586` ``(feature): Disable by default SNMP for Keepalived VRRP`` + + +2023-11-06 +========== + +* :vytask:`T4269` ``(feature): node.def generator should automatically add default values`` + + +2023-10-26 +========== + +* :vytask:`T5684` ``(bug): services using VRF generates the error "Failed to load BPF prog: 'Operation not permitted'" when the system boots.`` +* :vytask:`T5594` ``(bug): VRRP - Error if using IPv6 Link Local as hello source address`` + + +2023-10-21 +========== + +* :vytask:`T5670` ``(bug): bridge: missing member interface validator`` +* :vytask:`T5191` ``(default): Replace underscores with hyphens in command-line options generated by vyos.opmode`` +* :vytask:`T4402` ``(bug): OpenVPN client-ip-pool option is broken`` +* :vytask:`T2719` ``(feature): Standardized op mode script structure`` + + +2023-10-19 +========== + +* :vytask:`T5669` ``(bug): VXLAN interface changing port does not work`` + + +2023-10-17 +========== + +* :vytask:`T5235` ``(bug): SSH keys with special characters cannot be applied via Cloud-init`` + + +2023-10-08 +========== + +* :vytask:`T5630` ``(feature): pppoe: allow to specify MRU in addition to already configurable MTU`` + + +2023-10-06 +========== + +* :vytask:`T5576` ``(feature): Add bgp remove-private-as all option`` + + +2023-10-04 +========== + +* :vytask:`T5632` ``(feature): Add jq package to parse JSON files`` + + +2023-09-25 +========== + +* :vytask:`T5533` ``(bug): Keepalived VRRP IPv6 group enters in FAULT state`` + + +2023-09-20 +========== + +* :vytask:`T5271` ``(default): Add support for peer-fingerprint to OpenVPN`` + + +2023-09-11 +========== + +* :vytask:`T5557` ``(bug): bgp: Use treat-as-withdraw for tunnel encapsulation attribute CVE-2023-38802`` +* :vytask:`T3424` ``(default): PPPoE IA-PD doesn't work in VRF`` + + +2023-09-10 +========== + +* :vytask:`T5555` ``(bug): Fix timezone migrator (system 13-to-14)`` +* :vytask:`T5545` ``(bug): sflow is not working`` + + +2023-09-08 +========== + +* :vytask:`T4426` ``(default): Add arpwatch to the image`` + + +2023-09-05 +========== + +* :vytask:`T5524` ``(feature): Add config directory to liveCD`` +* :vytask:`T2958` ``(bug): DHCP server doesn't work from a live CD`` +* :vytask:`T5428` ``(bug): dhcp: client renewal fails when running inside VRF`` + + +2023-09-04 +========== + +* :vytask:`T5506` ``(bug): Container bridge interfaces do not have a link-local address`` + + +2023-08-31 +========== + +* :vytask:`T5190` ``(feature): Cloud-Init cannot fetch Meta-data on machines where the main Ethernet interface is not eth0`` +* :vytask:`T5140` ``(bug): Firewall network-group problems`` +* :vytask:`T4895` ``(bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data`` +* :vytask:`T4874` ``(default): Add Warning message to Equuleus`` +* :vytask:`T4855` ``(bug): Trying to create more than one tunnel of the same type to the same address causes unhandled exception`` +* :vytask:`T4776` ``(bug): NVME storage is not detected properly during installation`` +* :vytask:`T3546` ``(feature): Add support for running scripts on PPPoE server session events`` +* :vytask:`T738` ``(feature): Add local-port and resolver port options for powerdns in CLI configuration tree`` + + +2023-08-30 +========== + +* :vytask:`T5221` ``(bug): BGP as-override behavior differs from new FRR and other vendors`` +* :vytask:`T4933` ``(default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a nondescript error`` +* :vytask:`T4790` ``(bug): RADIUS login does not work if sum of timeouts more than 50s`` +* :vytask:`T4475` ``(bug): route-map does not support ipv6 peer`` +* :vytask:`T4459` ``(bug): API service with VRF doesn't work in 1.3.1`` +* :vytask:`T4407` ``(bug): Network-config v2 is broken in Cloud-init 22.1 and VyOS 1.3`` +* :vytask:`T4113` ``(bug): Incorrect GRUB configuration parsing`` +* :vytask:`T1764` ``(bug): Use lists instead of whitespace-separated strings in vyos.config`` +* :vytask:`T4121` ``(bug): Nameservers from DHCP client cannot be used in specific cases`` +* :vytask:`T4151` ``(feature): IPV6 local PBR Support`` +* :vytask:`T4306` ``(default): Do not check for ditry repository when building release images`` + + +2023-08-29 +========== + +* :vytask:`T3940` ``(bug): DHCP client does not remove IP address when stopped by the 02-vyos-stopdhclient hook`` +* :vytask:`T3713` ``(default): Create a meta-package for user utilities`` +* :vytask:`T3339` ``(bug): Cloud-Init domain search setting not applied`` +* :vytask:`T2640` ``(feature): Running VyOS inside Docker containers`` +* :vytask:`T3577` ``(bug): Generating vpn x509 key pair fails with command not found`` + + +2023-08-28 +========== + +* :vytask:`T4745` ``(bug): CLI TAB issue with values with '-' at the beginning in conf mode`` +* :vytask:`T2611` ``(bug): Prefix list names are shared between ipv4 and ipv6`` +* :vytask:`T2296` ``(default): Upgrade WALinux to 2.2.41`` +* :vytask:`T2123` ``(default): Configure 3 NTP servers`` +* :vytask:`T469` ``(bug): Problem after commit with errors`` + + +2023-08-25 +========== + +* :vytask:`T4412` ``(bug): commit archive: reboot not working with sftp`` +* :vytask:`T3702` ``(feature): Policy: Allow routing by fwmark`` +* :vytask:`T3536` ``(default): Unable to list all available routes`` + + +2023-08-24 +========== + +* :vytask:`T5006` ``(bug): Http api segfault with concurrent requests`` +* :vytask:`T5305` ``(bug): REST API configure operation should not be defined as async`` + + +2023-08-23 +========== + +* :vytask:`T5387` ``(feature): dhcp6c: add a no release option`` + + +2023-08-20 +========== + +* :vytask:`T5470` ``(bug): wlan: can not disable interface if SSID is not configured`` + + +2023-08-17 +========== + +* :vytask:`T5486` ``(bug): Service dns dynamic cannot pass the smoketest`` +* :vytask:`T5223` ``(bug): tunnel key doesn't clear`` + + +2023-08-15 +========== + +* :vytask:`T5273` ``(default): Add op mode commands for displaying certificate details and fingerprints`` +* :vytask:`T5270` ``(default): Make OpenVPN `tls dh-params` optional`` + + +2023-08-10 +========== + +* :vytask:`T5329` ``(bug): Wireguard interface as GRE tunnel source causes configuration error on boot`` + + +2023-07-24 +========== + +* :vytask:`T5354` ``(feature): Add sshguard to protect against brut-forces for 1.3`` + + +2023-07-17 +========== + +* :vytask:`T2051` ``(bug): Throughput anomalies`` + + +2023-07-14 +========== + +* :vytask:`T305` ``(default): loadbalancing does not work with one pppoe connection and another connection of either dhcp or static`` + + +2023-07-13 +========== + +* :vytask:`T3045` ``(bug): Changes to Conntrack-Sync don't apply correctly (Mutlicast->UDP)`` +* :vytask:`T971` ``(bug): authentication public-keys options quoting issue`` + + +2023-07-12 +========== + +* :vytask:`T5009` ``(bug): op-mode command: restart dhcp relay-agent not working`` +* :vytask:`T4927` ``(bug): Need to change restart to reload-or-restart in Webproxy module`` +* :vytask:`T3835` ``(bug): vyos router 1.2.7 snmp Dos bug`` +* :vytask:`T4959` ``(feature): Add container registry authentication config for containers`` +* :vytask:`T425` ``(feature): AWS CloudWatch monitoring scripts`` + + +2023-07-11 +========== + +* :vytask:`T4862` ``(bug): webproxy domain-block does not work`` +* :vytask:`T4844` ``(bug): Incorrect permissions of the safeguard DB directory`` +* :vytask:`T4262` ``(bug): install image doesn't respect chosen root partition size`` +* :vytask:`T3810` ``(bug): webproxy squidguard rules don't work properly after rewriting to python.`` +* :vytask:`T1928` ``(bug): Is the 'Welcome to VyOS' message when using SSH an information leak?`` +* :vytask:`T4737` ``(bug): FRRouting/zebra 7.5.1 does not redistribute routes to other protocols`` +* :vytask:`T3852` ``(bug): DHCP client issue - interface has two dhclient processes when link is unpluged and then plug again`` +* :vytask:`T2118` ``(bug): Failure to boot after power outage due to dirty filesystem and no fsck in initramfs`` + + +2023-07-05 +========== + +* :vytask:`T5331` ``(bug): ath10k_pci not functioning`` + + +2023-06-30 +========== + +* :vytask:`T5315` ``(feature): vrrp: add support for version 3`` +* :vytask:`T5313` ``(bug): UDP broadcast relay - missing verify() that relay interfaces have an IP address assigned`` + + +2023-06-26 +========== + +* :vytask:`T5272` ``(default): Upgrade OpenVPN to 2.6 in Equuleus`` +* :vytask:`T5265` ``(bug): WAN load-balancing: missing completion helpers`` + + +2023-06-25 +========== + +* :vytask:`T5240` ``(bug): Service router-advert failed to start radvd with more then 3 name-servers`` + + +2023-06-21 +========== + +* :vytask:`T5280` ``(bug): Update Expired keys (2023-06-08) for PowerDNS`` + + +2023-06-13 +========== + +* :vytask:`T5213` ``(feature): Accel-ppp sending accounting interim updates acct-interim-interval option`` + + +2023-05-29 +========== + +* :vytask:`T5243` ``(bug): Default route is inactive if an interface has multiple ip addresses of the same subnet in 1.3.2 Equuleus`` + + +2023-05-19 +========== + +* :vytask:`T5186` ``(bug): QoS test cannot pass for 1.3`` + + +2023-05-12 +========== + +* :vytask:`T2769` ``(feature): Add VRF support for syslog`` + + +2023-05-08 +========== + +* :vytask:`T5212` ``(bug): snmp community name -error with special carracter`` + + +2023-04-27 +========== + +* :vytask:`T5175` ``(bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0`` +* :vytask:`T5176` ``(bug): http-api: update vyos-http-api-tools for FastAPI security vulnerability`` + + +2023-04-13 +========== + +* :vytask:`T5152` ``(bug): Telegraf agent hostname isn't qualified`` +* :vytask:`T4727` ``(feature): Add RADIUS rate limit support to PPTP server`` +* :vytask:`T4939` ``(bug): VRRP command no-preempt not work as expected`` +* :vytask:`T3608` ``(default): Standardize warnings from configure scripts`` + + +2023-04-05 +========== + +* :vytask:`T4975` ``(bug): CLI does not work after cutting off the power or reset`` +* :vytask:`T5136` ``(bug): Possible config corruption on upgrade`` + + +2023-04-01 +========== + +* :vytask:`T5047` ``(bug): Recreate only a specific container`` + + +2023-03-31 +========== + +* :vytask:`T5111` ``(bug): pppd-dns.service startup failed`` + + +2023-03-29 +========== + +* :vytask:`T5033` ``(bug): generate-public-key command fails for address with multiple public keys like GitHub`` +* :vytask:`T5097` ``(bug): the operational command "show interfaces ethernet ethx" doesn't reflect a call to 'clear counters'`` + + +2023-03-21 +========== + +* :vytask:`T5098` ``(feature): PPPoE client holdoff configuration`` + + +2023-03-19 +========== + +* :vytask:`T4925` ``(feature): Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2`` + + +2023-03-16 +========== + +* :vytask:`T3083` ``(feature): Add feature event-handler`` +* :vytask:`T2516` ``(bug): vyos-container: cannot configure ethernet interface`` + + +2023-03-09 +========== + +* :vytask:`T5066` ``(bug): Different GRE tunnel but same tunnel keys error`` + + +2023-03-08 +========== + +* :vytask:`T4381` ``(default): OpenVPN: Add "Tunnel IP" column in "show openvpn server" operational command`` +* :vytask:`T4872` ``(bug): Op-mode show openvpn misses a case when parsing for tunnel IP`` + + +2023-03-07 +========== + +* :vytask:`T2838` ``(bug): Ethernet device names changing, multiple hw-id being added`` +* :vytask:`T2649` ``(default): Ensure configration mode scripts conform to coding guidelines`` +* :vytask:`T4900` ``(default): Cache intermediary results of get_config_diff in Config instance`` + + +2023-03-03 +========== + +* :vytask:`T4625` ``(enhancment): Update ocserv to current revision (1.1.6)`` + + +2023-02-28 +========== + +* :vytask:`T4955` ``(bug): Openconnect radiusclient.conf generating with extra authserver`` +* :vytask:`T4219` ``(feature): support incoming-interface (iif) in local PBR`` + + +2023-02-25 +========== + +* :vytask:`T5008` ``(bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine`` +* :vytask:`T5007` ``(bug): Interface multicast setting is invalid`` +* :vytask:`T5017` ``(bug): Bug with validator interface-name`` +* :vytask:`T4992` ``(bug): Incorrect check is_local_address for bgp neighbor with option ip_nonlocal_bind set`` +* :vytask:`T4978` ``(bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.4-rolling-202302041536`` +* :vytask:`T4948` ``(feature): pppoe: add CLI option to allow definition of host-uniq flag`` + + +2023-02-22 +========== + +* :vytask:`T5011` ``(bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu check should be skipped`` + + +2023-02-18 +========== + +* :vytask:`T4743` ``(feature): Enable IPv6 address for Dynamic DNS`` + + +2023-02-16 +========== + +* :vytask:`T4971` ``(feature): Radius attribute "Framed-Pool" for PPPoE`` + + +2023-02-15 +========== + +* :vytask:`T4993` ``(bug): Can't delete conntrack ignore rule`` + + +2023-02-14 +========== + +* :vytask:`T4999` ``(feature): vyos.util backport dict_search_recursive`` +* :vytask:`T1993` ``(feature): Extended pppoe rate-limiter`` + + +2023-02-13 +========== + +* :vytask:`T4153` ``(bug): Monitor bandwidth-test initiate not working`` + + +2023-02-11 +========== + +* :vytask:`T2603` ``(feature): pppoe-server: reduce min MTU`` + + +2023-02-08 +========== + +* :vytask:`T1288` ``(feature): FRR: rewrite staticd backend (/opt/vyatta/share/vyatta-cfg/templates/protocols/static/*)`` + + +2023-02-07 +========== + +* :vytask:`T4117` ``(bug): Does not possible to configure PoD/CoA for L2TP vpn`` + + +2023-02-01 +========== + +* :vytask:`T4970` ``(default): pin OCaml pcre package to avoid JIT support`` + + +2023-01-30 +========== + +* :vytask:`T4954` ``(bug): DNS cannot be configured via Network-Config v1 received from ConfigDrive / Cloud-Init`` + + +2023-01-24 +========== + +* :vytask:`T4949` ``(feature): Backport "monitor log" and "show log" op-mode definitions from current to equuleus`` +* :vytask:`T4947` ``(feature): Support mounting container volumes as ro or rw`` + + +2023-01-23 +========== + +* :vytask:`T4798` ``(default): Migrate the file-exists validator away from Python`` +* :vytask:`T4683` ``(enhancment): Add kitty-terminfo package to build`` +* :vytask:`T4875` ``(default): Replace Python validator 'interface-name' to avoid Python startup cost`` +* :vytask:`T4664` ``(bug): Add validation to reject whitespace in tag node value names`` + + +2023-01-22 +========== + +* :vytask:`T4906` ``(bug): ipsec connections shows only one connection as up`` + + +2023-01-21 +========== + +* :vytask:`T4896` ``(bug): ospfv3: Fix broken not-advertise option`` +* :vytask:`T4799` ``(bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd`` + + +2023-01-17 +========== + +* :vytask:`T4902` ``(bug): snmpd: exclude container storage from monitoring`` + + +2023-01-15 +========== + +* :vytask:`T4832` ``(feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)`` +* :vytask:`T4918` ``(bug): Odd show interface behavior`` + + +2023-01-09 +========== + +* :vytask:`T4922` ``(feature): Add ssh-client source-interface CLI option`` + + +2023-01-07 +========== + +* :vytask:`T4884` ``(bug): Missing a community6 in snmpd config`` + + +2023-01-05 +========== + +* :vytask:`T3937` ``(default): Rewrite "show system memory" in Python to make it usable as a library function`` + + +2023-01-03 +========== + +* :vytask:`T4869` ``(bug): A network with `/32` or `/128` mask cannot be removed from a network-group`` + + +2022-12-31 +========== + +* :vytask:`T4898` ``(feature): Add mtu config option for dummy interfaces`` + + +2022-12-26 +========== + +* :vytask:`T4511` ``(bug): IPv6 DNS lookup`` +* :vytask:`T4809` ``(feature): radvd: Allow use of AdvRASrcAddress`` + + +2022-12-18 +========== + +* :vytask:`T4709` ``(bug): TCP MSS clamping broken in equuleus`` + + +2022-12-15 +========== + +* :vytask:`T4671` ``(bug): linux-firmware package is missing symlinks defined in WHENCE file`` + + +2022-12-04 +========== + +* :vytask:`T4825` ``(feature): interfaces veth/veth-pairs -standalone used`` + + +2022-12-02 +========== + +* :vytask:`T4122` ``(bug): interface ip address config missing after upgrade from 1.2.8 to 1.3.0 (when redirect is configured?)`` +* :vytask:`T1024` ``(feature): Policy Based Routing by DSCP`` + + +2022-11-23 +========== + +* :vytask:`T4793` ``(feature): Create warning message about disable-route-autoinstall when ipsec vti is used`` + + +2022-11-21 +========== + +* :vytask:`T4812` ``(feature): IPsec ability to show all configured connections`` + + +2022-11-06 +========== + +* :vytask:`T2913` ``(bug): Failure to install fpm while building builder docker image`` + + +2022-11-04 +========== + +* :vytask:`T2417` ``(feature): Python validator cleanup`` + + +2022-11-01 +========== + +* :vytask:`T4177` ``(bug): Strip-private doesn't work for service monitoring`` + + +2022-10-31 +========== + +* :vytask:`T1875` ``(feature): Add the ability to use network address as BGP neighbor (bgp listen range)`` +* :vytask:`T4785` ``(feature): snmp: Allow !, @, * and # in community name`` + + +2022-10-21 +========== + +* :vytask:`T2189` ``(bug): Adding a large port-range will take ~ 20 minutes to commit`` + + +2022-10-18 +========== + +* :vytask:`T4533` ``(bug): Radius clients don’t have simple permissions`` + + +2022-10-13 +========== + +* :vytask:`T4312` ``(bug): Telegraf configuration doesn't accept IPs for URL`` + + +2022-10-12 +========== + +* :vytask:`T4730` ``(bug): Conntrack-sync error - listen-address is not the correct type in config as it should be`` + + +2022-10-11 +========== + +* :vytask:`T4680` ``(bug): Telegraf prometheus-client listen-address invalid format`` + + +2022-10-04 +========== + +* :vytask:`T4702` ``(bug): Wireguard peers configuration is not synchronized with CLI`` +* :vytask:`T4652` ``(feature): Upgrade PowerDNS recursor to 4.7 series`` +* :vytask:`T4648` ``(default): PPPoE: Ignore default router from RA when PPPoE default-route is set to none`` +* :vytask:`T4582` ``(default): Router-advert: Preferred lifetime cannot equal valid lifetime in PIOs`` + + +2022-09-17 +========== + +* :vytask:`T4666` ``(bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584`` + + +2022-09-15 +========== + +* :vytask:`T4679` ``(bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address`` +* :vytask:`T4630` ``(bug): Prevent attempts to use the same interface as a source interface for pseudo-ethernet and MACsec at the same time`` + + +2022-09-12 +========== + +* :vytask:`T4647` ``(feature): Add Google Virtual NIC (gVNIC) support`` + + +2022-09-05 +========== + +* :vytask:`T4668` ``(bug): Adding/removing members from bond doesn't work/results in incorrect interface state`` +* :vytask:`T4628` ``(bug): ConfigTree() throws ValueError() if tagNode contains whitespaces`` + + +2022-08-29 +========== + +* :vytask:`T4653` ``(bug): Interface offload options are not applied correctly`` +* :vytask:`T4061` ``(default): Add util function to check for completion of boot config`` +* :vytask:`T4654` ``(bug): RPKI cache incorrect description`` +* :vytask:`T4572` ``(bug): Add an option to force interface MTU to the value received from DHCP`` + + +2022-08-26 +========== + +* :vytask:`T4642` ``(bug): proxy: hyphen not allowed in proxy URL`` + + +2022-08-23 +========== + +* :vytask:`T4618` ``(bug): Traffic policy not set on virtual interfaces`` +* :vytask:`T4538` ``(bug): Macsec does not work correctly when the interface status changes.`` + + +2022-08-22 +========== + +* :vytask:`T4629` ``(bug): Raised ConfigErrors contain dict instead of only the dict key`` +* :vytask:`T4632` ``(bug): VLAN-aware bridge not working`` + + +2022-08-19 +========== + +* :vytask:`T4616` ``(bug): openconnect: KeyError: 'local_users'`` +* :vytask:`T4614` ``(feature): OpenConnect split-dns directive`` + + +2022-08-16 +========== + +* :vytask:`T4592` ``(bug): macsec: can not create two interfaces using the same source-interface`` +* :vytask:`T4584` ``(bug): hostap: create custom package build`` +* :vytask:`T4537` ``(bug): MACsec not working with cipher gcm-aes-256`` + + +2022-08-15 +========== + +* :vytask:`T4565` ``(bug): vlan aware bridge not working with - Kernel: T3318: update Linux Kernel to v5.4.205 #249`` +* :vytask:`T4206` ``(bug): Policy Based Routing with DHCP Interface Issue`` +* :vytask:`T2763` ``(feature): New SNMP resource request - SNMP over TCP`` + + +2022-08-14 +========== + +* :vytask:`T4579` ``(bug): bridge: can not delete member interface CLI option when VLAN is enabled`` +* :vytask:`T4421` ``(default): Add support for floating point numbers in the numeric validator`` +* :vytask:`T4415` ``(bug): Include license/copyright files in the image but remove user documentation from /usr/share/doc to reduce its size`` +* :vytask:`T4313` ``(bug): "generate public-key-command" throws unhandled exceptions when it cannot retrieve the key`` +* :vytask:`T4082` ``(bug): Add op mode command to restart ldpd`` +* :vytask:`T3714` ``(bug): Some sysctl custom parameters disappear after reboot`` +* :vytask:`T4260` ``(bug): Extend vyos.configdict.node_changed() to support recursiveness`` +* :vytask:`T3785` ``(default): Add unicode support to configtree backend`` +* :vytask:`T3507` ``(bug): Bond with mode LACP show u/u in show interfaces even if peer is not configured`` + + +2022-08-11 +========== + +* :vytask:`T4476` ``(default): Next steps after installation is not communicated properly to new users`` + + +2022-08-02 +========== + +* :vytask:`T4515` ``(default): Reduce telegraf binary size`` + + +2022-07-30 +========== + +* :vytask:`T4575` ``(feature): vyos.utill add new wrapper "rc_cmd" to get the return code and output`` +* :vytask:`T4532` ``(bug): Flow-accounting IPv6 server/receiver bug`` + + +2022-07-27 +========== + +* :vytask:`T4571` ``(bug): Sflow with vrf configured does not use vrf to validate agent-address IP from vrf-configured interfaces`` + + +2022-07-18 +========== + +* :vytask:`T4228` ``(bug): bond: OS error thrown when two bonds use the same member`` +* :vytask:`T4534` ``(bug): bond: bridge: error out if member interface is assigned to a VRF instance`` +* :vytask:`T4525` ``(bug): Delete interface from VRF and add it to bonding error`` +* :vytask:`T4522` ``(feature): bond: add ability to specify mii monitor interval via CLI`` +* :vytask:`T4521` ``(bug): bond: ARP monitor interval is not configured despite set via CLI`` + + +2022-07-14 +========== + +* :vytask:`T4491` ``(bug): Use empty string for internal name of root node of config_tree`` + + +2022-07-13 +========== + +* :vytask:`T1375` ``(feature): Add clear dhcp server lease function`` + + +2022-07-12 +========== + +* :vytask:`T4527` ``(bug): Prevent to create VRF name default`` +* :vytask:`T4084` ``(default): Dehardcode the default login banner`` +* :vytask:`T3864` ``(enhancment): Add Edgecore build to VyOS 1.3 Equuleus`` + + +2022-07-09 +========== + +* :vytask:`T4507` ``(feature): IPoE-server add multiplier option for shaper`` +* :vytask:`T4468` ``(bug): web-proxy source group cannot start with a number bug`` +* :vytask:`T4373` ``(feature): PPPoE-server add multiplier option for shaper`` + + +2022-07-07 +========== + +* :vytask:`T4456` ``(bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many messages`` +* :vytask:`T4509` ``(feature): Feature Request: DNS64`` + + +2022-07-06 +========== + +* :vytask:`T4513` ``(bug): Webproxy monitor commands do not work`` + + +2022-07-05 +========== + +* :vytask:`T4510` ``(bug): set system static-host-mapping doesn't allow IPv4 and IPv6 for same name.`` +* :vytask:`T2654` ``(bug): Multiple names unable to be assigned to the same static mapping`` +* :vytask:`T2683` ``(default): no dual stack in system static-host-mapping host-name`` + + +2022-07-01 +========== + +* :vytask:`T4489` ``(bug): MPLS sysctl not persistent for tunnel interfaces`` + + +2022-06-20 +========== + +* :vytask:`T1856` ``(feature): Support configuring IPSec SA bytes`` + + +2022-06-16 +========== + +* :vytask:`T3866` ``(bug): Configs with DNS forwarding listening on OpenVPN interfaces or interfaces without a fixed address cannot be migrated to the new syntax`` + + +2022-06-15 +========== + +* :vytask:`T1890` ``(feature): Metatask: rewrite flow-accounting to XML and Python`` + + +2022-06-09 +========== + +* :vytask:`T2580` ``(feature): Support for ip pools for ippoe`` + + +2022-06-08 +========== + +* :vytask:`T4447` ``(bug): DHCPv6 prefix delegation `sla-id` limited to 128`` +* :vytask:`T4350` ``(bug): DMVPN opennhrp spokes dont work behind NAT`` + + +2022-05-30 +========== + +* :vytask:`T4315` ``(feature): Telegraf - Output to prometheus`` + + +2022-05-27 +========== + +* :vytask:`T4441` ``(bug): wwan: connection not possible after a change added after 1.3.1-S1 release`` + + +2022-05-26 +========== + +* :vytask:`T4442` ``(feature): HTTP API add action "reset"`` + + +2022-05-25 +========== + +* :vytask:`T2194` ``(default): "show firewall" garbled output`` + + +2022-05-19 +========== + +* :vytask:`T4430` ``(bug): Show firewall output with visual shift default rule`` + + +2022-05-16 +========== + +* :vytask:`T4377` ``(default): generate tech-support archive includes previous archives`` + + +2022-05-12 +========== + +* :vytask:`T4100` ``(feature): Firewall increase maximum number of rules`` + + +2022-05-11 +========== + +* :vytask:`T4405` ``(bug): DHCP client sometimes ignores `no-default-route` option of an interface`` + + +2022-05-10 +========== + +* :vytask:`T1972` ``(feature): Allow setting interface name for virtual_ipaddress in VRRP VRID`` + + +2022-05-07 +========== + +* :vytask:`T4361` ``(bug): `vyos.config.exists()` does not work for nodes with multiple values`` +* :vytask:`T4354` ``(bug): Slave interfaces fall out from bonding during configuration change`` + + +2022-05-03 +========== + +* :vytask:`T4395` ``(feature): Extend show vpn debug`` + + +2022-05-01 +========== + +* :vytask:`T4369` ``(bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node`` +* :vytask:`T4363` ``(bug): salt-minion: default mine_interval option is not set`` + + +2022-04-29 +========== + +* :vytask:`T4388` ``(bug): dhcp-server: missing constraint on tftp-server-name option`` +* :vytask:`T4366` ``(bug): geneve: interface is removed on changes to e.g. description`` + + +2022-04-26 +========== + +* :vytask:`T4235` ``(default): Add config tree diff algorithm`` + + +2022-04-19 +========== + +* :vytask:`T4344` ``(bug): DHCP statistics not matching, conf-mode generates incorrect pool name with dash`` +* :vytask:`T4268` ``(bug): Elevated LA while using VyOS monitoring feature`` + + +2022-04-08 +========== + +* :vytask:`T4331` ``(bug): IPv6 link local addresses are not configured when an interface is in a VRF`` +* :vytask:`T4339` ``(bug): wwan: tab-completion results in "No such file or directory" if there is no WWAN interface`` +* :vytask:`T4338` ``(bug): wwan: changing interface description should not trigger reconnect`` +* :vytask:`T4324` ``(bug): wwan: check alive script should only be run via cron if a wwan interface is configured at all`` + + +2022-04-07 +========== + +* :vytask:`T4330` ``(bug): MTU settings cannot be applied when IPv6 is disabled`` +* :vytask:`T4346` ``(feature): Deprecate "system ipv6 disable" option to disable address family within OS kernel`` +* :vytask:`T4337` ``(bug): isis: IETF SPF delay algorithm can not be configured - results in vyos.frr.CommitError`` +* :vytask:`T4319` ``(bug): The command "set system ipv6 disable" doesn't work as expected.`` +* :vytask:`T4341` ``(feature): login: disable user-account prior to deletion and wait until deletion is complete`` +* :vytask:`T4336` ``(feature): isis: add support for MD5 authentication password on a circuit`` + + +2022-04-06 +========== + +* :vytask:`T4308` ``(feature): Op-comm "Show log frr" to view specific protocol logs`` + + +2022-03-29 +========== + +* :vytask:`T3686` ``(bug): Bridging OpenVPN tap with no local-address breaks`` + + +2022-03-24 +========== + +* :vytask:`T4294` ``(bug): Adding a new openvpn-option does not restart the OpenVPN process`` +* :vytask:`T4230` ``(bug): OpenVPN server configuration deleted after reboot when using a VRRP virtual-address`` + + +2022-03-21 +========== + +* :vytask:`T4311` ``(bug): CVE-2021-4034: local privilege escalation in PolKit`` +* :vytask:`T4310` ``(bug): CVE-2022-0778: infinite loop in OpenSSL certificate parsing`` + + +2022-03-12 +========== + +* :vytask:`T4296` ``(bug): Interface config injected by Cloud-Init may interfere with VyOS native`` +* :vytask:`T4002` ``(default): firewall group network-group long names restriction incorrect behavior`` + + +2022-03-11 +========== + +* :vytask:`T4297` ``(bug): Interface configuration saving fails for ice/iavf based interfaces because they can't change speed/duplex settings`` + + +2022-03-05 +========== + +* :vytask:`T4259` ``(bug): The conntrackd daemon can be started wrongly`` + + +2022-02-28 +========== + +* :vytask:`T4273` ``(bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config`` +* :vytask:`T4115` ``(bug): reboot in not working as expected`` + + +2022-02-24 +========== + +* :vytask:`T4267` ``(bug): Error - Missing required "ip key" parameter`` + + +2022-02-23 +========== + +* :vytask:`T4264` ``(bug): vxlan: interface is destroyed and rebuild on description change`` +* :vytask:`T4263` ``(bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes`` + + +2022-02-21 +========== + +* :vytask:`T4120` ``(feature): [VXLAN] add ability to set multiple unicast-remotes`` + + +2022-02-20 +========== + +* :vytask:`T4261` ``(feature): MACsec: add DHCP client support`` +* :vytask:`T4203` ``(bug): Reconfigure DHCP client interface causes brief outages`` + + +2022-02-19 +========== + +* :vytask:`T4258` ``(bug): [DHCP-SERVER] error parameter on Failover`` + + +2022-02-17 +========== + +* :vytask:`T4241` ``(bug): ocserv openconnect looks broken in recent bulds of 1.3 Equuleus`` +* :vytask:`T4255` ``(bug): Unexpected print of dict bridge on delete`` +* :vytask:`T4240` ``(bug): Cannot add wlan0 to bridge via configure`` +* :vytask:`T4154` ``(bug): Error add second gre tunnel with the same source interface`` + + +2022-02-16 +========== + +* :vytask:`T4237` ``(bug): Conntrack-sync error - error adding listen-address command`` + + +2022-02-15 +========== + +* :vytask:`T4201` ``(bug): Firewall - ICMPv6 matches not working as expected on 1.3.0`` +* :vytask:`T3006` ``(bug): Accel-PPP & vlan-mon config get invalid VLAN`` +* :vytask:`T3494` ``(bug): DHCPv6 leases traceback when PD using`` + + +2022-02-13 +========== + +* :vytask:`T4242` ``(bug): ethernet speed/duplex can never be switched back to auto/auto`` +* :vytask:`T4191` ``(bug): Lost access to host after VRF re-creating`` + + +2022-02-11 +========== + +* :vytask:`T3872` ``(feature): Add configurable telegraf monitoring service`` +* :vytask:`T4234` ``(bug): Show firewall partly broken in 1.3.x`` + + +2022-02-10 +========== + +* :vytask:`T4165` ``(bug): Custom conntrack rules cannot be deleted`` + + +2022-02-08 +========== + +* :vytask:`T4227` ``(bug): Typo in help completion of hello-time option of bridge interface`` + + +2022-02-07 +========== + +* :vytask:`T4233` ``(bug): ssh: sync regex for allow/deny usernames to "system login"`` +* :vytask:`T4087` ``(feature): IPsec IKE-group proposals limit of 10 pieces`` + + +2022-02-05 +========== + +* :vytask:`T4226` ``(bug): VRRP transition-script does not work for groups name which contains -(minus) sign`` + + +2022-02-04 +========== + +* :vytask:`T4196` ``(bug): DHCP server client-prefix-length parameter results in non-functional leases`` + + +2022-02-03 +========== + +* :vytask:`T3643` ``(bug): show vpn ipsec sa doesn't show tunnels in "down" state`` + + +2022-02-01 +========== + +* :vytask:`T4198` ``(bug): Error shown on commit`` + + +2022-01-28 +========== + +* :vytask:`T4184` ``(bug): NTP allow-clients address doesn't work it allows to use ntp server for all addresses`` + + +2022-01-24 +========== + +* :vytask:`T4204` ``(feature): Update Accel-PPP to a newer revision`` + + +2022-01-17 +========== + +* :vytask:`T3164` ``(bug): console-server ssh does not work with RADIUS PAM auth`` + + +2022-01-15 +========== + +* :vytask:`T4183` ``(feature): IPv6 link-local address not accepted as wireguard peer`` +* :vytask:`T4110` ``(feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0`` + + +2022-01-12 +========== + +* :vytask:`T4168` ``(bug): IPsec VPN is impossible to restart when DMVPN is configured`` +* :vytask:`T4167` ``(bug): DMVPN apply wrong param on the first configuration`` +* :vytask:`T4152` ``(bug): NHRP shortcut-target holding-time does not work`` + + +2022-01-10 +========== + +* :vytask:`T3299` ``(bug): Allow the web proxy service to listen on all IP addresses`` +* :vytask:`T3115` ``(feature): Add support for firewall on L3 VIF bridge interface`` + + +2022-01-09 +========== + +* :vytask:`T3822` ``(bug): OpenVPN processes do not have permission to read key files generated with `run generate openvpn key``` +* :vytask:`T4142` ``(bug): Input ifbX interfaces not displayed in op-mode`` +* :vytask:`T3914` ``(bug): VRRP rfc3768-compatibility doesn't work with unicast peers`` + + +2022-01-07 +========== + +* :vytask:`T3924` ``(bug): VRRP stops working with VRF`` + + +2022-01-06 +========== + +* :vytask:`T4141` ``(bug): Set high-availability vrrp sync-group without members error`` + + +2022-01-03 +========== + +* :vytask:`T4065` ``(bug): IPSEC configuration error: connection to unix:///var/run/charon.ctl failed: No such file or directory`` +* :vytask:`T4052` ``(bug): Validator return traceback on VRRP configuration with the script path not in config dir`` +* :vytask:`T4128` ``(bug): keepalived: Upgrade package to add VRF support`` + + +2021-12-31 +========== + +* :vytask:`T4081` ``(bug): VRRP health-check script stops working when setting up a sync group`` + + +2021-12-29 +========== + +* :vytask:`T2922` ``(bug): The `vpn ipsec logging log-modes` miss the IPSec daemons state check`` +* :vytask:`T2695` ``(bug): Flow-accounting bug with subinterfaces`` +* :vytask:`T2400` ``(default): OpenVPN: dont restart server if no need`` +* :vytask:`T4086` ``(default): system login banner is not removed on deletion.`` + + +2021-12-28 +========== + +* :vytask:`T3380` ``(bug): "show vpn ike sa" does not display IPv6 peers`` +* :vytask:`T2933` ``(feature): VRRP add option virtual_ipaddress_excluded`` + + +2021-12-27 +========== + +* :vytask:`T2566` ``(bug): sstp not able to run tunnels ipv6 only`` +* :vytask:`T4093` ``(bug): SNMPv3 snmpd.conf generation bug`` +* :vytask:`T2764` ``(enhancment): Increase maximum number of NAT rules`` + + +2021-12-26 +========== + +* :vytask:`T4104` ``(bug): RAID1: "add raid md0 member sda1" does not restore boot sector`` + + +2021-12-25 +========== + +* :vytask:`T4101` ``(bug): commit-archive: Use of uninitialized value $source_address in concatenation`` +* :vytask:`T4055` ``(feature): Add VRF support for HTTP(S) API service`` + + +2021-12-24 +========== + +* :vytask:`T3854` ``(bug): Missing op-mode commands for conntrack-sync`` + + +2021-12-23 +========== + +* :vytask:`T4092` ``(bug): IKEv2 mobike commit failed with DMVPN nhrp`` +* :vytask:`T3354` ``(default): Convert strip-private script from Perl to Python`` + + +2021-12-22 +========== + +* :vytask:`T3356` ``(feature): Script for remote file transfers`` + + +2021-12-21 +========== + +* :vytask:`T4053` ``(bug): VRRP impossible to set scripts out of the /config directory`` +* :vytask:`T4013` ``(bug): Add pkg cloudwatch for AWS images`` +* :vytask:`T3913` ``(bug): VRF traffic fails after upgrade from 1.3.0-RC6 to 1.3.0-EPA1/2`` + + +2021-12-20 +========== + +* :vytask:`T4088` ``(default): Fix typo in login banner`` + + +2021-12-19 +========== + +* :vytask:`T3912` ``(default): Use a more informative default post-login banner`` + + +2021-12-17 +========== + +* :vytask:`T3176` ``(bug): Ordering of ports on EdgeCore SAF51015I is mixed up?`` +* :vytask:`T4059` ``(bug): VRRP sync-group transition script does not persist after reboot`` + + +2021-12-16 +========== + +* :vytask:`T4046` ``(feature): Sflow - Add Source address parameter`` +* :vytask:`T2615` ``(default): Provide an explicit option for server fingerprint in commit archive, and make insecure the default`` +* :vytask:`T4076` ``(enhancment): Allow setting CORS options in HTTP API`` +* :vytask:`T3378` ``(bug): commit-archive source-address broken for IPv6 addresses`` + + +2021-12-15 +========== + +* :vytask:`T4077` ``(bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"`` +* :vytask:`T4073` ``(bug): "show protocols bfd peer <>" shows incorrect peer information.`` + + +2021-12-14 +========== + +* :vytask:`T4071` ``(feature): Allow HTTP API to bind to unix domain socket`` + + +2021-12-12 +========== + +* :vytask:`T4036` ``(bug): VXLAN incorrect raiseError if set multicast network instead of singe address`` + + +2021-12-10 +========== + +* :vytask:`T4068` ``(feature): Python: ConfigError should insert line breaks into the error message`` + + +2021-12-09 +========== + +* :vytask:`T4033` ``(bug): VRRP - Error security when setting scripts`` +* :vytask:`T4064` ``(bug): IP address for vif is not removed from the system when deleted in configuration`` +* :vytask:`T4063` ``(bug): VRRP log error - /usr/libexec/vyos/vyos-vrrp-conntracksync.sh - No such file or directory`` +* :vytask:`T4060` ``(enhancment): Extend configquery for use before boot configuration is complete`` + + +2021-12-08 +========== + +* :vytask:`T4024` ``(bug): Access-lists and prefix-lists disappear when setting ldp hello-ipv4-interval`` + + +2021-12-07 +========== + +* :vytask:`T4041` ``(servicerequest): "transition-script" doesn't work on "sync-group"`` + + +2021-12-06 +========== + +* :vytask:`T4012` ``(feature): Add VRF support for TFTP`` + + +2021-12-05 +========== + +* :vytask:`T4034` ``(bug): "make xcp-ng-iso" still includes vyos-xe-guest-utilities`` +* :vytask:`T2076` ``(feature): RAID install: sfdisk change-id is deprecated in favor of --part-type`` +* :vytask:`T1126` ``(bug): Reusing a RAID from a BIOS install in an EFI install causes a failure to boot`` + + +2021-12-04 +========== + +* :vytask:`T4049` ``(feature): support command-style output with compare command`` +* :vytask:`T4047` ``(bug): Wrong regex validation in XML definitions`` +* :vytask:`T4045` ``(bug): Unable to "format disk like "`` + + +2021-12-02 +========== + +* :vytask:`T4035` ``(bug): Geneve interfaces aren't displayed by operational mode commands`` + + +2021-12-01 +========== + +* :vytask:`T3695` ``(bug): OpenConnect reports commit success when ocserv fails to start due to SSL cert/key file issues`` + + +2021-11-30 +========== + +* :vytask:`T3725` ``(feature): show configuration in json format`` + + +2021-11-29 +========== + +* :vytask:`T2661` ``(bug): SSTP wrong certificates check`` +* :vytask:`T3946` ``(enhancment): Automatically resize the root partition if the drive has extra space`` + + +2021-11-28 +========== + +* :vytask:`T3999` ``(bug): show lldp neighbor Traceback error`` + + +2021-11-26 +========== + +* :vytask:`T4019` ``(bug): Smoketests for SSTP and openconnect fails`` + + +2021-11-25 +========== + +* :vytask:`T4005` ``(feature): Feature Request: IPsec IKEv1 + IKEv2 for one peer`` + + +2021-11-24 +========== + +* :vytask:`T4015` ``(feature): Update Accel-PPP to a newer revision`` +* :vytask:`T1083` ``(feature): Implement persistent/random address and port mapping options for NAT rules`` + + +2021-11-23 +========== + +* :vytask:`T3990` ``(bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to files left behind in /var/tmp/frr/ after reboot)`` + + +2021-11-20 +========== + +* :vytask:`T4004` ``(bug): IPsec ike-group parameters are not saved correctly (after reboot)`` + + +2021-11-19 +========== + +* :vytask:`T4003` ``(bug): API for "show interfaces ethernet" does not include the interface description`` +* :vytask:`T4011` ``(bug): ethernet: deleting interface should place interface in admin down state`` + + +2021-11-18 +========== + +* :vytask:`T3995` ``(feature): OpenVPN: do not stop/start service on configuration change`` +* :vytask:`T4008` ``(feature): dhcp: change client retry interval form 300 -> 60 seconds`` +* :vytask:`T3795` ``(bug): WWAN: issues with non connected interface / no signal`` + + +2021-11-17 +========== + +* :vytask:`T3350` ``(bug): OpenVPN config file generation broken`` +* :vytask:`T3996` ``(bug): SNMP service error in log`` + + +2021-11-15 +========== + +* :vytask:`T3934` ``(bug): Openconnect VPN broken: ocserv-worker general protection fault on client connect`` +* :vytask:`T3724` ``(feature): Allow setting host-name in l2tp section of accel-ppp`` + + +2021-11-14 +========== + +* :vytask:`T3974` ``(bug): route-map commit fails if interface does not exist`` + + +2021-11-11 +========== + +* :vytask:`T1349` ``(bug): L2TP remote-access vpn terminated and not showing as connected`` +* :vytask:`T1058` ``(default): hw-id is ignored when naming interfaces`` +* :vytask:`T914` ``(feature): Extend list_interfaces.py to support multiple interface types`` +* :vytask:`T688` ``(enhancment): Move component versions used for config migration purposes into vyos-1x`` + + +2021-11-10 +========== + +* :vytask:`T3982` ``(bug): DHCP server commit fails if static-mapping contains + or .`` + + +2021-11-09 +========== + +* :vytask:`T3962` ``(bug): Image cannot be built without open-vm-tools`` +* :vytask:`T2088` ``(bug): Increased boot time from 1.2.4 -> 1.3 rolling by 100%`` +* :vytask:`T2136` ``(bug): XML command definition convertor doesn't disallow tag nodes with multi flag on`` + + +2021-11-07 +========== + +* :vytask:`T2874` ``(feature): Add MTU and TCP-MSS discovery tool`` +* :vytask:`T3626` ``(bug): Configuring and disabling DHCP Server`` + + +2021-11-06 +========== + +* :vytask:`T3971` ``(feature): Ability to build ISO images for XCP-NG hypervisor`` +* :vytask:`T3514` ``(bug): NIC flap at any interface change`` + + +2021-11-05 +========== + +* :vytask:`T3972` ``(bug): Removing vif-c interface raises KeyError`` + + +2021-11-04 +========== + +* :vytask:`T3964` ``(bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses`` + + +2021-11-03 +========== + +* :vytask:`T3610` ``(bug): DHCP-Server creation for not primary IP address fails`` + + +2021-11-01 +========== + +* :vytask:`T3846` ``(bug): dmvpn configuration not reapllied after "restart vpn"`` +* :vytask:`T3956` ``(bug): GRE tunnel - unable to move from source-interface to source-address, commit error`` + + +2021-10-31 +========== + +* :vytask:`T3945` ``(feature): Add route-map for bgp aggregate-address`` +* :vytask:`T3341` ``(bug): Wrong behavior of the "reset vpn ipsec-peer XXX tunnel XXX" command`` +* :vytask:`T3954` ``(bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated, config system error`` +* :vytask:`T3943` ``(bug): "netflow source-ip" prevents image upgrades if IP address does not exist locally`` + + +2021-10-29 +========== + +* :vytask:`T3942` ``(feature): Generate IPSec debug archive from op-mode`` + + +2021-10-28 +========== + +* :vytask:`T3941` ``(bug): "show vpn ipsec sa" shows established time of parent SA not child SA's`` + + +2021-10-27 +========== + +* :vytask:`T3944` ``(bug): VRRP fails over when adding new group to master`` + + +2021-10-25 +========== + +* :vytask:`T3935` ``(bug): Update from rc5 to EPA2 failed`` + + +2021-10-22 +========== + +* :vytask:`T3188` ``(bug): Tunnel local-ip to dhcp-interface Change Fails to Update`` + + +2021-10-21 +========== + +* :vytask:`T3920` ``(bug): dhclient exit hook script 01-vyos-cleanup causes too many arguments error`` +* :vytask:`T3926` ``(bug): strip-private does not sanitize "cisco-authentication" from NHRP configuration`` +* :vytask:`T3925` ``(feature): Tunnel: dhcp-interface not implemented - use source-interface instead`` +* :vytask:`T3927` ``(feature): Kernel: Enable kernel support for HW offload of the TLS protocol`` + + +2021-10-20 +========== + +* :vytask:`T3922` ``(bug): NHRP: delete fails`` +* :vytask:`T3918` ``(bug): DHCPv6 prefix delegation incorrect verify error`` +* :vytask:`T3921` ``(bug): tunnel: KeyError when using dhcp-interface`` + + +2021-10-19 +========== + +* :vytask:`T3396` ``(bug): syslog can't be configured with an ipv6 literal destination in 1.2.x`` +* :vytask:`T690` ``(feature): Allow OpenVPN servers to push routes with custom metric values`` + + +2021-10-17 +========== + +* :vytask:`T3786` ``(bug): GRE tunnel source address 0.0.0.0 error`` +* :vytask:`T3425` ``(bug): Scripts from the /config/scripts/ folder do not run on live system`` +* :vytask:`T3217` ``(default): Save FRR configuration on each commit`` +* :vytask:`T3076` ``(bug): Router reboot adds unwanted 'conntrack-sync mcast-group '225.0.0.50'' line to configuration`` +* :vytask:`T2800` ``(bug): Pseudo-Ethernet: source-interface must not be member of a bridge`` +* :vytask:`T3422` ``(bug): Dynamic DNS doesn't allow zone field with cloudflare protocol`` +* :vytask:`T3381` ``(bug): Change GRE tunnel failed`` +* :vytask:`T3254` ``(bug): Dynamic DNS status shows incorrect last update time`` +* :vytask:`T3253` ``(bug): rpki: multiple peers cannot be configured`` +* :vytask:`T3219` ``(default): Typo in openvpn server client config for IPv6 iroute`` +* :vytask:`T2100` ``(feature): BGP route adverisement wih checks rib`` +* :vytask:`T1663` ``(enhancment): T1656 equuleus: buster: arm64/aarch64: ipaddrcheck does not complete testing`` +* :vytask:`T1243` ``(bug): BGP local-as accept wrong values`` +* :vytask:`T770` ``(bug): Bonded interfaces get updated with incorrect hw-id in config.`` +* :vytask:`T697` ``(bug): Clean up and sanitize package dependencies`` +* :vytask:`T3837` ``(default): OpenConnect: Fix typo in help property`` +* :vytask:`T1440` ``(bug): Creating two DHCPv6 shared-network-names with the same subnet is allowed, causes dhcpd to fail to start.`` +* :vytask:`T578` ``(feature): Support Linux Container`` + + +2021-10-16 +========== + +* :vytask:`T3879` ``(bug): GPG key verification fails when upgrading from a 1.3 beta version`` +* :vytask:`T3851` ``(bug): Missing ospf and rip options for bridge vifs`` + + +2021-10-13 +========== + +* :vytask:`T3904` ``(bug): NTP pool associations silently fail`` +* :vytask:`T3277` ``(feature): DNS Forwarding - reverse zones`` + + +2021-10-11 +========== + +* :vytask:`T2607` ``(feature): Support for pppoe-server radius mode auth and config radius accouting port`` + + +2021-10-10 +========== + +* :vytask:`T3750` ``(bug): pdns-recursor 4.4 issue with dont-query and private DNS servers`` +* :vytask:`T3885` ``(default): dhcpv6-pd: randomly generated DUID is not persisted`` +* :vytask:`T3899` ``(enhancment): Add support for hd44780 LCD displays`` + + +2021-10-09 +========== + +* :vytask:`T3894` ``(bug): Tunnel Commit Failed if system does not have `eth0``` + + +2021-10-08 +========== + +* :vytask:`T3893` ``(bug): MGRE Tunnel commit crash If sit tunnel available`` + + +2021-10-04 +========== + +* :vytask:`T3888` ``(bug): Incorrect warning when poweroff command executed from configure mode.`` +* :vytask:`T3890` ``(feature): dhcp(v6): provide op-mode commands to retrieve both server and client logfiles`` +* :vytask:`T3889` ``(feature): Migrate to journalctl when reading daemon logs`` + + +2021-10-03 +========== + +* :vytask:`T3880` ``(bug): EFI boot shows error on display`` + + +2021-10-02 +========== + +* :vytask:`T3882` ``(feature): Upgrade PowerDNs recursor to 4.5 series`` +* :vytask:`T3883` ``(bug): VRF - Delette vrf config on interface`` + + +2021-10-01 +========== + +* :vytask:`T3877` ``(bug): VRRP always enabled rfc3768-compatibility even when not specified`` + + +2021-09-30 +========== + +* :vytask:`T3874` ``(bug): D-Link Ethernet Interface not working.`` + + +2021-09-27 +========== + +* :vytask:`T3858` ``(bug): Deleting OSPFv3 process yields: Unknown command: no router-id`` + + +2021-09-26 +========== + +* :vytask:`T3860` ``(bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64 addresses`` +* :vytask:`T3857` ``(feature): reboot: send wall message to all users for information`` +* :vytask:`T3867` ``(bug): vxlan: multicast group address is not validated`` +* :vytask:`T3859` ``(bug): Add "log-adjacency-changes" to ospfv3 process`` + + +2021-09-23 +========== + +* :vytask:`T3850` ``(bug): Dots are no longer allowed in SSH public key names`` + + +2021-09-21 +========== + +* :vytask:`T2602` ``(bug): pptp/sstp/l2tp add possibility enable or disable CCP`` + + +2021-09-19 +========== + +* :vytask:`T3841` ``(feature): dhcp-server: add ping-check option to CLI`` +* :vytask:`T2738` ``(bug): Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization`` +* :vytask:`T3842` ``(feature): Backport DHCP server improvements from VyOS 1.4 sagitta to 1.3 equuleus`` +* :vytask:`T3840` ``(feature): dns forwarding: Cache size should allow values > 10k`` +* :vytask:`T3672` ``(bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.conf configuration file output`` + + +2021-09-11 +========== + +* :vytask:`T3402` ``(feature): Add VyOS programming library for operational level commands`` + + +2021-09-10 +========== + +* :vytask:`T3802` ``(bug): Commit fails if ethernet interface doesn't support flow control`` +* :vytask:`T3819` ``(bug): Upgrade Salt Stack 3002.3 -> 3003 release train`` +* :vytask:`T3421` ``(bug): MTR/Traceroute broken in 1.3-beta`` +* :vytask:`T3820` ``(feature): PowerDNS recursor - update from 4.3 -> 4.4 to sync with current`` +* :vytask:`T1770` ``(bug): webproxy breaks commit and http access on routed client`` +* :vytask:`T915` ``(feature): MPLS Support`` + + +2021-09-09 +========== + +* :vytask:`T3816` ``(bug): Error after entering outbound-interface command in NAT`` +* :vytask:`T3814` ``(bug): wireguard: commit error showing incorrect peer name from the configured name`` +* :vytask:`T3805` ``(bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP interface`` + + +2021-09-07 +========== + +* :vytask:`T2322` ``(bug): CLI [op-mode] bugs. Root task`` +* :vytask:`T1894` ``(bug): FRR config not loaded after daemons segfault or restart`` +* :vytask:`T3807` ``(bug): Op Command "show interfaces wireguard" does not show the output`` +* :vytask:`T3808` ``(default): ipsec is mistakenly restarted after delete`` + + +2021-09-06 +========== + +* :vytask:`T3806` ``(bug): Don't set link local ipv6 address if MTU less then 1280`` +* :vytask:`T3803` ``(default): Add source-address option to the ping CLI`` +* :vytask:`T3431` ``(bug): Show version all bug`` +* :vytask:`T3362` ``(bug): 1.3 - RC1 ifb redirect failing to commit`` +* :vytask:`T3291` ``(bug): Fault on setting offload RPS with single-core CPU`` +* :vytask:`T2920` ``(bug): Commit crash when adding the second mGRE tunnel with the same key`` +* :vytask:`T2895` ``(bug): VPN IPsec "leftsubnet" declared 2 times`` +* :vytask:`T2019` ``(bug): LLDP wrong config generation for interface 'all'`` + + +2021-09-05 +========== + +* :vytask:`T3804` ``(feature): cli: Migrate and merge "system name-servers-dhcp" into "system name-server"`` + + +2021-09-04 +========== + +* :vytask:`T3697` ``(bug): Impossible to delete IPsec completely`` +* :vytask:`T3619` ``(bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage`` +* :vytask:`T1785` ``(bug): Deleting partitions on disks (Raid1) with default value 'no'`` + + +2021-09-03 +========== + +* :vytask:`T3788` ``(bug): Keys are not allowed with ipip and sit tunnels`` +* :vytask:`T3683` ``(bug): VXLAN not accept ipv6 and source-interface options and mtu bug`` +* :vytask:`T3634` ``(feature): Add op command option for ping for do not fragment bit to be set`` + + +2021-09-02 +========== + +* :vytask:`T3792` ``(bug): login: A hypen present in a username from "system login user" is replaced by an underscore`` +* :vytask:`T3790` ``(bug): Does not possible to configure PPTP static ip-address to users`` + + +2021-09-01 +========== + +* :vytask:`T2434` ``(bug): Duplicate Address Detection Breaks Interfaces`` + + +2021-08-31 +========== + +* :vytask:`T3789` ``(feature): Add custom validator for base64 encoded CLI data`` +* :vytask:`T3782` ``(default): Ingress Shaping with IFB No Longer Functional with 1.3`` + + +2021-08-30 +========== + +* :vytask:`T3777` ``(bug): adding IPv6 EUI64 address fails commit in 1.3.0-rc6`` +* :vytask:`T3768` ``(default): Remove early syntaxVersion implementation`` +* :vytask:`T2558` ``(feature): Add some CPU information to `show version` + fix broken hypervisor detection`` +* :vytask:`T2430` ``(default): cannot delete specific route static next-hop`` +* :vytask:`T1350` ``(bug): VRRP transition script will be executed once only`` +* :vytask:`T2941` ``(default): Using a non-ASCII character in the description field causes UnicodeDecodeError in configsource.py`` +* :vytask:`T3787` ``(bug): Remove deprecated UDP fragmentation offloading option`` +* :vytask:`T3677` ``(feature): "sipcalc" not included in 1.3`` + + +2021-08-29 +========== + +* :vytask:`T3708` ``(bug): isisd and gre-bridge commit error`` +* :vytask:`T3783` ``(bug): "set protocols isis spf-delay-ietf" is not working`` +* :vytask:`T2750` ``(default): Use m4 as a template processor`` + + +2021-08-27 +========== + +* :vytask:`T3182` ``(bug): Main blocker Task for FRR 7.4/7.5 series update`` +* :vytask:`T2108` ``(default): Use minisign/signify instead of GPG for release signing`` + + +2021-08-26 +========== + +* :vytask:`T3781` ``(bug): Revert the NAT implementation in 1.3 back to iptables`` +* :vytask:`T3776` ``(default): Rename FRR daemon restart op-mode commands`` +* :vytask:`T3779` ``(feature): Backport all 1.4 IS-IS features and configuration to 1.3 except VRF`` + + +2021-08-25 +========== + +* :vytask:`T3773` ``(bug): Delete the "show system integrity" command (to prepare for a re-implementation)`` +* :vytask:`T1514` ``(default): Add ability to restart frr processes`` + + +2021-08-24 +========== + +* :vytask:`T3772` ``(bug): VRRP virtual interfaces are not shown in show interfaces`` + + +2021-08-23 +========== + +* :vytask:`T2555` ``(bug): XML op-mode generation scripts silently discard XML nodes`` + + +2021-08-21 +========== + +* :vytask:`T3682` ``(bug): Remove running dhclient from ether-resume.py`` + + +2021-08-20 +========== + +* :vytask:`T1950` ``(default): Store VyOS configuration syntax version data in JSON file`` + + +2021-08-19 +========== + +* :vytask:`T2759` ``(bug): validate-value prints error messages from validators that fail even if overall validation succeeds`` +* :vytask:`T3234` ``(bug): multi_to_list fails in certain cases, with root cause an element redundancy in XML interface-definitions`` +* :vytask:`T3732` ``(feature): override-default helper should support adding defaultValues to default less nodes`` +* :vytask:`T1962` ``(default): Add syntax version to schema`` + + +2021-08-17 +========== + +* :vytask:`T2525` ``(bug): OSPFv3 missing route map, not establishing`` +* :vytask:`T508` ``(bug): ISC DHCP incorrect UDP checksum generation`` +* :vytask:`T1643` ``(bug): Deleting all firewall zones failed and locked out box`` +* :vytask:`T1550` ``(bug): Add support for Large BGP Community show commands`` + + +2021-08-16 +========== + +* :vytask:`T3738` ``(default): openvpn fails if server and authentication are configured`` +* :vytask:`T1594` ``(bug): l2tpv3 error on IPv6 local-ip`` + + +2021-08-15 +========== + +* :vytask:`T3756` ``(default): VyOS generates invalid QR code for wireguard clients`` + + +2021-08-14 +========== + +* :vytask:`T3745` ``(feature): op-mode IPSec show vpn ipse sa sorting`` +* :vytask:`T521` ``(bug): Network services may fail if vyatta-router.service startup takes longer than a few seconds`` + + +2021-08-13 +========== + +* :vytask:`T3740` ``(bug): HTTPs API breaks when the address is IPv6`` + + +2021-08-12 +========== + +* :vytask:`T3731` ``(bug): verify_accel_ppp_base_service return wrong config error for SSP`` +* :vytask:`T3405` ``(feature): PPPoE server unit-cache`` +* :vytask:`T2432` ``(default): dhcpd: Can't create new lease file: Permission denied`` +* :vytask:`T3746` ``(feature): Inform users logging into the system about a pending reboot`` +* :vytask:`T3744` ``(default): Dns forwarding statistics formatting missing a new line`` + + +2021-08-10 +========== + +* :vytask:`T3730` ``(bug): op-mode conntrack-sync miss some functions`` + + +2021-08-09 +========== + +* :vytask:`T1501` ``(bug): VPN Commit Errors`` + + +2021-08-08 +========== + +* :vytask:`T2027` ``(bug): get_config_dict is failing when the configuration section is empty/missing`` +* :vytask:`T169` ``(feature): Image install should put correct serial console device in created GRUB menu entry`` + + +2021-08-07 +========== + +* :vytask:`T548` ``(feature): BGP IPv6 multipath support`` + + +2021-08-06 +========== + +* :vytask:`T1153` ``(bug): VyOS 1.2.0RC10, RAID-1, fresh install, unable to save config`` + + +2021-08-05 +========== + +* :vytask:`T696` ``(feature): Rewrite conntrack sync to XML`` + + +2021-08-04 +========== + +* :vytask:`T3704` ``(feature): Add ability to interact with Areca RAID adapers`` +* :vytask:`T320` ``(default): OSPF does not redistribute connected routes associated with virtual tunnel interfaces`` + + +2021-08-02 +========== + +* :vytask:`T2623` ``(bug): Creating sit tunnel fails with “Can not set “local” for tunnel sit tun1 at tunnel creation”`` +* :vytask:`T2161` ``(default): snmpd cannot start if ipv6 disabled`` +* :vytask:`T3601` ``(default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.`` + + +2021-08-01 +========== + +* :vytask:`T3707` ``(bug): Ping incorrect ip host checks`` + + +2021-07-31 +========== + +* :vytask:`T3716` ``(feature): Linux kernel parameters ignore_routes_with_link_down- ignore disconnected routing connections`` +* :vytask:`T1626` ``(bug): BGP exchanges prefixes without specified address-family`` + + +2021-07-30 +========== + +* :vytask:`T1176` ``(default): FRR - BGP replicating routes`` +* :vytask:`T1123` ``(bug): Inconsistency in community-list naming validation`` + + +2021-07-29 +========== + +* :vytask:`T2931` ``(bug): Unicode decode error causes vyos.configd service to restart`` +* :vytask:`T2727` ``(bug): Add a dotted decimal value validator`` +* :vytask:`T2328` ``(default): dhcpv6 server not starting (disable check reversed?)`` +* :vytask:`T1758` ``(default): Switch vyos.config to libvyosconfig`` +* :vytask:`T954` ``(bug): Using the 10.255.255.0/24 subnet on other interfaces breaks L2TP/IPSec`` + + +2021-07-23 +========== + +* :vytask:`T3699` ``(bug): login: verify selected "system login user" name is not already used by the base system.`` + + +2021-07-21 +========== + +* :vytask:`T3689` ``(bug): static ipv6 route doesn't deleted in some cases`` +* :vytask:`T3685` ``(feature): IPv6 PBR doesn't allow setting of an egress interface`` + + +2021-07-20 +========== + +* :vytask:`T3691` ``(bug): GRETAP: key is not applied when interface is created`` + + +2021-07-13 +========== + +* :vytask:`T3679` ``(default): Point the unexpected exception message link to the new rolling release location`` + + +2021-07-11 +========== + +* :vytask:`T3665` ``(bug): Missing VRF support for VxLAN but already documented`` + + +2021-07-06 +========== + +* :vytask:`T3660` ``(feature): Conntrack-Sync configuration command to specify destination udp port for peer`` + + +2021-07-01 +========== + +* :vytask:`T3658` ``(feature): Add support for dhcpdv6 fixed-prefix6`` + + +2021-06-29 +========== + +* :vytask:`T3593` ``(bug): PPPoE server called-sid format does not work`` + + +2021-06-25 +========== + +* :vytask:`T3650` ``(bug): OpenVPN: Upgrade package to 2.5.1 before releasing VyOS 1.3.0`` +* :vytask:`T3649` ``(feature): Add bonding additional hash-policy`` + + +2021-06-24 +========== + +* :vytask:`T2722` ``(bug): get_config_dict() and key_mangling=('-', '_') will alter CLI data for tagNodes`` + + +2021-06-22 +========== + +* :vytask:`T3629` ``(bug): IPoE server shifting address in the range`` + + +2021-06-20 +========== + +* :vytask:`T3637` ``(bug): vrf: bind-to-all didn't work properly`` + + +2021-06-19 +========== + +* :vytask:`T3633` ``(feature): Add LRO offload for interface ethernet`` + + +2021-06-17 +========== + +* :vytask:`T3631` ``(feature): route-map: migrate "set extcommunity-rt" and "set extcommunity-soo" to "set extcommunity rt|soo" to match FRR syntax`` + + +2021-06-16 +========== + +* :vytask:`T2425` ``(feature): Rewrite all policy zebra filters to XML/Python style`` +* :vytask:`T3630` ``(feature): op-mode: add "show version kernel" command`` + + +2021-06-13 +========== + +* :vytask:`T3620` ``(feature): Rename WWAN interface from wirelessmodem to wwan to use QMI interface`` +* :vytask:`T3622` ``(feature): WWAN: add support for APN authentication`` +* :vytask:`T3621` ``(bug): PPPoE interface does not validate if password is supplied when username is set`` + + +2021-06-10 +========== + +* :vytask:`T3250` ``(bug): PPPoE server: wrong local usernames`` +* :vytask:`T3138` ``(bug): ddclient improperly updated when apply rfc2136 config`` +* :vytask:`T2645` ``(default): Editing route-map action requires adding a new rule`` + + +2021-06-09 +========== + +* :vytask:`T3602` ``(bug): Renaming BGP Peer Groups Leaves Router Broken`` +* :vytask:`T2916` ``(bug): A state of VTI interface in a configuration does not being processing properly`` + + +2021-06-08 +========== + +* :vytask:`T3605` ``(default): Allow to set prefer-global for ipv6-next-hop`` +* :vytask:`T3607` ``(feature): [route-map] set ipv6 next-hop prefer-global`` + + +2021-06-07 +========== + +* :vytask:`T3581` ``(bug): Incomplete command `show ipv6 ospfv3 linkstate``` +* :vytask:`T3516` ``(bug): FRR 7.5 adds a second route when you attempt to change a static route distance instead of overwriting the old route`` +* :vytask:`T3461` ``(bug): OpenConnect Server redundancy check`` +* :vytask:`T3455` ``(bug): system users can not be added in "edit"`` + + +2021-06-04 +========== + +* :vytask:`T3592` ``(feature): Set default TTL 64 for tunnels`` + + +2021-06-01 +========== + +* :vytask:`T406` ``(bug): VPN configuration error: IPv6 over IPv4 IPsec is not supported when using IPv6 ONLY tunnel.`` + + +2021-05-30 +========== + +* :vytask:`T1866` ``(bug): Commit archive over SFTP doesn't work with non-standard ports`` +* :vytask:`T3589` ``(feature): op-mode: support clearing out logfiles from CLI`` +* :vytask:`T3508` ``(bug): Check if there's enough drive space for an upgrade before downloading an image`` +* :vytask:`T1506` ``(enhancment): commit-archive scp/sftp public key authentication`` + + +2021-05-29 +========== + +* :vytask:`T3135` ``(bug): BFD configurations fail to be applied`` +* :vytask:`T3103` ``(default): Rewrite parts of vyos\frr.py for readability, logging and to fix mulitiline regex "bugs"`` +* :vytask:`T2739` ``(default): vyos-utils is not compiled with a Jenkins pipeline.`` +* :vytask:`T2451` ``(bug): Cannot use !tcp or !tcp_udp while adding firewall rule`` +* :vytask:`T2436` ``(default): equuleus: Testing: vyos-1x: syntax checking Python scripts in PR`` +* :vytask:`T2184` ``(bug): OpenVPN op_mode tools broken`` +* :vytask:`T1944` ``(bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure of Zebra`` + + +2021-05-28 +========== + +* :vytask:`T1579` ``(feature): Rewrite all interface types in new XML/Python style`` + + +2021-05-27 +========== + +* :vytask:`T2629` ``(bug): VXLAN interfaces don't actually allow you to configure most settings`` +* :vytask:`T2617` ``(feature): Rewrite vyatta-op-quagga "show" to XML`` +* :vytask:`T2512` ``(feature): vyatta-op-quagga [show ip] to XML format`` +* :vytask:`T1905` ``(default): Update to Keepalived 2.0.19`` +* :vytask:`T2669` ``(bug): DHCP-server overlapping ranges.`` + + +2021-05-26 +========== + +* :vytask:`T3558` ``(default): autocomplete options for dhcp-interface is not showing for the static route command`` +* :vytask:`T3540` ``(bug): Keepalived memory utilisation issue when constantly getting its state in JSON format`` +* :vytask:`T2807` ``(feature): IPv6 Link-Local Address - Automatically generation/configuration on GRE Interfaces`` + + +2021-05-24 +========== + +* :vytask:`T3575` ``(bug): pseudo-ethernet: must check source-interface MTU`` +* :vytask:`T3571` ``(bug): Broken Show Tab Complete`` +* :vytask:`T3576` ``(bug): ISIS does not support IPV6`` + + +2021-05-23 +========== + +* :vytask:`T3570` ``(default): Prevent setting of a larger MTU on child interfaces`` +* :vytask:`T3572` ``(feature): Basic Drive Diagnostic Tools`` + + +2021-05-20 +========== + +* :vytask:`T3554` ``(feature): Add area-type stub for ospfv3`` + + +2021-05-19 +========== + +* :vytask:`T3562` ``(feature): Update Accel-PPP to a newer revision`` +* :vytask:`T3559` ``(feature): Add restart op-command for OpenConnect Server`` + + +2021-05-18 +========== + +* :vytask:`T3525` ``(default): VMWare resume script syntax errors`` +* :vytask:`T2462` ``(default): LLDP op-mode exception: IndexError: list index out of range`` + + +2021-05-15 +========== + +* :vytask:`T3549` ``(bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not correctly exported to dhcpdv6.conf when multiple name-server entries are present`` +* :vytask:`T3532` ``(bug): Not possible to change ethertype after interface creation`` +* :vytask:`T3550` ``(bug): Router-advert completion typo`` +* :vytask:`T3547` ``(feature): conntrackd: remove deprecated config options`` +* :vytask:`T3535` ``(feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor`` +* :vytask:`T2049` ``(feature): Update strongSwan cipher suites list for IPSec settings`` + + +2021-05-14 +========== + +* :vytask:`T3346` ``(bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node exists but there are no rules`` +* :vytask:`T3248` ``(default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3`` +* :vytask:`T3426` ``(default): add support for script arguments to vyos-configd`` + + +2021-05-13 +========== + +* :vytask:`T3544` ``(feature): DHCP server should validate configuration before applying it`` +* :vytask:`T3543` ``(feature): Support for setting lacp_rate on LACP bonded interfaces`` + + +2021-05-12 +========== + +* :vytask:`T3302` ``(default): Make vyos-configd relay stdout from scripts to the user's console`` + + +2021-05-11 +========== + +* :vytask:`T3526` ``(bug): Smoketest policy fail in CI`` + + +2021-05-10 +========== + +* :vytask:`T3528` ``(bug): Frr 7.5.1 uses 'seq' for community-lists`` + + +2021-05-08 +========== + +* :vytask:`T3517` ``(bug): FRR 7.5 bfd behavior for 1.3`` + + +2021-05-07 +========== + +* :vytask:`T1171` ``(bug): 1.2.0 epa2 - IPsec VPN initiation`` + + +2021-05-06 +========== + +* :vytask:`T3519` ``(bug): Cannot add / assign L2TPv3 to vrf`` + + +2021-05-01 +========== + +* :vytask:`T3379` ``(feature): Add global-parameters name-server for dhcpv6-server`` +* :vytask:`T3491` ``(default): Change Kernel HZ to 1000`` + + +2021-04-30 +========== + +* :vytask:`T3170` ``(default): Add a sanity check for empty node.def files`` + + +2021-04-29 +========== + +* :vytask:`T3502` ``(bug): "system ip multipath layer4-hashing" doesn't work`` +* :vytask:`T3029` ``(bug): Generated NGINX configuration is wrong for the redirection (http -> https)`` +* :vytask:`T3156` ``(feature): Add op and additional conf commands for ISIS`` +* :vytask:`T2012` ``(feature): Global PBR`` +* :vytask:`T1314` ``(feature): Allow BGP on unnumbered interfaces`` + + +2021-04-27 +========== + +* :vytask:`T2946` ``(bug): Calling 'stty_size' causes show interfaces API to fail`` + + +2021-04-25 +========== + +* :vytask:`T3468` ``(bug): Tunnel interfaces aren't suggested as being available for bridging (regression)`` +* :vytask:`T1802` ``(feature): Wireguard QR code in cli for mobile devices`` + + +2021-04-23 +========== + +* :vytask:`T3290` ``(bug): Disabling GRE conntrack module fails`` + + +2021-04-18 +========== + +* :vytask:`T3481` ``(default): Exclude tag node values from key mangling`` +* :vytask:`T3475` ``(bug): XML dictionary cache unable to process syntaxVersion elements`` + + +2021-04-15 +========== + +* :vytask:`T3386` ``(bug): PPPoE-server don't start with local authentication`` + + +2021-04-14 +========== + +* :vytask:`T3055` ``(bug): op-mode incorrect naming for ipsec policy-based tunnels`` + + +2021-04-12 +========== + +* :vytask:`T3454` ``(enhancment): dhclient reject option`` + + +2021-04-05 +========== + +* :vytask:`T1612` ``(default): dhcp-server time-offset fails to validate`` +* :vytask:`T3438` ``(bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf from the operating system`` +* :vytask:`T3418` ``(bug): BGP: system wide known interface can not be used as neighbor`` + + +2021-04-04 +========== + +* :vytask:`T3457` ``(feature): Output the "monitor log" command in a colorful way`` + + +2021-03-31 +========== + +* :vytask:`T3445` ``(bug): vyos-1x build include not all nodes`` + + +2021-03-25 +========== + +* :vytask:`T2639` ``(feature): sort output of show vpn ipsec sa`` + + +2021-03-22 +========== + +* :vytask:`T3284` ``(bug): merge/load fail silently if unable to resolve host`` + + +2021-03-21 +========== + +* :vytask:`T3416` ``(bug): NTP: when running inside a VRF op-mode commands do not work`` + + +2021-03-20 +========== + +* :vytask:`T3392` ``(bug): vrrp over dhcp default route bug (unexpected vrf)`` +* :vytask:`T3373` ``(feature): Upgrade to SaltStack version 3002.5`` +* :vytask:`T3329` ``(default): "system conntrack ignore" rules can no longer be created due to an iptables syntax change`` +* :vytask:`T3300` ``(feature): Add DHCP default route distance`` +* :vytask:`T3306` ``(feature): Extend set route-map aggregator as to 4 Bytes`` + + +2021-03-18 +========== + +* :vytask:`T3411` ``(default): Extend the redirect_stdout context manager in vyos-configd to redirect stdout from subprocesses`` +* :vytask:`T3271` ``(bug): qemu-kvm grub issue`` + + +2021-03-17 +========== + +* :vytask:`T3413` ``(bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP address string passed to inet_pton"`` + + +2021-03-14 +========== + +* :vytask:`T2271` ``(feature): OSPF: add per VRF instance support`` +* :vytask:`T175` ``(feature): Add source route option to VTI interfaces`` + + +2021-03-13 +========== + +* :vytask:`T3406` ``(bug): tunnel: interface no longer supports specifying encaplimit none - or migrator is missing`` +* :vytask:`T3407` ``(bug): console-server: do not allow to spawn a console-server session on serial port used by "system console"`` + + +2021-03-11 +========== + +* :vytask:`T3399` ``(bug): RPKI: dashes in hostnames are replaced with underscores when rendering the FRR config`` +* :vytask:`T3305` ``(bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot`` +* :vytask:`T2927` ``(bug): isc-dhcpd release and expiry events never execute`` +* :vytask:`T899` ``(bug): Tunnels cannot be moved from one bridge to another`` +* :vytask:`T786` ``(feature): new style xml and conf-mode scripts: posibillity to add tagNode value as parameter to conf-script`` + + +2021-03-09 +========== + +* :vytask:`T3382` ``(bug): Error creating Console Server`` + + +2021-03-08 +========== + +* :vytask:`T3387` ``(bug): Command "Monitor vpn ipsec" is not working`` + + +2021-03-07 +========== + +* :vytask:`T3319` ``(bug): VXLAN uses ttl 1 (auto) by default`` +* :vytask:`T3391` ``(feature): Add CLI support for specifying maximum-paths per address family ipv4 unicast and ipv6 unicast`` +* :vytask:`T3211` ``(feature): ability to redistribute ISIS into other routing protocols`` + + +2021-03-05 +========== + +* :vytask:`T2659` ``(feature): Add fastnetmon (DDoS detection) support`` + + +2021-03-04 +========== + +* :vytask:`T2861` ``(bug): route-map "set community additive" not working correctly`` + + +2021-03-03 +========== + +* :vytask:`T2966` ``(feature): tunnel: add new encapsulation types ip6tnl and ip6gretap`` + + +2021-03-01 +========== + +* :vytask:`T3342` ``(bug): On xen-netback interfaces must set "scattergather" offload before MTU>1500`` + + +2021-02-28 +========== + +* :vytask:`T3370` ``(bug): dhcp: Invalid domain name "private"`` +* :vytask:`T3369` ``(feature): VXLAN: add IPv6 underlay support`` + + +2021-02-27 +========== + +* :vytask:`T2291` ``(bug): Bad hostnames in /etc/hosts with static-mapping in dhcp server config`` +* :vytask:`T3364` ``(feature): tunnel: cleanup/rename CLI nodes`` +* :vytask:`T3368` ``(feature): macsec: add support for gcm-aes-256 cipher`` +* :vytask:`T3366` ``(bug): tunnel: can not change local / remote ip address for gre-bridge tunnel`` +* :vytask:`T3173` ``(feature): Need 'nopmtudisc' option for tunnel interface`` + + +2021-02-26 +========== + +* :vytask:`T3357` ``(default): HTTP-API redirect from http correct https port`` + + +2021-02-24 +========== + +* :vytask:`T3303` ``(feature): Change welcome message on boot`` + + +2021-02-21 +========== + +* :vytask:`T3163` ``(feature): ethernet ring-buffer can be set with an invalid value`` + + +2021-02-19 +========== + +* :vytask:`T3326` ``(bug): OSPFv3: Cannot add L2TPv3 interface`` + + +2021-02-18 +========== + +* :vytask:`T3259` ``(default): many dnat rules makes the vyos http api crash, even showConfig op timeouts`` + + +2021-02-17 +========== + +* :vytask:`T3047` ``(bug): OSPF : virtual-link and passive-interface default parameters does not work together`` +* :vytask:`T3312` ``(feature): SolarFlare NICs support`` + + +2021-02-16 +========== + +* :vytask:`T3318` ``(feature): Update Linux Kernel to v5.4.208 / 5.10.142`` + + +2021-02-14 +========== + +* :vytask:`T2152` ``(bug): ddclient has bug which prevents use_web from being used`` +* :vytask:`T3308` ``(feature): BGP: add gracefull shutdown support`` + + +2021-02-13 +========== + +* :vytask:`T3028` ``(feature): Create a default user when metadata is not available (for Cloud-init builds)`` +* :vytask:`T2867` ``(feature): Cleanup DataSourceOVF.py in the Cloud-init`` +* :vytask:`T2726` ``(feature): Allow to use all supported SSH key types in Cloud-init`` +* :vytask:`T2403` ``(feature): Full support for networking config in Cloud-init`` +* :vytask:`T2387` ``(feature): Create XML scheme for [conf_mode] BGP`` +* :vytask:`T2174` ``(feature): Rewrite protocol BGP to new XML/Python style`` +* :vytask:`T1987` ``(bug): A default route can be deleted by dhclient-script in some cases`` +* :vytask:`T723` ``(feature): Add support for first boot or installation time saved config modification`` +* :vytask:`T1775` ``(bug): Cloud-init not running userdata runcmd`` +* :vytask:`T1389` ``(feature): Add support for NoCloud cloud-init datasource`` +* :vytask:`T1315` ``(feature): Allow BGP to use address-family l2vpn evpn`` + + +2021-02-11 +========== + +* :vytask:`T2638` ``(default): FRR: New framework for configuring FRR`` + + +2021-02-08 +========== + +* :vytask:`T3295` ``(feature): Update Linux Kernel to v5.4.96 / 5.10.14`` + + +2021-02-07 +========== + +* :vytask:`T3293` ``(bug): RPKI migration script errors out after CLI rewrite`` + + +2021-02-06 +========== + +* :vytask:`T3285` ``(feature): Schedule reboots through systemd-shutdownd instead of atd`` +* :vytask:`T661` ``(feature): Show a warning if the router is going to reboot soon (due to "commit-confirm" command)`` + + +2021-02-05 +========== + +* :vytask:`T2450` ``(feature): Rewrite "protocols vrf" tree in XML and Python`` +* :vytask:`T208` ``(feature): Ability to ignore default-route from dhcpcd per interface`` + + +2021-02-03 +========== + +* :vytask:`T3239` ``(default): XML: override 'defaultValue' for mtu of certain interfaces; remove workarounds`` +* :vytask:`T2910` ``(feature): XML: generator should support override of variables`` +* :vytask:`T2873` ``(bug): "show nat destination translation address" doesn't filter at all`` + + +2021-02-02 +========== + +* :vytask:`T3018` ``(bug): Unclear behaviour when configuring vif and vif-s interfaces`` +* :vytask:`T3255` ``(default): Rewrite protocol RPKI to new XML/Python style`` + + +2021-02-01 +========== + +* :vytask:`T3268` ``(feature): Add VRF support to VIF-S interfaces`` +* :vytask:`T3274` ``(default): ask_yes_no() doesn't handle EOFError`` + + +2021-01-31 +========== + +* :vytask:`T3276` ``(feature): Update Linux Kernel to v5.4.94 / 5.10.12`` + + +2021-01-30 +========== + +* :vytask:`T3269` ``(bug): VIF-C interfaces don't verify configuration`` +* :vytask:`T3240` ``(feature): Support per-interface DHCPv6 DUIDs`` +* :vytask:`T3273` ``(default): PPPoE static default-routes deleted on interface down when not added by interface up`` + + +2021-01-29 +========== + +* :vytask:`T3262` ``(bug): DHCPv6 client runs when dhcpv6-options is configured without requesting an address or PD`` +* :vytask:`T3261` ``(bug): Does not possible to disable pppoe client interface.`` + + +2021-01-27 +========== + +* :vytask:`T3257` ``(feature): tcpdump supporting complete protocol`` +* :vytask:`T3110` ``(bug): Broken pipe in show interfaces`` +* :vytask:`T651` ``(enhancment): Split CI'ed, VyOS-specific packages and other packages into separate repos`` +* :vytask:`T597` ``(enhancment): Code testing on sonarcloud.com`` +* :vytask:`T516` ``(default): Make Python / XML code development more testable`` +* :vytask:`T625` ``(default): Lack of IKEv1 lifetime negotiation`` +* :vytask:`T613` ``(bug): Missing linux-kbuild`` +* :vytask:`T505` ``(bug): Hostapd cannot log`` + + +2021-01-26 +========== + +* :vytask:`T3251` ``(bug): PPPoE client trying to authorize with the wrong username`` +* :vytask:`T2859` ``(bug): show nat source translation - Errors out`` + + +2021-01-25 +========== + +* :vytask:`T3249` ``(feature): Support operation mode forwarding table output`` + + +2021-01-24 +========== + +* :vytask:`T3230` ``(bug): RPKI can't be deleted`` +* :vytask:`T3243` ``(feature): Update Linux Kernel to v5.4.92 / 5.10.10`` + + +2021-01-18 +========== + +* :vytask:`T2761` ``(feature): Extend "show vrrp" op-mode command with router priority`` +* :vytask:`T2679` ``(feature): VRRP with BFD Failure Detection`` +* :vytask:`T3212` ``(bug): SSH: configuration directory is not always created on boot`` +* :vytask:`T3231` ``(bug): "system option ctrl-alt-delete" has no effect`` + + +2021-01-17 +========== + +* :vytask:`T3222` ``(bug): Typo in BGP dampening description`` +* :vytask:`T2944` ``(bug): NTP by default listen on any address/interface`` +* :vytask:`T3226` ``(bug): Repair bridge smoke test damage`` +* :vytask:`T2442` ``(enhancment): Move application of STP settings for bridge members from interfaces-bridge.py to Interface.add_to_bridge()`` +* :vytask:`T2381` ``(bug): OpenVPN: openvpn-option parsed/rendered improperly`` + + +2021-01-16 +========== + +* :vytask:`T3215` ``(bug): Operational command "show ipv6 route" is broken`` +* :vytask:`T3172` ``(bug): Builds sometime after 2020-12-17 have broken routing after reboot`` +* :vytask:`T3157` ``(bug): salt-minion fails to start due to permission error accessing /root/.salt/minion.log`` +* :vytask:`T3167` ``(default): Recurring bugs in Intel NIC drivers`` +* :vytask:`T3151` ``(default): Decide on the final list of packages for 1.3`` +* :vytask:`T3137` ``(feature): Let VLAN aware bridge approach the behavior of professional equipment`` +* :vytask:`T3223` ``(feature): Update Linux Kernel to v5.4.89 / 5.10.7`` + + +2021-01-15 +========== + +* :vytask:`T3210` ``(feature): ISIS three-way-handshake`` +* :vytask:`T3184` ``(feature): Add correct desctiptions for BGP neighbors`` +* :vytask:`T2850` ``(feature): Add BGP template for FRR`` + + +2021-01-14 +========== + +* :vytask:`T3218` ``(feature): Replace Intel out-of-tree drivers with Linux Kernel stock drivers.`` + + +2021-01-13 +========== + +* :vytask:`T3186` ``(bug): NAT: Commit failed when applying negated(!) addresses`` + + +2021-01-12 +========== + +* :vytask:`T3205` ``(bug): Does not possible to configure tunnel mode gre-bridge`` + + +2021-01-11 +========== + +* :vytask:`T3208` ``(bug): Does not possible to change user password`` +* :vytask:`T3198` ``(bug): OSPF database filtering issue`` +* :vytask:`T3206` ``(bug): Unable to delete destination NAT rule`` +* :vytask:`T3193` ``(bug): DHCPv6 PD verification issues`` +* :vytask:`T3201` ``(bug): Operational command "show log all" is not working for RADIUS users`` + + +2021-01-10 +========== + +* :vytask:`T3178` ``(feature): Migrate vyatta-op-quagga to vyos-1x`` + + +2021-01-09 +========== + +* :vytask:`T2467` ``(bug): Restarting flow accounting fails with systemd error`` +* :vytask:`T3199` ``(feature): Update Linux Kernel to v5.4.88 / 5.10.6`` + + +2021-01-07 +========== + +* :vytask:`T3192` ``(feature): login: radius: add support for IPv6 RADIUS servers`` + + +2021-01-05 +========== + +* :vytask:`T3169` ``(enhancment): Reimplement smoke test of span (mirror)`` +* :vytask:`T3161` ``(default): Consider removing ConfigLoad.pm`` +* :vytask:`T1398` ``(default): Remove vyatta-config-migrate package`` +* :vytask:`T805` ``(enhancment): Drop config compatibility with Vyatta Core older than 6.5`` + + +2021-01-04 +========== + +* :vytask:`T3185` ``(bug): [conf-mode] Wrong CompletionHelp for Tunnel local-ip`` +* :vytask:`T2601` ``(bug): pppoe-server: Cannot disable CCP`` + + +2021-01-03 +========== + +* :vytask:`T3180` ``(bug): DHCP server raises NameError`` + + +2021-01-02 +========== + +* :vytask:`T2321` ``(feature): VRF support for SSH, NTP, SNMP service`` +* :vytask:`T3177` ``(bug): Rolling Release no longer reports VMware UUID`` + + +2021-01-01 +========== + +* :vytask:`T3171` ``(feature): Add CLI option to enable RPS (Receive Packet Steering)`` + + +2020-12-31 +========== + +* :vytask:`T3162` ``(bug): Wrong PPPoE server pado-delay parameter added to config`` +* :vytask:`T3160` ``(bug): PPPoE server called-sid option defined in wrong section`` +* :vytask:`T3168` ``(feature): Update Linux Kernel to v5.4.86`` + + +2020-12-29 +========== + +* :vytask:`T3082` ``(bug): multi_to_list must distinguish between values and defaults`` +* :vytask:`T1466` ``(feature): Add EAPOL login support`` + + +2020-12-28 +========== + +* :vytask:`T1732` ``(feature): Removing vyatta-webproxy module`` +* :vytask:`T2666` ``(feature): Packet Processing with eBPF and XDP`` +* :vytask:`T2581` ``(default): webproxy: implement proxy chaining`` +* :vytask:`T563` ``(feature): webproxy: migrate 'service webproxy' to get_config_dict()`` + + +2020-12-27 +========== + +* :vytask:`T3150` ``(bug): When configuring QoS, the setting procedure of port mirroring is wrong`` + + +2020-12-23 +========== + +* :vytask:`T3143` ``(bug): OpenVPN server: Push route config format is wrong`` +* :vytask:`T3146` ``(feature): Upgrade FRR from 7.4 -> 7.5 version incl. new libyang`` +* :vytask:`T3145` ``(feature): Update Linux Kernel to v5.4.85`` +* :vytask:`T3147` ``(feature): Upgrade to SaltStack version 3002.2`` + + +2020-12-22 +========== + +* :vytask:`T3142` ``(bug): OpenVPN op-command completion fails due to missing status file`` +* :vytask:`T2940` ``(feature): Update FRR to 7.4`` +* :vytask:`T2573` ``(bug): BFD op-mode commands are broken`` +* :vytask:`T2495` ``(feature): Add xml for ISIS [conf_mode]`` +* :vytask:`T1316` ``(feature): Support for IS-IS`` + + +2020-12-21 +========== + +* :vytask:`T2619` ``(bug): Bug: Changes in NAT or ZONES from 1.2 to 1.3`` + + +2020-12-20 +========== + +* :vytask:`T3131` ``(bug): Typo in ipsec preshared-secret help`` +* :vytask:`T3134` ``(bug): DHCPv6 DUID configuration node missing`` +* :vytask:`T3140` ``(feature): Relax "ethernet offload-options" CLI definition`` +* :vytask:`T3132` ``(feature): Enable egress flow accounting`` + + +2020-12-17 +========== + +* :vytask:`T2810` ``(default): Docs for vpn anyconnect-server`` +* :vytask:`T2036` ``(default): Open Connect VPN Server () support`` + + +2020-12-14 +========== + +* :vytask:`T3128` ``(bug): pppoe smoke test failed`` +* :vytask:`T3129` ``(feature): Update Linux Kernel to v5.4.83`` +* :vytask:`T3089` ``(feature): Migrate port mirroring to vyos-1x and support two-way traffic mirroring`` +* :vytask:`T3130` ``(feature): Replace vyos-netplug with upstream debian version`` + + +2020-12-13 +========== + +* :vytask:`T3114` ``(bug): When the bridge member is a non-ethernet interface, setting VLAN-aware bridge parameters fails`` + + +2020-12-11 +========== + +* :vytask:`T3123` ``(bug): Configuration of vti interface impossible`` + + +2020-12-10 +========== + +* :vytask:`T3117` ``(bug): OpenVPN config migration errors upgrading from 1.3-rolling-202010280217 to 1.3-rolling-202012060217`` + + +2020-12-09 +========== + +* :vytask:`T3122` ``(feature): Update Linux Kernel to v4.19.162`` +* :vytask:`T3121` ``(bug): get_config_dict() and key_mangling=('-', '_') Broke PowerDNS dns_forwarding config file`` + + +2020-12-08 +========== + +* :vytask:`T2562` ``(bug): VyOS can't be used as a DHCP server for a DHCP relay`` + + +2020-12-07 +========== + +* :vytask:`T3120` ``(bug): Python error when deleting nat rule`` +* :vytask:`T3119` ``(feature): migrate "system ip" to get_config_dict() and provide smoketest`` + + +2020-12-05 +========== + +* :vytask:`T2744` ``(bug): igmp-proxy issue: Address already in use`` + + +2020-12-04 +========== + +* :vytask:`T3108` ``(bug): Section config overlapped match with FRRConfig`` +* :vytask:`T3112` ``(feature): PPPoE IPv6: remove "enable" node`` +* :vytask:`T3100` ``(feature): Migrate DHCP/DHCPv6 server to get_config_dict()`` + + +2020-12-03 +========== + +* :vytask:`T3105` ``(bug): static-host-mapping writing in one line`` +* :vytask:`T3107` ``(feature): Update Linux Kernel to v4.19.161`` +* :vytask:`T3104` ``(bug): LLDP Traceback error`` + + +2020-12-01 +========== + +* :vytask:`T3102` ``(bug): Destination NAT fails to commit`` +* :vytask:`T2713` ``(bug): VyOS must not change permissions on files in /config/auth`` + + +2020-11-30 +========== + +* :vytask:`T3091` ``(feature): Add "tag" for static route`` +* :vytask:`T1207` ``(feature): DMVPN behind NAT`` + + +2020-11-29 +========== + +* :vytask:`T3095` ``(feature): Migrate dhcp-relay and dhcpv6-relay to get_config_dict()`` + + +2020-11-28 +========== + +* :vytask:`T2890` ``(bug): NAT error adding translation address range`` +* :vytask:`T2868` ``(bug): Tcp-mss option in policy calls kernel-panic`` +* :vytask:`T3092` ``(feature): nat: migrate to get_config_dict()`` + + +2020-11-27 +========== + +* :vytask:`T2715` ``(feature): Duplicate address detection option supporting ARP`` +* :vytask:`T2714` ``(feature): A collection of utilities supporting IPv6 or ipv4`` +* :vytask:`T3088` ``(feature): Migrate IGMP-Proxy over to get_config_dict() and add smoketests`` + + +2020-11-24 +========== + +* :vytask:`T3087` ``(feature): Update Linux Kernel to v4.19.160`` + + +2020-11-23 +========== + +* :vytask:`T2177` ``(default): Commit fails on adding disabled interface to bridge`` +* :vytask:`T3066` ``(bug): reboot in - Invalid time`` +* :vytask:`T2802` ``(bug): Tunnel interface does not apply EUI-64 IPv6 Address`` +* :vytask:`T2359` ``(bug): Adding IPIP6 tun interface to bridge [conf_mode] errors`` +* :vytask:`T2357` ``(bug): GRE-bridge conf_mode errors`` +* :vytask:`T2259` ``(feature): Support for bind vif-c interfaces into VRFs`` +* :vytask:`T2205` ``(bug): "set interface ethernet" fails on Hyper-V`` +* :vytask:`T2182` ``(bug): Failure to commit an IPv6 address on a tunnel interface`` +* :vytask:`T2155` ``(bug): Cannot set anything on Intel 82599ES 10-Gigabit SFI/SFP+`` +* :vytask:`T2153` ``(bug): traceroute circular reference`` +* :vytask:`T3081` ``(bug): get_config_dict() does not honor whitespaces in the CLI values field`` +* :vytask:`T3080` ``(bug): OpenVPN failing silently for a number of reasons in rolling post Nov/02`` +* :vytask:`T3074` ``(bug): OpenVPN site-to-site creates wrong peer address`` +* :vytask:`T2542` ``(bug): OpenVPN client tap interfaces not coming up`` +* :vytask:`T3084` ``(bug): wifi: TypeError on "show interfaces wireless info"`` + + +2020-11-21 +========== + +* :vytask:`T3079` ``(bug): Fix the problem that VLAN 1 will be deleted in VLAN-aware bridge`` +* :vytask:`T3060` ``(bug): OpenVPN virtual interface not coming up after upgrade`` + + +2020-11-20 +========== + +* :vytask:`T3078` ``(feature): CLI cleanup: rename "system options" -> "system option"`` +* :vytask:`T2997` ``(feature): DHCP: disallow/do-not-request certain options when requesting IP address from server`` +* :vytask:`T3077` ``(feature): WireGuard: automatically create link-local IPv6 adresses`` +* :vytask:`T2550` ``(default): OpenVPN: IPv4 not working in client mode`` +* :vytask:`T3072` ``(feature): Migrate tunnel interfaces to new get_config_dict() approach`` +* :vytask:`T3065` ``(feature): Add "interfaces wirelessmodem" IPv6 support`` +* :vytask:`T3048` ``(feature): Drop static smp-affinity for a more dynamic way using tuned`` + + +2020-11-19 +========== + +* :vytask:`T3067` ``(bug): Wireless interface can no longer be added to the bridge after bridge VLAN support`` +* :vytask:`T3075` ``(feature): Update Linux Kernel to v4.19.158`` + + +2020-11-16 +========== + +* :vytask:`T3003` ``(enhancment): Extend smoketest framework to allow loading an arbitrary config file`` + + +2020-11-15 +========== + +* :vytask:`T3069` ``(bug): OpenVPN routed networks not available`` +* :vytask:`T3038` ``(feature): Supporting AZERTY keyboards`` +* :vytask:`T2993` ``(bug): op-mode: lldp: show lldp neighbors - AttributeError: 'str' object has no attribute 'items'`` + + +2020-11-14 +========== + +* :vytask:`T3041` ``(bug): Intel QAT: vyos-1.3-rolling-202011020217-amd64 kernel panic during configure`` + + +2020-11-13 +========== + +* :vytask:`T3063` ``(feature): Add support for Huawei LTE Module ME909s-120`` +* :vytask:`T3059` ``(bug): L2TPv3 interface: Enforced to shutdown but no command to enable interface permanently`` + + +2020-11-12 +========== + +* :vytask:`T3064` ``(feature): Update Linux Kernel to v4.19.157`` + + +2020-11-10 +========== + +* :vytask:`T2103` ``(bug): Abnormal interface names if VIF present`` + + +2020-11-08 +========== + +* :vytask:`T3050` ``(bug): Broken address/subnet validation on NAT configuration`` + + +2020-11-07 +========== + +* :vytask:`T2914` ``(bug): OpenVPN: Fix for IPv4 remote-host hostname in client mode:`` +* :vytask:`T2653` ``(feature): "set interfaces" Python handler code improvements - next iteration`` +* :vytask:`T311` ``(feature): DHCP: set client-hostname via CLI`` + + +2020-11-06 +========== + +* :vytask:`T3051` ``(bug): OpenVPN: multiple client routes do not work in server mode`` +* :vytask:`T3046` ``(bug): openvpn directory is not auto-created`` +* :vytask:`T3052` ``(feature): Update Linux firmware files to 20201022 version`` +* :vytask:`T2731` ``(bug): "show interfaces" returns invalid state when link is down`` + + +2020-11-05 +========== + +* :vytask:`T3049` ``(feature): Update Linux Kernel to v4.19.155`` +* :vytask:`T2994` ``(feature): Migrate OpenVPN interfaces to get_config_dict() syntax`` + + +2020-11-03 +========== + +* :vytask:`T3043` ``(feature): Wireless: Refactor CLI`` +* :vytask:`T3034` ``(feature): Add WiFi WPA 3 support`` +* :vytask:`T2967` ``(bug): Duplicate IPv6 BFD peers created`` +* :vytask:`T2483` ``(bug): DHCP most likely not restarting pdns_recursor`` + + +2020-11-02 +========== + +* :vytask:`T3024` ``(bug): DHCPv6 PD configuration doesn't really render an expected behavior`` + + +2020-11-01 +========== + +* :vytask:`T3036` ``(feature): OpenVPN remote-address does not accept IPv6 address`` +* :vytask:`T2193` ``(feature): Display disabled VRRP instances in a `show vrrp` output`` + + +2020-10-30 +========== + +* :vytask:`T2790` ``(feature): Add ability to set ipv6 protocol route-map for OSPFv3`` +* :vytask:`T3033` ``(feature): Update Linux Kernel to v4.19.154`` +* :vytask:`T2969` ``(bug): OpenVPN: command_set on interface is not applied, if interface doesn't come up in commit`` + + +2020-10-28 +========== + +* :vytask:`T2631` ``(default): l2tp, sstp, pptp add option to disable radius accounting`` +* :vytask:`T2630` ``(feature): Allow Interface MTU over 9000`` +* :vytask:`T3027` ``(bug): Unable to update system Signature check FAILED`` +* :vytask:`T2995` ``(bug): Enhancements/bugfixes for vyos_dict_search()`` +* :vytask:`T2968` ``(feature): Add support for Intel Atom C2000 series QAT`` + + +2020-10-27 +========== + +* :vytask:`T3026` ``(default): qemu: update script for deprecated ssh_host_port_min/max`` +* :vytask:`T2938` ``(feature): Adding remote Syslog RFC5424 compatibility`` +* :vytask:`T2924` ``(bug): Using 'set src' in a route-map invalidates it as part of a subsequent boot-up`` +* :vytask:`T2587` ``(bug): Cannot enable the interface when the MTU is set to less than 1280`` +* :vytask:`T2885` ``(default): configd: print commit errors to config session terminal`` +* :vytask:`T2808` ``(default): Add smoketest to ensure script consistency with config daemon`` +* :vytask:`T2582` ``(default): Script daemon to offload processing during commit`` +* :vytask:`T1721` ``(bug): Recursive Next Hop not updated for static routes`` + + +2020-10-24 +========== + +* :vytask:`T3007` ``(default): HTTP-API should use config load script, not backend config load`` +* :vytask:`T3009` ``(bug): vpn l2tp remoteaccess require option broken`` +* :vytask:`T3010` ``(bug): ttl option of gre-bridge`` +* :vytask:`T3005` ``(bug): Intel: update out-of-tree drivers, i40e driver warning`` +* :vytask:`T3004` ``(feature): ConfigSession should (optionally) use config load script`` +* :vytask:`T2723` ``(feature): Support tcptraceroute`` + + +2020-10-22 +========== + +* :vytask:`T2978` ``(bug): IPoE service does not work on shared mode`` +* :vytask:`T2906` ``(bug): OpenVPN: tls-auth missing key direction`` + + +2020-10-21 +========== + +* :vytask:`T2828` ``(bug): BGP conf_mode error enforce-first-as`` +* :vytask:`T2749` ``(bug): Setting ethx configuration takes a long time`` +* :vytask:`T2138` ``(default): Can't load archived configs as they are gzipped`` + + +2020-10-20 +========== + +* :vytask:`T2987` ``(bug): VxLAN not working properly after upgrading to latest October build and with a new installation`` +* :vytask:`T2989` ``(default): MPLS documentation expansion`` + + +2020-10-19 +========== + +* :vytask:`T1588` ``(bug): VRRP failed to start if any of its interaces not exist`` +* :vytask:`T1385` ``(feature): Allow bonding interfaces to have pseudo-ethernet interfaces`` +* :vytask:`T3000` ``(bug): Mismatch between "prefix-length" and "preference" in dhcp6-server syntax`` +* :vytask:`T2992` ``(feature): Automatically verify sha256 checksum on ISO download`` +* :vytask:`T752` ``(feature): Add an option to disable IPv4 forwarding on specific interface only`` + + +2020-10-18 +========== + +* :vytask:`T2965` ``(feature): Brief BFD Peer Info`` +* :vytask:`T2907` ``(feature): OpenVPN: Option to disable encryption`` +* :vytask:`T2985` ``(feature): Add glue code to create bridge interface on demand`` + + +2020-10-17 +========== + +* :vytask:`T2980` ``(bug): FRR bfdd crash due to invalid length`` +* :vytask:`T2991` ``(feature): Update WireGuard to 1.0.20200908`` +* :vytask:`T2990` ``(feature): Update Linux Kernel to v4.19.152`` +* :vytask:`T2981` ``(feature): MPLS LDP neighbor session clear capability`` +* :vytask:`T2792` ``(default): Failed to run `sudo make qemu` with vyos-build container due to the change of packer`` + + +2020-10-13 +========== + +* :vytask:`T2976` ``(bug): Client IP pool does not work for PPPoE local users`` + + +2020-10-12 +========== + +* :vytask:`T2951` ``(bug): Cannot enable logging for monitor nat`` +* :vytask:`T2782` ``(bug): Changing timezone, does not restart rsyslog`` + + +2020-10-06 +========== + +* :vytask:`T2957` ``(bug): show openvpn not printing anything`` + + +2020-10-05 +========== + +* :vytask:`T2963` ``(bug): Wireless: WIFI is not password protected when security wpa mode is not defined but passphrase is`` + + +2020-10-04 +========== + +* :vytask:`T2953` ``(feature): Accel-PPP services CLI config cleanup (SSTP, L2TP, PPPoE, IPoE)`` +* :vytask:`T2829` ``(bug): PPPoE server: mppe setting is implemented as node instead of leafNode`` +* :vytask:`T2960` ``(feature): sstp: migrate to get_config_dict()`` + + +2020-10-03 +========== + +* :vytask:`T2956` ``(feature): Add support for list of defaultValues`` +* :vytask:`T2955` ``(feature): Update Linux Kernel to v4.19.149`` + + +2020-10-02 +========== + +* :vytask:`T2952` ``(bug): configd: timeout breaks synchronization of messages, causing freeze`` + + +2020-10-01 +========== + +* :vytask:`T2945` ``(bug): Interface removed from bridge on setting change`` +* :vytask:`T2948` ``(bug): NAT: OSError when configuring translation address range`` +* :vytask:`T2936` ``(feature): Migrate PPPoE server to get_config_dict() do reduce boilerplate code`` + + +2020-09-30 +========== + +* :vytask:`T2939` ``(bug): Wireguard Remove Peer Fails`` + + +2020-09-29 +========== + +* :vytask:`T2919` ``(feature): PPPoE server: Called-Station-Id attribute`` +* :vytask:`T2918` ``(feature): Accounting interim jitter for pppoe, l2tp, pptp, ipoe`` +* :vytask:`T2917` ``(feature): PPPoE server: Preallocate NAS-Port-Id`` +* :vytask:`T2937` ``(feature): Update Linux Kernel to v4.19.148`` + + +2020-09-27 +========== + +* :vytask:`T2930` ``(feature): Support configuration of MAC address for VXLAN and GENEVE tunnel`` + + +2020-09-26 +========== + +* :vytask:`T2856` ``(bug): equuleus: `show version all` throws broken pipe exception on abort`` +* :vytask:`T2929` ``(bug): Upgrading from 1.2 (crux) to 1.3 rolling causes vyos.configtree.ConfigTreeError for RADIUS settings`` +* :vytask:`T2928` ``(bug): MTU less then 1280 bytes and IPv6 will raise FileNotFoundError`` +* :vytask:`T2926` ``(bug): snmp.py missing an import`` +* :vytask:`T2912` ``(feature): When setting MTU check for hardware maximum supported MTU size`` + + +2020-09-25 +========== + +* :vytask:`T2915` ``(bug): Lost "proxy-arp-pvlan" option for vlan`` +* :vytask:`T2925` ``(feature): Update Linux Kernel to v4.19.147`` +* :vytask:`T2921` ``(feature): Migrate "service dns forwarding" to get_config_dict() for ease of source maintenance`` + + +2020-09-24 +========== + +* :vytask:`T2896` ``(bug): set ip route 0.0.0.0/0 dhcp-interface eth0`` +* :vytask:`T2923` ``(bug): Configuring DHCPv6-PD without a interface to delegate to raises TypeError`` + + +2020-09-23 +========== + +* :vytask:`T2846` ``(bug): ip route doesn't show longer-prefixes`` + + +2020-09-20 +========== + +* :vytask:`T2904` ``(feature): 802.1ad / Q-in-Q ethertype default not utilized`` +* :vytask:`T2905` ``(feature): Sync CLI nodes between PPPoE and WWAN interface`` +* :vytask:`T2903` ``(feature): Q-in-Q (802.1.ad) ethertype should be defined explicitly and not via its raw value`` + + +2020-09-19 +========== + +* :vytask:`T2894` ``(bug): bond: lacp: member interfaces get removed once bond interface has vlans configured`` +* :vytask:`T2901` ``(feature): Update Linux Kernel to v4.19.146`` +* :vytask:`T2900` ``(bug): DNS forwarding: invalid warning is shown for "system name-server" or "system name-servers-dhcp" even if present`` + + +2020-09-18 +========== + +* :vytask:`T945` ``(bug): Unable to change configuration after changing it from script (vbash + script-template)`` + + +2020-09-16 +========== + +* :vytask:`T2886` ``(bug): RADIUS authentication broken only returns operator level`` +* :vytask:`T2887` ``(bug): WiFi ht40+ channel width is not set in hostaptd.conf`` + + +2020-09-15 +========== + +* :vytask:`T2515` ``(bug): Ethernet interface is automatically disabled when removing it from bond`` + + +2020-09-14 +========== + +* :vytask:`T2872` ``(bug): "Show log" for nat and openvpn got intermixed`` +* :vytask:`T2301` ``(bug): Cannot delete PBR`` +* :vytask:`T2880` ``(feature): Update Linux Kernel to v4.19.145`` +* :vytask:`T2879` ``(feature): Cleanup 4.19.144 kernel configuration`` + + +2020-09-13 +========== + +* :vytask:`T2858` ``(feature): Rewrite dynamic dns client to get_config_dict()`` +* :vytask:`T2857` ``(feature): Cleanup Intel QAT configuration script`` +* :vytask:`T2877` ``(feature): LACP / bonding: support configuration of minimum number of links`` + + +2020-09-12 +========== + +* :vytask:`T2863` ``(default): Wireguard IPv6 Link-Local Addresses Are Not Unique`` +* :vytask:`T2876` ``(feature): Update Linux Kernel to v4.19.144`` + + +2020-09-10 +========== + +* :vytask:`T2870` ``(feature): Update Linux Kernel to v5.8.8`` + + +2020-09-09 +========== + +* :vytask:`T2728` ``(bug): Protocol option ignored for IPSec peers in transport mode`` +* :vytask:`T1934` ``(default): Change default hostname when deploy from OVA without params.`` +* :vytask:`T1953` ``(bug): DDNS service name validation rejects valid service names`` + + +2020-09-07 +========== + +* :vytask:`T1729` ``(default): PIM (Protocol Independent Multicast) implementation`` + + +2020-09-06 +========== + +* :vytask:`T2860` ``(bug): Update Accel-PPP to fix l2tp CVE`` + + +2020-09-02 +========== + +* :vytask:`T2833` ``(bug): RIP outgoing update filter list no longer operational`` +* :vytask:`T2849` ``(bug): vyos.xml.defaults should return a list on multi nodes, by default`` + + +2020-08-31 +========== + +* :vytask:`T2636` ``(bug): get_config_dict() shall always return a list on nodes`` + + +2020-08-30 +========== + +* :vytask:`T2843` ``(feature): Upgrade Linux Kernel to 5.8 series`` +* :vytask:`T2814` ``(default): kernel 5.1+ : NAT : module `nft_chain_nat_ipv4` renamed`` +* :vytask:`T2839` ``(feature): Upgrade WireGuard user-space tools and Kernel module`` +* :vytask:`T2842` ``(feature): Replace custom "wireguard, wireguard-tools" package with debian-backports version`` + + +2020-08-29 +========== + +* :vytask:`T2836` ``(default): show system integrity broken in 1.3`` + + +2020-08-28 +========== + +* :vytask:`T2126` ``(bug): show vpn ipsec sa IPSec - Process NOT Running`` +* :vytask:`T2813` ``(bug): NAT: possible to commit illegal source nat without translation`` +* :vytask:`T1463` ``(bug): Missing command `show ip bgp scan` appears in command completion`` + + +2020-08-27 +========== + +* :vytask:`T2832` ``(feature): Migrate vyos-smoketest content into vyos-1x`` + + +2020-08-26 +========== + +* :vytask:`T2830` ``(default): Migrate "service https" to use get_config_dict()`` +* :vytask:`T2831` ``(feature): Update Linux Kernel to v4.19.142`` + + +2020-08-25 +========== + +* :vytask:`T2826` ``(bug): frr: frr python lib error in replace_section`` + + +2020-08-24 +========== + +* :vytask:`T2423` ``(bug): Loadkey scp ssh key errors`` + + +2020-08-23 +========== + +* :vytask:`T2811` ``(bug): Cannot delete vpn anyconnect`` +* :vytask:`T2823` ``(bug): VXLAN has state A/D after configuration`` +* :vytask:`T2812` ``(default): Add basic smoketest for anyconnect`` + + +2020-08-22 +========== + +* :vytask:`T2822` ``(feature): Update Linux Kernel to v4.19.141`` +* :vytask:`T2821` ``(feature): Support DHCPv6-PD without "address dhcpv6"`` +* :vytask:`T2677` ``(feature): Proposal for clearer DHCPv6-PD configuration options`` + + +2020-08-20 +========== + +* :vytask:`T2209` ``(bug): Documentation has reference to the old 'user x level admin' option`` +* :vytask:`T1665` ``(default): prefix-list and prefix-list6 rules incorrectly accept a host address where prefix is required`` +* :vytask:`T2815` ``(default): Move certbot config directory under /config/auth`` + + +2020-08-19 +========== + +* :vytask:`T2794` ``(bug): op-mode: lldp: "show lldp neighbors" IndexError: list index out of range`` +* :vytask:`T2791` ``(feature): "monitor traceroute" has no explicit IPv4/IPv6 support`` +* :vytask:`T1515` ``(bug): FRR ospf6d crashes when performing: "show ipv6 ospfv3 database"`` + + +2020-08-16 +========== + +* :vytask:`T2277` ``(bug): dhclient-script-vyos does not support VRFs`` +* :vytask:`T2090` ``(default): Deleting 'service salt-minion' causes python TypeError`` + + +2020-08-15 +========== + +* :vytask:`T2797` ``(feature): Update Linux Kernel to v4.19.139`` +* :vytask:`T2796` ``(bug): PPPoE-Server: listen interface is mandatory but validation check is missing`` + + +2020-08-14 +========== + +* :vytask:`T2795` ``(bug): console server fails to commit`` + + +2020-08-12 +========== + +* :vytask:`T2786` ``(bug): OSPF Interface Cost`` +* :vytask:`T2325` ``(bug): NHRP op-mode errors with missing daemon socket`` +* :vytask:`T2227` ``(feature): MPLS documentation`` +* :vytask:`T2767` ``(bug): The interface cannot be disabled for network enabled configuration`` +* :vytask:`T2316` ``(bug): DHCP-server op-mode errors`` + + +2020-08-11 +========== + +* :vytask:`T2779` ``(bug): LLDP: "show lldp neighbors interface" does not yield any result`` +* :vytask:`T2379` ``(bug): DHCPv6 address for interface deletion triggers a script error`` +* :vytask:`T2784` ``(default): Remove unused arg from host_name.py functions verify and get_config`` + + +2020-08-10 +========== + +* :vytask:`T2780` ``(feature): Update Linux Kernel to v4.19.138`` + + +2020-08-08 +========== + +* :vytask:`T2716` ``(bug): Shaper-HFSC shapes but does not control latency correctly`` +* :vytask:`T2497` ``(default): Cache config string during commit`` +* :vytask:`T2501` ``(bug): Cannot recover from failed boot config load`` +* :vytask:`T1974` ``(feature): Allow route-map to set administrative distance`` +* :vytask:`T1949` ``(bug): Multihop IPv6 BFD is unconfigurable`` + + +2020-08-04 +========== + +* :vytask:`T2758` ``(bug): router-advert: 'infinity' is not a valid integer number`` +* :vytask:`T2637` ``(bug): Vlan is not removed from the system`` +* :vytask:`T1287` ``(bug): No DHCPv6 leases reported for "show dhcpv6 client leases"`` + + +2020-08-03 +========== + +* :vytask:`T2241` ``(default): Changing settings on an interface causes it to fall out of bridge`` +* :vytask:`T2757` ``(bug): "show system image version" contains additional new-line character breaking output`` +* :vytask:`T1826` ``(bug): Misleading message on "reboot at" command`` +* :vytask:`T1511` ``(default): Rewrite ethernet setup scripts to python`` +* :vytask:`T1600` ``(default): Convert 'ping' operation from vyatta-op to new syntax`` +* :vytask:`T1486` ``(bug): Unknown LLDP version reported to peers`` +* :vytask:`T1414` ``(enhancment): equuleus: buster: 10-unmountfs.chroot fail under apply`` +* :vytask:`T1076` ``(bug): SSH: make configuration (sshd_config) volatile and store it to /run`` +* :vytask:`T2724` ``(feature): Support for IPv6 Toolset`` +* :vytask:`T2323` ``(bug): LLDP: "show lldp neighbors detail" returns warnings when service is not configured`` +* :vytask:`T1754` ``(bug): DHCPv6 client is impossible to restart`` + + +2020-08-02 +========== + +* :vytask:`T2756` ``(feature): Accel-PPP: make RADIUS accounting port configurable`` + + +2020-08-01 +========== + +* :vytask:`T2752` ``(bug): Exception when configuring unavailable ethernet interface`` +* :vytask:`T2751` ``(feature): Update Linux Kernel to v4.19.136`` +* :vytask:`T2753` ``(feature): Rewrite "add system image" op mode commands in XML`` +* :vytask:`T2690` ``(feature): Add VRF support to the add system image command`` + + +2020-07-30 +========== + +* :vytask:`T2746` ``(feature): IPv6 link-local addresses not configured`` +* :vytask:`T2678` ``(bug): High RAM usage on SSH logins with lots of IPv6 routes in the routing table.`` +* :vytask:`T2701` ``(bug): `vpn ipsec pfs enable` doesn't work with IKE groups`` +* :vytask:`T2745` ``(feature): router-advert: migrate to get_config_dict()`` + + +2020-07-29 +========== + +* :vytask:`T2743` ``(feature): WireGuard: move key migration from config script to migration script`` +* :vytask:`T2742` ``(feature): mDNS repeater: migrate to get_config_dict()`` + + +2020-07-28 +========== + +* :vytask:`T1117` ``(feature): 'show ipv6 bgp route-map' missing`` +* :vytask:`T928` ``(feature): Add support for PIM (Protocol-Independent Multicast)`` + + +2020-07-27 +========== + +* :vytask:`T2729` ``(feature): Pseudo-ethernet replace fail message`` +* :vytask:`T1249` ``(feature): multiple PBR rules can set to a single interface`` +* :vytask:`T1956` ``(feature): PPPoE server: support PADO-delay`` +* :vytask:`T1295` ``(feature): FRR: update documentation`` +* :vytask:`T1222` ``(bug): OSPF routing problem - route looping`` +* :vytask:`T1158` ``(bug): Route-Map configuration dropped updating rc11 to epa2`` +* :vytask:`T1130` ``(bug): Deleting BGP communities from prefix does not work`` +* :vytask:`T2067` ``(feature): pppoe-server: Add possibility set multiple service-name`` + + +2020-07-26 +========== + +* :vytask:`T2734` ``(feature): WireGuard: fwmark CLI definition is inconsistent`` +* :vytask:`T2733` ``(feature): Support MTU configuration on pseudo ethernet devices`` +* :vytask:`T2644` ``(default): Bonding interfaces cannot be disabled`` +* :vytask:`T2476` ``(bug): Bond member description change leads to network outage`` +* :vytask:`T2443` ``(feature): NHRP: Add debugging information to syslog`` +* :vytask:`T2021` ``(bug): OSPFv3 doesn't support decimal area syntax`` +* :vytask:`T1901` ``(bug): Semicolon in values is interpreted as a part of the shell command by validators`` +* :vytask:`T2000` ``(bug): strongSwan does not install routes to table 220 in certain cases`` +* :vytask:`T2091` ``(bug): swanctl.conf file is not generated properly if more than one IPsec profile is used`` +* :vytask:`T1983` ``(feature): Expose route-map when BGP routes are programmed in to FIB`` +* :vytask:`T1973` ``(feature): Allow route-map to match on BGP local preference value`` +* :vytask:`T1853` ``(bug): wireguard - disable peer doesn't work`` +* :vytask:`T1985` ``(feature): pppoe: Enable ipv6 modules without configured ipv6 pools`` + + +2020-07-25 +========== + +* :vytask:`T2730` ``(feature): Update Linux Kernel to v4.19.134`` +* :vytask:`T2106` ``(bug): Wrong interface states after reboot`` +* :vytask:`T1507` ``(default): cli: logical redundancy with boolean type`` + + +2020-07-24 +========== + +* :vytask:`T2097` ``(bug): Problems when using as completion helper in op-mode`` +* :vytask:`T2092` ``(bug): dhcp-server rfc3442 static route should add default route`` +* :vytask:`T1817` ``(bug): BGP next-hop-self not working.`` +* :vytask:`T1462` ``(bug): Upgrade path errors 1.1.8 to 1.2.1-S2`` +* :vytask:`T1372` ``(bug): Diff functionality behaves incorrectly in some cases`` +* :vytask:`T2073` ``(feature): ipoe-server: reset op-mode command for sessions`` +* :vytask:`T1715` ``(bug): System DNS Server Order Incorrect`` + + +2020-07-23 +========== + +* :vytask:`T2673` ``(bug): After the bridge is configured with Mac, bridge is automatically disabled`` +* :vytask:`T2626` ``(bug): Changing pseudo-ethernet mode, throws CLI error`` +* :vytask:`T2608` ``(bug): delete pseudo-ethernet failed (another error type)`` +* :vytask:`T2527` ``(bug): bonding: the last slave interface is not deleted`` +* :vytask:`T2358` ``(bug): ip6ip6 bridge conf_mode errors`` +* :vytask:`T2346` ``(bug): Setting hostname yields temporary file error`` +* :vytask:`T2330` ``(bug): Vpn op-mode syntax`` +* :vytask:`T2188` ``(default): NTP op-mode commands don't work`` + + +2020-07-22 +========== + +* :vytask:`T2718` ``(bug): ntp.conf updated incorrectly`` +* :vytask:`T2658` ``(bug): Interface description comment display error`` +* :vytask:`T2643` ``(bug): show interfaces does not scale with terminal width`` +* :vytask:`T2725` ``(bug): Config fails to load if user has no password`` +* :vytask:`T2707` ``(default): Allow alternative initialization data for Config`` + + +2020-07-20 +========== + +* :vytask:`T2709` ``(bug): Destination NAT translation port without address fails to commit`` +* :vytask:`T2519` ``(bug): Broadcast address does not add automatically`` + + +2020-07-19 +========== + +* :vytask:`T2708` ``(bug): "show flow-accounting" should not display script's "usage" help`` +* :vytask:`T2592` ``(default): dhcp-relay discarding packets on valid interfaces`` +* :vytask:`T2712` ``(feature): udp-broadcast-relay: serivce no longer starts`` +* :vytask:`T2706` ``(feature): Support NDP protocol monitoring`` + + +2020-07-18 +========== + +* :vytask:`T2704` ``(bug): connect/disconnect Missing newline in op-mode tab completion helper`` +* :vytask:`T2689` ``(feature): Add helper functions to query changes between session and effective configs`` +* :vytask:`T2585` ``(bug): Unable to access the Internet after opening PPPoE on-demand dialing`` + + +2020-07-15 +========== + +* :vytask:`T2675` ``(bug): DNS service failed to start`` +* :vytask:`T2596` ``(feature): Allow specifying source IP for 'add system image'`` + + +2020-07-12 +========== + +* :vytask:`T1575` ``(default): `show snmp mib ifmib` crashes with IndexError`` +* :vytask:`T2696` ``(bug): Some bugfixes of vyatta-wanloadbalance`` + + +2020-07-11 +========== + +* :vytask:`T2687` ``(feature): SNMP: change logic on v3 password encryption`` +* :vytask:`T2693` ``(bug): Dhcp6c cannot be restarted after PPPoE link is reset`` + + +2020-07-08 +========== + +* :vytask:`T2692` ``(bug): Evaluate Setting Default Hash Policy to L3+L4`` +* :vytask:`T2646` ``(bug): Sysctl for IPv4 ECMP Hash Policy Not Set`` + + +2020-07-07 +========== + +* :vytask:`T2691` ``(bug): Upgrade from 1.2.5 to 1.3-rolling-202007040117 results in broken config due to case mismatch`` +* :vytask:`T2389` ``(bug): BGP community-list unknown command`` +* :vytask:`T2686` ``(bug): FRR: BGP: large-community configuration is not applied properly after upgrading FRR to 7.3.x series`` + + +2020-07-06 +========== + +* :vytask:`T2680` ``(bug): dhcp6c service cannot recover when it fails`` + + +2020-07-05 +========== + +* :vytask:`T2684` ``(feature): Update Linux Kernel to v4.19.131`` +* :vytask:`T2685` ``(feature): Update Accel-PPP to fix SSTP client issues`` +* :vytask:`T2681` ``(bug): PPPoE stops negotiating IPv6`` + + +2020-07-04 +========== + +* :vytask:`T2682` ``(bug): VRF aware services - connection no longer possible after system reboot`` + + +2020-07-03 +========== + +* :vytask:`T2670` ``(default): Remove dependency on show_config from get_config_dict`` +* :vytask:`T2676` ``(feature): NTP: migrate to get_config_dict() implementation`` + + +2020-07-02 +========== + +* :vytask:`T2668` ``(default): get_config_dict: add get_first_key arg to utility function get_sub_dict`` + + +2020-07-01 +========== + +* :vytask:`T2662` ``(default): get_config_dict includes node name as key only for tag and leaf nodes`` +* :vytask:`T2667` ``(feature): get_config_dict: Use utility function for non-empty path argument`` + + +2020-06-28 +========== + +* :vytask:`T2660` ``(bug): XML: Python default dictionary does not obey underscore (_) when flat is False`` + + +2020-06-27 +========== + +* :vytask:`T2656` ``(bug): XML: Python default dictionary returns wrong dictionary level(s)`` + + +2020-06-26 +========== + +* :vytask:`T2642` ``(bug): sshd fails to start due to configuration error`` +* :vytask:`T2588` ``(default): Add support for default values to the interface-definition format`` +* :vytask:`T2622` ``(bug): Pseudo-ethernet interface config disappears across versions`` +* :vytask:`T2057` ``(feature): Generalised Interface configuration`` +* :vytask:`T2625` ``(feature): Provide generic Library for package builds`` + + +2020-06-25 +========== + +* :vytask:`T2487` ``(bug): VRRP does not display info when group disabled`` +* :vytask:`T2329` ``(bug): Show remote config openvpn`` +* :vytask:`T2165` ``(bug): When trying to add route to ripng it complains that ip address should be IPv4 format`` +* :vytask:`T2159` ``(default): webproxy log read from wrong file`` +* :vytask:`T2101` ``(feature): Fix VXLAN config option parsing`` +* :vytask:`T2062` ``(bug): Wrong dhcp-server static route subnet bytes`` +* :vytask:`T1986` ``(bug): Python configuration manipulation library leaks open files`` +* :vytask:`T1762` ``(bug): VLAN interface configuration fails after internal representation of edit level was switched from a string to a list`` +* :vytask:`T1538` ``(bug): Update conntrack-sync packages to fix VRRP issues`` +* :vytask:`T1808` ``(feature): add package nftables`` + + +2020-06-24 +========== + +* :vytask:`T2634` ``(feature): remove autogeneration of interface "ip section" from vyatta-cfg-system`` +* :vytask:`T2633` ``(bug): Error with arp_accept on tun interface`` +* :vytask:`T2595` ``(feature): Update Linux Kernel to v4.19.128`` +* :vytask:`T1938` ``(bug): syslog doesn't start automatically`` + + +2020-06-23 +========== + +* :vytask:`T2632` ``(bug): WireGuard: Cannot use only one preshared-key for one peer`` +* :vytask:`T1829` ``(bug): Install Image script does not respect size of partition greater than 2G but less than disk size`` +* :vytask:`T2635` ``(feature): SSH: migrate to get_config_dict()`` + + +2020-06-22 +========== + +* :vytask:`T2486` ``(bug): DNS records set via 'system static-host-mapping' return NXDOMAIN from 'service dns forwarding' after a request to a forwarded zone`` +* :vytask:`T2463` ``(bug): DHCP-received nameserver not added to vyos-hostsd`` +* :vytask:`T2534` ``(bug): pdns-recursor override.conf error`` +* :vytask:`T2054` ``(bug): Changing "system name-server" doesn't update dns forwarding config, neither does "restart dns forwarding"`` +* :vytask:`T2225` ``(default): PIM/IGMP documentation`` + + +2020-06-21 +========== + +* :vytask:`T2624` ``(feature): Serial Console: fix migration script for configured powersave and no console`` +* :vytask:`T2610` ``(bug): default-lifetime is not reflected in the RA message`` +* :vytask:`T2299` ``(feature): login radius-server priority`` +* :vytask:`T1739` ``(bug): Serial interface seems not to be deleted properly`` +* :vytask:`T480` ``(bug): Error if no serial interface is present (/dev/ttyS0: not a tty)`` + + +2020-06-20 +========== + +* :vytask:`T2621` ``(bug): show interfaces repeats interface description if it is longer then an arbitrary number of characters`` +* :vytask:`T2618` ``(default): Conversion from 1.2 to 1.3 lost RADVD prefix autonomous-flag setting`` + + +2020-06-19 +========== + +* :vytask:`T2589` ``(bug): delete pseudo-ethernet failed`` +* :vytask:`T2490` ``(feature): Add serial (rs232) to ssh bridge service`` + + +2020-06-18 +========== + +* :vytask:`T2614` ``(default): Add an option to mangle dict keys to vyos.config.get_config_dict()`` +* :vytask:`T2026` ``(default): Make cli-shell-api correctly exit with non-zero code on failures`` +* :vytask:`T1868` ``(default): Add opportunity to get current values from API`` + + +2020-06-17 +========== + +* :vytask:`T2478` ``(feature): login radius: use NAS-IP-Address if defined source address`` +* :vytask:`T2141` ``(bug): Static ARP is not applied on boot`` +* :vytask:`T2609` ``(bug): router-advert: radvd does not start when lifetime is improperly configured`` +* :vytask:`T1720` ``(feature): support for more 'show ip route' commands`` + + +2020-06-16 +========== + +* :vytask:`T2604` ``(default): Remove use of is_tag in system-syslog.py`` +* :vytask:`T2605` ``(bug): SNMP service is not disabled by default`` +* :vytask:`T2568` ``(bug): Add some missing checks in config`` +* :vytask:`T2156` ``(default): PIM op-mode commands`` + + +2020-06-15 +========== + +* :vytask:`T2600` ``(bug): RADIUS system login configuration rendered wrongly`` +* :vytask:`T2599` ``(bug): "show interfaces" does not list VIF interfaces in ascending order`` +* :vytask:`T2591` ``(bug): show command has wrong interfaces ordering`` +* :vytask:`T2576` ``(bug): "show interfaces" does not return VTI`` + + +2020-06-14 +========== + +* :vytask:`T2354` ``(bug): Wireless conf_mode errors`` +* :vytask:`T2593` ``(bug): source NAT translation port can not be set when translation address is set to masquerade`` +* :vytask:`T2594` ``(default): Missing firmware for iwlwifi`` + + +2020-06-11 +========== + +* :vytask:`T2578` ``(bug): ipaddrcheck unaware of /31 host addresses - can no longer assign /31 mask to interface addresses`` +* :vytask:`T2571` ``(bug): NAT destination port with ! results in error`` +* :vytask:`T2570` ``(feature): Drop support for "system console device modem"`` +* :vytask:`T2586` ``(bug): WWAN default route is not installed into VRF`` +* :vytask:`T2561` ``(feature): Drop support for "system console netconsole"`` +* :vytask:`T2569` ``(feature): Migrate "set system console" to XML and Python representation`` + + +2020-06-10 +========== + +* :vytask:`T2575` ``(bug): pppoe-server: does not possibly assign IP address`` +* :vytask:`T2565` ``(bug): Cannot connect to l2tp server with radius auth`` +* :vytask:`T2553` ``(bug): set interface ethN vif-s nnnn does not commit`` + + +2020-06-08 +========== + +* :vytask:`T2559` ``(feature): Add operational mode command to retrieve hardware sensor data`` + + +2020-06-07 +========== + +* :vytask:`T2529` ``(feature): WWAN: migrate from ttyUSB device to new device in /dev/serial/by-bus`` +* :vytask:`T2560` ``(feature): New op-mode command to display information about USB interfaces`` + + +2020-06-05 +========== + +* :vytask:`T2548` ``(bug): Interfaces allowing inappropriate network addresses to be assigned`` +* :vytask:`T1958` ``(default): Include only firmware we actually need`` + + +2020-06-04 +========== + +* :vytask:`T2514` ``(enhancment): "mac" setting for bond members`` + + +2020-06-02 +========== + +* :vytask:`T2129` ``(feature): XML schema: tagNode not allowed on first level in new XML op-mode definition`` +* :vytask:`T2545` ``(feature): Show physical device offloading capabilities for specified ethernet interface`` +* :vytask:`T2544` ``(feature): Enable Kernel KONFIG_KALLSYMS`` +* :vytask:`T2543` ``(feature): Kernel: always build perf binary but ship as additional deb package to not bloat the image`` +* :vytask:`T1096` ``(bug): BGP process memory leak`` + + +2020-06-01 +========== + +* :vytask:`T2535` ``(feature): Update Intel QAT drivers to 1.7.l.4.9.0-00008`` +* :vytask:`T2537` ``(feature): Migrate "show log dns" from vyatta-op to vyos-1x`` +* :vytask:`T2536` ``(bug): "show log dns forwarding" still refers to dnsmasq`` +* :vytask:`T2538` ``(feature): Update Intel NIC drivers to recent release (preparation for Kernel >=5.4)`` +* :vytask:`T2526` ``(feature): Wake-On-Lan CLI implementation`` + + +2020-05-31 +========== + +* :vytask:`T2532` ``(feature): VRF aware OpenVPN`` + + +2020-05-30 +========== + +* :vytask:`T2388` ``(feature): template rendering should create folder and set permission`` +* :vytask:`T2531` ``(feature): Update Linux Kernel to v4.19.125`` +* :vytask:`T2530` ``(bug): Error creating VRF with a name of exactly 16 characters`` + + +2020-05-29 +========== + +* :vytask:`T2528` ``(bug): "update dns dynamic" throws FileNotFoundError excepton`` + + +2020-05-28 +========== + +* :vytask:`T1291` ``(default): Under certain conditions the VTI will stay forever down`` + + +2020-05-27 +========== + +* :vytask:`T2395` ``(feature): HTTP API move to flask/flask-restx as microframework`` +* :vytask:`T1121` ``(bug): Can't search for prefixes by community: Community malformed: AA:NN`` + + +2020-05-26 +========== + +* :vytask:`T2520` ``(bug): show conntrack fails with Perl error`` +* :vytask:`T2502` ``(bug): PPPoE default route not installed for IPv6 when "default-route auto"`` +* :vytask:`T2458` ``(feature): Update FRR to 7.3.1`` +* :vytask:`T2506` ``(feature): DHCPv6-PD add prefix hint CLI option`` + + +2020-05-25 +========== + +* :vytask:`T2391` ``(bug): pppoe-server session-control does not work`` +* :vytask:`T2269` ``(feature): SSTP specify tunnels names`` +* :vytask:`T1137` ``(bug): 'sh ip bgp sum' being truncated`` + + +2020-05-22 +========== + +* :vytask:`T2491` ``(feature): MACsec: create CLI for replay protection`` +* :vytask:`T2489` ``(feature): Add MACsec interfaces to "show interfaces" output`` +* :vytask:`T2201` ``(feature): Rewrite protocol BGP [op-mode] to new XML/Python style`` +* :vytask:`T2492` ``(feature): Do not set encrypted user password when it is not changed`` +* :vytask:`T2496` ``(feature): Set default to new syntax for config file component versions`` +* :vytask:`T2493` ``(feature): Update Linux Kernel to v4.19.124`` +* :vytask:`T2380` ``(bug): After PPPoE 0 is restarted, the default static route is lost`` + + +2020-05-21 +========== + +* :vytask:`T1876` ``(bug): IPSec VTI tunnels are deleted after rekey and dangling around as A/D`` +* :vytask:`T2488` ``(feature): Remove logfile for dialup interfaces like pppoe and wwan`` +* :vytask:`T2475` ``(bug): linting`` +* :vytask:`T1820` ``(bug): VRRP transition scripts for sync-groups are not supported in VyOS (anymore)`` +* :vytask:`T2364` ``(default): Add CLI command for mroute`` +* :vytask:`T2023` ``(feature): Add support for 802.1ae MACsec`` + + +2020-05-20 +========== + +* :vytask:`T2480` ``(bug): NAT: after rewrite commit tells that dnat IP address is not locally connected`` + + +2020-05-19 +========== + +* :vytask:`T2481` ``(feature): WireGuard: support tunnel via IPv6 underlay`` +* :vytask:`T421` ``(bug): Add Pv6 prefix delegation support`` +* :vytask:`T815` ``(feature): Add DHCPv6 server prefix-delegation support`` + + +2020-05-17 +========== + +* :vytask:`T2471` ``(feature): PPPoE server: always add AdvAutonomousFlag when IPv6 is configured`` +* :vytask:`T2409` ``(default): At boot, effective config should not be equal to current config`` + + +2020-05-16 +========== + +* :vytask:`T2466` ``(bug): live-build encounters apt dependency problem when building with local packages`` +* :vytask:`T2470` ``(feature): Update to PowerDNS recursor 4.3`` +* :vytask:`T2469` ``(feature): Update Linux Kernel to v4.19.123`` +* :vytask:`T2198` ``(default): Rewrite NAT in new XML/Python style`` + + +2020-05-15 +========== + +* :vytask:`T2449` ``(bug): 'ipv6 address autoconf' and 'address dhcpv6' don't work because interfaces have accept_ra=1 (they should have accept_ra=2 when forwarding=1)`` + + +2020-05-14 +========== + +* :vytask:`T2456` ``(bug): netflow source-ip cannot be configured`` + + +2020-05-13 +========== + +* :vytask:`T2435` ``(bug): Pseudo-ethernet Interfaces Broken`` +* :vytask:`T2294` ``(bug): ipoe-server broken (jinja2 template issue)`` + + +2020-05-12 +========== + +* :vytask:`T2454` ``(feature): Update Linux Kernel to v4.19.122`` +* :vytask:`T2392` ``(bug): SSTP with ipv6`` + + +2020-05-10 +========== + +* :vytask:`T2445` ``(bug): VRF route leaking for ipv4 not working`` +* :vytask:`T2372` ``(bug): VLAN: error on commit if main interface is disabled`` +* :vytask:`T2439` ``(bug): Configuration dependency problem, unable to load complex configuration after reboot`` + + +2020-05-09 +========== + +* :vytask:`T2427` ``(default): Interface addressing broken since fix for T2372 was merged`` +* :vytask:`T2438` ``(default): isc-dhcp-server(6).service reports startup success immediately even if dhcpd fails to start up`` +* :vytask:`T2367` ``(default): Flush addresses from bridge members`` + + +2020-05-08 +========== + +* :vytask:`T2441` ``(bug): TZ validator has a parse error`` +* :vytask:`T2429` ``(bug): Vyos cannot apply VLAN sub interface to bridge`` + + +2020-05-06 +========== + +* :vytask:`T2402` ``(bug): Live ISO should warn when configuring that changes won't persist`` + + +2020-05-05 +========== + +* :vytask:`T1899` ``(bug): Unionfs metadata folder is copied to the active configuration directory`` + + +2020-05-04 +========== + +* :vytask:`T2412` ``(bug): ping flood does not work as unprivileged user`` +* :vytask:`T701` ``(bug): LTE interface dosen't come up`` +* :vytask:`T951` ``(bug): command 'isolate-stations true/false' does not make any changes in the hostapd.conf`` + + +2020-05-03 +========== + +* :vytask:`T2420` ``(feature): Update Linux Kernel to v4.19.120`` +* :vytask:`T2406` ``(feature): DHCPv6 CLI improvements`` +* :vytask:`T2421` ``(feature): Update WireGuard to Debian release 1.0.20200429-2_bpo10+1`` + + +2020-05-02 +========== + +* :vytask:`T2414` ``(feature): Improve runtime from Python numeric validator`` +* :vytask:`T2413` ``(feature): Update Linux Kernel to v4.19.119`` + + +2020-05-01 +========== + +* :vytask:`T2411` ``(feature): op-mode: make "monitor traceroute" VRF aware`` +* :vytask:`T2347` ``(bug): During commit, any script output directed to stdout will contain path`` +* :vytask:`T2239` ``(default): build-vmware-image script ignores the predefined file path, uses the environment variable unconditionally.`` + + +2020-04-29 +========== + +* :vytask:`T2399` ``(bug): op-mode "dhcp client leases" does not return leases`` +* :vytask:`T2398` ``(bug): op-mode "dhcp client leases interface" completion helper misses interfaces`` +* :vytask:`T2394` ``(feature): dhcpv6 client does not start`` +* :vytask:`T2393` ``(feature): dhclient: migrate from SysVinit to systemd`` +* :vytask:`T2268` ``(bug): DHCPv6 is broken`` + + +2020-04-28 +========== + +* :vytask:`T1227` ``(bug): rip PW can't be set at interface config`` + + +2020-04-27 +========== + +* :vytask:`T2373` ``(feature): Required auth options for pppoe-server`` +* :vytask:`T1381` ``(feature): Enable DHCP option 121 processing`` +* :vytask:`T2010` ``(bug): Reboot at reports wrong time or missing timezone`` + + +2020-04-26 +========== + +* :vytask:`T2386` ``(bug): salt: upgrade to 2019.2 packages`` +* :vytask:`T2385` ``(bug): salt-minion: improve completion helpers`` +* :vytask:`T2384` ``(bug): salt-minion: log to syslog and remove custom logging option`` +* :vytask:`T2383` ``(feature): Update Linux Kernel to v4.19.118`` +* :vytask:`T2382` ``(bug): salt-minion: Throws KeyError on commit`` +* :vytask:`T2350` ``(bug): Interface geneve conf-mode error`` + + +2020-04-25 +========== + +* :vytask:`T2304` ``(feature): "system login" add RADIUS VRF support`` +* :vytask:`T1842` ``(bug): Equuleus: "reboot at 04:00" command not working`` + + +2020-04-24 +========== + +* :vytask:`T2375` ``(feature): WireGuard: throw exception if address and port are not given as both are mandatory`` +* :vytask:`T2348` ``(bug): On IPv6 address distribution and DHCPv6 bugs`` + + +2020-04-23 +========== + +* :vytask:`T2369` ``(feature): VRF: can not leak interface route from default VRf to any other VRF`` +* :vytask:`T2368` ``(bug): VRF: missing completion helper when leaking to default table`` +* :vytask:`T2374` ``(bug): Tunnel interface can not be disabled`` +* :vytask:`T2362` ``(default): IPv6 link-local addresses missing due to EUI64 address code, causing router-advert not to work`` +* :vytask:`T2345` ``(default): IPv6 router-advert not working`` + + +2020-04-22 +========== + +* :vytask:`T2361` ``(bug): Unable to delete VLAN vif interface`` +* :vytask:`T2339` ``(bug): OpenVPN: IPv4 no longer working after adding IPv6 support`` +* :vytask:`T2331` ``(bug): VRRP op-mode errors`` +* :vytask:`T2320` ``(bug): Wireguard creates non-existing interfaces in [op-mode].`` +* :vytask:`T2096` ``(feature): Provide "generate" and "show" commands via the http API`` +* :vytask:`T2351` ``(feature): Cleanup PPTP server implementation and CLI commands`` + + +2020-04-21 +========== + +* :vytask:`T2341` ``(bug): Pseudo-ethernet Interfaces Not Loaded on Boot`` +* :vytask:`T2270` ``(bug): using load with scp/sftp and a username and password does not work`` +* :vytask:`T2255` ``(bug): DNS forwarding op-mode error`` +* :vytask:`T1907` ``(bug): Traceback on a non-existent interface.`` +* :vytask:`T2204` ``(feature): Support tunnel source-interface`` + + +2020-04-20 +========== + +* :vytask:`T2335` ``(bug): Unable to assign IPv6 from ISP`` +* :vytask:`T2317` ``(bug): l2tp overwriting ipsec config files`` +* :vytask:`T2292` ``(bug): Ensure graceful shutdown of vyos-http-api`` +* :vytask:`T2344` ``(bug): PPPoE server client static IP assignment silently fails`` + + +2020-04-19 +========== + +* :vytask:`T2337` ``(default): hw-id gone missing from interfaces after upgrade to 1.3-rolling-202004191028`` +* :vytask:`T2340` ``(feature): Remove informational "sg" messages from syslog`` +* :vytask:`T2338` ``(bug): Can't delete static IPv6 route on vrf`` +* :vytask:`T2336` ``(bug): OpenVPN service fails to start`` +* :vytask:`T2308` ``(default): openvpn op-mode scripts broken after migrating to systemd service`` +* :vytask:`T2185` ``(default): Start daemons with systemd units instead of with start-stop-daemon`` + + +2020-04-18 +========== + +* :vytask:`T2318` ``(bug): dns-forwarding migration script breaks with invalid interface name`` +* :vytask:`T2319` ``(feature): Update Linux Kernel to v4.19.116`` +* :vytask:`T2314` ``(feature): Cleanup PPPoE server implementation and CLI commands`` +* :vytask:`T2313` ``(bug): Accel-PPP / PPPoEserver raises "Floating point exception" when not all limits are defined`` +* :vytask:`T2312` ``(feature): Use LED modules to enable more visible feedback on VyOS hardware chassis`` +* :vytask:`T2306` ``(feature): Add new cipher suites to the WiFi configuration`` +* :vytask:`T2286` ``(default): IPoE server vulnerability`` +* :vytask:`T2224` ``(feature): Update Linux Kernel to v4.19.114`` +* :vytask:`T2110` ``(feature): RADIUS: supply include file for radius config to have a uniform CLI`` +* :vytask:`T2324` ``(feature): Cleanup IPoE server implementation and CLI commands`` + + +2020-04-17 +========== + +* :vytask:`T2275` ``(bug): flow-accounting broken in rolling`` +* :vytask:`T2256` ``(feature): Accel-ppp op-mode syntax`` + + +2020-04-16 +========== + +* :vytask:`T2295` ``(bug): Passwords with Special Characters Broken`` +* :vytask:`T2305` ``(feature): Add release name to "show version" command`` +* :vytask:`T2235` ``(default): OpenVPN server client IP doesn't reserve that IP in the pool`` +* :vytask:`T149` ``(feature): IPv6 support in OpenVPN tunnel`` + + +2020-04-15 +========== + +* :vytask:`T2293` ``(bug): OpenVPN: UnboundLocalError after merging server_network PullRequest`` +* :vytask:`T2298` ``(bug): Errors PDNS with name-server set`` + + +2020-04-14 +========== + +* :vytask:`T2213` ``(bug): vyos-1x: WiFi mode ieee80211ac should also activate ieee80211n`` + + +2020-04-13 +========== + +* :vytask:`T2283` ``(default): openvpn not starting: ccd path in template not moved to /run/openvpn/ccd`` +* :vytask:`T2236` ``(bug): DMVPN broken after tunnel rewrite to XML/Python`` +* :vytask:`T2284` ``(default): Upgrade ddclient to 3.9.1 which also brings systemd files`` +* :vytask:`T2282` ``(feature): Clarify hw-id in ethernet and wireless interface nodes`` +* :vytask:`T611` ``(feature): Static route syntax should reflect `ip` command routing capabilities, if possible.`` + + +2020-04-12 +========== + +* :vytask:`T2273` ``(default): OpenVPN no longer starts in latest rolling, migrate to systemd`` +* :vytask:`T2263` ``(feature): Reset feature for SSTP sessions`` +* :vytask:`T2262` ``(bug): Broken reset commands for pptp and l2tp`` +* :vytask:`T2031` ``(bug): pseudo-ethernet link interface cannot be changed`` + + +2020-04-11 +========== + +* :vytask:`T2264` ``(feature): l2tp: cleanup CLI definition`` +* :vytask:`T2233` ``(bug): Typos in wlanX.cfg`` +* :vytask:`T2238` ``(bug): After re-writing list_interfaces.py to use Interfaces() pseudo-ethernet is missing`` + + +2020-04-10 +========== + +* :vytask:`T2265` ``(feature): DHCP to be an attribute of the class instead of a inheritance`` +* :vytask:`T2261` ``(bug): "client-config-dir" not being set for openvpn`` +* :vytask:`T2248` ``(bug): PPPoE Broken in Latest 1.3 Rolling (1.3-rolling-202004070629)`` +* :vytask:`T1629` ``(bug): IP addresses configured on vif-s interfaces are not added to the system`` +* :vytask:`T2266` ``(default): openvpn bridged client-server doesn't work (validation error)`` +* :vytask:`T2253` ``(default): Fix use of cmd in merge config and remote function helpers`` + + +2020-04-09 +========== + +* :vytask:`T2260` ``(feature): vxlan, pseudo-ethernet: convert link nodes to source-interface`` +* :vytask:`T2172` ``(feature): Enable conf VXLAN without remote address`` +* :vytask:`T2237` ``(bug): l2tp, pptp, pppoe wrong chap-secrets file`` + + +2020-04-08 +========== + +* :vytask:`T2244` ``(feature): WireGuard: cleanup Python implementation and reduce amount of boilerplate code`` +* :vytask:`T2186` ``(feature): Provide more information to the user when a traceback is reported to the user`` +* :vytask:`T2246` ``(bug): LLDP op-mode error`` +* :vytask:`T2240` ``(feature): Support for bind vif-c interfaces into VRFs`` +* :vytask:`T2160` ``(feature): Allow restricting HTTP API to specific virtual hosts`` +* :vytask:`T2247` ``(feature): WireGuard: add VRF support`` + + +2020-04-05 +========== + +* :vytask:`T2212` ``(bug): vyos-1x: WiFi card antenna count not set accordingly`` +* :vytask:`T2230` ``(feature): Split out inlined Jina2 template to data/templates folder`` +* :vytask:`T2206` ``(feature): Split WireGuard endpoint into proper host and port nodes`` + + +2020-04-04 +========== + +* :vytask:`T2158` ``(bug): Commit fails if ethernet interface doesn't support flow control (pause)`` +* :vytask:`T2221` ``(bug): Ability to remove a VRF that has a next-hop-vrf as target`` +* :vytask:`T2211` ``(bug): vyos-1x: VHT channel width not set accordingly`` +* :vytask:`T2208` ``(bug): vyos-1x: commit on interfaces wireless wlanX capabilities vht link-adaptation (both|unsolicited) fails`` +* :vytask:`T2183` ``(bug): A number of bugs with wireguard script due to interface rearrangement`` +* :vytask:`T2104` ``(default): ifconfig.py size`` +* :vytask:`T2028` ``(feature): Convert "interfaces tunnel" to new XML/Python representation`` +* :vytask:`T2219` ``(bug): VRF default route of PPPoE and WWAN interfaces do not get added into proper routing table`` +* :vytask:`T2222` ``(default): openvpn: requires "multihome" option to listen on all addresses with udp protocol`` + + +2020-04-02 +========== + +* :vytask:`T2072` ``(bug): Shell autocomplete of option (config node) with quoted value doesn't work`` +* :vytask:`T1823` ``(feature): l2tpv3 interface migration fails`` +* :vytask:`T2202` ``(feature): Update PowerDNS recursor to 4.2 series`` +* :vytask:`T2200` ``(feature): Add VRF support on wirelessmodem interfaces`` + + +2020-03-31 +========== + +* :vytask:`T2166` ``(bug): Broken proxy-arp on vif`` +* :vytask:`T2180` ``(bug): get_config_dict should be independent of CLI edit level`` +* :vytask:`T2053` ``(default): Update vyos-load-config.py for version string syntax change`` +* :vytask:`T2052` ``(default): Update vyos-merge-config.py for version string syntax change`` +* :vytask:`T2144` ``(default): vyos-build: docker: selection of text in the terminal still selects it in vim (mouse isn't completely disabled)`` + + +2020-03-30 +========== + +* :vytask:`T2176` ``(default): 'WiFiIf' object has no attribute 'set_state'`` +* :vytask:`T2029` ``(feature): Switch to new syntax for config file component versions`` + + +2020-03-29 +========== + +* :vytask:`T2178` ``(bug): VRF interface don't get removed when VRF is deleted`` +* :vytask:`T2170` ``(feature): Add ability to create static route from default to VRF`` +* :vytask:`T1831` ``(feature): Denest IPv6 router-advert from Interfaces to general service`` + + +2020-03-28 +========== + +* :vytask:`T2167` ``(bug): vyos.ifconfig.get_mac() broken`` +* :vytask:`T2151` ``(default): wireless: can't delete interface present in config but not present in system`` +* :vytask:`T1988` ``(feature): Migrate wirelessmodem to new XML/Python style interface`` + + +2020-03-27 +========== + +* :vytask:`T2164` ``(bug): Package libstrongswan-standard-plugins missing from image`` +* :vytask:`T2105` ``(bug): wireless: not possible to disabled wlan0`` +* :vytask:`T2169` ``(default): Remove redundant use of show_config in vyos-merge-config`` + + +2020-03-26 +========== + +* :vytask:`T2162` ``(default): migration script for router-advert sets link-mtu 0 on bridge interfaces`` +* :vytask:`T1735` ``(bug): Issue in "show vpn ipsec/ike sa" output with ipsec encryption algorithm aes128gcm128/aes256gcm128/chacha etc`` + + +2020-03-25 +========== + +* :vytask:`T2148` ``(default): openvpn: setting "server client" config without "server client ip" results in ValueError: '' does not appear to be an IPv4 or IPv6 address`` +* :vytask:`T2146` ``(default): openvpn: "delete server client" doesn't delete the corresponding ccd configs`` + + +2020-03-24 +========== + +* :vytask:`T2157` ``(default): Organize service https listen-address/listen-port/server-name under 'virtual-host' node`` +* :vytask:`T1845` ``(bug): syslog host no longer accepts a port`` + + +2020-03-22 +========== + +* :vytask:`T2150` ``(feature): SSTP ssl certificates can only be stored in /config/user-data/sstp`` +* :vytask:`T2149` ``(feature): Update Linux Kernel to v4.19.112`` +* :vytask:`T476` ``(enhancment): Update the base system to Debian 10 (Buster)`` + + +2020-03-21 +========== + +* :vytask:`T2142` ``(bug): vyos-build: Add required packages and step to build-GCE-image script`` +* :vytask:`T1870` ``(feature): Extend Pipeline scripts to support PullRequests`` + + +2020-03-20 +========== + +* :vytask:`T2006` ``(bug): SSTP RADIUS CLI accepts invalid values`` +* :vytask:`T2140` ``(default): openvpn: tls file check function checkCertHeader returns True even when no match is found`` +* :vytask:`T2007` ``(feature): SSTP accepts client MTU up to 16384 bytes`` +* :vytask:`T2008` ``(feature): Adjustment of SSTP CLI to be more consistent to the rest of VyOS`` + + +2020-03-19 +========== + +* :vytask:`T2135` ``(bug): Login banner missing spacing now`` +* :vytask:`T2132` ``(feature): Document kernel boot parameter 'vyos-config-debug'`` +* :vytask:`T1744` ``(default): Config load fails in ConfigTree with ValueError: Failed to parse config: lexing: empty token`` + + +2020-03-17 +========== + +* :vytask:`T2134` ``(bug): VXLAN: `NameError: name 'config' is not defined``` + + +2020-03-16 +========== + +* :vytask:`T2131` ``(feature): Improve syslog remote host CLI definition`` + + +2020-03-15 +========== + +* :vytask:`T2122` ``(feature): Update Intel out-of-tree drivers to latest version(s)`` +* :vytask:`T2121` ``(feature): Update Linux Kernel to v4.19.109`` +* :vytask:`T2119` ``(bug): Error on boot when removing ethernet interface from VM`` + + +2020-03-14 +========== + +* :vytask:`T834` ``(feature): New L2TP server implementation based on accel-ppp`` + + +2020-03-13 +========== + +* :vytask:`T1622` ``(default): Add failsafe and back trace to boot config loader`` + + +2020-03-11 +========== + +* :vytask:`T1961` ``(bug): VXLAN - fails to commit due to non-existent variable, broken MTU`` +* :vytask:`T2084` ``(default): conntrack-tools package build error for current/equuleus`` + + +2020-03-10 +========== + +* :vytask:`T1331` ``(bug): DNS stops working`` + + +2020-03-09 +========== + +* :vytask:`T2111` ``(feature): VRF add route leaking support`` +* :vytask:`T2109` ``(bug): Ping by name broken in VyOS 1.3-rolling-202003080217`` +* :vytask:`T2065` ``(bug): VyOS 1.3 Don't set daemon in openvpn-{intf}.conf file`` +* :vytask:`T31` ``(feature): Add VRF support`` + + +2020-03-08 +========== + +* :vytask:`T1954` ``(bug): Having `system login radius` configured causes exponentially long boot times`` +* :vytask:`T1760` ``(bug): RADIUS shared secret is not redacted from "show configuration" op mode command`` + + +2020-03-07 +========== + +* :vytask:`T2107` ``(bug): Wireless interfaces do not work in station mode without security`` + + +2020-03-05 +========== + +* :vytask:`T2074` ``(bug): VyOS docker container: Cannot configure ethernet interface`` + + +2020-03-04 +========== + +* :vytask:`T2098` ``(bug): Wrong call to cli-shell-api in generated op-mode templates for path completion helper`` + + +2020-03-03 +========== + +* :vytask:`T2095` ``(bug): Copy command errors out`` + + +2020-03-01 +========== + +* :vytask:`T2082` ``(bug): WireGuard broken after merging T2057`` +* :vytask:`T2089` ``(feature): RADIUS: do not query servers when commit is running started from a non RADIUS user`` +* :vytask:`T2086` ``(feature): Move sudo session open/close log entries to auth.log`` + + +2020-02-29 +========== + +* :vytask:`T2046` ``(feature): allowing sub-classes of Interface to redefine how the interface is created`` + + +2020-02-28 +========== + +* :vytask:`T2083` ``(default): vyos-build: build-packages fails at mdns-repeater due to wrong branch`` +* :vytask:`T2080` ``(default): traffic-policy shaper error when setting bandwidth`` + + +2020-02-27 +========== + +* :vytask:`T2075` ``(feature): Add support for OpenVPN tls-crypt file option`` +* :vytask:`T2068` ``(feature): Update Linux Kernel to v4.19.105`` +* :vytask:`T1703` ``(default): Macvlan PPPoE support`` +* :vytask:`T2078` ``(feature): Kernel: remove unused RAID functions 5,6,10,jbod,dm`` + + +2020-02-25 +========== + +* :vytask:`T2070` ``(feature): Rewrite (dis-)connect op-mode commands in XML and Python`` +* :vytask:`T2071` ``(feature): Add possibility to temporary disable a RADIUS server used for system login`` + + +2020-02-23 +========== + +* :vytask:`T2055` ``(feature): Remove IPv6 router-advert options for PPPoE`` +* :vytask:`T1318` ``(feature): PPPoE client CLI redesign`` + + +2020-02-22 +========== + +* :vytask:`T2063` ``(feature): vyos-salt-minion package is missing from vyos-world`` + + +2020-02-20 +========== + +* :vytask:`T1969` ``(default): OSPF with WireGuard cause Route Inactive`` + + +2020-02-18 +========== + +* :vytask:`T2034` ``(default): Removal of interfaces loopback lo removed 127.0.0.1 and ::1`` + + +2020-02-17 +========== + +* :vytask:`T2047` ``(feature): Update Linux Kernel to v4.19.104`` +* :vytask:`T2048` ``(bug): ISO boot fails when wireless adapter is present`` + + +2020-02-16 +========== + +* :vytask:`T2043` ``(bug): Bond VLANs can't be extended on the fly`` +* :vytask:`T2030` ``(bug): Bond doesn't survive reboot`` +* :vytask:`T1992` ``(bug): Adding vlan on a bond resets all BGP connections on same bond`` +* :vytask:`T1908` ``(feature): Add zone option for Cloudflare DDNS`` +* :vytask:`T1246` ``(bug): VyOS 1.2.0 "openvpn-options" configuration does not allow quotes in values`` + + +2020-02-15 +========== + +* :vytask:`T2042` ``(bug): Error on reboot after deleting "service snmp" and not "service lldp snmp enable"`` +* :vytask:`T2041` ``(bug): Adding non existent bond interface raises exception`` + + +2020-02-14 +========== + +* :vytask:`T2039` ``(bug): Wrong system type displayed in show version`` +* :vytask:`T2040` ``(bug): vyos-http-api-server should reload Config in all routes`` + + +2020-02-13 +========== + +* :vytask:`T2033` ``(feature): Drop vyos-replace package`` +* :vytask:`T1635` ``(feature): Rewrite interface pseudo-ethernet in new XML/Python style`` + + +2020-02-10 +========== + +* :vytask:`T2024` ``(feature): Migrate "system login banner" to XML/Python`` + + +2020-02-09 +========== + +* :vytask:`T2022` ``(bug): When RADIUS config is active, local logins won't work`` +* :vytask:`T2020` ``(default): Unable to log in after upgrade to 1.3-rolling-202002080217`` +* :vytask:`T1931` ``(bug): Enabling SNMP commit error`` + + +2020-02-05 +========== + +* :vytask:`T1948` ``(bug): RADIUS login broken in 1.3`` +* :vytask:`T1990` ``(feature): Migrate "system login" to XML/Python representation`` +* :vytask:`T1585` ``(default): Add letsencrypt/certbot support for 'service https'`` + + +2020-02-04 +========== + +* :vytask:`T1965` ``(bug): VyOS-1.3: ping no longer supports specifying interface or source`` + + +2020-02-02 +========== + +* :vytask:`T2011` ``(feature): Update Linux Kernel to v4.19.101`` +* :vytask:`T640` ``(bug): Images no longer work when built without "recommended" packages`` + + +2020-02-01 +========== + +* :vytask:`T2009` ``(bug): Ethernet Interface always stays down`` +* :vytask:`T1989` ``(bug): conf.get_config_dict() throws exception`` + + +2020-01-31 +========== + +* :vytask:`T1768` ``(bug): PPtP - vyos.config rewrite`` +* :vytask:`T2002` ``(bug): VLAN interfaces try to be enabled even if parent interface is A/D`` + + +2020-01-30 +========== + +* :vytask:`T1994` ``(default): lldpd not bound to specified interfaces - Fix jinja template`` +* :vytask:`T1896` ``(enhancment): Remove LLDP-MED civic_based location information`` +* :vytask:`T1724` ``(feature): wireguard - add endpoint check in verify()`` + + +2020-01-29 +========== + +* :vytask:`T1996` ``(feature): Update Linux Kernel to 4.19.99`` +* :vytask:`T1862` ``(default): Use regex pattern \s+ to split strings on whitespace in Python 3.7`` +* :vytask:`T1755` ``(bug): Python KeyError exceptions raised with 'show vpn ipsec sa' command under use of certain IPSEC cipher suites`` +* :vytask:`T1747` ``(bug): L2TP breaks after upgrading to VyOS 1.2-rolling-201910180117 [issue report and proposed solution]`` +* :vytask:`T1664` ``(bug): Ipoe with bond per vlan don't work`` +* :vytask:`T1895` ``(feature): There is not restriction on selection of syslog facility`` +* :vytask:`T1670` ``(feature): OpenVPN option for tls-auth`` + + +2020-01-26 +========== + +* :vytask:`T1937` ``(bug): snmpd throwing a tremendous amount of errors`` +* :vytask:`T1767` ``(bug): IPoE - vyos.config rewrite`` +* :vytask:`T1765` ``(bug): wireguard - vyos.config rewrite`` + + +2020-01-24 +========== + +* :vytask:`T1975` ``(bug): OpenVPN tap devices won't come up automatically`` + + +2020-01-23 +========== + +* :vytask:`T1766` ``(bug): service-pppoe - vyos.config rewrite`` + + +2020-01-21 +========== + +* :vytask:`T1784` ``(bug): DMVPN with IPSec does not work in HUB mode`` +* :vytask:`T1977` ``(bug): webproxy error on fresh install`` + + +2020-01-18 +========== + +* :vytask:`T1830` ``(feature): 1.3-rolling boots to GRUB prompt post-install on UEFI systems`` +* :vytask:`T1940` ``(bug): EFI Fresh Install fails to boot, 4K Sector Drives Fail to boot EFI`` + + +2020-01-16 +========== + +* :vytask:`T1880` ``(default): "A stop job is running for live-tools - System Support Scripts" hangs, times out when shutting down equuleus live iso`` + + +2020-01-15 +========== + +* :vytask:`T1959` ``(bug): Error message when adding IPSec VPN`` + + +2020-01-09 +========== + +* :vytask:`T1955` ``(feature): snmp - cli config val_help missing`` +* :vytask:`T1813` ``(bug): error in generated /etc/hosts file`` + + +2020-01-08 +========== + +* :vytask:`T1946` ``(bug): Recovery ifname for PPtP remote-access`` + + +2020-01-03 +========== + +* :vytask:`T1939` ``(feature): Provide abstraction for interface "ip" options`` + + +2020-01-01 +========== + +* :vytask:`T1779` ``(bug): Tunnel interfaces aren't suggested as being available for bridging`` + + +2019-12-31 +========== + +* :vytask:`T1654` ``(bug): sFlow: multiple "sflow server" not work, and "disable-imt" could break configuration`` +* :vytask:`T1923` ``(feature): Migrate L2TPv3 interface to XML/Python`` + + +2019-12-30 +========== + +* :vytask:`T1920` ``(bug): beep: Error: Running under sudo, which is not supported for security reasons.`` +* :vytask:`T1918` ``(bug): l2tp / ipsec config broken in latest daily`` +* :vytask:`T1897` ``(bug): IPSec - 1.2 to 1.3 migration failed`` +* :vytask:`T1921` ``(bug): snmp: VyOS options no longer recognized`` +* :vytask:`T1922` ``(feature): Add VXLAN IPv6 support`` +* :vytask:`T1919` ``(feature): Migrate "system options" to XML/Python representation`` + + +2019-12-28 +========== + +* :vytask:`T1916` ``(feature): Update Linux Kernel to v4.19.91`` +* :vytask:`T1915` ``(bug): Remove "system ipv6 blacklist" option`` +* :vytask:`T1912` ``(feature): Migrate "system (ip|ipv6)" to XML/Python representation`` + + +2019-12-27 +========== + +* :vytask:`T1910` ``(bug): Invalid parmissions on latest 1.3 rolling ISO images`` + + +2019-12-26 +========== + +* :vytask:`T1794` ``(bug): Interface description can't contain a colon`` +* :vytask:`T1906` ``(feature): Migrate "system time-zone" configuration to XML/Python`` + + +2019-12-23 +========== + +* :vytask:`T1898` ``(enhancment): Support multiple IPv4/IPv6 LLDP management addresses`` +* :vytask:`T1878` ``(bug): accel-ppp: pppoe single-session option implementation`` + + +2019-12-22 +========== + +* :vytask:`T393` ``(enhancment): Migrate vyatta-lldpd to vyos-1x`` + + +2019-12-20 +========== + +* :vytask:`T1892` ``(default): vyos-build: Do not install recommends in docker image [enhancement]`` +* :vytask:`T1411` ``(enhancment): equuleus: buster: vyatta-ravpn: libfreeradius-client2 is missing in buster`` + + +2019-12-19 +========== + +* :vytask:`T1873` ``(default): DHCP server fails to start due to a change in isc-dhcp-server init scripts`` + + +2019-12-18 +========== + +* :vytask:`T1889` ``(bug): Error building docker build image`` +* :vytask:`T1132` ``(default): Build on Debian Buster`` + + +2019-12-17 +========== + +* :vytask:`T1886` ``(feature): Update Linux Kernel to v4.19.89`` +* :vytask:`T1887` ``(feature): Update WireGuard to Debian release 0.0.20191212-1`` + + +2019-12-13 +========== + +* :vytask:`T1861` ``(default): hosts lost after modified static-host-mapping`` + + +2019-12-10 +========== + +* :vytask:`T1843` ``(feature): Add GCC preprocessor support for XML files`` + + +2019-12-08 +========== + +* :vytask:`T1566` ``(feature): Extend L2TP/IPSec server with IPv6`` + + +2019-12-07 +========== + +* :vytask:`T1714` ``(bug): Disable DHCP Nameservers Not Working`` + + +2019-12-06 +========== + +* :vytask:`T1860` ``(feature): Update WireGuard to Debian release 0.0.20191127-2`` +* :vytask:`T1859` ``(feature): Update Linux Kernel to v4.19.88`` +* :vytask:`T1854` ``(bug): Dynamic DNS configuration cannot be deleted`` +* :vytask:`T1849` ``(bug): DHCPv6 client does not start`` +* :vytask:`T1169` ``(bug): LLDP potentially broken`` +* :vytask:`T586` ``(bug): Cannot add ethernet vif-s vif-c interface to bridge-group`` + + +2019-12-05 +========== + +* :vytask:`T1847` ``(bug): set_level incorrectly handles path given as empty string`` + + +2019-12-04 +========== + +* :vytask:`T1787` ``(default): Failed config migration from V1.2.3 to 1.2-rolling-201911030217`` +* :vytask:`T1212` ``(bug): IPSec Tunnel to Cisco ASA drops reliably after 4.2GB transferred`` +* :vytask:`T1704` ``(feature): OpenVPN - Add support for ncp-ciphers`` + + +2019-12-03 +========== + +* :vytask:`T1782` ``(bug): pppoe0: showing as "Coming up"`` +* :vytask:`T1801` ``(bug): Unescaped backslashes in config values cause configuration failure`` + + +2019-12-02 +========== + +* :vytask:`T1840` ``(bug): PPPoE doesn't not rename pppX to pppoeX`` + + +2019-11-25 +========== + +* :vytask:`T1824` ``(bug): Permission denied: '/opt/vyatta/etc/config/vyos-migrate.log'`` + + +2019-11-24 +========== + +* :vytask:`T1673` ``(bug): vif bridge-group not migrated to bridge member interface`` +* :vytask:`T1799` ``(feature): Add support for GENEVE (Generic Network Virtualization Encapsulation)`` + + +2019-11-23 +========== + +* :vytask:`T1627` ``(feature): Rewrite wireless interface in new style XML syntax`` + + +2019-11-21 +========== + +* :vytask:`T1818` ``(default): Print name of migration script on failure`` +* :vytask:`T1814` ``(default): Add log of migration scripts run during config migration`` + + +2019-11-14 +========== + +* :vytask:`T1710` ``(default): [equuleus] buster: add patch to fix live-build missing key error`` +* :vytask:`T1804` ``(default): Add python3-psutil to docker image`` +* :vytask:`T1736` ``(default): Decide on best practice for patching live-team packages for VyOS build system`` +* :vytask:`T1424` ``(default): Rewrite the config load script`` + + +2019-11-11 +========== + +* :vytask:`T1793` ``(feature): Editing description on an interface causes BGP sessions to reset on commit`` + + +2019-11-10 +========== + +* :vytask:`T1791` ``(feature): Update Linux Kernel to 4.19.82`` + + +2019-11-08 +========== + +* :vytask:`T1789` ``(bug): ddclient not working with generated RFC2136 / nsupdate config`` + + +2019-11-03 +========== + +* :vytask:`T1777` ``(bug): Bonding interface MAC address mismatch after reboot`` +* :vytask:`T1752` ``(bug): PPPoE does not automatically start on boot`` + + +2019-11-02 +========== + +* :vytask:`T1783` ``(bug): Interface can't unpin from bridge`` + + +2019-10-22 +========== + +* :vytask:`T1756` ``(feature): Modify output to be more useful - Wireguard`` + + +2019-10-21 +========== + +* :vytask:`T1741` ``(feature): Add system wide proxy setting`` + + +2019-10-19 +========== + +* :vytask:`T1746` ``(bug): 201910180117 fails startup with 'Permission Denied' errors`` +* :vytask:`T1743` ``(default): equuleus: remove references to SSH key type "rsa1" deprecated in Debian Buster`` + + +2019-10-18 +========== + +* :vytask:`T1712` ``(default): DHCP client sometimes doesn't start`` +* :vytask:`T1604` ``(enhancment): equuleus: buster: vbash: tab completion breaks`` + + +2019-10-11 +========== + +* :vytask:`T1723` ``(bug): wireguard - Interface wg01 could not be brought up in time`` + + +2019-10-09 +========== + +* :vytask:`T1719` ``(feature): ssh deprecated options`` +* :vytask:`T1718` ``(bug): ISO check in /opt/vyatta/sbin/install-image faulty`` +* :vytask:`T1682` ``(feature): Migrate to new Jenkins Pipeline script`` + + +2019-10-08 +========== + +* :vytask:`T1717` ``(bug): disable multiple daemons to autostart at boot`` + + +2019-10-06 +========== + +* :vytask:`T1713` ``(feature): Remove deprecated packages no longer required after migration to Accel-PPP`` + + +2019-10-03 +========== + +* :vytask:`T1689` ``(feature): "reset openvpn" op-mode command should terminate and restart OpenVPN process`` + + +2019-10-01 +========== + +* :vytask:`T1706` ``(bug): wireguard broken in latest rolling`` + + +2019-09-30 +========== + +* :vytask:`T1688` ``(feature): OpenVPN - Add new cipher aes-(128|192|256)-gcm`` + + +2019-09-28 +========== + +* :vytask:`T1696` ``(bug): NTP - Tests fail when building vyos-1x`` +* :vytask:`T1512` ``(bug): vyos 1.2 openvpn client names with spaces created incorrectly`` + + +2019-09-27 +========== + +* :vytask:`T1681` ``(feature): cleanup wireguard code since tagnodes are now visible`` +* :vytask:`T1695` ``(bug): Syntax error in interface-dummy.py`` + + +2019-09-26 +========== + +* :vytask:`T1692` ``(bug): ipoe-server verify function error`` +* :vytask:`T1691` ``(bug): OpenVPN - Commiting config when OpenVPN peer/server not available makes commit hang`` +* :vytask:`T1690` ``(feature): restart op-mode commands for 'service (pppoe|ipoe)-server'`` + + +2019-09-25 +========== + +* :vytask:`T1672` ``(bug): Wireguard keys not automatically moved`` + + +2019-09-23 +========== + +* :vytask:`T1679` ``(bug): during bootup: invalid literal for int() with base 10`` +* :vytask:`T1680` ``(feature): DHCP client does not release IP address on exit/deletion`` + + +2019-09-21 +========== + +* :vytask:`T1676` ``(default): [equuleus] buster: update GRUB boot parameters during upgrade`` +* :vytask:`T1637` ``(feature): Rewrite ethernet interface in new style XML syntax`` +* :vytask:`T1675` ``(feature): OpenVPN - Specify minimum TLS version`` + + +2019-09-20 +========== + +* :vytask:`T1602` ``(default): equuleus: buster: add live build apt options for choosing vyos packages`` + + +2019-09-19 +========== + +* :vytask:`T1666` ``(feature): Deleting a bond will place member interfaces into A/D state`` + + +2019-09-17 +========== + +* :vytask:`T239` ``(bug): Improve documentation for the firewall all-ping setting`` + + +2019-09-16 +========== + +* :vytask:`T1040` ``(default): rc.local is executed too early`` + + +2019-09-15 +========== + +* :vytask:`T1662` ``(default): openvpn: 'show openvpn client' error`` +* :vytask:`T1661` ``(default): openvpn: wrong checking for existence cert files`` +* :vytask:`T1630` ``(bug): OpenVPN after changing it from root to nobody (unprivileged user) cant add routes`` + + +2019-09-13 +========== + +* :vytask:`T1660` ``(bug): Bonding dont’t work on VyOS 1.2-rolling-201909120338`` +* :vytask:`T1655` ``(enhancment): equuleus: buster: arm: vyos-accel-ppp build failes because of filename hardcoded as x86_64 in debian/rules`` + + +2019-09-12 +========== + +* :vytask:`T1572` ``(feature): Wireguard keyPair per interface`` +* :vytask:`T1545` ``(bug): IPSEC vti issue`` + + +2019-09-10 +========== + +* :vytask:`T1650` ``(feature): implement wireguard default key removal`` +* :vytask:`T1649` ``(feature): feature documentation different keypairs per interface`` +* :vytask:`T1648` ``(feature): add cli command 'delete wireguard named-key '`` + + +2019-09-09 +========== + +* :vytask:`T1639` ``(bug): wireguard pubkey change error`` + + +2019-09-07 +========== + +* :vytask:`T1640` ``(feature): Update Linux Kernel to v4.19.70`` + + +2019-09-06 +========== + +* :vytask:`T1624` ``(bug): Failed to set up config session`` +* :vytask:`T1636` ``(feature): Rewrite VXLAN in new style XML/Python`` +* :vytask:`T1479` ``(bug): libvyosconfig error reporting doesn't include line numbers`` +* :vytask:`T808` ``(feature): replace lighthttpd with nginx`` +* :vytask:`T1478` ``(bug): libvyosconfig parser does not support escaped quotes inside single-quoted strings`` + + +2019-09-04 +========== + +* :vytask:`T1632` ``(bug): OpenVPN 'push' options with quotes`` +* :vytask:`T1631` ``(bug): Multiple push-route options cause error generating openvpn configuration`` +* :vytask:`T1557` ``(feature): Create generic abstraction for configuring interfaces e.g. IP address`` +* :vytask:`T1628` ``(feature): Adopt WireGuard configuration script to new vyos.ifconfig class`` +* :vytask:`T1614` ``(feature): Rewrite bonding interface in new style XML syntax`` + + +2019-09-02 +========== + +* :vytask:`T1621` ``(default): Rewrite the rest of trivial vyatta-op commands to new syntax`` + + +2019-08-31 +========== + +* :vytask:`T1456` ``(bug): Port group cannot be configured if the same port is configured as standalone and inside a range`` + + +2019-08-28 +========== + +* :vytask:`T1615` ``(feature): After migration to pyroute2 the address DHCP statement is no longer covered`` + + +2019-08-27 +========== + +* :vytask:`T1617` ``(default): OpenVPN push route failure`` +* :vytask:`T1250` ``(bug): FRR not setting default gateway from DHCP`` + + +2019-08-26 +========== + +* :vytask:`T1591` ``(bug): OpenVPN "run show openvpn client status" does not work`` +* :vytask:`T1608` ``(feature): bridge: Bridge adding non existing interfaces is allowed but does not work`` +* :vytask:`T1548` ``(feature): Rewrite OpenVPN interface/op-commands in new style XML/Python`` +* :vytask:`T1607` ``(default): Convert 'reset conntrack' and 'reset ip[v6] cache' operations from vyatta-op to new syntax`` + + +2019-08-25 +========== + +* :vytask:`T1611` ``(default): Migration to latest rolling fails with vyos.configtree.ConfigTreeError: Path [b'interfaces bridge br0 igmp-snooping querier'] doesn't exist`` + + +2019-08-23 +========== + +* :vytask:`T1606` ``(bug): Rolling release no longer boots after adding hostname daemon`` + + +2019-08-21 +========== + +* :vytask:`T1601` ``(feature): Rewrite loopback interface type with new style XML/Python interface`` +* :vytask:`T1596` ``(default): Convert 'telnet' and 'traceroute' vyatta-op commands to new syntax`` + + +2019-08-20 +========== + +* :vytask:`T1595` ``(feature): Migrate deprecated "service dns forwarding listen-on" to listen-address`` + + +2019-08-19 +========== + +* :vytask:`T1580` ``(feature): Rewrite dummy interface type with new style XML/Python interface`` +* :vytask:`T1590` ``(default): Convert 'show system' operations from vyatta-op to python/xml syntax`` + + +2019-08-17 +========== + +* :vytask:`T1592` ``(feature): Update Linux Kernel to v4.19.67`` + + +2019-08-15 +========== + +* :vytask:`T1584` ``(default): equuleus: buster: add consistent grub options for predictable interface names`` + + +2019-08-13 +========== + +* :vytask:`T1556` ``(feature): Rewrite Bridge in new style XML syntax`` + + +2019-08-09 +========== + +* :vytask:`T1569` ``(feature): interfaceconfig class documetation`` + + +2019-08-05 +========== + +* :vytask:`T1562` ``(feature): Change version scheme on current branch used for rolling releases`` + + +2019-08-04 +========== + +* :vytask:`T1561` ``(bug): VyOS rolling ISO cluttered with vyatta-ravpn Git Repo`` + + +2019-08-02 +========== + +* :vytask:`T853` ``(feature): Add SSTP server support`` +* :vytask:`T742` ``(feature): Replace poptop and xl2tpd with accel-ppp`` + + +2019-08-01 +========== + +* :vytask:`T1544` ``(feature): L2TP documentation`` + + +2019-07-31 +========== + +* :vytask:`T1552` ``(feature): accel-ppp: SSTP documentation`` +* :vytask:`T1553` ``(default): equuleus: buster: add 'noautologin' to boot parameters`` + + +2019-07-29 +========== + +* :vytask:`T1532` ``(default): [equuleus] buster: GPG error on vyos package repository`` + + +2019-07-28 +========== + +* :vytask:`T1547` ``(feature): accel-ppp/L2TP restructure CLI`` +* :vytask:`T1546` ``(bug): accel-ppp/L2TP radius-source address is not honored`` + + +2019-07-23 +========== + +* :vytask:`T1533` ``(bug): Rolling builds broken!`` +* :vytask:`T1489` ``(feature): Add vlan_mon usage at Accel`` + + +2019-07-22 +========== + +* :vytask:`T1435` ``(enhancment): Make ip-address [OPTIONAL] (in dhcp-server -> static-mapping) to cope with "unfriendly" client-hostnames of IoT-Devices`` + + +2019-07-21 +========== + +* :vytask:`T823` ``(feature): Rewrite DHCP op mode in the new style`` + + +2019-07-18 +========== + +* :vytask:`T1497` ``(bug): "set system name-server" generates invalid/incorrect resolv.conf`` +* :vytask:`T533` ``(feature): Support for PPPoE MTU greater than 1492`` + + +2019-07-08 +========== + +* :vytask:`T1510` ``(feature): [IPoE] vlan-mon option implementation`` +* :vytask:`T1508` ``(feature): [pppoe] migration script for service pppoe-server interface`` +* :vytask:`T1494` ``(feature): accel-ppp: IPoE update documentation`` +* :vytask:`T989` ``(feature): Add support for IPoE server`` + + +2019-07-03 +========== + +* :vytask:`T1502` ``(feature): Add build sanity checking tools to the dev builds`` + + +2019-07-02 +========== + +* :vytask:`T1099` ``(default): Openvpn: use config files instead of one long command.`` +* :vytask:`T1495` ``(feature): accel-ppp: IPoE implement IPv6 PD`` + + +2019-07-01 +========== + +* :vytask:`T1498` ``(bug): Nameservers are not propagated into resolv.conf`` + + +2019-06-24 +========== + +* :vytask:`T1482` ``(feature): Add OpenVPN SHA384 hashing algorithm`` + + +2019-06-23 +========== + +* :vytask:`T1476` ``(bug): Update PowerDNS recursor to 4.2 series`` + + +2019-06-22 +========== + +* :vytask:`T1313` ``(feature): Add support for reusable build flavours`` +* :vytask:`T1202` ``(bug): Add `hvinfo` to the packages directory`` + + +2019-06-20 +========== + +* :vytask:`T1413` ``(enhancment): equuleus: buster: vyos-xe-guest-utilities is not installable and breaks live-build`` +* :vytask:`T1412` ``(enhancment): equuleus: buster: vyos-netplug is not installable and breaks live-build`` + + +2019-06-19 +========== + +* :vytask:`T1334` ``(feature): Migration script runner rewrite`` +* :vytask:`T1327` ``(bug): Set the serial console speed to 115200 by default`` + + +2019-06-18 +========== + +* :vytask:`T1451` ``(bug): Intel e1000e driver missing in lates rolling release`` + + +2019-06-17 +========== + +* :vytask:`T1408` ``(feature): pppoe-server - implement local-ipv6 for pure IPv6 based deployments`` + + +2019-06-12 +========== + +* :vytask:`T1397` ``(default): Rewrite the config merge script`` + + +2019-06-05 +========== + +* :vytask:`T1426` ``(default): Update the script that checks conntrack hash-size on reboot`` + + +2019-06-03 +========== + +* :vytask:`T1423` ``(default): When merging remote config files, create known_hosts file if not present.`` + + +2019-05-28 +========== + +* :vytask:`T1410` ``(feature): Upgrade Linux Kernel to 4.19.46`` + + +2019-05-26 +========== + +* :vytask:`T1404` ``(feature): Update iproute2 package to 4.19`` + + +2019-05-24 +========== + +* :vytask:`T1407` ``(bug): pppoe IPv6 PD documention by practical example`` + + +2019-05-23 +========== + +* :vytask:`T1402` ``(feature): Update Linux Kernel to 4.19.45`` + + +2019-05-22 +========== + +* :vytask:`T1399` ``(bug): accel-ppp kernel modules missing in rolling build 20190522`` +* :vytask:`T1393` ``(bug): pppoe IPv6 pool doesn't work`` + + +2019-05-21 +========== + +* :vytask:`T592` ``(bug): lldpcli: unknown command from argument 1: `#``` + + +2019-05-16 +========== + +* :vytask:`T1267` ``(feature): FRR: Add interface name for static routes`` +* :vytask:`T1148` ``(bug): epa2 BGP peers initiate before config is fully loaded, routes leak.`` + + +2019-05-06 +========== + +* :vytask:`T1368` ``(feature): Enable MPLS support in Linux Kernel`` + + +2019-05-04 +========== + +* :vytask:`T1365` ``(bug): Cannot configure syslog on 1.2.0-rolling+201904260337`` + + +2019-04-29 +========== + +* :vytask:`T1352` ``(feature): vyos-documentaion: accel-pppoe adding CIDR based IP pool option`` + + +2019-04-21 +========== + +* :vytask:`T1348` ``(feature): Upgrade WireGuard to 0.0.20190406-1`` +* :vytask:`T1347` ``(feature): Upgrade Linux Kernel to 4.19.36`` + + +2019-04-20 +========== + +* :vytask:`T1344` ``(feature): Unclutter "system login radius" configuration nodes`` + + +2019-04-19 +========== + +* :vytask:`T1325` ``(default): GRE tunnel to Cisco router fails in 1.2.0 - works in 1.1.8`` + + +2019-04-16 +========== + +* :vytask:`T1184` ``(feature): wireguard - extend documentation with the show interface wireguard commands`` + + +2019-04-15 +========== + +* :vytask:`T1260` ``(feature): VICI-based implementation of "run show vpn ipsec sa"`` +* :vytask:`T1248` ``(default): Add a function for copying nodes to the vyos.configtree library`` + + +2019-04-05 +========== + +* :vytask:`T1324` ``(feature): update documtation for 'set system login user level'`` + + +2019-04-04 +========== + +* :vytask:`T1323` ``(feature): migrate operator accounts to admin accounts and remove the option to setup an operator account`` + + +2019-03-20 +========== + +* :vytask:`T405` ``(feature): Add binaries for lcdproc`` + + +2019-03-12 +========== + +* :vytask:`T1284` ``(feature): accel-ppp: pptp implementation documention`` +* :vytask:`T833` ``(feature): New PPTP server implementation based on accel-ppp`` + + +2019-02-22 +========== + +* :vytask:`T1257` ``(bug): implement 'set system static-host-mapping' in host_name.py and remove old function calls`` + + +2019-02-21 +========== + +* :vytask:`T1214` ``(bug): Add `ipaddrcheck` to the packages directory`` + + +2019-02-10 +========== + +* :vytask:`T1154` ``(default): use of local cache to build iso`` + + +2019-02-09 +========== + +* :vytask:`T1236` ``(feature): Update Linux Kernel`` diff --git a/docs/changelog/rst-1.4.rst b/docs/changelog/rst-1.4.rst new file mode 100644 index 00000000..0ad129e1 --- /dev/null +++ b/docs/changelog/rst-1.4.rst @@ -0,0 +1,6044 @@ +########### +1.4 Sagitta +########### + +.. + Please don't add anything by hand. + This file is managed by the script: + _ext/releasenotes.py + + +2024-04-25 +========== + +* :vytask:`T6263` ``(bug): Multicast: Could not commit multicast config with multicast join group using source-address`` +* :vytask:`T5833` ``(bug): Not all AFIs compatible with VRF`` + + +2024-04-24 +========== + +* :vytask:`T6255` ``(bug): Static table description should not contain white-space`` +* :vytask:`T6226` ``(feature): add HAPROXY `tcp-request content accept` related block to load-balancing reverse proxy config`` +* :vytask:`T6109` ``(bug): remote syslog do not get all the logs`` +* :vytask:`T6217` ``(feature): VRRP contrack-sync script change name of the logger`` +* :vytask:`T6244` ``(feature): Spacing of "Show System Uptime" hard to parse`` + + +2024-04-23 +========== + +* :vytask:`T6260` ``(bug): image-tools: remove failed image directory if 'No space left on device' error`` +* :vytask:`T6261` ``(default): Typo in op_mode connect_disconnect print statement for check_ppp_running`` +* :vytask:`T6237` ``(feature): IPSec remote access VPN: ability to set EAP ID of clients`` + + +2024-04-22 +========== + +* :vytask:`T5996` ``(bug): unescape backslashes for config save, compare commands`` +* :vytask:`T6103` ``(bug): DHCP-server bootfile-name double slash syntax weird behaviour`` +* :vytask:`T6080` ``(default): Default NTP server settings`` +* :vytask:`T5986` ``(bug): Container: Error on commit when environment variable value contains \n line break`` + + +2024-04-21 +========== + +* :vytask:`T6191` ``(bug): Policy Route TCP-MSS Behavior Different from 1.3.x`` +* :vytask:`T5535` ``(feature): disable-directed-broadcast should be moved to firewall global-options`` + + +2024-04-20 +========== + +* :vytask:`T6252` ``(bug): gre tunnel - doesn't allow configure jumbo frame more than 8024`` + + +2024-04-19 +========== + +* :vytask:`T6221` ``(bug): Enabling VRF breaks connectivity`` +* :vytask:`T6035` ``(bug): QoS policy shaper queue-type random-detect requires limit avpkt`` +* :vytask:`T6246` ``(feature): Enable basic haproxy http-check configuration options`` +* :vytask:`T6242` ``(feature): Loadbalancer reverse-proxy: SSL backend skip CA certificate verification`` + + +2024-04-17 +========== + +* :vytask:`T6168` ``(bug): add system image does not set default boot to current console type in compatibility mode`` +* :vytask:`T6243` ``(bug): Update vyos-http-api-tools for package idna security advisory`` +* :vytask:`T6154` ``(enhancment): Installer should ask for password twice`` +* :vytask:`T5966` ``(default): Adjust dynamic dns configuration address subpath to be more intuitive and other op-mode adjustments`` +* :vytask:`T5723` ``(default): mdns repeater: Always reload systemd daemon before applying changes`` +* :vytask:`T5722` ``(bug): Failing to add route in failover if gateway not in the same interface network`` +* :vytask:`T5612` ``(default): Miscellaneous improvements and fixes for dynamic DNS configuration`` +* :vytask:`T5574` ``(default): Support per-service cache management for dynamic dns providers`` +* :vytask:`T5360` ``(bug): ddclient generating abuse`` + + +2024-04-15 +========== + +* :vytask:`T6100` ``(bug): NAT config migration error in 1.4.0-epa1 if invalid address/network defined in 1.3.6 version`` +* :vytask:`T5734` ``(bug): OpenVPN server dh-params that are not in PKI error`` + + +2024-04-14 +========== + +* :vytask:`T6210` ``(feature): Add container ability to configure capability sys-nice`` + + +2024-04-13 +========== + +* :vytask:`T6173` ``(bug): Build Causes Errors When "--version" Contains Slashes ("/")`` +* :vytask:`T2518` ``(feature): Support NAT for ipv6(NPT)`` +* :vytask:`T6238` ``(default): vyos-build Check pull request title requires the python script`` +* :vytask:`T6235` ``(default): Git check PR status: conflicts and resolution`` + + +2024-04-12 +========== + +* :vytask:`T5872` ``(default): ipsec remote access VPN: support dhcp-interface`` +* :vytask:`T6216` ``(bug): Upgrade error from 1.3 to 1.4 - Firewall using character '+'`` +* :vytask:`T6214` ``(bug): Error when using some constraints`` +* :vytask:`T6213` ``(bug): Firewall group constraints`` +* :vytask:`T6148` ``(bug): Reset vpn ipsec command breaks tunnel and does not reset SAs that are down`` +* :vytask:`T1487` ``(default): DNS (pdns_recursor) stats logs not saved to disk`` +* :vytask:`T6222` ``(bug): VRRP rfc3768-compatibility not working correctly when resulting interface name is over 15 characters`` +* :vytask:`T6218` ``(bug): Container network interface in VRF fails to generate IPv6 link-local address`` +* :vytask:`T5959` ``(default): Streamline dns forwarding service`` +* :vytask:`T5846` ``(default): Refactor and simplify DUID definition in conf-mode`` +* :vytask:`T5631` ``(feature): Ability to export the current configuration in JSON format`` +* :vytask:`T5615` ``(default): Narrow down spurious name conflict with mdns`` +* :vytask:`T5530` ``(default): Add LFA to IS-IS`` +* :vytask:`T5195` ``(default): Break up the vyos.util module`` +* :vytask:`T5124` ``(bug): Python3 deprecation distutils.version import LooseVersion`` +* :vytask:`T1871` ``(feature): add MTU option when configure limiter traffic-policy`` +* :vytask:`T874` ``(feature): Support for Two Factor Authentication for CLI access via Google Authenticator/OTP`` +* :vytask:`T6204` ``(default): Remove shebang lines from Python modules`` +* :vytask:`T6166` ``(bug): Tech support generation error for custom output location`` +* :vytask:`T6062` ``(feature): container: add support for image manipulation based on tag name`` +* :vytask:`T5877` ``(default): Reduce unnecessary nesting in system domain-search path and improve smoketest`` +* :vytask:`T5871` ``(default): ipsec remote access VPN: specify "cacerts" to disambiguate mulitple remote access configurations`` +* :vytask:`T5870` ``(default): ipsec remote access VPN: add x509 ("pubkey") authentication`` +* :vytask:`T5772` ``(default): Require HTTPS API server configurations to include at least one key if key-based auth is used`` +* :vytask:`T5447` ``(feature): Allow static MACsec keys with peers`` +* :vytask:`T4221` ``(default): Add a template filter for converting scalars to single-item lists`` +* :vytask:`T3766` ``(feature): containers: Expanding options for networking and building containers`` + + +2024-04-11 +========== + +* :vytask:`T4516` ``(feature): Rewrite system image manipulation tools in Python`` +* :vytask:`T4548` ``(feature): GRUB loader configuration rework`` +* :vytask:`T3774` ``(bug): atop logs are not limited in size`` +* :vytask:`T3574` ``(default): Add constraintGroup for combining validators with logical AND`` +* :vytask:`T3474` ``(default): Revisit storing syntax version of interface definitions in XML file`` +* :vytask:`T160` ``(feature): Support NAT64`` +* :vytask:`T6228` ``(bug): Cleanup of not existing units`` + + +2024-04-10 +========== + +* :vytask:`T6207` ``(bug): image-tools: restore ability to copy config.boot.default on image install`` +* :vytask:`T5750` ``(bug): Upgrade from 1.3.4 to 1.4 Rolling fails QoS`` +* :vytask:`T5858` ``(bug): Show conntrack statistics formatting is all over the place`` +* :vytask:`T4734` ``(feature): Feature Request: openvpn: add OTP 2FA support`` + + +2024-04-09 +========== + +* :vytask:`T3409` ``(feature): Add back TCP-MSS Clamp to PMTU`` +* :vytask:`T6121` ``(feature): Extend service config-sync for sections vpn, policy, vrf`` + + +2024-04-08 +========== + +* :vytask:`T6197` ``(bug): IPoE-server interface client-subnet looks broken or works with the wrong logic`` +* :vytask:`T6196` ``(bug): Route-map and summary-only do not work in BGP aggregation at the same time`` +* :vytask:`T6068` ``(feature): dhcp server: allow switching between load-balanced and hotspare mode`` + + +2024-04-07 +========== + +* :vytask:`T6205` ``(bug): ipoe: error in migration script logic while renaming mac-address to mac node`` +* :vytask:`T6039` ``(bug): cloud-init DNS search-domain causes configuration migration/validation error`` +* :vytask:`T5862` ``(bug): Default MTU is not acceptable in some environments`` +* :vytask:`T6208` ``(feature): container: rename "cap-add" CLI node to "capability"`` +* :vytask:`T6188` ``(feature): Add Firewall Rule Description to "show firewall" commands`` +* :vytask:`T1244` ``(default): Support for StartupResync in conntrackd`` + + +2024-04-06 +========== + +* :vytask:`T6203` ``(enhancment): Remove obsoleted xml lib`` +* :vytask:`T6202` ``(bug): Multi-Protocol BGP is broken by 6PE patch in upstream FRR 9.1`` + + +2024-04-05 +========== + +* :vytask:`T6089` ``(bug): [1.3.6->1.4.0-epa1 Migration] "ospf passive-interface default" incorrectly added`` +* :vytask:`T2590` ``(bug): DHCPv6 not updating nameservers and search domains since replacing isc-dhcp-client with WIDE dhcp6c`` +* :vytask:`T6199` ``(feature): spring cleaning - drop unused Python imports`` + + +2024-04-04 +========== + +* :vytask:`T6119` ``(default): Use a compliant TOML parser`` +* :vytask:`T6171` ``(feature): dhcp server fail-over - Rename fail-over node`` +* :vytask:`T6115` ``(bug): Build from Git tags fail`` +* :vytask:`T5122` ``(feature): Move "archive-areas" to defaults.toml to support "non-free-firmware" repository`` +* :vytask:`T5121` ``(bug): Incorrect "architecture" config loaded`` +* :vytask:`T4951` ``(default): Add an op mode exception for cases when operations fail due to insufficient system resources`` +* :vytask:`T4883` ``(default): Add a description field for routing tables`` +* :vytask:`T4796` ``(bug): build-vyos-image ignores multiple options`` +* :vytask:`T4795` ``(feature): Cleanup custom python validators`` +* :vytask:`T4761` ``(default): Add a generic URL validator`` +* :vytask:`T3843` ``(bug): l2tp configuration not cleared after delete`` +* :vytask:`T3681` ``(default): The VMware Tools resume script did not run successfully in this virtual machine.`` +* :vytask:`T1991` ``(feature): Rework time services`` +* :vytask:`T5711` ``(default): Put the version data file inside the ISO image`` +* :vytask:`T5672` ``(default): Remove the old-style command definition importer`` +* :vytask:`T5639` ``(default): Group vyos-1x dependencies by their VyOS components and specify their purpose`` +* :vytask:`T5638` ``(default): Add support for requiring numeric values to be ranges rather than single numbers`` +* :vytask:`T5634` ``(default): Remove support for Blowfish and DES from OpenVPN`` +* :vytask:`T5605` ``(default): Do not generate keysize option in OpenVPN configs`` +* :vytask:`T5582` ``(default): Add a command to force NTP sync`` +* :vytask:`T5449` ``(default): Add options for TCP MSS probing`` +* :vytask:`T4440` ``(default): Add OCI compliant image labels to vyos-build and vyos containers`` +* :vytask:`T671` ``(enhancment): Identify and remove dead code`` +* :vytask:`T5109` ``(feature): Improve OCaml XML validator`` +* :vytask:`T1449` ``(feature): Add opportunity to include custom default configs (few) at building`` + + +2024-04-03 +========== + +* :vytask:`T6198` ``(feature): configverify: add common helper for PKI certificate validation`` +* :vytask:`T6192` ``(feature): Multi VRF support for SSH`` + + +2024-04-02 +========== + +* :vytask:`T6167` ``(bug): VNI not set on VRF after reboot`` +* :vytask:`T6151` ``(default): BGP VRF - Route-leaking not work when the next-hop is a recursive route.`` +* :vytask:`T6033` ``(bug): hsflowd fails to start when using a tunnel interface`` + + +2024-04-01 +========== + +* :vytask:`T6195` ``(feature): dropbear: package upgrade 2022.83-1 -> 2022.83-1+deb12u1`` +* :vytask:`T6193` ``(bug): dhcp-client: invalid warning "is not a DHCP interface but uses DHCP name-server option" for VLAN interfaces`` +* :vytask:`T6178` ``(bug): Reverse-proxy should check that certificate exists during commit`` + + +2024-03-31 +========== + +* :vytask:`T6186` ``(bug): Fix regression in 'set system image default-boot'`` +* :vytask:`T5832` ``(feature): Keepalived: Allow using the 'dev' statement on excluded-addresses`` + + +2024-03-28 +========== + +* :vytask:`T6147` ``(bug): Conntrack not working as expected with global state-policy`` +* :vytask:`T6175` ``(bug): op-mode: "renew dhcp interface " does not check if it's an actual DHCP interface`` + + +2024-03-26 +========== + +* :vytask:`T6066` ``(bug): Setting same network in different ospf area will raise exception`` + + +2024-03-25 +========== + +* :vytask:`T6145` ``(bug): Service config-sync does not rely on priorities but must`` + + +2024-03-24 +========== + +* :vytask:`T6161` ``(feature): Output container images as JSON`` +* :vytask:`T6165` ``(bug): grub: vyos-grub-update failed to start on "slow" systems`` +* :vytask:`T6085` ``(bug): VTI interfaces are in UP state by default`` +* :vytask:`T6152` ``(bug): Kernel panic for ZimaBoard 232`` + + +2024-03-23 +========== + +* :vytask:`T6160` ``(bug): isis: NameError: name 'process' is not defined`` +* :vytask:`T6131` ``(bug): Disabling openvpn interface(s) causes OSPF to fail to load on reboot`` +* :vytask:`T4022` ``(feature): Add package nat-rtsp-dkms`` + + +2024-03-22 +========== + +* :vytask:`T6136` ``(bug): Configuring a dynamic address group, config script did not check whether the group was created`` +* :vytask:`T6130` ``(bug): [1.3.6->1.4.0-epa2 Migration] BGP "set community" missing`` +* :vytask:`T6090` ``(bug): [1.3.6->1.4.0-epa1 Migration] policy route fails due tcp flag case sensitivity`` +* :vytask:`T6155` ``(default): ixgbe: failed to initialize because an unsupported SFP+ module type was detected.`` +* :vytask:`T6125` ``(feature): Support 802.1ad (0x88a8) vlan filtering for bridge`` +* :vytask:`T5624` ``(default): Remove /etc/debian_version from the image`` + + +2024-03-21 +========== + +* :vytask:`T6143` ``(feature): Increase configuration timeout range for service config-sync`` + + +2024-03-20 +========== + +* :vytask:`T6133` ``(feature): Add domain-name to commit-archive`` +* :vytask:`T6129` ``(feature): bgp: add route-map option "as-path exclude all"`` + + +2024-03-19 +========== + +* :vytask:`T6127` ``(bug): Ability to view logs for rules with Offload not functional`` +* :vytask:`T6138` ``(bug): Conntrack table op-mode fails with flowtable offload entries`` + + +2024-03-15 +========== + +* :vytask:`T6118` ``(feature): radvd: RFC8781: add nat64prefix support`` + + +2024-03-12 +========== + +* :vytask:`T6020` ``(bug): VRRP health-check script is not applied correctly in keepalived.conf`` +* :vytask:`T5646` ``(bug): QoS policy limiter broken if class without match`` +* :vytask:`T2433` ``(feature): Improve CLI value validator performance`` +* :vytask:`T1436` ``(bug): Config entries with default values do not correctly show as changed`` + + +2024-03-11 +========== + +* :vytask:`T6098` ``(bug): Description doesnt seem to allow for non international characters`` +* :vytask:`T6070` ``(bug): bnx2x NIC causes a commit error due to incorrect implementation of EEE status reading`` +* :vytask:`T2998` ``(bug): SNMP v3 oid "exclude" option doesn't work`` +* :vytask:`T6107` ``(bug): Nginx does not allow big config queries for configure endpoint API`` +* :vytask:`T6096` ``(bug): Config commits are not synced properly because 00vyos-sync is deleted by vyos-router`` +* :vytask:`T6093` ``(bug): Incorrect dhcp-options vendor-class-id regex`` +* :vytask:`T6083` ``(feature): ethtool: move string parsing to JSON parsing`` +* :vytask:`T6069` ``(bug): HTTP API segfault during concurrent configuration requests`` +* :vytask:`T6057` ``(feature): Add ability to disable syslog for conntrackd`` +* :vytask:`T5504` ``(feature): Keepalived VRRP ability to set more than one peer-address`` +* :vytask:`T5717` ``(feature): ospfv3 - add allow to set metric-type to ospf redistribution while frr docs says its possible.`` +* :vytask:`T6071` ``(bug): firewall: CLI description limit of 256 characters cause config upgrade issues`` + + +2024-03-08 +========== + +* :vytask:`T6086` ``(bug): NAT does not work with network-groups`` +* :vytask:`T6094` ``(bug): Destination Nat not Making Firewall Rules`` +* :vytask:`T6061` ``(bug): connection-status nat destination firewall filter not working in 1.4.0-epa1`` +* :vytask:`T6075` ``(bug): Applying firewall rules with a non-existent interface group`` + + +2024-03-07 +========== + +* :vytask:`T6104` ``(bug): Regression in commit-archive for non-interactive configuration`` +* :vytask:`T6084` ``(bug): OpenNHRP DMVPN configuration file clean after reboot if we have any IPSec configuration`` +* :vytask:`T5348` ``(bug): Service config-sync can freeze the secondary router if it has commit-archive location`` +* :vytask:`T6073` ``(bug): Conntrack/NAT not being disabled when VRFs are defined`` +* :vytask:`T6095` ``(default): Tab completion for "set interfaces wireless wlan0 country-code" incorrect country "uk"`` + + +2024-03-06 +========== + +* :vytask:`T6079` ``(bug): dhcp: migration fails for duplicate static-mapping`` + + +2024-03-05 +========== + +* :vytask:`T5903` ``(bug): NHRP don´t start on reboot from version 1.5-rolling-202401010026`` +* :vytask:`T2447` ``(feature): Additional Boot Argument Configuration to limit CPU C-States`` + + +2024-03-04 +========== + +* :vytask:`T6054` ``(bug): load-balancing wan - doesn't configure a list of ports`` +* :vytask:`T6087` ``(feature): ospfv3: add support to redistribute IS-IS routes`` + + +2024-03-02 +========== + +* :vytask:`T6081` ``(bug): QoS policy shaper target and interval wrong calcuations`` + + +2024-02-29 +========== + +* :vytask:`T6078` ``(feature): Update ethtool to 6.6`` +* :vytask:`T6077` ``(feature): banner: implement ASCII contest winner default logo`` +* :vytask:`T6074` ``(feature): container: do not allow deleting images which have a container running`` + + +2024-02-28 +========== + +* :vytask:`T6055` ``(bug): PKI error: "failed to install x value" when executed the command from conf mode`` +* :vytask:`T4270` ``(bug): dns forwarding - When "ignore-hosts-file" is unset, local hostname of router resolves to 127.0.1.1`` + + +2024-02-27 +========== + +* :vytask:`T6065` ``(bug): Duplicate lines in build-vyos-image script cause sagitta build to fail`` +* :vytask:`T5080` ``(bug): Conntrack enabled by default`` + + +2024-02-26 +========== + +* :vytask:`T6064` ``(bug): Can not build VyOS if repository it not cloned to a branch`` +* :vytask:`T5754` ``(default): Update to StrongSwan 5.9.11`` + + +2024-02-25 +========== + +* :vytask:`T6060` ``(feature): op-mode: container: support removing all container images at once`` + + +2024-02-24 +========== + +* :vytask:`T5909` ``(bug): Container registry with authentication prevents config load (section container) after reboot`` + + +2024-02-23 +========== + +* :vytask:`T5376` ``(bug): Conntrack FTP helper does not work properly`` +* :vytask:`T970` ``(feature): Hostname Support in NAT and Firewall Rules`` +* :vytask:`T4940` ``(feature): Interface debugging`` + + +2024-02-22 +========== + +* :vytask:`T6048` ``(bug): Exception in event handler script`` +* :vytask:`T3902` ``(bug): Firewall does not load on boot, address-group not found, even though it exists`` + + +2024-02-21 +========== + +* :vytask:`T6050` ``(bug): Wrong scripting commands descriptions in accel-ppp services`` + + +2024-02-19 +========== + +* :vytask:`T5971` ``(default): Create the same view of ppp section for all accel-ppp services`` +* :vytask:`T6029` ``(default): Rewrite Accel-PPP services to an identical feature set`` +* :vytask:`T3722` ``(bug): op-mode IPSec show vpn ike sa always shows L-TIME 0`` + + +2024-02-18 +========== + +* :vytask:`T6043` ``(bug): VxLAN and bridge error bug`` +* :vytask:`T6041` ``(bug): image-tools: install fails from PXE boot into live iso due to restrictive logic`` + + +2024-02-17 +========== + +* :vytask:`T5972` ``(feature): login: add possibility to disable individual local user accounts`` + + +2024-02-16 +========== + +* :vytask:`T6009` ``(bug): Firewall - Time not working properly when not using UTC`` +* :vytask:`T6005` ``(bug): Error on adding a wireguard interface to OSPFv3`` +* :vytask:`T2113` ``(bug): OpenVPN Options error: you cannot use --verify-x509-name with --compat-names or --no-name-remapping`` +* :vytask:`T6019` ``(feature): Bump nftables and libnftnl version`` +* :vytask:`T3471` ``(bug): DHCP hook is not able to detect all running DHCP instances`` +* :vytask:`T6015` ``(default): "journalctl_charon" file does not contain data in the generated "ipsec debug-archive" file`` +* :vytask:`T6001` ``(default): Add option to enable resolve-via-default`` +* :vytask:`T5965` ``(bug): WWAN modems using raw-ip do not work with dhclient/dhcp6c`` +* :vytask:`T5418` ``(bug): PPPoE-Server Client IP pool Subnet`` +* :vytask:`T5245` ``(bug): Wireless interfaces do not get IPv6 link-local address assigned`` + + +2024-02-15 +========== + +* :vytask:`T5977` ``(bug): nftables: Operation not supported when using match-ipsec in outbound firewall`` +* :vytask:`T2612` ``(bug): HTTPS API, changing API key fails but goes through`` +* :vytask:`T5989` ``(bug): IP subnets not usable in UPnP ACLs`` +* :vytask:`T5890` ``(default): OTP key generation is broken`` +* :vytask:`T5719` ``(default): mdns repeater: Add op-mode commands`` +* :vytask:`T4839` ``(feature): Dynamic Firewall groups`` +* :vytask:`T4801` ``(feature): Support for building AWS-ready ISO`` +* :vytask:`T3993` ``(enhancment): Extend HTTP API GraphQL support`` +* :vytask:`T3991` ``(bug): PKI operational command return traceback`` +* :vytask:`T3780` ``(bug): VTI not being brought down when tunnel is down`` +* :vytask:`T3001` ``(feature): Disable spectre mitigation patches from CLI`` +* :vytask:`T562` ``(feature): PDNS: Add support for authoritative dns server`` +* :vytask:`T71` ``(feature): Add virtual IP and route installation policy options for IPsec`` +* :vytask:`T5496` ``(default): `show firewall` error`` +* :vytask:`T4038` ``(default): Rewrite `vyatta-image-tools.pl` in Python`` +* :vytask:`T4997` ``(default): Add DHCP client user hooks dir`` +* :vytask:`T775` ``(feature): Config Sync between two VyOS routers`` +* :vytask:`T381` ``(feature): config nodes for EasyRSA CAs`` +* :vytask:`T118` ``(feature): Native Zabbix Support`` + + +2024-02-14 +========== + +* :vytask:`T6034` ``(feature): rpki: move file based SSH keys for authentication to PKI subsystem`` +* :vytask:`T5981` ``(bug): IPsec site-to-site migrated PKI ca certificates are created with an '@'`` +* :vytask:`T5930` ``(bug): vrf - route-leak not work using route-target both command.`` +* :vytask:`T5709` ``(bug): IPoE-server fails if next pool mentioned but not defined`` +* :vytask:`T4119` ``(bug): Issue with l2tp remote-access ipv6 configuration`` +* :vytask:`T2044` ``(bug): RPKI doesn't boot properly`` +* :vytask:`T6032` ``(feature): bgp: add EVPN MAC-VRF Site-of-Origin support`` +* :vytask:`T5960` ``(default): Rewriting authentication section in accel-ppp services`` + + +2024-02-13 +========== + +* :vytask:`T5928` ``(bug): Configuration fails to load on boot if offloading has VLAN interfaces defined`` +* :vytask:`T5482` ``(bug): Chrony NTP Server Fails To Sync Time`` +* :vytask:`T5064` ``(bug): Value validation for domain-groups seems to be broken`` + + +2024-02-12 +========== + +* :vytask:`T6010` ``(bug): Support setting multiple values in BGP path-attribute`` +* :vytask:`T6004` ``(bug): RPKI is not configured`` +* :vytask:`T5952` ``(default): DHCP allow same MAC Address on same subnet`` +* :vytask:`T5849` ``(feature): Add SRv6 route commands`` + + +2024-02-10 +========== + +* :vytask:`T6023` ``(bug): rpki: add support for CLI knobs expire-interval and retry-interval`` +* :vytask:`T1090` ``(default): Webproxy overhaul`` + + +2024-02-09 +========== + +* :vytask:`T6028` ``(bug): QoS policy shaper wrong class_id_max and default_minor_id`` +* :vytask:`T6026` ``(bug): QoS hide attempts to delete qdisc from devices`` +* :vytask:`T5788` ``(feature): frr: update to 9.1 release`` +* :vytask:`T5703` ``(bug): QoS config on pppoe interface resets back to fq_codel after tunnel reboots`` +* :vytask:`T5685` ``(feature): Keepalived VRRP prefix is not necessary for the virtual address`` + + +2024-02-08 +========== + +* :vytask:`T6014` ``(feature): Bump keepalived version`` +* :vytask:`T5910` ``(bug): Grub problem(?) Serial Console no longer working`` +* :vytask:`T6021` ``(bug): QoS r2q wrong calculation`` + + +2024-02-07 +========== + +* :vytask:`T6017` ``(bug): Update vyos-http-api-tools for security advisory`` +* :vytask:`T6016` ``(bug): Resolve intermittent failures in cleanup function after failed image install`` +* :vytask:`T6024` ``(feature): bgp: add additional missing FRR features`` +* :vytask:`T6011` ``(feature): rpki: known-hosts-file is no longer supported by FRR CLI - remove VyOS CLI node`` +* :vytask:`T5998` ``(feature): replay_window setting under vpn in config`` + + +2024-02-06 +========== + +* :vytask:`T6018` ``(default): smoketest: updating http-api framework requires a pause before test`` +* :vytask:`T5921` ``(bug): Trying to commit an OpenConnect configuration without any local users results in an exception`` +* :vytask:`T5687` ``(feature): Implement ECS settings for PowerDNS recursor`` + + +2024-02-05 +========== + +* :vytask:`T5974` ``(bug): QoS policy shaper is currently miscalculating bandwidth and ceil values for the default class`` +* :vytask:`T5865` ``(feature): Rewrite ipv6 pool section to ipv6 named pools in Accel-ppp services`` + + +2024-02-02 +========== + +* :vytask:`T5739` ``(bug): Password recovery does not work if public keys are configured`` +* :vytask:`T5955` ``(feature): Rootless containers/set uid/gid for container`` +* :vytask:`T5941` ``(bug): [1.3.5 -> 1.4.0-RC1 Migration] Orphaned Configuration Nodes Cause Issues`` +* :vytask:`T6003` ``(feature): Add 'show rpki as-number' and 'show rpki prefix'`` +* :vytask:`T5848` ``(feature): Add triple-isolate flow isolation option to CAKE QoS policy`` + + +2024-02-01 +========== + +* :vytask:`T5995` ``(bug): Kernel NIC-drivers for Huawei NICs are not properly enabled`` +* :vytask:`T5978` ``(bug): ethernet: hw-tc-offload does not actually get enabled on the NIC`` +* :vytask:`T5979` ``(enhancment): Add configurable kernel boot parameters`` +* :vytask:`T5973` ``(bug): vrf: RTNETLINK answers: File exists`` +* :vytask:`T5967` ``(bug): Multi-hop BFD connections can't be established; please add minimum-ttl option.`` +* :vytask:`T5619` ``(default): Update the Intel ixgbe driver due to issues with Intel X533`` + + +2024-01-31 +========== + +* :vytask:`T6000` ``(bug): [1.3.x -> 1.5.x] migrating threw exception in /opt/vyatta/etc/config-migrate/migrate/https/5-to-6, performed workaround`` +* :vytask:`T5999` ``(bug): load-balancing reverse-proxy can't configure root as a redirect`` + + +2024-01-30 +========== + +* :vytask:`T5980` ``(feature): Add image-tools support for configurable kernel boot options`` + + +2024-01-29 +========== + +* :vytask:`T5988` ``(bug): image-tools: a check of valid image name is missing from 'add image'`` +* :vytask:`T5994` ``(bug): Fix typo in 'remote' module preventing 'add system image' via ftp`` + + +2024-01-26 +========== + +* :vytask:`T5957` ``(bug): Firewall fails to delete inbound-interface name`` +* :vytask:`T5779` ``(bug): custom conntrack timeout rule not applicable`` +* :vytask:`T5984` ``(feature): Add user util numactl`` + + +2024-01-25 +========== + +* :vytask:`T5983` ``(bug): image-tools: minor regression in pruning version files in compatibility mode`` +* :vytask:`T5927` ``(bug): QoS policy shaper-hfsc class does not have a `bandwidth` node but requires one in the check`` +* :vytask:`T5834` ``(bug): Rename 'enable-default-log' to 'default-log'`` + + +2024-01-22 +========== + +* :vytask:`T5968` ``(feature): hsflowd: add VRF support`` +* :vytask:`T5975` ``(bug): GraphQL expects script otp.py that does not exists in 1.4`` +* :vytask:`T5961` ``(bug): QoS policy shaper vif with ceiling fails on commit`` +* :vytask:`T5958` ``(bug): QoS policy shaper-hfsc is not implemented`` +* :vytask:`T5160` ``(feature): Firewall refactor`` +* :vytask:`T5969` ``(feature): op-mode: list multicast group membership`` + + +2024-01-21 +========== + +* :vytask:`T5799` ``(bug): vyos unbootable after 1.4-rolling-202308240020 to 1.5-rolling-202312010026 upgrade`` +* :vytask:`T5787` ``(bug): dhcp-server allows duplicate static-mapping for the same IP address`` +* :vytask:`T5692` ``(enhancment): NTP leap smear`` +* :vytask:`T5954` ``(feature): Enable nvme_hwmon and drivetemp in KERNEL`` + + +2024-01-20 +========== + +* :vytask:`T5915` ``(bug): Firewall zone - Re add op-mode commands`` +* :vytask:`T5805` ``(bug): Missed per-interface statistic in telegraf`` +* :vytask:`T5724` ``(feature): About dhcp client hooks`` +* :vytask:`T5577` ``(bug): Optimize PAM configs for RADIUS/TACACS+`` +* :vytask:`T5550` ``(bug): Source validation on interface does not work properly`` +* :vytask:`T5267` ``(bug): Another corruption on upgrade`` +* :vytask:`T5239` ``(bug): frr 'hostname' missing or incorrect, and domain-name missing totally`` +* :vytask:`T5219` ``(bug): ddclient: Cloudflare doesn't require login`` +* :vytask:`T5217` ``(feature): Add firewall SYNPROXY`` +* :vytask:`T5203` ``(feature): load-balancing wan add systemd unit instead of old vyatta-wanloadbalance.init`` +* :vytask:`T5199` ``(bug): Salt-minion cannot connect to server in python 3.10 and up`` +* :vytask:`T5138` ``(feature): Add patch to accel-ppp build L2TP LNS use Calling-Number as RADIUS Calling-Station-ID`` +* :vytask:`T5054` ``(bug): ipsec: "show vpn ipsec remote-access" does not list active connections`` +* :vytask:`T5053` ``(bug): Vyatta-cfg Post-Removal Hook Tries to Disable Deleted Service`` +* :vytask:`T5035` ``(feature): Add more actions to policy route rule`` +* :vytask:`T4990` ``(bug): Commit results may not be properly saved if power is cut immediately after a successful commit`` +* :vytask:`T4988` ``(default): Expose time and size conversion functions as Jinja2 filters`` +* :vytask:`T4986` ``(feature): Ability to filter traffic originating from the router itself via firewall`` +* :vytask:`T4963` ``(default): vyos.ethtool: improve/fix driver name detection`` +* :vytask:`T4935` ``(bug): ospfv3: "not-advertise" and "advertise" conflict`` +* :vytask:`T4897` ``(bug): Setting 'source-address' or `source-interface` on existing vxlan interface doesn't work`` +* :vytask:`T4888` ``(default): Rewrite the conntrack sync script using vyos.opmode`` +* :vytask:`T4863` ``(feature): need an option for route policy to apply to dynamic interfaces l2tp*/ipoe*/pppoe* (for TCP MSS setting)`` +* :vytask:`T4817` ``(feature): Please add support for RFC 9234`` +* :vytask:`T4765` ``(default): Normalize field names in op mode JSON outputs`` +* :vytask:`T4751` ``(enhancment): Feature Request: system login: 2FA OTP key generator in VyOS CLI`` +* :vytask:`T4726` ``(default): Add completion and validation for the accel-ppp RADIUS vendor option`` +* :vytask:`T4722` ``(default): Improve abbreviation/acronym consistency`` +* :vytask:`T4172` ``(feature): Patch ndppd to not read route table if there are no auto prefixes`` +* :vytask:`T4085` ``(feature): Rewrite L2TP/PPTP/SSTP/PPPoE services to get_config_dict`` +* :vytask:`T4031` ``(feature): Ability to configure DMVPN in vrf`` +* :vytask:`T4030` ``(bug): SR-IOV and interface renaming bug`` +* :vytask:`T4014` ``(feature): Add “command” and “arg” configuration options for containers`` +* :vytask:`T3965` ``(default): arm: Extend configure scripts to allow for arm builds`` +* :vytask:`T3813` ``(bug): Some custom sysctl parameters can't be applied bug`` +* :vytask:`T3778` ``(bug): Abnormal network communication and settings`` +* :vytask:`T3591` ``(bug): OpenVPN with/without VRF not working (NordVPN)`` +* :vytask:`T3372` ``(feature): Support public HTTPS repos in live-build`` +* :vytask:`T5963` ``(bug): QoS policy shaper rate calculations could be wrong for some ethernet devices`` +* :vytask:`T5962` ``(feature): QoS policy set default speed to 100mbit or 1gbit instead of 10mbit`` +* :vytask:`T5697` ``(bug): event-handler keep failing`` +* :vytask:`T4779` ``(default): Make raw op mode command outputs use bytes for data amount values`` + + +2024-01-19 +========== + +* :vytask:`T5897` ``(bug): VyOS with Cloud-init and VRF stucks at reboot/shutdown process`` +* :vytask:`T5554` ``(bug): Disable sudo for PAM RADIUS`` +* :vytask:`T4754` ``(default): Improvement: system login: show configured 2FA OTP key`` +* :vytask:`T5857` ``(bug): show interfaces wireless info`` +* :vytask:`T5841` ``(default): Remove old ssh-session-cleanup.service`` +* :vytask:`T5543` ``(bug): Fix source address handling in static joins`` +* :vytask:`T5884` ``(default): Minor description fix (op-mode: generate wireguard)`` +* :vytask:`T5781` ``(default): Add ability to add additional minisign keys`` + + +2024-01-18 +========== + +* :vytask:`T5863` ``(bug): Failure to Load Config on Recent 1.5 Versions`` +* :vytask:`T4638` ``(bug): Deleting a parent interface does not delete its underlying VLAN interfaces`` +* :vytask:`T5953` ``(default): Rename 'close_action' value from `hold` to `trap` in IPSEC IKE`` +* :vytask:`T905` ``(bug): The command show remote-config does not work for remote-platform openvpn`` + + +2024-01-17 +========== + +* :vytask:`T5923` ``(bug): Config mode system_console.py is not aware of revised GRUB file structure`` +* :vytask:`T4658` ``(feature): Rename DPD action `hold` to `trap``` +* :vytask:`T5932` ``(bug): 1.4-rolling-202304120317 to 1.4.0-rc1: dynamic dns migration fail`` + + +2024-01-16 +========== + +* :vytask:`T5951` ``(bug): [1.4.0-RC2] show hardware dmi Operational Mode Command Broken`` +* :vytask:`T5937` ``(bug): [1.3.5 -> 1.4.0-RC1 Migration] IPv6 BGP Neighbor Peer Groups Missing / Not Migrated`` +* :vytask:`T5889` ``(bug): Migration NAT 5-to-6 bug`` +* :vytask:`T5859` ``(bug): Invalid format of pool range in accel-ppp services`` +* :vytask:`T5842` ``(feature): Rewrite PPTP service to get_config_dict`` +* :vytask:`T5801` ``(feature): Rewrite L2TP service to get_config_dict`` +* :vytask:`T5688` ``(default): Create the same view of pool configuration for all accel-ppp services`` + + +2024-01-15 +========== + +* :vytask:`T5944` ``(bug): "reboot in 1" not working`` +* :vytask:`T5936` ``(bug): [1.3.5 -> 1.4.0-RC1 Migration] OSPF Passive Interface Configuration Not Working Correctly`` +* :vytask:`T5247` ``(bug): the bug of the command "show interfaces system"`` +* :vytask:`T5901` ``(bug): Cloud-init and DHCP exit hook errors`` +* :vytask:`T4856` ``(bug): DHCP-client exit hook for IPsec is incorrect`` +* :vytask:`T2556` ``(bug): "show interfaces vrrp" does not return any interface`` + + +2024-01-14 +========== + +* :vytask:`T4428` ``(feature): Update ddclient to newer version`` + + +2024-01-12 +========== + +* :vytask:`T5925` ``(feature): Containers change systemd KillMode`` +* :vytask:`T5920` ``(bug): Quick Start documentation contains error`` +* :vytask:`T5919` ``(bug): Firewall - opmode for ipv6`` +* :vytask:`T5306` ``(default): bgp config migration failed with v6only option configured with peer-group`` +* :vytask:`T3429` ``(bug): Hyper-V integration services not working on VyOS 1.4 (sagitta/current)`` + + +2024-01-11 +========== + +* :vytask:`T5896` ``(bug): Config Error on Boot with Podman and Firewall`` +* :vytask:`T5532` ``(bug): After add system image the boot stuck and works again after the second reboot`` +* :vytask:`T5512` ``(bug): build linux-firmware script cannot expand asterisks if firmware name is a glob string`` +* :vytask:`T5379` ``(bug): show system updates doesnt seem to be working`` +* :vytask:`T5275` ``(default): Add op mode commands for exporting certificates to PEM files with correct headers`` +* :vytask:`T5274` ``(default): Add a deprecation warning for OpenVPN site-to-site with pre-shared secret`` +* :vytask:`T5262` ``(default): Warn the user about unsaved config on reboot/shutdown attempts`` +* :vytask:`T5257` ``(feature): Cannont assign netflow source ip to ip in non default VRF`` +* :vytask:`T5026` ``(feature): Python3 modules crypt and spwd are deprecated`` +* :vytask:`T5814` ``(bug): VyOS 1.3 to 1.4 LTS Firewall ruleset migration script breaks configuration`` +* :vytask:`T4610` ``(bug): Firewall with 20K entries cannot load after reboot`` +* :vytask:`T3191` ``(bug): PAM RADIUS freezing when accounting does not configured on RADIUS server`` +* :vytask:`T5917` ``(feature): Restore annotations of (running)/(default boot) in select image list`` +* :vytask:`T5916` ``(default): Added segment routing check for index size and SRGB size`` +* :vytask:`T5913` ``(feature): Allow for Peer-Groups in ipv4-labeled-unicast SAFI`` + + +2024-01-10 +========== + +* :vytask:`T5918` ``(bug): Verification problem for `set vpn ipsec interface``` +* :vytask:`T5911` ``(bug): pki: service update ignored if certificate name contains a hyphen (-)`` +* :vytask:`T5886` ``(feature): Add support for ACME protocol (LetsEncrypt)`` +* :vytask:`T5766` ``(bug): http: rewrite conf-mode script to get_config_dict()`` +* :vytask:`T5144` ``(default): Modernize dynamic dns operation`` +* :vytask:`T4689` ``(feature): Support RFS(Receive Flow Steering)`` +* :vytask:`T4659` ``(feature): Use vtysh to display bridge and some interface parameter information`` +* :vytask:`T4646` ``(bug): USB serial output console does not work`` +* :vytask:`T4577` ``(bug): WWAN commit failed which simple config`` +* :vytask:`T4502` ``(feature): Consider implementing (NAT/other) flow table offload`` +* :vytask:`T4446` ``(default): Unified CLI for displaying neithbors (ARP, IP, and NDP)`` +* :vytask:`T4427` ``(default): Remove the vyos-utils package list from vyos-build`` +* :vytask:`T4300` ``(feature): Extend list of supported interfaces for Cloud-init Network Configuration`` +* :vytask:`T4250` ``(bug): Organize logrotate settings to avoid duplicates`` +* :vytask:`T4236` ``(feature): Generate ovpn openvpn client configuration files`` +* :vytask:`T4222` ``(feature): Support for TWAMP as round-trip metric`` +* :vytask:`T3833` ``(bug): Cloud-init not finding data source in OpenStack`` +* :vytask:`T5902` ``(bug): http: remove virtual-host configuration in webserver`` +* :vytask:`T3499` ``(bug): Podman is not compatible with nat rules`` +* :vytask:`T3430` ``(bug): Cloud-init failing with “Unable to render networking” on VyOS 1.3`` +* :vytask:`T3011` ``(bug): router becomes unreachable for few minutes when vti interfaces goes down`` +* :vytask:`T5791` ``(default): Update dynamic dns configuration path to be consistent with other areas of VyOS`` +* :vytask:`T5708` ``(default): Additional dynamic dns improvements to align with ddclient 3.11.1 release`` +* :vytask:`T5573` ``(bug): Fix ddclient cache entries`` +* :vytask:`T5012` ``(feature): Control network configuration from Cloud-Init config`` +* :vytask:`T3116` ``(feature): Support back-end L4 level load balancing`` +* :vytask:`T5614` ``(default): Add conntrack helper matching on firewall`` +* :vytask:`T4782` ``(enhancment): Allow multiple CA certificates (on e.g. EAPoL)`` +* :vytask:`T2199` ``(default): Rewrite firewall in new XML/Python style`` + + +2024-01-09 +========== + +* :vytask:`T5898` ``(bug): Replace partprobe with partx due to unable to install VyOS`` +* :vytask:`T5838` ``(feature): Add Infiniband kernel modules`` +* :vytask:`T5785` ``(bug): API output of show container image broken`` +* :vytask:`T5410` ``(feature): Improve `utils.convert.convert_data()` to process all stdtypes`` +* :vytask:`T5269` ``(default): OpenVPN non-TLS site-to-site mode deprecation`` +* :vytask:`T5249` ``(feature): Add rollback-soft feature to rollback without a reboot`` +* :vytask:`T4944` ``(default): Prevent op mode functions from returning bare literals in raw output`` +* :vytask:`T4910` ``(default): Rewrite the remote access VPN op mode in the new style`` +* :vytask:`T4470` ``(feature): Rewrite load-balancing wan to XML/Python`` +* :vytask:`T3763` ``(bug): wireguard checks if port already binding`` +* :vytask:`T3489` ``(bug): NUMA has been disabled for the past few years and no-one has noticed`` +* :vytask:`T3476` ``(feature): Update availability check`` +* :vytask:`T2845` ``(bug): BGP conf_mode unable to delete configuration with peer-group`` +* :vytask:`T2844` ``(bug): BGP conf_mode errors disable-send-community`` +* :vytask:`T2755` ``(default): Requirements for partial interface setup`` +* :vytask:`T2721` ``(enhancment): Set FQ-CoDel as the default queueing mechanism for every class in Shaper`` +* :vytask:`T2511` ``(feature): Migrate vyatta-op-quagga to new XML format`` +* :vytask:`T2302` ``(default): Convert configuration scripts from executables to modules and use a script runner`` +* :vytask:`T2281` ``(feature): DHCP and Static IPs on Same Interface`` +* :vytask:`T2216` ``(default): Containerized third-party applications for VyOS`` +* :vytask:`T2171` ``(feature): Unify creation and manipulation of interfaces`` +* :vytask:`T1759` ``(feature): Replacing Vyatta::Interface perl`` +* :vytask:`T2408` ``(enhancment): DHCP Relay upstream and downstream interfaces`` +* :vytask:`T1297` ``(feature): Add GARP settings to VRRP/keepalived`` + + +2024-01-08 +========== + +* :vytask:`T5888` ``(bug): Firewall upgrade fails because of icmpv6`` +* :vytask:`T5844` ``(bug): HTTPS API doesn't start without configured keys even when GraphQL authentication type is set to token`` +* :vytask:`T5664` ``(bug): 1.4 user has no permissions?`` +* :vytask:`T5215` ``(default): Add a built-in ICMP health check for VRRP groups`` +* :vytask:`T5045` ``(bug): BFD is not starting after upgrade to 1.4-rolling-202302150317`` +* :vytask:`T4193` ``(default): Add support for transparent firewall`` +* :vytask:`T3754` ``(default): Make config scripts more testable`` +* :vytask:`T3663` ``(default): Use inotify file watching where applicable`` +* :vytask:`T3480` ``(bug): Does not possible to change console baud-rate`` +* :vytask:`T2897` ``(default): Remove cluster command`` +* :vytask:`T5904` ``(feature): op-mode: add "show ipv6 route vrf " command`` + + +2024-01-07 +========== + +* :vytask:`T5891` ``(bug): OpenVPN IPv6 config issue with 1.4-rc1`` +* :vytask:`T5887` ``(feature): Upgrade Linux Kernel to 6.6.y (2023 LTS edition)`` + + +2024-01-06 +========== + +* :vytask:`T3670` ``(feature): Option to disable HTTP port 80 redirect`` + + +2024-01-05 +========== + +* :vytask:`T3642` ``(feature): PKI configuration`` +* :vytask:`T5894` ``(feature): Extend get_config_dict() with additional parameter with_pki that defaults to False`` + + +2024-01-04 +========== + +* :vytask:`T4072` ``(feature): Feature Request: Firewall on bridge interfaces`` +* :vytask:`T3459` ``(default): Inform the user when unable to install outdated image`` + + +2024-01-03 +========== + +* :vytask:`T5880` ``(bug): verify_source_interface should not allow dynamic interfaces like ppp, l2tp, ipoe or sstpc client interfaces`` +* :vytask:`T5879` ``(bug): tunnel: sourceing from dynamic pppoe0 interface will fail on reboots`` +* :vytask:`T4500` ``(bug): Missing firewall logs`` + + +2024-01-02 +========== + +* :vytask:`T5885` ``(default): image-tools: relax restriction on image-name length from 32 to 64`` + + +2024-01-01 +========== + +* :vytask:`T5883` ``(bug): Preserve file ownership in /config subdirs on add system image`` +* :vytask:`T5474` ``(feature): Establish common file name pattern for XML conf mode commands`` + + +2023-12-30 +========== + +* :vytask:`T5875` ``(bug): login: removing and re-adding a user keeps the home directory but UID will change, thus SSH keys no longer work`` +* :vytask:`T5653` ``(feature): Command to display fingerprint`` + + +2023-12-29 +========== + +* :vytask:`T5829` ``(bug): Can't Add IPv6 Address to Containers`` +* :vytask:`T5852` ``(bug): Reboots fail with eapol WAN interface`` +* :vytask:`T5869` ``(bug): vyos.template.first_host_address() does not honor RFC4291 section 2.6.1`` + + +2023-12-28 +========== + +* :vytask:`T4163` ``(feature): [BMP-BGP] Routing monitoring feature`` +* :vytask:`T5867` ``(feature): Upgrade podman to Debian Trixie version 4.7.x`` +* :vytask:`T5866` ``(feature): Add op-mode command to restart IPv6 RA daemon`` +* :vytask:`T5861` ``(bug): Flavor build system fails with third-party packages`` +* :vytask:`T5854` ``(feature): Extend override-default script to allow embedded defaultValue settings`` +* :vytask:`T5792` ``(default): Upgrade ddclient 3.11.2 release`` + + +2023-12-25 +========== + +* :vytask:`T5855` ``(feature): Migrate "set service lldp snmp enable" -> `set service lldp snmp"`` +* :vytask:`T5837` ``(bug): vyos.configdict.node_changed does not return keys per adding`` +* :vytask:`T5856` ``(bug): SNMP service removal fails`` + + +2023-12-24 +========== + +* :vytask:`T5853` ``(default): Typo interfaces-virtual-ethernet.xml.in`` + + +2023-12-22 +========== + +* :vytask:`T5804` ``(bug): SNAT "any" interface error`` +* :vytask:`T4760` ``(bug): VyOS does not support running multiple instances of DHCPv6 clients`` + + +2023-12-21 +========== + +* :vytask:`T5778` ``(bug): The show dhcp server leases operation mode command does not work as expected`` +* :vytask:`T5775` ``(default): Migrated Firewall Global State Policy ineffective on latest firewall zone config`` +* :vytask:`T5637` ``(bug): Firewall default-action log`` +* :vytask:`T5796` ``(bug): Openconnect - HTTPS security headers are missing`` +* :vytask:`T3580` ``(feature): Refactoring firewall ipv6 rule icmpv6`` +* :vytask:`T2898` ``(feature): Support NDP proxy`` +* :vytask:`T2229` ``(feature): PPPOE Default Queue type selection`` + + +2023-12-20 +========== + +* :vytask:`T5823` ``(feature): Protocol BGP add default values for config dictionary`` +* :vytask:`T5798` ``(enhancment): reverse-proxy load-balancing service should support multiple certificates for frontend`` + + +2023-12-19 +========== + +* :vytask:`T5828` ``(default): Fix GRUB installation on arm64`` + + +2023-12-18 +========== + +* :vytask:`T5751` ``(feature): Adjust new image tools for non-interactive use`` +* :vytask:`T5831` ``(feature): show system image should reverse order by addition date`` +* :vytask:`T5825` ``(bug): image-tools: restore authentication on 'add system image'`` +* :vytask:`T5821` ``(bug): image-tools: restore vrf-aware 'add system image'`` +* :vytask:`T5819` ``(bug): Don't echo password on install image`` +* :vytask:`T5806` ``(bug): Clear old raid data on new install image`` +* :vytask:`T5789` ``(bug): image-tools should copy ssh host keys on image update`` +* :vytask:`T5758` ``(default): Restore scanning configs when live installing`` + + +2023-12-15 +========== + +* :vytask:`T5824` ``(bug): busybox cannot connect some websites from initramfs`` +* :vytask:`T5803` ``(default): git/github: Adjust configuration for safe and baseline defaults`` + + +2023-12-14 +========== + +* :vytask:`T5773` ``(bug): Unable to load config via HTTP`` +* :vytask:`T5816` ``(bug): BGP Large Community List Validation Broken`` +* :vytask:`T5812` ``(bug): rollback check max revision number does not work`` +* :vytask:`T5749` ``(feature): Show MAC address VRF and MTU by default for "show interfaces"`` +* :vytask:`T5774` ``(bug): commit-archive to FTP server broken after update (VyOS 1.5-rolling)`` +* :vytask:`T5826` ``(default): Add dmicode as an explicit dependency`` +* :vytask:`T5793` ``(default): mdns-repeater: Cleanup avahi-daemon configuration in /etc`` + + +2023-12-13 +========== + +* :vytask:`T591` ``(feature): Support SRv6`` + + +2023-12-12 +========== + +* :vytask:`T4704` ``(feature): Allow to set metric (MED) to rtt with rtt,+rtt or -rtt`` +* :vytask:`T5815` ``(enhancment): Add load_config module`` +* :vytask:`T5413` ``(default): Deny the opportunity to use one public/private key pair on both wireguard peers.`` + + +2023-12-11 +========== + +* :vytask:`T5741` ``(bug): WAN Load Balancing failover route tables aren't created`` + + +2023-12-10 +========== + +* :vytask:`T5658` ``(default): Add VRF support for mtr`` + + +2023-12-09 +========== + +* :vytask:`T5808` ``(bug): op-mode: ipv6 ospfv3 graceful-restart description contains incorrect info`` +* :vytask:`T5802` ``(bug): ping (ip or hostname) interface produces error`` +* :vytask:`T5747` ``(feature): op-mode add MAC VRF and MTU for show interfaces summary`` +* :vytask:`T3983` ``(bug): show pki certificate Doesnt show x509 certificates`` + + +2023-12-08 +========== + +* :vytask:`T5782` ``(enhancment): Use a single config mode script for https and http-api`` +* :vytask:`T5768` ``(enhancment): Remove auxiliary http-api.conf for simplification of http-api config mode script`` +* :vytask:`T5809` ``(default): Enable GRUB support for gzip compressed kernels`` + + +2023-12-04 +========== + +* :vytask:`T5769` ``(bug): VTI tunnels lose their v6 Link Local addresses when set down/up`` + + +2023-12-03 +========== + +* :vytask:`T5753` ``(feature): Add VXLAN vnifilter support`` +* :vytask:`T5759` ``(feature): Change VXLAN default MTU to 1500 bytes`` + + +2023-11-30 +========== + +* :vytask:`T4601` ``(bug): dhcp : relay agent IP address issue.`` + + +2023-11-28 +========== + +* :vytask:`T4276` ``(bug): IPsec peers dh-group negotiation issue with pfs enabled and multiple proposals configured with IKEv1`` + + +2023-11-27 +========== + +* :vytask:`T5763` ``(bug): Fix imprecise check for remote file name in vyos-load-config.py`` +* :vytask:`T5783` ``(feature): frr: smoketests must notice any daemon crash`` + + +2023-11-26 +========== + +* :vytask:`T5760` ``(feature): DHCP client custom dhcp-options`` +* :vytask:`T2405` ``(feature): archive to GIT or other platform`` + + +2023-11-25 +========== + +* :vytask:`T5655` ``(bug): commit-archive: Ctrl+C should not eror out with stack trace, signal should be cought`` +* :vytask:`T4946` ``(default): Rewrite "add system image" in the new op-mode`` +* :vytask:`T4454` ``(default): `install-image` should check free storage`` + + +2023-11-24 +========== + +* :vytask:`T5776` ``(feature): Enable VFIO support`` +* :vytask:`T5402` ``(bug): VRRP router with rfc3768-compatibility sends multiple ARP replies`` +* :vytask:`T3895` ``(default): VYOS firewall rules do not adhere to time schedule unless placed in UTC mode.`` + + +2023-11-23 +========== + +* :vytask:`T4891` ``(bug): BFD flapping loop`` +* :vytask:`T4867` ``(bug): "show bgp neighbors ... advertised-routes" and some other commands fail for IPv4 neighbors`` + + +2023-11-22 +========== + +* :vytask:`T5767` ``(feature): Add reboot and poweroff the system via API`` +* :vytask:`T5729` ``(bug): Firewall, nat and policy route - Switch to valueless`` +* :vytask:`T5681` ``(feature): Interface match - Simplified and unified cli`` +* :vytask:`T4877` ``(bug): Need verification in using import vrf and import vpn, export vpn commands`` +* :vytask:`T4021` ``(bug): Long commit time on bridge interface with 1-4094 allowed VLAN tags`` +* :vytask:`T5338` ``(feature): Add 'mpls bgp forwarding' feature`` +* :vytask:`T3818` ``(bug): BGP export route-map only works after bgpd restart`` +* :vytask:`T5590` ``(default): Firewall "log enable" logs every packet`` +* :vytask:`T5426` ``(default): Add exceptions in vici functions calls`` + + +2023-11-21 +========== + +* :vytask:`T5762` ``(bug): http: api: smoketests fail as they can not establish IPv6 connection to uvicorn backend server`` + + +2023-11-20 +========== + +* :vytask:`T2816` ``(default): Rewrite IPsec scripts with the new XML/Python approach`` + + +2023-11-18 +========== + +* :vytask:`T1354` ``(feature): Add support for VLAN-Aware bridges`` + + +2023-11-16 +========== + +* :vytask:`T5726` ``(bug): HTTPS API image cannot be updated`` +* :vytask:`T5738` ``(feature): Extend XML building blocks`` +* :vytask:`T5736` ``(feature): igmp: migrate "protocols igmp" to "protocols pim"`` +* :vytask:`T5733` ``(feature): pim(6): rewrite FRR PIM daemon configuration to get_config_dict() and add missing IGMP features`` +* :vytask:`T5689` ``(default): FRR 9.0.1 in VyOS current segfaults on show rpki prefix $prefix`` +* :vytask:`T5595` ``(feature): Multicast - PIM bfd feature enable`` +* :vytask:`T3638` ``(bug): Passwords With Dollar Sign Set Incorrectly`` + + +2023-11-15 +========== + +* :vytask:`T5695` ``(feature): Build FRR with LUA scripts --enable-scripting option`` +* :vytask:`T5665` ``(bug): radius user not working`` +* :vytask:`T5728` ``(bug): Improve compatibility between OpenVPN on VyOS 1.5 and OpenVPN Connect Client`` +* :vytask:`T5732` ``(bug): generate firewall rule-resequence drops geoip country-code from output`` +* :vytask:`T5661` ``(enhancment): Add show show ssh dynamic-protection attacker and show log ssh dynamic-protection`` +* :vytask:`T1276` ``(bug): dhcp relay + VLAN fails`` + + +2023-11-13 +========== + +* :vytask:`T5698` ``(feature): EVPN ESI Multihoming`` +* :vytask:`T5563` ``(bug): container: Container environment variable cannot be set`` +* :vytask:`T5706` ``(bug): Systemd-udevd high CPU utilization for multiple dynamic ppp/l2tp/ipoe interfaces`` + + +2023-11-10 +========== + +* :vytask:`T5727` ``(bug): validator: Use native URL validator instead of regex-based validator`` + + +2023-11-08 +========== + +* :vytask:`T5720` ``(bug): PPPoE-server adding new interface does not work`` +* :vytask:`T5716` ``(bug): PPPoE-server shaper template bug down-limiter option does not rely on fwmark`` +* :vytask:`T5702` ``(feature): Add ability to set include_ifmib_iface_prefix and ifmib_max_num_ifaces for SNMP`` +* :vytask:`T5648` ``(bug): ldpd neighbour template errors`` +* :vytask:`T5564` ``(bug): Both show firewall group and show firewall summary fails`` +* :vytask:`T5559` ``(feature): Selective proxy-arp/proxy-ndp when doing SNAT/DNAT`` +* :vytask:`T5541` ``(bug): Zone-Based Firewalling in VyOS Sagitta 1.4`` +* :vytask:`T5513` ``(bug): Anomalies in show firewall command after refactoring`` +* :vytask:`T4864` ``(bug): `show firewall` command errors`` + + +2023-11-07 +========== + +* :vytask:`T5586` ``(feature): Disable by default SNMP for Keepalived VRRP`` + + +2023-11-06 +========== + +* :vytask:`T5705` ``(bug): rsyslog - Not working when using facility=all`` +* :vytask:`T5704` ``(feature): PPPoE-server add max-starting option`` +* :vytask:`T5707` ``(bug): Wireguard peer public key update leaves redundant peers and breaks connectivity`` +* :vytask:`T4269` ``(feature): node.def generator should automatically add default values`` + + +2023-11-05 +========== + +* :vytask:`T4020` ``(feature): Add ability to control FRR daemons options`` + + +2023-11-03 +========== + +* :vytask:`T5700` ``(bug): Monitoring telegraf deprecated plugins inputs outputs`` +* :vytask:`T5018` ``(bug): Redirect to IFB removed after change in qos policy`` + + +2023-11-02 +========== + +* :vytask:`T5701` ``(feature): Update telegraf package`` + + +2023-11-01 +========== + +* :vytask:`T5690` ``(bug): Change to definition of environment variable 'vyos_rootfs_dir' is incorrect`` + + +2023-10-31 +========== + +* :vytask:`T5699` ``(feature): vxlan: migrate "external" CLI know to "parameters external"`` +* :vytask:`T5668` ``(feature): Disable VXLAN bridge learning and enable neigh_suppress when using EVPN`` + + +2023-10-27 +========== + +* :vytask:`T5652` ``(bug): Config migrate to image upgrade does not properly generate home directory`` +* :vytask:`T4057` ``(bug): Commit time for deleting sflow configuration ~1.5 min`` + + +2023-10-26 +========== + +* :vytask:`T5683` ``(bug): reverse-proxy pki filenames mismatch`` +* :vytask:`T4903` ``(bug): conntrack ignore does not suppotr IPv6 addresses`` +* :vytask:`T4309` ``(feature): Support network/address-groups and ipv6-network/ipv6-address-groups in conntrack ignore`` +* :vytask:`T5606` ``(feature): IPSec VPN: Allow multiple CAs certificates`` +* :vytask:`T5650` ``(default): Progressbars suffer from staircasing effect`` +* :vytask:`T5568` ``(default): Install image from live ISO always defaults boot to KVM entry`` +* :vytask:`T3509` ``(default): No BCP38 for IPv6 on VyOS`` + + +2023-10-23 +========== + +* :vytask:`T5299` ``(bug): QoS shaper ceiling does not work`` +* :vytask:`T5667` ``(feature): BGP label-unicast - enable ecmp`` +* :vytask:`T5337` ``(bug): MPLS/BGP: Route leak does not happen from the VPNv4 table to specific vrf`` + + +2023-10-22 +========== + +* :vytask:`T5254` ``(bug): Modification of any interface setting sets MTU back to default when MTU has been inherited from a bond`` +* :vytask:`T5671` ``(feature): vxlan: change port to IANA assigned default port`` + + +2023-10-21 +========== + +* :vytask:`T5670` ``(bug): bridge: missing member interface validator`` +* :vytask:`T5617` ``(feature): Add an option to exclude single values to the numeric validator`` +* :vytask:`T5414` ``(bug): dhcp-server does not allow valid bootfile-names`` +* :vytask:`T5261` ``(feature): Add AWS gateway load-balanceing tunnel handler (gwlbtun)`` +* :vytask:`T5260` ``(bug): Python3 module crypt is deprecated`` +* :vytask:`T5191` ``(default): Replace underscores with hyphens in command-line options generated by vyos.opmode`` +* :vytask:`T5172` ``(default): Set Python3 version dependency for vyos-1x to 3.10`` +* :vytask:`T4956` ``(default): 'show hardware cpu' issue on arm64`` +* :vytask:`T4837` ``(default): Expose "show ip route summary" in the op mode API`` +* :vytask:`T4770` ``(feature): Rewrite OpenVPN op-mode to vyos.opmode format`` +* :vytask:`T4657` ``(bug): op-mode scripts with type hints in `return` do not work`` +* :vytask:`T4604` ``(bug): bgpd eats huge amount of memory (about 500Megs a day)`` +* :vytask:`T4432` ``(default): Display load average normalized according to the number of CPU cores`` +* :vytask:`T4416` ``(default): Convert 'traceroute' operation to the new syntax and expand available options using python`` +* :vytask:`T4402` ``(bug): OpenVPN client-ip-pool option is broken`` +* :vytask:`T3433` ``(default): A review of the use of racist language in VyOS`` +* :vytask:`T2719` ``(feature): Standardized op mode script structure`` + + +2023-10-20 +========== + +* :vytask:`T5233` ``(bug): Op-mode flow-accounting netflow with disable-imt errors`` +* :vytask:`T5232` ``(bug): Flow-accounting uacctd.service cannot restart correctly`` + + +2023-10-19 +========== + +* :vytask:`T4913` ``(default): Rewrite the wireless op mode in the new style`` + + +2023-10-18 +========== + +* :vytask:`T5642` ``(bug): op cmd: generate tech-support archive: does not work`` +* :vytask:`T5521` ``(bug): Home owner directory changed to vyos for the user after reboot`` + + +2023-10-17 +========== + +* :vytask:`T5662` ``(bug): Fix indexing error in configdep script organization`` +* :vytask:`T5235` ``(bug): SSH keys with special characters cannot be applied via Cloud-init`` + + +2023-10-16 +========== + +* :vytask:`T5165` ``(feature): Policy local-route ability set protocol and port`` + + +2023-10-14 +========== + +* :vytask:`T5629` ``(bug): Policy local-route bug after migration to destination node address`` + + +2023-10-13 +========== + +* :vytask:`T5227` ``(feature): mDNS reflector should allow additional domains to browse and allow filtering services`` +* :vytask:`T5166` ``(feature): Remove local minisign package from build repo for 1.4`` +* :vytask:`T5118` ``(bug): Cleanup vestigial ntp completion script`` +* :vytask:`T5115` ``(default): Support custom port for name servers for forwarding zones`` +* :vytask:`T5113` ``(default): PDNS: Support custom port for DNS forwarders`` +* :vytask:`T5112` ``(feature): Enable support for Network Time Security (NTS) for chrony`` +* :vytask:`T5143` ``(enhancment): Apply constraint on powerdns forward-zones configuration`` + + +2023-10-12 +========== + +* :vytask:`T5649` ``(bug): vyos-1x should generate XML cache after building command templates for less cryptic error on typo`` + + +2023-10-10 +========== + +* :vytask:`T5489` ``(feature): Change to BBR as TCP congestion control, or at least make it an config option`` +* :vytask:`T5479` ``(bug): Helper leftovers found in nftables (firewall) even with all helpers disabled`` +* :vytask:`T5436` ``(bug): vyos-preconfig-bootup.script is missing`` +* :vytask:`T5014` ``(feature): Destination NAT - Add Load Balancing capabilities`` + + +2023-10-08 +========== + +* :vytask:`T5630` ``(feature): pppoe: allow to specify MRU in addition to already configurable MTU`` + + +2023-10-06 +========== + +* :vytask:`T5096` ``(feature): Change 'accept' firewall rule action from 'return' to 'accept'`` +* :vytask:`T5576` ``(feature): Add bgp remove-private-as all option`` +* :vytask:`T3506` ``(default): Migrate loadkey command to op-mode`` + + +2023-10-05 +========== + +* :vytask:`T4320` ``(default): Remove legacy version files in vyatta-cfg-system/cfg-version`` + + +2023-10-04 +========== + +* :vytask:`T5632` ``(feature): Add jq package to parse JSON files`` +* :vytask:`T3655` ``(bug): NAT Problem with VRF`` +* :vytask:`T5585` ``(bug): Fix file access mode for dynamic dns configuration`` + + +2023-10-03 +========== + +* :vytask:`T5618` ``(bug): Flow-accounting crushes when IMT is enabled`` +* :vytask:`T5561` ``(feature): NAT - Inbound or outbound interface should not be mandatory`` +* :vytask:`T5553` ``(feature): Firewall - Add action continue`` +* :vytask:`T5250` ``(bug): Firewall - show firewall group`` +* :vytask:`T4383` ``(bug): Flow Accounting returns permission error and fails to start`` +* :vytask:`T5626` ``(feature): Only select required Kernel CGROUP controllers`` +* :vytask:`T5628` ``(feature): op-mode: login: DeprecationWarning: 'spwd'`` + + +2023-10-01 +========== + +* :vytask:`T936` ``(feature): Reimplementation of tech-support diagnostic file generation`` + + +2023-09-30 +========== + +* :vytask:`T5048` ``(bug): QoS doesn't work correctly root task`` +* :vytask:`T4989` ``(bug): QoS Policy Limiter - classes for marked traffic do not work`` + + +2023-09-28 +========== + +* :vytask:`T5596` ``(feature): bgp: add new features from FRR 9`` +* :vytask:`T5412` ``(feature): Add support for extending config-mode dependencies in supplemental package`` + + +2023-09-26 +========== + +* :vytask:`T5480` ``(bug): Ability to disable SNMP for VRRP keepalived service`` + + +2023-09-25 +========== + +* :vytask:`T5533` ``(bug): Keepalived VRRP IPv6 group enters in FAULT state`` + + +2023-09-24 +========== + +* :vytask:`T5511` ``(feature): Cleanup of unused directories (and files) in order to shrink image-size`` + + +2023-09-23 +========== + +* :vytask:`T5518` ``(default): Add MLD protocol support`` + + +2023-09-22 +========== + +* :vytask:`T5602` ``(feature): For reverse-proxy type of load-balancing feature, support "backup" option in backends configuration`` +* :vytask:`T5609` ``(enhancment): Add util to get drive device name from id`` +* :vytask:`T5608` ``(enhancment): Rewrite add/delete raid member to Python and remove from vyatta-op`` +* :vytask:`T5607` ``(bug): Adjust RAID smoketest for non-deterministic SCSI device probing`` + + +2023-09-20 +========== + +* :vytask:`T5588` ``(bug): Add kernel conntrack_bridge module`` +* :vytask:`T5271` ``(default): Add support for peer-fingerprint to OpenVPN`` +* :vytask:`T5241` ``(feature): Support veth interfaces to working with netns`` +* :vytask:`T5238` ``(default): interface virtual-etherne - error when it doesn't use a peer`` +* :vytask:`T5592` ``(feature): salt: upgrade minion to 3005.2`` + + +2023-09-19 +========== + +* :vytask:`T5597` ``(feature): isis: add new features from FRR 9.`` +* :vytask:`T4284` ``(feature): QoS: rewrite to XML and Python`` + + +2023-09-18 +========== + +* :vytask:`T5419` ``(feature): Software/Hardware fastpath with nftables flowtable`` + + +2023-09-15 +========== + +* :vytask:`T5581` ``(feature): Add "show ip nht" op-mode command (IPv4 nexthop tracking table)`` + + +2023-09-11 +========== + +* :vytask:`T5567` ``(bug): vyos-1x: webproxy: maximum-object-size allowed ranges not in sync with Equuleus`` +* :vytask:`T5551` ``(bug): Missing check for boot_configuration_complete raises error in vyos-save-config.py`` +* :vytask:`T5353` ``(bug): config-mgmt: normalize archive updates and commit log entries`` +* :vytask:`T3424` ``(default): PPPoE IA-PD doesn't work in VRF`` +* :vytask:`T2773` ``(feature): EIGRP support for VRF`` + + +2023-09-10 +========== + +* :vytask:`T5565` ``(bug): Builds as vyos-999-timestamp instead of vyos-1.4-rolling-timestamp`` +* :vytask:`T5555` ``(bug): Fix timezone migrator (system 13-to-14)`` +* :vytask:`T5529` ``(bug): Missing symbolic link in linux-firmware package.`` + + +2023-09-09 +========== + +* :vytask:`T5540` ``(bug): vyos-1x: Wrong VHT configuration for WiFi 802.11ac`` +* :vytask:`T5423` ``(bug): ipsec: no output for op-cmd "show vpn ike secrets"`` +* :vytask:`T3700` ``(feature): Support VLAN tunnel mapping of VLAN aware bridges`` + + +2023-09-08 +========== + +* :vytask:`T5502` ``(bug): Firewall - wrong parser for inbound and/or outbound interface`` +* :vytask:`T5460` ``(feature): Firewall - remove config-trap`` +* :vytask:`T5450` ``(feature): Firewall interface group - Allow inverted matcher`` +* :vytask:`T4426` ``(default): Add arpwatch to the image`` +* :vytask:`T4356` ``(bug): DHCP v6 client only supports single interface configuration`` + + +2023-09-07 +========== + +* :vytask:`T5510` ``(feature): Shrink imagesize and improve read performance by changing mksquashfs syntax`` + + +2023-09-06 +========== + +* :vytask:`T5542` ``(bug): ipoe-server: external-dhcp(dhcp-relay) not woking / not implemented`` +* :vytask:`T5548` ``(bug): HAProxy renders timeouts incorrectly`` +* :vytask:`T5544` ``(feature): Allow CAP_SYS_MODULE to be set on containers`` + + +2023-09-05 +========== + +* :vytask:`T5524` ``(feature): Add config directory to liveCD`` +* :vytask:`T5519` ``(bug): Function `call` sometimes hangs`` +* :vytask:`T5508` ``(bug): Configuration Migration Fails to New Netfilter Firewall Syntax`` +* :vytask:`T5495` ``(feature): Enable snmp module also for frr/ldpd`` +* :vytask:`T2958` ``(bug): DHCP server doesn't work from a live CD`` +* :vytask:`T5428` ``(bug): dhcp: client renewal fails when running inside VRF`` + + +2023-09-04 +========== + +* :vytask:`T5536` ``(bug): show dhcp client leases caues No module named 'vyos.validate'`` +* :vytask:`T5506` ``(bug): Container bridge interfaces do not have a link-local address`` + + +2023-09-03 +========== + +* :vytask:`T5538` ``(bug): Change order within variable lb_config_tmpl to fit order of manpage and fix some typos`` +* :vytask:`T4612` ``(feature): Support arbitrary netmasks in firewall rules`` + + +2023-08-31 +========== + +* :vytask:`T5190` ``(feature): Cloud-Init cannot fetch Meta-data on machines where the main Ethernet interface is not eth0`` +* :vytask:`T4895` ``(bug): Tag nodes are overwritten when configured by Cloud-Init from User-Data`` +* :vytask:`T4776` ``(bug): NVME storage is not detected properly during installation`` +* :vytask:`T5531` ``(feature): Containers add label option`` +* :vytask:`T5525` ``(default): Change dev.packages.vyos.net repo to rolling-packages.vyos.net vyos-build:current uses`` + + +2023-08-30 +========== + +* :vytask:`T4933` ``(default): Malformed lines cause vyos.util.colon_separated_to_dict fail with a nondescript error`` +* :vytask:`T4790` ``(bug): RADIUS login does not work if sum of timeouts more than 50s`` +* :vytask:`T4113` ``(bug): Incorrect GRUB configuration parsing`` +* :vytask:`T5520` ``(bug): Likely source of corruption on system update exposed by change in coreutils for Bookworm`` +* :vytask:`T4151` ``(feature): IPV6 local PBR Support`` +* :vytask:`T4485` ``(default): OpenVPN: Allow multiple CAs certificates`` + + +2023-08-29 +========== + +* :vytask:`T3940` ``(bug): DHCP client does not remove IP address when stopped by the 02-vyos-stopdhclient hook`` +* :vytask:`T3713` ``(default): Create a meta-package for user utilities`` +* :vytask:`T3339` ``(bug): Cloud-Init domain search setting not applied`` +* :vytask:`T3577` ``(bug): Generating vpn x509 key pair fails with command not found`` + + +2023-08-28 +========== + +* :vytask:`T4745` ``(bug): CLI TAB issue with values with '-' at the beginning in conf mode`` +* :vytask:`T5472` ``(bug): NAT redirect should not require port`` + + +2023-08-27 +========== + +* :vytask:`T4759` ``(bug): domain-group on policy route not working`` +* :vytask:`T1097` ``(feature): Make firewall groups work everywhere that's appropropriate`` + + +2023-08-26 +========== + +* :vytask:`T5039` ``(bug): Can't add new local user`` +* :vytask:`T5023` ``(bug): PKI commit fails to update dependents`` +* :vytask:`T4512` ``(feature): enable-default-log on zone-policy`` +* :vytask:`T5003` ``(default): Upgrade base system to Debian 12 "Bookworm"`` + + +2023-08-25 +========== + +* :vytask:`T5468` ``(feature): Remove unused manpages to free up space`` +* :vytask:`T5463` ``(feature): Containers allow publish IPv6 address port`` +* :vytask:`T4412` ``(bug): commit archive: reboot not working with sftp`` +* :vytask:`T3702` ``(feature): Policy: Allow routing by fwmark`` +* :vytask:`T3536` ``(default): Unable to list all available routes`` + + +2023-08-24 +========== + +* :vytask:`T5448` ``(feature): Add service zabbix-agent`` +* :vytask:`T5006` ``(bug): Http api segfault with concurrent requests`` +* :vytask:`T5505` ``(feature): system: zebra route-map is not removed from FRR`` +* :vytask:`T5305` ``(bug): REST API configure operation should not be defined as async`` +* :vytask:`T4292` ``(feature): Rewrite vyatta-save-config.pl to Python`` + + +2023-08-23 +========== + +* :vytask:`T5478` ``(bug): Cannot configure resolver-cache options for firewall`` +* :vytask:`T5466` ``(feature): L3VPN - label allocation mode`` +* :vytask:`T5453` ``(bug): Fix nat66 - broken after load-balance was introduced in nat`` +* :vytask:`T5446` ``(bug): bgp: validity check for bestpath med option`` +* :vytask:`T5500` ``(feature): Minor fixes to configtree render`` +* :vytask:`T5469` ``(default): Incorrect dependency set in the openvpn-dco package when building VyOS for arm64`` +* :vytask:`T5387` ``(feature): dhcp6c: add a no release option`` +* :vytask:`T5491` ``(feature): Hostapd - AP-Mode - allow white-/blacklisting of Clients`` +* :vytask:`T4889` ``(default): Add nftables NAT REDIRECT [to localhost] to CLI`` + + +2023-08-22 +========== + +* :vytask:`T5407` ``(bug): Static routes pointed to container networks fail to persist after reboot`` + + +2023-08-20 +========== + +* :vytask:`T5470` ``(bug): wlan: can not disable interface if SSID is not configured`` + + +2023-08-18 +========== + +* :vytask:`T5488` ``(bug): System conntrack ignore does not take any effect`` + + +2023-08-17 +========== + +* :vytask:`T4202` ``(bug): NFT: Zone policies fail to apply when "l2tp+" is in the interface list`` +* :vytask:`T5409` ``(feature): Add 'set interfaces wireguard wgX threaded'`` +* :vytask:`T5476` ``(feature): netplug: replace Perl helper scripts with a Python equivalent`` +* :vytask:`T5223` ``(bug): tunnel key doesn't clear`` +* :vytask:`T5490` ``(feature): login: add missing regex for home direcotry and radius server key`` + + +2023-08-16 +========== + +* :vytask:`T5483` ``(bug): Residual dhcp-server test file causing zabbix-agent smoketest to fail`` + + +2023-08-15 +========== + +* :vytask:`T5293` ``(feature): Support for Floating Rules (Global Firewall-Rules that are automatically applied before all other Zone Rules)`` +* :vytask:`T5273` ``(default): Add op mode commands for displaying certificate details and fingerprints`` +* :vytask:`T5270` ``(default): Make OpenVPN `tls dh-params` optional`` + + +2023-08-14 +========== + +* :vytask:`T5477` ``(bug): op-mode pki.py should use Config for defaults`` +* :vytask:`T5461` ``(feature): Improve rootfs directory variable`` +* :vytask:`T5457` ``(feature): Add environmental variable pointing to current rootfs directory`` +* :vytask:`T5440` ``(bug): Restore pre/postconfig scripts if user deleted them`` + + +2023-08-12 +========== + +* :vytask:`T5467` ``(bug): ospf(v3): removing an interface from the OSPF process does not clear FRR configuration`` + + +2023-08-11 +========== + +* :vytask:`T5465` ``(feature): adjust-mss: config migration fails if applied to a VLAN or Q-in-Q interface`` +* :vytask:`T2665` ``(bug): vyos.xml.defaults for tag nodes`` +* :vytask:`T5434` ``(enhancment): Replace remaining calls of vyos.xml library`` +* :vytask:`T5319` ``(enhancment): Remove remaining workarounds for incorrect defaults`` +* :vytask:`T5464` ``(feature): ipv6: add support for per-interface dad (duplicate address detection) setting`` + + +2023-08-10 +========== + +* :vytask:`T5416` ``(bug): Ignoring "ipsec match-none" for firewall`` +* :vytask:`T5329` ``(bug): Wireguard interface as GRE tunnel source causes configuration error on boot`` + + +2023-08-09 +========== + +* :vytask:`T5452` ``(bug): Uncaught error in generate_cache during vyos-1x build`` +* :vytask:`T5443` ``(enhancment): Add merge_defaults as Config method`` +* :vytask:`T5435` ``(enhancment): Expose utility function for default values at path`` + + +2023-08-07 +========== + +* :vytask:`T5406` ``(bug): "update webproxy blacklists" fails when vrf is being configured`` +* :vytask:`T5302` ``(bug): QoS class with multiple matches generates one filter rule but expects several rules`` +* :vytask:`T5266` ``(bug): QoS- HTB error when match with a dscp parameter for queue-type 'priority'`` +* :vytask:`T5071` ``(bug): QOS-Rewrite: DSCP match missing`` + + +2023-08-06 +========== + +* :vytask:`T5420` ``(feature): nftables - upgrade to latest 1.0.8`` +* :vytask:`T5445` ``(feature): dyndns: add possibility to specify update interval (timeout)`` + + +2023-08-05 +========== + +* :vytask:`T5291` ``(bug): vyatta-cfg-cmd-wrapper missing ${vyos_libexec_dir} variable`` +* :vytask:`T5290` ``(bug): Failing commits for SR-IOV interfaces using ixgbevf driver due to change speed/duplex settings`` +* :vytask:`T5439` ``(bug): Upgrade to FRR version 9.0 added new daemons which must be adjusted`` + + +2023-08-04 +========== + +* :vytask:`T5427` ``(bug): Change migration script len arguments checking`` + + +2023-08-03 +========== + +* :vytask:`T5301` ``(bug): NTP: chrony only allows one bind address`` +* :vytask:`T5154` ``(bug): Chrony - multiple listen addresses`` + + +2023-08-02 +========== + +* :vytask:`T5374` ``(feature): Ability to set 24-hour time format`` +* :vytask:`T5350` ``(bug): Confusing warning message when committing VRRP config`` +* :vytask:`T5430` ``(bug): bridge: vxlan interfaces are not listed as bridgable in completion helpers`` +* :vytask:`T5429` ``(bug): vxlan: source-interface is not honored and throws config error`` +* :vytask:`T5415` ``(feature): Upgrade FRR to version 9.0`` +* :vytask:`T5422` ``(feature): Support LXD Agent`` + + +2023-08-01 +========== + +* :vytask:`T5399` ``(bug): "show ntp" fails when vrf is being configured`` +* :vytask:`T5346` ``(bug): MPLS sysctl not persistent for L2TP interfaces`` +* :vytask:`T5343` ``(feature): BGP peer group VPNv4 & VPNv6 Address Family Support`` +* :vytask:`T5339` ``(feature): Geneve interface - option to use IPv4 as inner protocol`` +* :vytask:`T5335` ``(bug): ISIS: error when loading config from file`` + + +2023-07-31 +========== + +* :vytask:`T5421` ``(feature): Add arg to completion helper 'list_interfaces' to filter out vlan subinterfaces`` + + +2023-07-29 +========== + +* :vytask:`T5403` ``(feature): Add support for extending xml cache`` + + +2023-07-28 +========== + +* :vytask:`T4602` ``(bug): DHCP `ping-check` enabled by default`` +* :vytask:`T5411` ``(feature): Remove old background monitoring implementation`` +* :vytask:`T5317` ``(enhancment): configtree: remove mutable references`` +* :vytask:`T5316` ``(enhancment): configtree: use a single pass of the diff algorithm`` + + +2023-07-27 +========== + +* :vytask:`T5368` ``(feature): FastNetmon service ids ddos-protection add support sflow mode`` + + +2023-07-26 +========== + +* :vytask:`T5398` ``(bug): FRR mangles container network interface names`` +* :vytask:`T5365` ``(bug): Container systemd units require authentication`` +* :vytask:`T4974` ``(feature): OpenVPN- Data Channel Offload(DCO)`` + + +2023-07-25 +========== + +* :vytask:`T5377` ``(feature): ospf: add graceful restart FRR feature (RFC 3623)`` + + +2023-07-21 +========== + +* :vytask:`T5373` ``(bug): LLDP seems to be running even if its disabled on all interfaces`` +* :vytask:`T5328` ``(default): bgp: Incorrect warning showed for address-family configured with neighbor as interface`` +* :vytask:`T5363` ``(bug): Bash history file does not exists after reboot and ony other file in home directory`` +* :vytask:`T5385` ``(bug): reference_tree: catch parse error on non-transcluded files`` +* :vytask:`T5361` ``(bug): "monitor log" behaves like "show log"`` + + +2023-07-20 +========== + +* :vytask:`T5362` ``(bug): `set high-availability vrrp global-parameters version 3` seems to have no effect`` +* :vytask:`T5355` ``(bug): IPSec: OP cmd : "show vpn ike sa" does not show output`` +* :vytask:`T5330` ``(enhancment): Keep track of source of config dict value when merging defaults`` +* :vytask:`T4497` ``(feature): ping cannot force ipv4 or ipv6`` +* :vytask:`T4288` ``(bug): IPsec tunnel will break when ESP timeout`` + + +2023-07-19 +========== + +* :vytask:`T5340` ``(bug): SNMP and VRF`` +* :vytask:`T5059` ``(feature): add 'disable' option to DHCP relay config`` + + +2023-07-17 +========== + +* :vytask:`T2051` ``(bug): Throughput anomalies`` + + +2023-07-16 +========== + +* :vytask:`T141` ``(feature): TACACS+ Support`` + + +2023-07-15 +========== + +* :vytask:`T5341` ``(feature): Improve CLI for high-availability virtual-server to work with multiple ports`` + + +2023-07-14 +========== + +* :vytask:`T5358` ``(bug): 99-ipsec-dhclient-hook prevents DHCP stateless routes from being installed in VRF table`` +* :vytask:`T4376` ``(bug): DNAT with multiwan and policy routing, incoming connections only work on primary interface`` +* :vytask:`T305` ``(default): loadbalancing does not work with one pppoe connection and another connection of either dhcp or static`` + + +2023-07-13 +========== + +* :vytask:`T4713` ``(bug): vyos@vyos:~$ show nat destination rules | doesn't work`` +* :vytask:`T2315` ``(feature): Ability to have right address-family for BGP peers.`` + + +2023-07-12 +========== + +* :vytask:`T5347` ``(bug): Compare commit revision bug`` +* :vytask:`T5161` ``(default): BFD Static Route Monitoring`` +* :vytask:`T5105` ``(bug): DHCP Server - Wrong error message`` +* :vytask:`T4927` ``(bug): Need to change restart to reload-or-restart in Webproxy module`` +* :vytask:`T3835` ``(bug): vyos router 1.2.7 snmp Dos bug`` +* :vytask:`T5352` ``(default): Fix missing dependency for netavark`` +* :vytask:`T4959` ``(feature): Add container registry authentication config for containers`` + + +2023-07-11 +========== + +* :vytask:`T5314` ``(bug): QOS Default classes are not configured with correct qdisc`` +* :vytask:`T4862` ``(bug): webproxy domain-block does not work`` +* :vytask:`T4844` ``(bug): Incorrect permissions of the safeguard DB directory`` +* :vytask:`T4815` ``(bug): Fix various name server config issues`` +* :vytask:`T4810` ``(bug): Op-mode show/monitor log pppoe interface does not show any logs`` +* :vytask:`T4758` ``(feature): Rewrite show dhcp server to vyos.opmode format`` +* :vytask:`T4262` ``(bug): install image doesn't respect chosen root partition size`` +* :vytask:`T3810` ``(bug): webproxy squidguard rules don't work properly after rewriting to python.`` +* :vytask:`T1928` ``(bug): Is the 'Welcome to VyOS' message when using SSH an information leak?`` +* :vytask:`T1877` ``(default): Feature Request: Allow NAT to use network and address groups`` +* :vytask:`T4813` ``(feature): L3VPN over GRE Tunnels`` +* :vytask:`T4943` ``(bug): Radius SSH login displays "permission denied" on 1.4 rolling release`` +* :vytask:`T4542` ``(default): route-map: "match prefix-len" incorrect behavior`` +* :vytask:`T4392` ``(default): Multiline login banner text reports error on commit`` + + +2023-07-10 +========== + +* :vytask:`T5345` ``(bug): Error incorrectly raised in revised multi_to_list when tag node value name == tag node name`` +* :vytask:`T3578` ``(bug): Prefix-List(6) update cause empty prefix-list(6)`` +* :vytask:`T762` ``(feature): Include rulseset in firewall`` + + +2023-07-06 +========== + +* :vytask:`T5336` ``(feature): Add Swedish keyboard-layout`` + + +2023-07-04 +========== + +* :vytask:`T5333` ``(bug): Policy base routing PBR generetes incorrect rules with name POSTROUTING`` +* :vytask:`T5081` ``(feature): ISIS and OSPF syncronization with IGP-LDP sync`` + + +2023-07-03 +========== + +* :vytask:`T5295` ``(bug): QoS shaper incorrect rate limit the traffic`` +* :vytask:`T5334` ``(feature): ospf: add support for External Route Summarisation Type-5 and Type-7`` + + +2023-07-02 +========== + +* :vytask:`T5332` ``(bug): Show policy route not working when no interface is configured`` + + +2023-07-01 +========== + +* :vytask:`T5304` ``(feature): Containers add bind-propagation option rshared`` +* :vytask:`T5296` ``(bug): QoS class cannot calculate correctly the default bandwidth auto`` +* :vytask:`T5210` ``(bug): IPSec cosmetic bug for Warning vti inrerface`` +* :vytask:`T5277` ``(bug): Dhcpv6-relay does not start on boot`` + + +2023-06-30 +========== + +* :vytask:`T5315` ``(feature): vrrp: add support for version 3`` +* :vytask:`T5283` ``(bug): IPoE server assigns network address`` +* :vytask:`T5313` ``(bug): UDP broadcast relay - missing verify() that relay interfaces have an IP address assigned`` + + +2023-06-29 +========== + +* :vytask:`T5320` ``(enhancment): Add warning when entering config mode after a boot configuration error`` + + +2023-06-28 +========== + +* :vytask:`T1237` ``(feature): Static Route Path Monitoring, failover`` + + +2023-06-26 +========== + +* :vytask:`T5159` ``(bug): DHCPv6-server leases op-command shows warning message even if configured`` + + +2023-06-25 +========== + +* :vytask:`T5240` ``(bug): Service router-advert failed to start radvd with more then 3 name-servers`` +* :vytask:`T5312` ``(bug): Nonescaped special character in help text`` + + +2023-06-24 +========== + +* :vytask:`T5303` ``(bug): Rsyslog.service is not working`` +* :vytask:`T5298` ``(bug): Add RFKILL support into kernel.`` +* :vytask:`T5308` ``(enhancment): Remove workarounds for incorrect defaults in get_interface_dict`` +* :vytask:`T5228` ``(enhancment): Simplify get_config_dict and add argument with_defaults`` +* :vytask:`T5310` ``(bug): Need some help troubleshooting NIC detection.`` + + +2023-06-22 +========== + +* :vytask:`T5297` ``(default): Utility function to check if config under node has been changed between revisions`` + + +2023-06-20 +========== + +* :vytask:`T5300` ``(bug): verification of port availability can return false negative on boot`` +* :vytask:`T5248` ``(feature): Ability to load config via API in JSON format`` + + +2023-06-19 +========== + +* :vytask:`T5281` ``(feature): Add kernel options for vhost-net`` +* :vytask:`T5072` ``(default): QOS-Rewrite: protocol name used literally`` +* :vytask:`T4969` ``(bug): QoS Policy - Unable to set class match mark number`` + + +2023-06-18 +========== + +* :vytask:`T5256` ``(bug): QoS expects protocol number but not protocol name`` + + +2023-06-13 +========== + +* :vytask:`T5258` ``(bug): git Actions use ubuntu-22.04 instead of deprecated ubuntu-18.04 for PR conflicts checker`` +* :vytask:`T5222` ``(feature): Add load-balancing reverse-proxy based on haproxy`` +* :vytask:`T5213` ``(feature): Accel-ppp sending accounting interim updates acct-interim-interval option`` +* :vytask:`T5171` ``(feature): Use XML for conf-mode "load-balancing wan" instead of legacy templates`` + + +2023-06-12 +========== + +* :vytask:`T5282` ``(bug): Poweroff now does not work`` +* :vytask:`T5264` ``(feature): Add Mellanox Technologies firmware flash module mlxfw to kernel`` +* :vytask:`T5286` ``(feature): Remove XDP support`` + + +2023-06-10 +========== + +* :vytask:`T5231` ``(feature): Add op-mode for load-balancing reverse-proxy`` + + +2023-06-09 +========== + +* :vytask:`T5253` ``(bug): MPLS config removed at boot when wireguard interfaces present`` + + +2023-06-05 +========== + +* :vytask:`T5259` ``(bug): Openconnect cannot pass migration 1-to-2`` + + +2023-06-02 +========== + +* :vytask:`T5252` ``(bug): Route distinguisher and route targets changing upon adding interface to new VRF`` +* :vytask:`T5251` ``(bug): Uncaught errors for functions delete/delete_value in Python module configtree.py`` + + +2023-06-01 +========== + +* :vytask:`T5127` ``(bug): VPNv4/VPNv6 routes are not reinstalled following link flap`` + + +2023-05-28 +========== + +* :vytask:`T5244` ``(feature): dropbear: update to 2022.83`` +* :vytask:`T5242` ``(feature): interfaces: smoketest: automatically detect "capabilities"`` +* :vytask:`T5234` ``(feature): Add bash identifier for given VRF instance`` + + +2023-05-25 +========== + +* :vytask:`T5237` ``(feature): interfaces virtual-ethernet - Extend capabilitys of Vlans/QinQ`` +* :vytask:`T4686` ``(feature): Provides support for veth`` + + +2023-05-24 +========== + +* :vytask:`T4605` ``(feature): Firewall change default table names`` +* :vytask:`T4550` ``(feature): router-advert: Add deprecate-prefix & decrement-lifetimes options`` + + +2023-05-23 +========== + +* :vytask:`T4916` ``(feature): Rewrite IPsec authentication`` + + +2023-05-22 +========== + +* :vytask:`T5214` ``(bug): PPPoE-server incorrect warning if a named pool is defined`` +* :vytask:`T4977` ``(feature): Babel routing protocol support`` + + +2023-05-21 +========== + +* :vytask:`T4733` ``(default): Feature Request: dhcp server: add VRF support`` +* :vytask:`T5218` ``(enhancment): Revise vyos xml lib for bug fixes and extensions`` + + +2023-05-17 +========== + +* :vytask:`T5226` ``(default): Deduplicate and standardize validators and constraints for hostname and IP address`` +* :vytask:`T5225` ``(bug): BGP allowas-in unusable`` +* :vytask:`T5208` ``(bug): Failed to start nvmf-autoconnect.service during the boot`` + + +2023-05-16 +========== + +* :vytask:`T5194` ``(default): Add reference tree to vyos1x-config`` + + +2023-05-15 +========== + +* :vytask:`T3896` ``(feature): Extend ocserv support to allow for per-group configs`` + + +2023-05-12 +========== + +* :vytask:`T2778` ``(feature): Migrate "system syslog" to get_config_dict() to support new features`` +* :vytask:`T2769` ``(feature): Add VRF support for syslog`` + + +2023-05-10 +========== + +* :vytask:`T5209` ``(bug): dhclient load-balancing exit hook 04-dhcp-wanlb returned non-zero exit status`` +* :vytask:`T5065` ``(bug): Mixing `destination port xxx` and `destination group port-group yyy` in firewall rules doesn't work, but can be commited`` +* :vytask:`T5060` ``(feature): add a VRRP 'maintenance mode'`` + + +2023-05-09 +========== + +* :vytask:`T5202` ``(bug): After removal load-balancing a pid remained which used in dhclient-exit-hooks`` + + +2023-05-06 +========== + +* :vytask:`T5206` ``(bug): ethtool.py:Ethtool.__init__ has always true conditional due to typo`` + + +2023-05-05 +========== + +* :vytask:`T5082` ``(feature): container: switch to netavark network stack`` + + +2023-05-04 +========== + +* :vytask:`T5193` ``(feature): Ability to specify NS records to specify NS servers for subdomains`` +* :vytask:`T3891` ``(bug): X550-T2/Possibly other X550/X540 cards no link on VyOS`` +* :vytask:`T5010` ``(bug): bgp: EVPN route-target not honored`` +* :vytask:`T5196` ``(feature): wwan: op-mode should inform user if there is no WWAN interface`` + + +2023-05-03 +========== + +* :vytask:`T5163` ``(feature): Policy route-map add match source-protocol`` + + +2023-05-02 +========== + +* :vytask:`T5042` ``(bug): Command 'show vpn ipsec remote-access' does not work`` + + +2023-04-27 +========== + +* :vytask:`T5185` ``(bug): Static IPv6 route with blackhole fails`` +* :vytask:`T5175` ``(bug): http-api: error in MultiPart parser for FastAPI version >= 0.91.0`` +* :vytask:`T5183` ``(bug): IPv6 route6 problem`` +* :vytask:`T5181` ``(bug): Wrong dependencies or priorities for zebra vni vrf interfaces and bgpd`` +* :vytask:`T5128` ``(feature): Policy route - Allow wildcard interfaces`` +* :vytask:`T5055` ``(feature): Firewall - Add packet type matcher (pkttype)`` +* :vytask:`T5050` ``(feature): Firewall - Add options for logging packets`` +* :vytask:`T5037` ``(feature): Firewall - Add queue action`` +* :vytask:`T5176` ``(bug): http-api: update vyos-http-api-tools for FastAPI security vulnerability`` +* :vytask:`T5174` ``(bug): vrf: ensure no duplicate VNIs can be created`` +* :vytask:`T5123` ``(default): Display route originator in show ospf table command`` + + +2023-04-25 +========== + +* :vytask:`T5179` ``(bug): multi nodes defined in XML are not properly represented as list in get_config_dict()`` + + +2023-04-17 +========== + +* :vytask:`T5052` ``(bug): Error displaying dhcpv6 prefix delegation leases`` +* :vytask:`T5150` ``(feature): Rework CLI definitions to apply route-maps between routing daemons and zebra/kernel`` +* :vytask:`T3734` ``(bug): Move EVPN VRF up in FRR config`` + + +2023-04-13 +========== + +* :vytask:`T5152` ``(bug): Telegraf agent hostname isn't qualified`` +* :vytask:`T4727` ``(feature): Add RADIUS rate limit support to PPTP server`` +* :vytask:`T4939` ``(bug): VRRP command no-preempt not work as expected`` +* :vytask:`T4791` ``(default): Consistent normalization of 'raw' output of op-mode scripts for CLI and API`` +* :vytask:`T3608` ``(default): Standardize warnings from configure scripts`` + + +2023-04-11 +========== + +* :vytask:`T4924` ``(bug): Systemctl strongswan.service for some reason is not disabled`` +* :vytask:`T4197` ``(bug): Vyos arm64-latest build issue with telegraf pkg`` +* :vytask:`T4051` ``(bug): Connected routes strange / not working`` + + +2023-04-10 +========== + +* :vytask:`T5151` ``(bug): EAP-TLS TLSv1.0/1.1 regression after T5003`` +* :vytask:`T5148` ``(bug): OpenVPN cannot start due to could not load plugin shared object /openvpn-otp.so`` +* :vytask:`T5110` ``(bug): Show frr op-mode vtysh_pam: Failed in account validation`` +* :vytask:`T5078` ``(feature): VyOS BGP does not support 'show bgp neighbors $NB filtered-routes'`` +* :vytask:`T5070` ``(feature): show bgp nexthop unavailable in VRF`` +* :vytask:`T5061` ``(bug): All containers restart on config change`` + + +2023-04-07 +========== + +* :vytask:`T5149` ``(bug): op-mode openvpn should not raise error in case interface is disabled`` + + +2023-04-06 +========== + +* :vytask:`T5147` ``(bug): Can't Commit with Container Network`` +* :vytask:`T5142` ``(feature): One of the requirements is to use a system auditing tool to monitor and log all security-relevant events.`` +* :vytask:`T5125` ``(feature): Add op-mode commands for hsflowd based sflow`` + + +2023-04-05 +========== + +* :vytask:`T5145` ``(feature): Add maxsyslogins maximum number of all logins on system`` +* :vytask:`T5135` ``(default): Rewrite opennhrp script using vyos.ipsec library`` +* :vytask:`T4975` ``(bug): CLI does not work after cutting off the power or reset`` +* :vytask:`T5136` ``(bug): Possible config corruption on upgrade`` + + +2023-04-04 +========== + +* :vytask:`T5141` ``(feature): Add numbers for dhclient-exit-hooks.d to enforce script order execution`` +* :vytask:`T5093` ``(bug): Command 'reset vpn ipsec-profile' doesn't work`` +* :vytask:`T4362` ``(bug): Wan Load Balancing - Can't create routing tables`` + + +2023-04-03 +========== + +* :vytask:`T5139` ``(feature): IKE life-time should start from 0 for disable rekey`` +* :vytask:`T4173` ``(bug): Wan Load Balancing - Error on firewall NAT rules`` + + +2023-04-02 +========== + +* :vytask:`T5134` ``(feature): Try if netavark networks can be moved to a VRF instance`` + + +2023-04-01 +========== + +* :vytask:`T5047` ``(bug): Recreate only a specific container`` +* :vytask:`T5132` ``(default): Operational command "show isis vrf XXX route | neighbord" aren't working`` + + +2023-03-31 +========== + +* :vytask:`T5129` ``(feature): Add AWS build flavour`` +* :vytask:`T5126` ``(feature): http-api: add 'allow-client' to restrict IP address of client connections`` + + +2023-03-30 +========== + +* :vytask:`T5130` ``(bug): op-mode: drop remaining reference to obsoleted 'show_interfaces.py'`` +* :vytask:`T4866` ``(feature): Rewrite show_interfaces to standardized form`` +* :vytask:`T366` ``(bug): SNMP Query for BGP Tunnels Returns IPv4 Tunnels Only`` + + +2023-03-29 +========== + +* :vytask:`T5100` ``(feature): Update FRR to 8.5`` +* :vytask:`T5094` ``(bug): FRR systemd logs unknow key LimitNOFILESoft`` +* :vytask:`T5085` ``(bug): ospfv3 route-map not applied in FRR configuration`` +* :vytask:`T5056` ``(bug): IPoE server vlan-mon is not working`` +* :vytask:`T5033` ``(bug): generate-public-key command fails for address with multiple public keys like GitHub`` +* :vytask:`T4876` ``(bug): mpls - LSP broken on FRR 8.4.1`` +* :vytask:`T5097` ``(bug): the operational command "show interfaces ethernet ethx" doesn't reflect a call to 'clear counters'`` +* :vytask:`T5089` ``(enhancment): Add unit test of config_diff`` +* :vytask:`T5088` ``(enhancment): Add lexicographical-numeric compare function for vytree/configtree`` +* :vytask:`T5087` ``(enhancment): Add support for lexical ordering of nodes in config_tree`` +* :vytask:`T4885` ``(feature): Rewrite 'clear interfaces counters' from Perl to Python`` +* :vytask:`T4846` ``(bug): L3VPN- network command doesn't install direct connected prefix`` + + +2023-03-28 +========== + +* :vytask:`T5043` ``(feature): Need to create reset command for IKEv2 remote-access vpn connections`` + + +2023-03-27 +========== + +* :vytask:`T5099` ``(feature): IPoE server add option 'next-pool' for named ip pools`` +* :vytask:`T5106` ``(feature): Extend generation of API client requests to configsession native functions and composite requests`` +* :vytask:`T5104` ``(bug): DHCP default route issues with static routes in VRFs`` +* :vytask:`T5079` ``(feature): xml: schema extension to support defaultValues on tagNodes`` +* :vytask:`T5114` ``(feature): bgp: implement new CLI commands introduced in FRR 8.5`` + + +2023-03-23 +========== + +* :vytask:`T5108` ``(feature): Get rate limit for L2TP/PPTP/SSTP/IPoE in raw format`` +* :vytask:`T5086` ``(feature): Integrate hsflowd for sflow accounting`` +* :vytask:`T5107` ``(bug): Raise error in op-mode dns.py instead of calling exit`` + + +2023-03-22 +========== + +* :vytask:`T5068` ``(feature): Generate op-mode API client requests along with schema generation`` + + +2023-03-21 +========== + +* :vytask:`T5098` ``(feature): PPPoE client holdoff configuration`` +* :vytask:`T3694` ``(bug): Static routes not installed into kernel nor frr`` +* :vytask:`T5102` ``(feature): ospf: "redistribute babel" is always set`` + + +2023-03-20 +========== + +* :vytask:`T5057` ``(bug): IPoE server incorrect interface regex`` +* :vytask:`T5095` ``(feature): Return list instead of dict for 'raw' output of op-mode openvpn`` + + +2023-03-19 +========== + +* :vytask:`T4925` ``(feature): Need to add the possibility to configure Pseudo-Random Functions (PRF) in IKEv2`` + + +2023-03-17 +========== + +* :vytask:`T5092` ``(bug): IPoE-server named pool must not rely on the authentication type`` +* :vytask:`T5091` ``(bug): IPoE server with RADIUS authentication does not verify radius configuration`` + + +2023-03-16 +========== + +* :vytask:`T5073` ``(bug): IPoE-server interface option failed to parse`` +* :vytask:`T5063` ``(bug): IPoE-server ethX vlan must not be used with client-subnet`` +* :vytask:`T5058` ``(feature): Extend template filter range_to_regex`` +* :vytask:`T3083` ``(feature): Add feature event-handler`` +* :vytask:`T2516` ``(bug): vyos-container: cannot configure ethernet interface`` + + +2023-03-13 +========== + +* :vytask:`T5074` ``(bug): Show IPSEC SA failed if remote access IKEv2 vpn is used.`` +* :vytask:`T4973` ``(bug): show dhcp server leases error for lease time 4294967295`` + + +2023-03-11 +========== + +* :vytask:`T5076` ``(feature): CI/CD: Docker container is bloated by legacy and conflicting dependencies`` + + +2023-03-09 +========== + +* :vytask:`T5066` ``(bug): Different GRE tunnel but same tunnel keys error`` +* :vytask:`T4952` ``(feature): Improve interface completion helper CLI experience`` + + +2023-03-08 +========== + +* :vytask:`T4381` ``(default): OpenVPN: Add "Tunnel IP" column in "show openvpn server" operational command`` +* :vytask:`T4872` ``(bug): Op-mode show openvpn misses a case when parsing for tunnel IP`` + + +2023-03-07 +========== + +* :vytask:`T2838` ``(bug): Ethernet device names changing, multiple hw-id being added`` +* :vytask:`T5051` ``(feature): Use Literal types to provide op-mode CLI choices and API enums`` +* :vytask:`T4900` ``(default): Cache intermediary results of get_config_diff in Config instance`` + + +2023-03-05 +========== + +* :vytask:`T5040` ``(default): Generate API GraphQL schema on installation, rather than dynamically`` + + +2023-03-03 +========== + +* :vytask:`T4625` ``(enhancment): Update ocserv to current revision (1.1.6)`` + + +2023-03-02 +========== + +* :vytask:`T4967` ``(feature): Ability to set hostname for the container`` + + +2023-03-01 +========== + +* :vytask:`T5015` ``(bug): Invalid format character error at hfsc class settings help text`` + + +2023-02-28 +========== + +* :vytask:`T5029` ``(feature): Nginx change default root directory and fix regex`` +* :vytask:`T5025` ``(bug): Time-zone validation failed`` +* :vytask:`T4955` ``(bug): Openconnect radiusclient.conf generating with extra authserver`` +* :vytask:`T4843` ``(feature): Command-line arguments in container config`` +* :vytask:`T4219` ``(feature): support incoming-interface (iif) in local PBR`` +* :vytask:`T3903` ``(bug): Containers: after command "reboot" the host system will reboot after 1.5 minutes`` + + +2023-02-27 +========== + +* :vytask:`T5028` ``(feature): Add package exfatprogs to VyOS`` +* :vytask:`T4985` ``(bug): reset vpn ipsec-peer command with peer name does not work`` + + +2023-02-26 +========== + +* :vytask:`T4979` ``(feature): Add API request 'show_user_info' for UI`` + + +2023-02-25 +========== + +* :vytask:`T5008` ``(bug): MACsec CKN of 32 chars is not allowed in CLI, but works fine`` +* :vytask:`T5007` ``(bug): Interface multicast setting is invalid`` +* :vytask:`T5027` ``(bug): OpenVPN options and site-to-site cannot pass smoketest`` +* :vytask:`T4978` ``(bug): KeyError: 'memory' container_config['memory'] on upgrading to 1.4-rolling-202302041536`` +* :vytask:`T5034` ``(bug): Migrate multicast CLI node to valueLess`` +* :vytask:`T4948` ``(feature): pppoe: add CLI option to allow definition of host-uniq flag`` + + +2023-02-24 +========== + +* :vytask:`T5030` ``(bug): HTTPS-API delete key without id error`` + + +2023-02-23 +========== + +* :vytask:`T5013` ``(feature): Extend accelppp.py op-mode to get subnet start stop info from config`` +* :vytask:`T5002` ``(feature): Add uk (United Kingdom) keymap`` + + +2023-02-22 +========== + +* :vytask:`T5024` ``(bug): check-qemu-install VM is not shutdown the first time`` +* :vytask:`T5011` ``(bug): Some interface drivers don't support min_mtu and max_mtu and verify_mtu check should be skipped`` + + +2023-02-21 +========== + +* :vytask:`T5021` ``(bug): IPsec SA is closed before negotiating a new one or it is negotiated on every second if big life-time is set in swanctl.conf`` +* :vytask:`T5020` ``(feature): Extend openvpn.py op-mode to get a list of configured clients`` + + +2023-02-20 +========== + +* :vytask:`T5005` ``(feature): Skip user authentication for PPPoE Server with noauth option`` + + +2023-02-16 +========== + +* :vytask:`T4971` ``(feature): Radius attribute "Framed-Pool" for PPPoE`` + + +2023-02-15 +========== + +* :vytask:`T4991` ``(bug): Restore path level information to compare output`` + + +2023-02-14 +========== + +* :vytask:`T4968` ``(bug): VPN IPsec check dpd and close action for empty values`` +* :vytask:`T1993` ``(feature): Extended pppoe rate-limiter`` + + +2023-02-13 +========== + +* :vytask:`T4905` ``(feature): Convert show nhrp tunnel to tabulate format`` +* :vytask:`T4153` ``(bug): Monitor bandwidth-test initiate not working`` + + +2023-02-12 +========== + +* :vytask:`T4998` ``(bug): pppoe username validation too restrictive (regression)`` + + +2023-02-11 +========== + +* :vytask:`T2603` ``(feature): pppoe-server: reduce min MTU`` + + +2023-02-10 +========== + +* :vytask:`T4857` ``(feature): SNMP - Implement FRR SNMP recommendations`` +* :vytask:`T4995` ``(feature): pppoe, wwan and sstp-client - rename user -> username on authentication`` + + +2023-02-07 +========== + +* :vytask:`T4980` ``(bug): chrony not listening as a server`` +* :vytask:`T4868` ``(bug): L2TP ppp-options ipv6 does not work without ipv6 pool but should`` +* :vytask:`T4117` ``(bug): Does not possible to configure PoD/CoA for L2TP vpn`` + + +2023-02-01 +========== + +* :vytask:`T4970` ``(default): pin OCaml pcre package to avoid JIT support`` + + +2023-01-31 +========== + +* :vytask:`T4964` ``(bug): FRR bgp address-family l2vpn-evpn route-target export/import not working`` +* :vytask:`T4780` ``(feature): Firewall - Add interface group`` +* :vytask:`T4157` ``(default): Add jinja2 to pip test requirements`` + + +2023-01-30 +========== + +* :vytask:`T4958` ``(feature): Add OpenConnect RADIUS Accounting support`` +* :vytask:`T4954` ``(bug): DNS cannot be configured via Network-Config v1 received from ConfigDrive / Cloud-Init`` +* :vytask:`T4118` ``(default): IPsec syntax overhaul`` + + +2023-01-29 +========== + +* :vytask:`T4965` ``(default): empty description in firewall group causes configuration error on migration`` + + +2023-01-28 +========== + +* :vytask:`T4961` ``(bug): Uncaught configtree error allows ntp migration 1-to-2 to fail silentlly on config.boot.default`` + + +2023-01-27 +========== + +* :vytask:`T4960` ``(bug): Bugs in `cc_vyos.py` code (Cloud-Init)`` + + +2023-01-26 +========== + +* :vytask:`T4886` ``(feature): Firewall and Policy - Add connection mark`` +* :vytask:`T4957` ``(bug): config-mgmt should not attempt to archive config at boot`` +* :vytask:`T4962` ``(bug): Fix typo in regex in vyos.config_mgmt compare function`` +* :vytask:`T4912` ``(default): Rewrite the IGMP op mode in the new style`` + + +2023-01-25 +========== + +* :vytask:`T4941` ``(bug): Accel-ppp IPoE incompatibility with kernel 6.1`` + + +2023-01-24 +========== + +* :vytask:`T4947` ``(feature): Support mounting container volumes as ro or rw`` + + +2023-01-23 +========== + +* :vytask:`T4798` ``(default): Migrate the file-exists validator away from Python`` +* :vytask:`T4683` ``(enhancment): Add kitty-terminfo package to build`` +* :vytask:`T4953` ``(bug): Remove convert_kwargs_to_snake_case decorator in dynamic generation of GraphQL resolvers`` +* :vytask:`T4875` ``(default): Replace Python validator 'interface-name' to avoid Python startup cost`` +* :vytask:`T4664` ``(bug): Add validation to reject whitespace in tag node value names`` + + +2023-01-22 +========== + +* :vytask:`T4906` ``(bug): ipsec connections shows only one connection as up`` + + +2023-01-21 +========== + +* :vytask:`T4799` ``(bug): PowerDNS >= 4.7 does not get reloaded by vyos-hostsd`` +* :vytask:`T4878` ``(bug): Any interface bonding changes cause interface flapping`` +* :vytask:`T4387` ``(default): Create additional smoketests for multiwan PBR & load-balanced configurations`` + + +2023-01-20 +========== + +* :vytask:`T4551` ``(bug): IPsec rekeying collisions bug`` +* :vytask:`T4942` ``(feature): Rewrite vyatta-config-mgmt to Python/XML`` + + +2023-01-17 +========== + +* :vytask:`T4938` ``(bug): Interface input ifb does not work`` +* :vytask:`T4902` ``(bug): snmpd: exclude container storage from monitoring`` +* :vytask:`T4140` ``(bug): Lack of SNMP IANA mibs`` + + +2023-01-15 +========== + +* :vytask:`T4832` ``(feature): dhcp: Add IPv6-only dhcp option support (RFC 8925)`` +* :vytask:`T4937` ``(feature): ocserv: upgrade package to version 1.1.6`` +* :vytask:`T4918` ``(bug): Odd show interface behavior`` +* :vytask:`T3008` ``(feature): Migrate from ntpd to chronyd`` + + +2023-01-13 +========== + +* :vytask:`T4911` ``(default): Rewrite the LLDP op mode in the new format`` +* :vytask:`T4928` ``(feature): Upgrade Linux Kernel to 6.1.y (2022 LTS edition)`` + + +2023-01-12 +========== + +* :vytask:`T4934` ``(bug): ospf: Fix inter-area route summarization`` +* :vytask:`T4929` ``(feature): Update Intel QAT drivers to 4.20.0-00001`` + + +2023-01-10 +========== + +* :vytask:`T4880` ``(feature): Expose 'add/delete container image' in HTTP-API`` + + +2023-01-09 +========== + +* :vytask:`T4922` ``(feature): Add ssh-client source-interface CLI option`` +* :vytask:`T4524` ``(bug): Squid webproxy not working properly`` + + +2023-01-08 +========== + +* :vytask:`T4920` ``(bug): ospf: Fix `passive-interface default` option`` + + +2023-01-07 +========== + +* :vytask:`T4884` ``(bug): Missing a community6 in snmpd config`` + + +2023-01-05 +========== + +* :vytask:`T4904` ``(feature): Allow multiple ports for high-availability virtual-server`` +* :vytask:`T4789` ``(feature): Ability to get L2TP/PPTP/SSTP sessions info in a machine readable format`` +* :vytask:`T3937` ``(default): Rewrite "show system memory" in Python to make it usable as a library function`` + + +2023-01-04 +========== + +* :vytask:`T4848` ``(bug): Minor bug in OpenConnect server with default route`` +* :vytask:`T4656` ``(feature): Support the listen-host config field of openconnect server`` + + +2023-01-03 +========== + +* :vytask:`T4907` ``(bug): nat source translations couldn't show metrics`` + + +2023-01-02 +========== + +* :vytask:`T4893` ``(feature): l2tp add ppp-options IPv6 interface identifier`` +* :vytask:`T4717` ``(feature): Connect to console server by name`` +* :vytask:`T725` ``(feature): Cake and FQ-PIE`` + + +2022-12-31 +========== + +* :vytask:`T4898` ``(feature): Add mtu config option for dummy interfaces`` + + +2022-12-30 +========== + +* :vytask:`T4834` ``(bug): Limit container network name to 15 characters`` +* :vytask:`T4901` ``(bug): Update Podman to v4.3.1`` +* :vytask:`T4899` ``(bug): Podman systemd services not being installed correctly`` + + +2022-12-28 +========== + +* :vytask:`T4593` ``(feature): Upgrade strongswan to 5.9.8`` + + +2022-12-26 +========== + +* :vytask:`T4511` ``(bug): IPv6 DNS lookup`` +* :vytask:`T4809` ``(feature): radvd: Allow use of AdvRASrcAddress`` + + +2022-12-25 +========== + +* :vytask:`T3579` ``(feature): Rewrite vyatta-conntrack in new XML and Python flavour`` + + +2022-12-24 +========== + +* :vytask:`T4890` ``(bug): show conntrack table ipv4 fail`` +* :vytask:`T4879` ``(bug): IPSec migration failed with missing remote-id`` +* :vytask:`T4870` ``(feature): Containers switch to using overlay driver for podman storage`` + + +2022-12-23 +========== + +* :vytask:`T4792` ``(feature): Add SSTP VPN client`` + + +2022-12-21 +========== + +* :vytask:`T4887` ``(bug): Schema generation from op-mode functions should set default 'false' on boolean arguments`` + + +2022-12-18 +========== + +* :vytask:`T4882` ``(bug): Missing ICMPv6 type names in firewall configuration`` + + +2022-12-15 +========== + +* :vytask:`T4671` ``(bug): linux-firmware package is missing symlinks defined in WHENCE file`` + + +2022-12-14 +========== + +* :vytask:`T4881` ``(bug): Return opmode.Error on openconnect.py show_sessions`` + + +2022-12-12 +========== + +* :vytask:`T4861` ``(feature): Openconnect restart on adding users - Aborts all active connections`` + + +2022-12-09 +========== + +* :vytask:`T4865` ``(bug): container impossible to generate local image from a file if it requires install some pkgs`` + + +2022-12-05 +========== + +* :vytask:`T4860` ``(bug): Openconnect server incorrect unconfigured check`` +* :vytask:`T4804` ``(bug): PPPoE server incorrect unconfigured check`` +* :vytask:`T4854` ``(feature): BGP-route reflector allows to apply route-maps`` + + +2022-12-04 +========== + +* :vytask:`T4825` ``(feature): interfaces veth/veth-pairs -standalone used`` +* :vytask:`T4805` ``(bug): PPPoE server does not restart service if pool was changed`` + + +2022-12-02 +========== + +* :vytask:`T4830` ``(bug): nat66 - Error in port translation rules`` +* :vytask:`T4859` ``(bug): Correct calling of config mode script dependencies from http-api.py`` +* :vytask:`T4820` ``(enhancment): Support for inter-config-mode script dependencies`` +* :vytask:`T4858` ``(bug): L3VPN- Route Distinguisher notations`` +* :vytask:`T1024` ``(feature): Policy Based Routing by DSCP`` + + +2022-12-01 +========== + +* :vytask:`T4841` ``(feature): add fan control`` +* :vytask:`T4847` ``(bug): Correct calling of config mode script dependencies from pki.py`` + + +2022-11-29 +========== + +* :vytask:`T4842` ``(bug): Routing config broken if mpls config exists`` +* :vytask:`T4845` ``(default): Add smoketest to detect cycles in config-mode script dependency calls`` + + +2022-11-27 +========== + +* :vytask:`T4739` ``(feature): ISIS and OSPF segment routing being refactored`` + + +2022-11-24 +========== + +* :vytask:`T4794` ``(bug): show firewall name - Can't use .items() on a list`` +* :vytask:`T4714` ``(feature): Delete unused ipset from the filecaps`` +* :vytask:`T3541` ``(bug): Route Map large community set additive is missing`` + + +2022-11-23 +========== + +* :vytask:`T4836` ``(feature): Kernel: enable new features like switchdev, ESP in TCP and HSR`` +* :vytask:`T4835` ``(bug): SNMPD configuration incorrect for IPv6`` +* :vytask:`T4819` ``(feature): Allow printing Warning messages in multiple lines with \n`` +* :vytask:`T4807` ``(feature): Need to fix traceroute help completion`` +* :vytask:`T4660` ``(feature): Reorganize route map set community CLI`` +* :vytask:`T4526` ``(bug): keepalived-fifo.py unable to load config`` +* :vytask:`T4793` ``(feature): Create warning message about disable-route-autoinstall when ipsec vti is used`` +* :vytask:`T4492` ``(bug): Incorrect list of neighbors in help for "show bgp vrf VRF neighbors"`` +* :vytask:`T4496` ``(feature): ping vrf help does not list VRFs`` + + +2022-11-22 +========== + +* :vytask:`T4823` ``(bug): swanctl.conf is broken when ipsec site-to-site peer set.`` +* :vytask:`T4706` ``(bug): NAT and NAT66 issues`` +* :vytask:`T4670` ``(feature): policy route - Update matching criteria`` + + +2022-11-21 +========== + +* :vytask:`T4812` ``(feature): IPsec ability to show all configured connections`` +* :vytask:`T4829` ``(default): Tunnel argument to 'reset_peer' in ipsec.py should have type hint Optional`` + + +2022-11-20 +========== + +* :vytask:`T4827` ``(bug): route-map issues , not load configuration FRR`` + + +2022-11-19 +========== + +* :vytask:`T4826` ``(bug): Wrong key type is used for SSH SK public keys`` +* :vytask:`T4720` ``(feature): Ability to configure SSH HostKeyAlgorithms`` +* :vytask:`T4828` ``(default): Raise appropriate op-mode errors in ipsec.py 'reset_peer'`` + + +2022-11-18 +========== + +* :vytask:`T4821` ``(bug): Correct calling of config mode script dependencies from firewall.py`` + + +2022-11-17 +========== + +* :vytask:`T4750` ``(feature): Support of higher level SSH keys (sk-ssh-ed25519)`` + + +2022-11-15 +========== + +* :vytask:`T4808` ``(feature): Add details of configtree operations to migration log`` + + +2022-11-12 +========== + +* :vytask:`T4814` ``(bug): Regression in bundled powerdns version`` + + +2022-11-09 +========== + +* :vytask:`T4800` ``(bug): undefined var includes_chroot_dir in build-vyos-image`` + + +2022-11-08 +========== + +* :vytask:`T4771` ``(feature): Rewrite protocol BGP op-mode to vyos.opmode format`` +* :vytask:`T4806` ``(default): Update FRR to 8.4 in 1.4 version`` + + +2022-11-06 +========== + +* :vytask:`T4803` ``(bug): The header 'Authorization' needs to be explictly allowed in http-api CORS middleware`` + + +2022-11-05 +========== + +* :vytask:`T4802` ``(feature): Ability to define per container shared-memory size`` + + +2022-11-01 +========== + +* :vytask:`T4764` ``(bug): NAT tables vyos_nat and vyos_static_nat not deleting after deleting nat`` +* :vytask:`T4177` ``(bug): Strip-private doesn't work for service monitoring`` + + +2022-10-31 +========== + +* :vytask:`T4786` ``(feature): Add package python3-pyhumps`` +* :vytask:`T1875` ``(feature): Add the ability to use network address as BGP neighbor (bgp listen range)`` +* :vytask:`T4785` ``(feature): snmp: Allow !, @, * and # in community name`` +* :vytask:`T4787` ``(feature): ipsec: add support for road-warrior/remote-access RADIUS timeout`` + + +2022-10-29 +========== + +* :vytask:`T4783` ``(default): Add support for stunnel`` +* :vytask:`T4784` ``(feature): Add description node for static route/route6 tagNodes`` + + +2022-10-28 +========== + +* :vytask:`T4291` ``(default): Consolidate component version read/write functions`` + + +2022-10-27 +========== + +* :vytask:`T4763` ``(feature): Change XML for Show nat destination statistics`` +* :vytask:`T4762` ``(bug): Show nat rules with empty rules incorrect error`` +* :vytask:`T4778` ``(bug): Raise error UnconfiguredSubsystem if op-mode ipsec.py fails initialization`` + + +2022-10-26 +========== + +* :vytask:`T4773` ``(default): Add camel_case to snake_case conversion utility`` + + +2022-10-25 +========== + +* :vytask:`T4574` ``(default): Add token based authentication to GraphQL API`` + + +2022-10-24 +========== + +* :vytask:`T4772` ``(default): Return list of dicts in 'raw' output of route.py instead of dict with redundant information`` + + +2022-10-23 +========== + +* :vytask:`T3723` ``(bug): op-mode IPSec show vpn ipsec sa output with underscores`` + + +2022-10-21 +========== + +* :vytask:`T4768` ``(default): Change name of api child node from 'gql' to 'graphql'`` + + +2022-10-18 +========== + +* :vytask:`T4684` ``(feature): Rewrite show ip route by protocol to vyos.opmode format`` +* :vytask:`T4533` ``(bug): Radius clients don’t have simple permissions`` +* :vytask:`T4753` ``(enhancment): Extend automatic generation of schema to query SystemStatus`` + + +2022-10-17 +========== + +* :vytask:`T4725` ``(bug): Unable to reset vpn IPsec peer`` + + +2022-10-14 +========== + +* :vytask:`T4672` ``(bug): RADIUS server disable does not work`` +* :vytask:`T4749` ``(enhancment): Use config_dict for conf_mode http-api.py`` + + +2022-10-13 +========== + +* :vytask:`T4746` ``(bug): Monitoring nft. table vyos_filter by default does not exist but telegraf checks this table`` +* :vytask:`T4744` ``(bug): BGP directly connected neighbors don't compatible with ebgp-multihop`` +* :vytask:`T4716` ``(feature): SSH ability to configure RekeyLimit`` +* :vytask:`T4343` ``(default): Expose powerdns network-timeout for service dns forwarding`` +* :vytask:`T4312` ``(bug): Telegraf configuration doesn't accept IPs for URL`` +* :vytask:`T4274` ``(default): Extend OpenConnect RADIUS Timeout to Permit 2FA Entry`` + + +2022-10-12 +========== + +* :vytask:`T4747` ``(bug): Monitoring influxdb template input exec plugin does not work`` +* :vytask:`T4740` ``(bug): Show conntrack table ipv6 fail`` +* :vytask:`T4730` ``(bug): Conntrack-sync error - listen-address is not the correct type in config as it should be`` + + +2022-10-11 +========== + +* :vytask:`T4742` ``(bug): Autocomplete in policy route rule x set table / does not show the tables created in the static protocols`` +* :vytask:`T4741` ``(bug): set firewall zone Local local-zone failed`` +* :vytask:`T4680` ``(bug): Telegraf prometheus-client listen-address invalid format`` + + +2022-10-10 +========== + +* :vytask:`T538` ``(feature): Support for network mapping in NAT`` + + +2022-10-09 +========== + +* :vytask:`T4738` ``(enhancment): Extend automatic generation of schema definition files to native configsession functions; use single resolver/directive`` + + +2022-10-08 +========== + +* :vytask:`T4707` ``(feature): Enable OSPF segment routing`` + + +2022-10-07 +========== + +* :vytask:`T4736` ``(bug): Error on JSON output of API query ShowConfig`` + + +2022-10-04 +========== + +* :vytask:`T4708` ``(bug): 'show nat destination rules' throwing an error`` +* :vytask:`T4700` ``(feature): Firewall - Add interface match criteria`` +* :vytask:`T4699` ``(feature): Firewall - Add jump action - Add return action`` +* :vytask:`T4651` ``(feature): Firewall - Add options to match packet size`` +* :vytask:`T4702` ``(bug): Wireguard peers configuration is not synchronized with CLI`` +* :vytask:`T4685` ``(bug): Interface does not exist on boot when used as inbound-interface for local policy route`` +* :vytask:`T4652` ``(feature): Upgrade PowerDNS recursor to 4.7 series`` +* :vytask:`T4582` ``(default): Router-advert: Preferred lifetime cannot equal valid lifetime in PIOs`` + + +2022-09-29 +========== + +* :vytask:`T4715` ``(feature): Auto logout user after a period of inactivity`` +* :vytask:`T4697` ``(bug): policy route: Generating ConfigError failes when tcp flag is missing on set tcp-mss rule commit`` + + +2022-09-27 +========== + +* :vytask:`T4711` ``(feature): Ability to terminate user TTY and PTS sessions`` +* :vytask:`T4557` ``(feature): fastnetmon: allow configure limits per protocol (tcp, udp, icmp)`` + + +2022-09-21 +========== + +* :vytask:`T4678` ``(feature): Rewrite service ipoe-server to get_config_dict`` +* :vytask:`T4703` ``(feature): accel-ppp: combine vlan-id and vlan-range into single CLI node`` + + +2022-09-20 +========== + +* :vytask:`T4693` ``(bug): ISIS segment routing was broken...`` + + +2022-09-17 +========== + +* :vytask:`T4666` ``(bug): EAP-TLS no longer allows TLSv1.0 after T4537, T4584`` +* :vytask:`T4665` ``(bug): Keepalived cannot use same VRID for VRRPv2 and VRRPv3`` + + +2022-09-16 +========== + +* :vytask:`T4698` ``(enhancment): Drop validator name="range" and replace it with numeric`` +* :vytask:`T4695` ``(feature): Add 'es' and 'jp106' keymap option keyboard-layout`` +* :vytask:`T4669` ``(enhancment): Extend numeric.ml for inversion of values and range values`` + + +2022-09-15 +========== + +* :vytask:`T4679` ``(bug): OpenVPN site-to-site incorrect check for IPv6 local and remote address`` +* :vytask:`T4691` ``(feature): Upgrade Linux Kernel to latest 5.15.y train`` +* :vytask:`T4630` ``(bug): Prevent attempts to use the same interface as a source interface for pseudo-ethernet and MACsec at the same time`` +* :vytask:`T4696` ``(default): Extend bgp parameters for bgp bestpath peer-type multipath-relax`` + + +2022-09-12 +========== + +* :vytask:`T4617` ``(feature): VRF specification is needed for telegraf prometheus-client listen-address
`` +* :vytask:`T4690` ``(bug): Update GraphQL resolver for 'SystemStatus' following changes to 'show_uptime' op-mode script`` +* :vytask:`T4647` ``(feature): Add Google Virtual NIC (gVNIC) support`` +* :vytask:`T4170` ``(feature): Rename "policy ipv6-route" -> "policy route6"`` + + +2022-09-09 +========== + +* :vytask:`T4682` ``(feature): Rewrite 'show system storage' in standardized format`` +* :vytask:`T4681` ``(feature): Complete standardization of show_uptime.py`` + + +2022-09-06 +========== + +* :vytask:`T4640` ``(enhancment): Integrate op-mode exception hierarchy into API`` +* :vytask:`T4597` ``(bug): Check bind port before assign service HTTPS API and openconnect`` +* :vytask:`T4674` ``(bug): API should show op-mode error message, if present`` +* :vytask:`T4673` ``(bug): op-mode bridge.py should raise error on show_fdb for nonexistent bridge interface`` + + +2022-09-05 +========== + +* :vytask:`T4668` ``(bug): Adding/removing members from bond doesn't work/results in incorrect interface state`` +* :vytask:`T4663` ``(bug): Interface pseudo-ethernet does not change mode`` +* :vytask:`T4655` ``(bug): Firewall in 1.4 sets the default action 'accept' instead of 'drop'`` +* :vytask:`T4628` ``(bug): ConfigTree() throws ValueError() if tagNode contains whitespaces`` + + +2022-09-01 +========== + +* :vytask:`T4606` ``(bug): monitor nat destination translation shows missing script`` +* :vytask:`T4435` ``(bug): Policy route and firewall - error when using undefined group`` +* :vytask:`T4147` ``(bug): New Firewall Implementation - proposed changes on group implementation`` + + +2022-08-31 +========== + +* :vytask:`T4650` ``(feature): Rewire show nat translation to vyos.opmode format`` +* :vytask:`T4644` ``(bug): Check bind port before assign vpn sstp`` +* :vytask:`T4643` ``(bug): Smoketest exclude either sstp or openconnect from pki-misc default listen port`` +* :vytask:`T4569` ``(feature): Rewrite show bridge to new format`` +* :vytask:`T4547` ``(bug): Show vpn ipsec sa show unexpected prefix 'B' in packets`` +* :vytask:`T4367` ``(bug): NAT - Config tmp file not available`` + + +2022-08-29 +========== + +* :vytask:`T4645` ``(bug): show nat source statistics lack argument --family`` +* :vytask:`T4634` ``(bug): Bgp neighbor disable-connected-check does not work`` +* :vytask:`T4631` ``(feature): Add port and protocol to nat66`` +* :vytask:`T4623` ``(feature): Add show conntrack statistics`` +* :vytask:`T4595` ``(bug): DPD interval and timeout do not work in DMVPN`` +* :vytask:`T4594` ``(feature): Rewrite op-mode IPsec to vyos.opmode format`` +* :vytask:`T4508` ``(bug): Problem with values of the same environment in different event handlers`` +* :vytask:`T4653` ``(bug): Interface offload options are not applied correctly`` +* :vytask:`T4546` ``(bug): Does not connect Cisco spoke to VyOS hub.`` +* :vytask:`T4061` ``(default): Add util function to check for completion of boot config`` +* :vytask:`T4654` ``(bug): RPKI cache incorrect description`` +* :vytask:`T4572` ``(bug): Add an option to force interface MTU to the value received from DHCP`` + + +2022-08-26 +========== + +* :vytask:`T4642` ``(bug): proxy: hyphen not allowed in proxy URL`` + + +2022-08-25 +========== + +* :vytask:`T4626` ``(bug): Error showing nat66 source and destination`` +* :vytask:`T4622` ``(feature): Firewall allow drop packets by TCP MSS size`` + + +2022-08-24 +========== + +* :vytask:`T4641` ``(bug): prefix-list allows ipv6 prefix as input`` +* :vytask:`T4633` ``(feature): Change keepalived to v2.2.7`` + + +2022-08-23 +========== + +* :vytask:`T4618` ``(bug): Traffic policy not set on virtual interfaces`` +* :vytask:`T4538` ``(bug): Macsec does not work correctly when the interface status changes.`` + + +2022-08-22 +========== + +* :vytask:`T4089` ``(bug): Show nat destination rules shows ip address instead of interface 'any'`` +* :vytask:`T4632` ``(bug): VLAN-aware bridge not working`` +* :vytask:`T4637` ``(feature): Upgrade to podman 4.2.0`` + + +2022-08-20 +========== + +* :vytask:`T4596` ``(bug): "show openconnect-server sessions" command does not work in the openconnect module`` + + +2022-08-19 +========== + +* :vytask:`T4620` ``(bug): UPnP does not work due to incorrect template`` +* :vytask:`T4619` ``(bug): Static arp is not set if another entry is present`` +* :vytask:`T4611` ``(bug): UPnP rule IP should be a prefix instead of an address`` +* :vytask:`T4614` ``(feature): OpenConnect split-dns directive`` + + +2022-08-18 +========== + +* :vytask:`T4613` ``(bug): UPnP configuration without listen option fail`` +* :vytask:`T4570` ``(bug): Exception when trying to set up VXLAN over Wireguard`` + + +2022-08-17 +========== + +* :vytask:`T4598` ``(feature): nat66 - Add exclude options`` +* :vytask:`T4480` ``(default): add an ability to configure squid acl safe ports and acl ssl safe ports`` + + +2022-08-16 +========== + +* :vytask:`T4592` ``(bug): macsec: can not create two interfaces using the same source-interface`` +* :vytask:`T4584` ``(bug): hostap: create custom package build`` +* :vytask:`T4413` ``(default): Add an API endpoint with basic system stats`` +* :vytask:`T4537` ``(bug): MACsec not working with cipher gcm-aes-256`` + + +2022-08-15 +========== + +* :vytask:`T4609` ``(bug): Unable to Restart Container VyOS 1.4`` +* :vytask:`T4565` ``(bug): vlan aware bridge not working with - Kernel: T3318: update Linux Kernel to v5.4.205 #249`` +* :vytask:`T3988` ``(default): Feature Request: IPsec Multiple local/remote prefix for the tunnel`` +* :vytask:`T2763` ``(feature): New SNMP resource request - SNMP over TCP`` + + +2022-08-14 +========== + +* :vytask:`T4579` ``(bug): bridge: can not delete member interface CLI option when VLAN is enabled`` +* :vytask:`T4421` ``(default): Add support for floating point numbers in the numeric validator`` +* :vytask:`T3507` ``(bug): Bond with mode LACP show u/u in show interfaces even if peer is not configured`` + + +2022-08-12 +========== + +* :vytask:`T4603` ``(feature): Need a config option to specify NAS-IP-Address for vpn l2tp`` + + +2022-08-10 +========== + +* :vytask:`T4408` ``(feature): Add sshguard to protect against brut-forces`` + + +2022-08-08 +========== + +* :vytask:`T4586` ``(feature): Add to NAT66: SNAT destination address and DNAT source address.`` + + +2022-08-04 +========== + +* :vytask:`T4257` ``(feature): Discussion on changing BGP autonomous system number syntax`` + + +2022-08-02 +========== + +* :vytask:`T4585` ``(feature): Rewrite op-mode containers to vyos.opmode`` +* :vytask:`T4515` ``(default): Reduce telegraf binary size`` + + +2022-08-01 +========== + +* :vytask:`T4581` ``(bug): 'show system cpu' not working`` +* :vytask:`T4578` ``(feature): Rewrite show dns forwarding statistics to new format`` + + +2022-07-31 +========== + +* :vytask:`T4580` ``(bug): Handle the case of op-mode file names with hyphens in GraphQL schema/resolver generation`` + + +2022-07-30 +========== + +* :vytask:`T4575` ``(feature): vyos.utill add new wrapper "rc_cmd" to get the return code and output`` +* :vytask:`T4562` ``(feature): Rewrite show vrf to new format`` +* :vytask:`T4545` ``(feature): Rewrite show nat source rules`` +* :vytask:`T4543` ``(bug): Show source nat statistics shows incorrect interface`` +* :vytask:`T4503` ``(default): Prevent op mode scripts from restarting services if there's a commit in progress`` +* :vytask:`T4411` ``(feature): Add migration for service monitoring telegraf influxdb`` + + +2022-07-29 +========== + +* :vytask:`T4554` ``(enhancment): Implement GraphQL resolvers for standardized op-mode scripts`` +* :vytask:`T4518` ``(feature): Add XML for CLI conf mode load-balancing wan`` +* :vytask:`T4544` ``(enhancment): Generate schema definitions from standardized op-mode scripts`` + + +2022-07-28 +========== + +* :vytask:`T4531` ``(bug): NAT op-mode errors with exclude rules`` +* :vytask:`T3435` ``(bug): NAT rules show corruption`` + + +2022-07-27 +========== + +* :vytask:`T4571` ``(bug): Sflow with vrf configured does not use vrf to validate agent-address IP from vrf-configured interfaces`` +* :vytask:`T4552` ``(bug): Unable to reset IPsec IPv6 peer`` + + +2022-07-26 +========== + +* :vytask:`T4568` ``(bug): show vpn debug peer doesn't work`` +* :vytask:`T4556` ``(feature): fastnetmon: Allow configure white_list_path and populate with hosts/networks that should be ignored.`` +* :vytask:`T4495` ``(feature): Combine BGP reset op commands`` + + +2022-07-25 +========== + +* :vytask:`T4567` ``(default): Merge experimental branch of GraphQL development`` +* :vytask:`T4560` ``(bug): VRF and BGP neighbor local-as error`` +* :vytask:`T4493` ``(bug): Incorrect help for "show bgp neighbors"`` +* :vytask:`T1233` ``(bug): ipsec vpn sa showing down`` + + +2022-07-22 +========== + +* :vytask:`T4145` ``(bug): Conntrack table not showing after firewall rewriting`` + + +2022-07-21 +========== + +* :vytask:`T4555` ``(feature): fastnetmon: add IPv6 support`` +* :vytask:`T4553` ``(default): Allow to set ban time on ddos-protection configuration`` + + +2022-07-20 +========== + +* :vytask:`T4056` ``(bug): Traffic policy not set in live configuration`` + + +2022-07-18 +========== + +* :vytask:`T4523` ``(feature): OP-mode Extend conntrack output to get marks, zones and directions`` +* :vytask:`T4228` ``(bug): bond: OS error thrown when two bonds use the same member`` +* :vytask:`T4539` ``(feature): qat: update Intel QuickAssist release version 1.7.L.4.16.0-00017`` +* :vytask:`T4534` ``(bug): bond: bridge: error out if member interface is assigned to a VRF instance`` +* :vytask:`T4525` ``(bug): Delete interface from VRF and add it to bonding error`` +* :vytask:`T4522` ``(feature): bond: add ability to specify mii monitor interval via CLI`` +* :vytask:`T4535` ``(feature): FRR: upgrade to stable/8.3 version`` +* :vytask:`T4521` ``(bug): bond: ARP monitor interval is not configured despite set via CLI`` +* :vytask:`T4540` ``(feature): firmware: update to Linux release 20220708`` + + +2022-07-17 +========== + +* :vytask:`T4028` ``(bug): FRR 8.1 routes not being applied to routing table after reboot if an interface has 2 ip addresses`` + + +2022-07-15 +========== + +* :vytask:`T4494` ``(bug): Cannot reset BGP peer within VRF`` +* :vytask:`T4536` ``(feature): FRR: move to systemd for daemon control`` + + +2022-07-14 +========== + +* :vytask:`T4491` ``(bug): Use empty string for internal name of root node of config_tree`` + + +2022-07-13 +========== + +* :vytask:`T1375` ``(feature): Add clear dhcp server lease function`` + + +2022-07-12 +========== + +* :vytask:`T4527` ``(bug): Prevent to create VRF name default`` +* :vytask:`T4084` ``(default): Dehardcode the default login banner`` +* :vytask:`T3948` ``(feature): IPSec VPN: Add a new option "none" for the connection-type`` +* :vytask:`T235` ``(feature): Ability to configure manual IP Rules`` + + +2022-07-10 +========== + +* :vytask:`T3836` ``(bug): Setting a default IPv6 route while getting IPv4 gateway via DHCP removes the IPv4 gateway`` + + +2022-07-09 +========== + +* :vytask:`T4507` ``(feature): IPoE-server add multiplier option for shaper`` +* :vytask:`T4499` ``(bug): NAT source translation not showing a single output`` +* :vytask:`T4468` ``(bug): web-proxy source group cannot start with a number bug`` +* :vytask:`T4373` ``(feature): PPPoE-server add multiplier option for shaper`` +* :vytask:`T3353` ``(bug): PPPoE server wrong vlan-range generating config`` +* :vytask:`T3648` ``(bug): op-mode: nat rules broken`` +* :vytask:`T4517` ``(feature): ip: Add options to enable directed broadcast forwarding`` + + +2022-07-07 +========== + +* :vytask:`T4456` ``(bug): NTP client in VRF tries to bind to interfaces outside VRF, logs many messages`` +* :vytask:`T4509` ``(feature): Feature Request: DNS64`` + + +2022-07-06 +========== + +* :vytask:`T4513` ``(bug): Webproxy monitor commands do not work`` +* :vytask:`T4299` ``(feature): Firewall - GeoIP filtering`` + + +2022-07-05 +========== + +* :vytask:`T4378` ``(bug): Unable to submit wildcard ("*.example.com") A or AAAA records in dns forwarder`` +* :vytask:`T2683` ``(default): no dual stack in system static-host-mapping host-name`` +* :vytask:`T478` ``(feature): Firewall address group (multi and nesting)`` + + +2022-07-04 +========== + +* :vytask:`T4501` ``(bug): Syslog-identifier does not work in event handler`` +* :vytask:`T3600` ``(bug): DHCP Interface static route breaks PBR`` +* :vytask:`T4498` ``(feature): bridge: Add option to enable/disable IGMP/MLD snooping`` + + +2022-07-01 +========== + +* :vytask:`T2455` ``(bug): No support for the IPv6 VTI`` +* :vytask:`T4490` ``(feature): BGP- warning message that AFI/SAFI is needed to establish the neighborship`` +* :vytask:`T4489` ``(bug): MPLS sysctl not persistent for tunnel interfaces`` + + +2022-06-29 +========== + +* :vytask:`T4477` ``(feature): router-advert: support RDNSS lifetime option`` + + +2022-06-28 +========== + +* :vytask:`T4486` ``(bug): Container can't be deleted`` +* :vytask:`T4473` ``(bug): Use container network without network declaration error`` +* :vytask:`T4458` ``(feature): Firewall - add support for matching ip ttl in firewall rules`` +* :vytask:`T3907` ``(feature): Firewall - Set log levels`` + + +2022-06-27 +========== + +* :vytask:`T4484` ``(default): Firewall op-mode summary doesn't correctly handle address group containing ranges`` + + +2022-06-25 +========== + +* :vytask:`T4482` ``(bug): dhcp: toggle of "dhcp-options no-default-route" has no effect`` +* :vytask:`T4483` ``(feature): Upgrade fastnetmon to v1.2.2 community edition`` + + +2022-06-22 +========== + +* :vytask:`T1748` ``(feature): vbash: beautify tab completion output/line breaks`` + + +2022-06-20 +========== + +* :vytask:`T1856` ``(feature): Support configuring IPSec SA bytes`` + + +2022-06-18 +========== + +* :vytask:`T4467` ``(bug): Validator Does Not Accept Signed Numbers`` + + +2022-06-17 +========== + +* :vytask:`T4209` ``(bug): Firewall incorrect handler for recent count and time`` + + +2022-06-16 +========== + +* :vytask:`T4352` ``(bug): wan-load balance - priority traffic rule doesn't work`` + + +2022-06-15 +========== + +* :vytask:`T4450` ``(feature): Route-map - Extend options for ip|ipv6 address match`` +* :vytask:`T4449` ``(feature): Route-map - Extend options for ip next-hop match`` +* :vytask:`T990` ``(feature): Make DNAT/SNAT a valid state in firewall rules.`` + + +2022-06-12 +========== + +* :vytask:`T4420` ``(feature): Feature Request: ocserv: show configured 2FA OTP key`` +* :vytask:`T4380` ``(default): Feature Request: ocserv: 2FA OTP key generator in VyOS CLI`` + + +2022-06-10 +========== + +* :vytask:`T4365` ``(bug): NAT - Error on setting up tables`` +* :vytask:`T4465` ``(feature): node.def generation misses whitespace on multiple use of `` + + +2022-06-09 +========== + +* :vytask:`T4444` ``(default): sstp: Feature request. Port number changing support`` +* :vytask:`T2580` ``(feature): Support for ip pools for ippoe`` + + +2022-06-08 +========== + +* :vytask:`T4447` ``(bug): DHCPv6 prefix delegation `sla-id` limited to 128`` + + +2022-05-31 +========== + +* :vytask:`T4212` ``(default): PermissionError when generating/installing server Certificate (generate pki certificate sign ...)`` +* :vytask:`T4199` ``(bug): Commit failed when setting icmpv6 type any`` +* :vytask:`T4148` ``(bug): Firewall - Error messages not that clear as it were in old firewall`` +* :vytask:`T3659` ``(bug): Configuration won't accept IPv6 addresses for site-to-site VPN tunnel prefixes/traffic selectors`` + + +2022-05-30 +========== + +* :vytask:`T4315` ``(feature): Telegraf - Output to prometheus`` + + +2022-05-29 +========== + +* :vytask:`T2473` ``(feature): Xml for EIGRP [conf_mode]`` + + +2022-05-28 +========== + +* :vytask:`T4448` ``(feature): rip: add support for explicit version selection`` + + +2022-05-26 +========== + +* :vytask:`T4442` ``(feature): HTTP API add action "reset"`` + + +2022-05-25 +========== + +* :vytask:`T4410` ``(feature): Telegraf - Output to Splunk`` +* :vytask:`T4382` ``(bug): Replacing legacy loadFile exposes missing steps in migration scripts and other errors`` + + +2022-05-21 +========== + +* :vytask:`T4437` ``(bug): flow-accounting: support IPv6 flow collectors`` + + +2022-05-20 +========== + +* :vytask:`T4418` ``(feature): Telegraf - output Plugin azure-data-explorer`` + + +2022-05-19 +========== + +* :vytask:`T4434` ``(bug): DMVPN: cisco-authentication password length is 8 characters`` +* :vytask:`T3938` ``(default): Rewrite the uptime script in Python to allow using it as a library`` +* :vytask:`T4334` ``(default): Make the config lexer reentrant`` + + +2022-05-17 +========== + +* :vytask:`T4424` ``(bug): policy local-route6 shows ipv4 format`` + + +2022-05-16 +========== + +* :vytask:`T4377` ``(default): generate tech-support archive includes previous archives`` + + +2022-05-12 +========== + +* :vytask:`T4417` ``(bug): VRRP doesn't start with conntrack-sync`` +* :vytask:`T4100` ``(feature): Firewall increase maximum number of rules`` + + +2022-05-11 +========== + +* :vytask:`T4405` ``(bug): DHCP client sometimes ignores `no-default-route` option of an interface`` + + +2022-05-10 +========== + +* :vytask:`T4156` ``(default): Adding DHCP Option 13 (bootfile-size)`` +* :vytask:`T1972` ``(feature): Allow setting interface name for virtual_ipaddress in VRRP VRID`` + + +2022-05-07 +========== + +* :vytask:`T4361` ``(bug): `vyos.config.exists()` does not work for nodes with multiple values`` +* :vytask:`T4354` ``(bug): Slave interfaces fall out from bonding during configuration change`` +* :vytask:`T4419` ``(feature): vrf: support to disable IP forwarding within a given VRF`` + + +2022-05-06 +========== + +* :vytask:`T4385` ``(bug): bgp: peer-group member cannot override remote-as of peer-group`` + + +2022-05-05 +========== + +* :vytask:`T4414` ``(feature): Add route-map "as-path prepend last-as x" option`` + + +2022-05-03 +========== + +* :vytask:`T4395` ``(feature): Extend show vpn debug`` + + +2022-05-01 +========== + +* :vytask:`T4369` ``(bug): OpenVPN: daemon not restarted on changes to "openvpn-option" CLI node`` +* :vytask:`T4363` ``(bug): salt-minion: default mine_interval option is not set`` +* :vytask:`T4353` ``(feature): Add Jinja2 linter to vyos-1x build process`` + + +2022-04-29 +========== + +* :vytask:`T4388` ``(bug): dhcp-server: missing constraint on tftp-server-name option`` +* :vytask:`T4366` ``(bug): geneve: interface is removed on changes to e.g. description`` + + +2022-04-28 +========== + +* :vytask:`T4400` ``(bug): Container OP mode has delete where show and update should be`` + + +2022-04-27 +========== + +* :vytask:`T4398` ``(bug): IPSec site-to-site generates unexpected passthrough option`` +* :vytask:`T4397` ``(feature): arp: migrate static ARP entry configuration to get_config_dict() and make it VRF aware`` +* :vytask:`T4357` ``(feature): Allow free-form setting of DHCPv6 server options`` + + +2022-04-26 +========== + +* :vytask:`T4210` ``(bug): NAT source/destination negated ports throws an error`` +* :vytask:`T4235` ``(default): Add config tree diff algorithm`` + + +2022-04-25 +========== + +* :vytask:`T4390` ``(feature): op-mode: extend "show log" and "monitor log" with additional daemons/subsystems to read journalctl logs`` +* :vytask:`T4391` ``(bug): PPPoE: IPv6 not working after system boot`` + + +2022-04-24 +========== + +* :vytask:`T4342` ``(bug): "show ip ospf neighbor address x.x.x.x" gives "unknown command" error`` + + +2022-04-23 +========== + +* :vytask:`T4386` ``(default): Applying limiter on traffic-policy "in" fails, incorrectly reports mirror or redirect policy in use`` + + +2022-04-22 +========== + +* :vytask:`T4389` ``(feature): dhcp: add vendor option support for Ubiquity Unifi controller`` + + +2022-04-21 +========== + +* :vytask:`T4384` ``(feature): pppoe: replace default-route CLI option with common CLI nodes already present for DHCP`` + + +2022-04-20 +========== + +* :vytask:`T4345` ``(bug): New firewall code does not accept "rate/time interval" syntax used in old config`` +* :vytask:`T4231` ``(feature): Feature Request: ocserv: 2FA (password+OTP) support in Openconnect`` + + +2022-04-19 +========== + +* :vytask:`T4379` ``(bug): PPPoE: default-route lost after applying additional static routes`` +* :vytask:`T4344` ``(bug): DHCP statistics not matching, conf-mode generates incorrect pool name with dash`` +* :vytask:`T4268` ``(bug): Elevated LA while using VyOS monitoring feature`` + + +2022-04-18 +========== + +* :vytask:`T4351` ``(bug): Openvpn conf-mode "openvpn-option" is not respected`` +* :vytask:`T4278` ``(default): vyos-vm-images: fix vagrant libvirt box`` +* :vytask:`T4368` ``(bug): bgp: AS specified for local as is the same as the remote as and this is not allowed.`` +* :vytask:`T4370` ``(feature): vxlan: geneve: support configuration of df bit option`` + + +2022-04-15 +========== + +* :vytask:`T4327` ``(default): Ethernet interface configuration fails on Hyper-V due to speed/duplex/autoneg ethtool command error`` +* :vytask:`T4364` ``(feature): salt-minion: Upgrade to 3004 and migrate to get_config_dict()`` + + +2022-04-13 +========== + +* :vytask:`T4333` ``(feature): Jinja2: add plugin to test if a variable is defined and not none to reduce template complexity`` + + +2022-04-08 +========== + +* :vytask:`T4331` ``(bug): IPv6 link local addresses are not configured when an interface is in a VRF`` +* :vytask:`T4347` ``(default): Return complete and consistent error codes from HTTP API`` +* :vytask:`T4339` ``(bug): wwan: tab-completion results in "No such file or directory" if there is no WWAN interface`` +* :vytask:`T4338` ``(bug): wwan: changing interface description should not trigger reconnect`` +* :vytask:`T4324` ``(bug): wwan: check alive script should only be run via cron if a wwan interface is configured at all`` + + +2022-04-07 +========== + +* :vytask:`T4330` ``(bug): MTU settings cannot be applied when IPv6 is disabled`` +* :vytask:`T4346` ``(feature): Deprecate "system ipv6 disable" option to disable address family within OS kernel`` +* :vytask:`T4319` ``(bug): The command "set system ipv6 disable" doesn't work as expected.`` +* :vytask:`T4341` ``(feature): login: disable user-account prior to deletion and wait until deletion is complete`` +* :vytask:`T4336` ``(feature): isis: add support for MD5 authentication password on a circuit`` + + +2022-04-06 +========== + +* :vytask:`T4308` ``(feature): Op-comm "Show log frr" to view specific protocol logs`` + + +2022-04-04 +========== + +* :vytask:`T4329` ``(bug): Bgp policy route-map bug with set several extcommunity rt`` + + +2022-04-02 +========== + +* :vytask:`T4335` ``(bug): open-vmdk fails to build under gcc-10.+`` + + +2022-04-01 +========== + +* :vytask:`T4332` ``(bug): bgp: deterministic-med cannot be disabled while addpath-tx-bestpath-per-AS is in use`` + + +2022-03-31 +========== + +* :vytask:`T4326` ``(feature): Add bgp option no-suppress-duplicates`` +* :vytask:`T4323` ``(default): ospf6d crashes on latest vyos nightly`` + + +2022-03-29 +========== + +* :vytask:`T3686` ``(bug): Bridging OpenVPN tap with no local-address breaks`` +* :vytask:`T3635` ``(default): Add ability to use mDNS repeater with VRRP`` + + +2022-03-26 +========== + +* :vytask:`T4321` ``(default): Allow BGP neighbors between different VIFs on the same VyOS`` + + +2022-03-24 +========== + +* :vytask:`T4301` ``(bug): The "arp-monitor" option in bonding interface settings does not work`` +* :vytask:`T4294` ``(bug): Adding a new openvpn-option does not restart the OpenVPN process`` +* :vytask:`T4290` ``(bug): BGP source-interface fails to commit`` +* :vytask:`T4230` ``(bug): OpenVPN server configuration deleted after reboot when using a VRRP virtual-address`` + + +2022-03-23 +========== + +* :vytask:`T4314` ``(bug): Latest 1.4 Rolling release config migration error`` + + +2022-03-21 +========== + +* :vytask:`T4304` ``(feature): [OSPF]import/export filter inter-area prefix`` + + +2022-03-20 +========== + +* :vytask:`T4298` ``(default): vyos-vm-images: fix ansible group name and remove obsolete empty command`` + + +2022-03-18 +========== + +* :vytask:`T4286` ``(bug): Fix for firewall ipv6 name address validator`` + + +2022-03-15 +========== + +* :vytask:`T4302` ``(feature): FRRouting upgrade to release 8.2.2`` +* :vytask:`T4293` ``(default): Add "set ip-next-hop unchanged" in route-map`` + + +2022-03-14 +========== + +* :vytask:`T4275` ``(default): Incorrect val_help for local/remote prefix in ipsec vpn`` + + +2022-03-12 +========== + +* :vytask:`T4296` ``(bug): Interface config injected by Cloud-Init may interfere with VyOS native`` +* :vytask:`T4265` ``(feature): Add op-mode for bgp flowspec state and routes`` + + +2022-03-11 +========== + +* :vytask:`T4297` ``(bug): Interface configuration saving fails for ice/iavf based interfaces because they can't change speed/duplex settings`` + + +2022-03-09 +========== + +* :vytask:`T3981` ``(feature): VRF support for flow-accounting`` + + +2022-03-05 +========== + +* :vytask:`T4259` ``(bug): The conntrackd daemon can be started wrongly`` + + +2022-03-03 +========== + +* :vytask:`T4283` ``(feature): Add support to "reject" routes - emit an ICMP unreachable when matched`` + + +2022-03-01 +========== + +* :vytask:`T4277` ``(feature): flow-accounting: support sending flow-data via VRF interface`` + + +2022-02-28 +========== + +* :vytask:`T4273` ``(bug): ssh: Upgrade from 1.2.X to 1.3.0 breaks config`` +* :vytask:`T4115` ``(bug): reboot in not working as expected`` +* :vytask:`T3656` ``(bug): IPSec 1.4 : "show vpn ike sa" does not show the correct default ike version`` + + +2022-02-26 +========== + +* :vytask:`T4272` ``(feature): lldp: migrate Python script to use get_config_dict()`` + + +2022-02-24 +========== + +* :vytask:`T4267` ``(bug): Error - Missing required "ip key" parameter`` + + +2022-02-23 +========== + +* :vytask:`T4194` ``(bug): prefix-list no check for duplicate entries`` +* :vytask:`T4264` ``(bug): vxlan: interface is destroyed and rebuild on description change`` +* :vytask:`T4263` ``(bug): vyos.util.leaf_node_changed() dos not honor valueLess nodes`` + + +2022-02-21 +========== + +* :vytask:`T4120` ``(feature): [VXLAN] add ability to set multiple unicast-remotes`` + + +2022-02-20 +========== + +* :vytask:`T4254` ``(feature): VPN IPSec charon add options cisco_flexvpn and install_virtual_ip_on`` +* :vytask:`T4249` ``(feature): Add support for device mapping in containers`` +* :vytask:`T3617` ``(bug): IPSec 1.4 generate invalid configuration`` +* :vytask:`T4261` ``(feature): MACsec: add DHCP client support`` +* :vytask:`T4203` ``(bug): Reconfigure DHCP client interface causes brief outages`` + + +2022-02-19 +========== + +* :vytask:`T4258` ``(bug): [DHCP-SERVER] error parameter on Failover`` + + +2022-02-17 +========== + +* :vytask:`T4255` ``(bug): Unexpected print of dict bridge on delete`` +* :vytask:`T4240` ``(bug): Cannot add wlan0 to bridge via configure`` +* :vytask:`T4154` ``(bug): Error add second gre tunnel with the same source interface`` + + +2022-02-16 +========== + +* :vytask:`T4237` ``(bug): Conntrack-sync error - error adding listen-address command`` + + +2022-02-15 +========== + +* :vytask:`T4160` ``(bug): Firewall - Error in rules that matches everything except something`` +* :vytask:`T3006` ``(bug): Accel-PPP & vlan-mon config get invalid VLAN`` +* :vytask:`T3494` ``(bug): DHCPv6 leases traceback when PD using`` +* :vytask:`T1292` ``(bug): Issues while deleting all rules from a firewall`` + + +2022-02-13 +========== + +* :vytask:`T4242` ``(bug): ethernet speed/duplex can never be switched back to auto/auto`` +* :vytask:`T4191` ``(bug): Lost access to host after VRF re-creating`` + + +2022-02-11 +========== + +* :vytask:`T3872` ``(feature): Add configurable telegraf monitoring service`` + + +2022-02-08 +========== + +* :vytask:`T4227` ``(bug): Typo in help completion of hello-time option of bridge interface`` + + +2022-02-07 +========== + +* :vytask:`T4233` ``(bug): ssh: sync regex for allow/deny usernames to "system login"`` + + +2022-02-06 +========== + +* :vytask:`T4223` ``(bug): policy route cannot have several entries with the same table`` +* :vytask:`T4216` ``(bug): Firewall: can't use negated groups in firewall rules`` +* :vytask:`T4178` ``(bug): policy based routing tcp flags issue`` +* :vytask:`T4164` ``(bug): PBR: network groups (as well as address and port groups) don't resolve in `nftables_policy.conf``` +* :vytask:`T3970` ``(feature): Add support for op-mode PKI direct install into an active config session`` +* :vytask:`T3828` ``(bug): ipsec: Subtle change in "pfs enable" behavior from equuleus -> sagitta`` + + +2022-02-05 +========== + +* :vytask:`T4226` ``(bug): VRRP transition-script does not work for groups name which contains -(minus) sign`` + + +2022-02-04 +========== + +* :vytask:`T4196` ``(bug): DHCP server client-prefix-length parameter results in non-functional leases`` + + +2022-02-03 +========== + +* :vytask:`T4218` ``(bug): firewall: rule name is not allowed to start with a number`` +* :vytask:`T3643` ``(bug): show vpn ipsec sa doesn't show tunnels in "down" state`` + + +2022-02-01 +========== + +* :vytask:`T4224` ``(bug): Ethernet interfaces configured for DHCP not working on latest rolling snapshot (vyos-1.4-rolling-202201291849-amd64.iso)`` +* :vytask:`T4225` ``(bug): Performance degration with latest rolling release`` +* :vytask:`T4220` ``(bug): Commit broke dhclient 78b247b724f74bdabab0706aaa7f5b00e5809bc1`` +* :vytask:`T4138` ``(bug): NAT configuration allows to set incorrect port range and invalid port`` + + +2022-01-28 +========== + +* :vytask:`T4184` ``(bug): NTP allow-clients address doesn't work it allows to use ntp server for all addresses`` +* :vytask:`T4217` ``(bug): firewall: port-group requires protocol to be set - but not in VyOS 1.3`` + + +2022-01-27 +========== + +* :vytask:`T4213` ``(default): ipv6 policy routing not working anymore`` +* :vytask:`T4188` ``(bug): Firewall does not correctly handle conntracking`` +* :vytask:`T3762` ``(feature): Support network and address groups for policy ipv6-route`` +* :vytask:`T3560` ``(feature): Ability to create groups of MAC addresses`` +* :vytask:`T3495` ``(feature): Modernising port/protocol definitions`` + + +2022-01-25 +========== + +* :vytask:`T4205` ``(feature): Disable Debian Version in SSH (DebianBanner->no)`` +* :vytask:`T4131` ``(bug): Show firewall group incorrect format members`` + + +2022-01-24 +========== + +* :vytask:`T4204` ``(feature): Update Accel-PPP to a newer revision`` +* :vytask:`T1795` ``(default): Commit rollback by timeout`` + + +2022-01-23 +========== + +* :vytask:`T4186` ``(bug): Firewall icmp type - Offered options not supported`` +* :vytask:`T4181` ``(bug): Firewall ipv6-network-group - incorrect description on helper`` + + +2022-01-21 +========== + +* :vytask:`T4200` ``(bug): Assigning ipv6-name to interface is not generating nftables rules`` +* :vytask:`T4144` ``(bug): Firewall address-group - Improve error messages`` +* :vytask:`T4137` ``(bug): Firewall group configuration allows to set incorrect port range and invalid port`` +* :vytask:`T4133` ``(bug): Firewall network group error with zone-based firewall rules`` + + +2022-01-20 +========== + +* :vytask:`T4171` ``(bug): Interface config migration error on 1.2.8 -> 1.4 upgrade`` + + +2022-01-19 +========== + +* :vytask:`T4195` ``(feature): [OSPF-ECMP]enable set maximun-path`` + + +2022-01-18 +========== + +* :vytask:`T4159` ``(bug): Empty firewall group (address, network & port) generates invalid nftables config, commit fails`` +* :vytask:`T4155` ``(bug): PBR: `set table main` fails in `firewall.py` with newer rolling releases`` +* :vytask:`T3873` ``(feature): Zone based Firewall - Filter traffic in same zone`` +* :vytask:`T3286` ``(feature): Switch the firewall from iptables to nftables`` +* :vytask:`T292` ``(feature): [ZBF] Allow filtering intra zone traffic`` + + +2022-01-17 +========== + +* :vytask:`T3164` ``(bug): console-server ssh does not work with RADIUS PAM auth`` + + +2022-01-15 +========== + +* :vytask:`T4183` ``(feature): IPv6 link-local address not accepted as wireguard peer`` +* :vytask:`T4150` ``(bug): VRRP with conntrack-sync does not work`` +* :vytask:`T4110` ``(feature): [IPV6-SSH/DNS} enable IPv6 link local adresses as listen-address %eth0`` + + +2022-01-14 +========== + +* :vytask:`T4182` ``(bug): Show vrrp if vrrp not configured bug`` +* :vytask:`T4179` ``(feature): Add op-mode CLI for show high-availability virtual-server`` + + +2022-01-13 +========== + +* :vytask:`T4175` ``(bug): BGP configuration failed`` +* :vytask:`T4109` ``(feature): Extend high-availability/keepalived for support virtual-server lb`` + + +2022-01-12 +========== + +* :vytask:`T4174` ``(bug): Validation fails when entering port range with upper port 65535`` +* :vytask:`T4162` ``(bug): VPN ipsec ike-group - Incorrect value help for ikev2-reauth`` +* :vytask:`T4161` ``(bug): Policy route-map - Incorrect value help for local preference`` +* :vytask:`T4152` ``(bug): NHRP shortcut-target holding-time does not work`` + + +2022-01-11 +========== + +* :vytask:`T4149` ``(bug): [Firewall-IPV6] Error delete Fw rules on VIF/INT`` +* :vytask:`T3950` ``(bug): CLI backtrace on update if DNS not defined`` +* :vytask:`T4166` ``(bug): Debug output missing when frr.py called under vyos-configd`` + + +2022-01-10 +========== + +* :vytask:`T3299` ``(bug): Allow the web proxy service to listen on all IP addresses`` +* :vytask:`T3115` ``(feature): Add support for firewall on L3 VIF bridge interface`` + + +2022-01-09 +========== + +* :vytask:`T4142` ``(bug): Input ifbX interfaces not displayed in op-mode`` +* :vytask:`T3914` ``(bug): VRRP rfc3768-compatibility doesn't work with unicast peers`` + + +2022-01-08 +========== + +* :vytask:`T4116` ``(bug): Webproxy/Squid not working with IPv6 listen-address`` + + +2022-01-07 +========== + +* :vytask:`T3924` ``(bug): VRRP stops working with VRF`` + + +2022-01-06 +========== + +* :vytask:`T4135` ``(bug): Declare zone policy firewall without local zone errors`` +* :vytask:`T4130` ``(bug): Firewall state policy errors chain`` +* :vytask:`T4141` ``(bug): Set high-availability vrrp sync-group without members error`` + + +2022-01-04 +========== + +* :vytask:`T4134` ``(bug): Incorrect firewall protocol completion help uppercase and duplicates`` +* :vytask:`T4132` ``(bug): Impossible to show a specific firewall group`` + + +2022-01-03 +========== + +* :vytask:`T4126` ``(feature): Ability to set priority to site to site IPSec vpn tunnels`` +* :vytask:`T4052` ``(bug): Validator return traceback on VRRP configuration with the script path not in config dir`` +* :vytask:`T4128` ``(bug): keepalived: Upgrade package to add VRF support`` + + +2021-12-31 +========== + +* :vytask:`T4081` ``(bug): VRRP health-check script stops working when setting up a sync group`` + + +2021-12-30 +========== + +* :vytask:`T4124` ``(feature): snmp: migrate to get_config_dict()`` + + +2021-12-29 +========== + +* :vytask:`T4111` ``(bug): IPSec generates wrong configuration colons for IPv6 peers`` +* :vytask:`T4023` ``(feature): Add grepcidr or similar functionality`` +* :vytask:`T4086` ``(default): system login banner is not removed on deletion.`` + + +2021-12-28 +========== + +* :vytask:`T3380` ``(bug): "show vpn ike sa" does not display IPv6 peers`` + + +2021-12-27 +========== + +* :vytask:`T3979` ``(bug): vyos-hostd unable to hostfile-update`` +* :vytask:`T2566` ``(bug): sstp not able to run tunnels ipv6 only`` +* :vytask:`T4093` ``(bug): SNMPv3 snmpd.conf generation bug`` +* :vytask:`T2764` ``(enhancment): Increase maximum number of NAT rules`` + + +2021-12-26 +========== + +* :vytask:`T4104` ``(bug): RAID1: "add raid md0 member sda1" does not restore boot sector`` +* :vytask:`T4108` ``(default): OSPFv3: add support for auto-cost parameter`` +* :vytask:`T4107` ``(default): OSPFv3: add support for "default-information originate"`` + + +2021-12-25 +========== + +* :vytask:`T4101` ``(bug): commit-archive: Use of uninitialized value $source_address in concatenation`` +* :vytask:`T4099` ``(feature): flow-accounting: sync "source-ip" and "source-address" between netflow and sflow ion CLI`` +* :vytask:`T4097` ``(feature): flow-accounting: migrate implementation to get_config_dict()`` +* :vytask:`T4105` ``(feature): flow-accounting: drop "sflow agent-address auto"`` +* :vytask:`T4106` ``(feature): flow-accounting: support specification of capture packet lenght`` +* :vytask:`T4102` ``(feature): OSPFv3: add support for NSSA area-type`` +* :vytask:`T4055` ``(feature): Add VRF support for HTTP(S) API service`` + + +2021-12-24 +========== + +* :vytask:`T3854` ``(bug): Missing op-mode commands for conntrack-sync`` + + +2021-12-23 +========== + +* :vytask:`T3354` ``(default): Convert strip-private script from Perl to Python`` + + +2021-12-22 +========== + +* :vytask:`T3678` ``(bug): VyOS 1.4: Invalid error message while deleting ipsec vpn configuration`` +* :vytask:`T3356` ``(feature): Script for remote file transfers`` + + +2021-12-21 +========== + +* :vytask:`T4083` ``(bug): Cluster heartbeat doesn't start b.c lack of directory /run/heartbeat/`` +* :vytask:`T4070` ``(bug): NATv4 : inbound-interface type "any" is missing.`` +* :vytask:`T4053` ``(bug): VRRP impossible to set scripts out of the /config directory`` +* :vytask:`T3931` ``(bug): SSTP doesn't work after rewriting to PKI`` + + +2021-12-20 +========== + +* :vytask:`T4088` ``(default): Fix typo in login banner`` + + +2021-12-19 +========== + +* :vytask:`T3912` ``(default): Use a more informative default post-login banner`` + + +2021-12-17 +========== + +* :vytask:`T4059` ``(bug): VRRP sync-group transition script does not persist after reboot`` + + +2021-12-16 +========== + +* :vytask:`T4046` ``(feature): Sflow - Add Source address parameter`` +* :vytask:`T3556` ``(bug): Commit-archive via scp causes 100% CPU on boot`` +* :vytask:`T4076` ``(enhancment): Allow setting CORS options in HTTP API`` +* :vytask:`T4037` ``(default): HTTP transfers do not follow redirects`` +* :vytask:`T4029` ``(default): Broken SFTP uploads`` + + +2021-12-15 +========== + +* :vytask:`T4077` ``(bug): op-mode: bfd: drop "show protocols bfd" in favour of "show bfd"`` +* :vytask:`T4073` ``(bug): "show protocols bfd peer <>" shows incorrect peer information.`` + + +2021-12-14 +========== + +* :vytask:`T4071` ``(feature): Allow HTTP API to bind to unix domain socket`` + + +2021-12-12 +========== + +* :vytask:`T4069` ``(feature): BGP: add additional available parameters to VyOS CLI`` +* :vytask:`T4036` ``(bug): VXLAN incorrect raiseError if set multicast network instead of singe address`` + + +2021-12-10 +========== + +* :vytask:`T4068` ``(feature): Python: ConfigError should insert line breaks into the error message`` + + +2021-12-09 +========== + +* :vytask:`T4033` ``(bug): VRRP - Error security when setting scripts`` +* :vytask:`T4064` ``(bug): IP address for vif is not removed from the system when deleted in configuration`` +* :vytask:`T4060` ``(enhancment): Extend configquery for use before boot configuration is complete`` +* :vytask:`T4058` ``(bug): BFD: add BGP and OSPF "bfd profile" support`` +* :vytask:`T4054` ``(bug): BFD profiles configuration incorrect behavior.`` + + +2021-12-07 +========== + +* :vytask:`T4041` ``(servicerequest): "transition-script" doesn't work on "sync-group"`` + + +2021-12-06 +========== + +* :vytask:`T4012` ``(feature): Add VRF support for TFTP`` + + +2021-12-04 +========== + +* :vytask:`T4049` ``(feature): support command-style output with compare command`` +* :vytask:`T4047` ``(bug): Wrong regex validation in XML definitions`` +* :vytask:`T4042` ``(bug): BGP L2VPN / EVPN and RD type 0 set`` +* :vytask:`T4048` ``(bug): BGP: L2VPN/EVPN and individual RD and RT settings for each VNI`` +* :vytask:`T4045` ``(bug): Unable to "format disk like "`` +* :vytask:`T4044` ``(feature): BFD: add vrf support`` +* :vytask:`T4043` ``(feature): BFD: add support for passive mode`` + + +2021-12-02 +========== + +* :vytask:`T4035` ``(bug): Geneve interfaces aren't displayed by operational mode commands`` + + +2021-12-01 +========== + +* :vytask:`T3695` ``(bug): OpenConnect reports commit success when ocserv fails to start due to SSL cert/key file issues`` + + +2021-11-30 +========== + +* :vytask:`T4010` ``(bug): DMVPN generates incorrect configuration life_time for swanctl.conf`` +* :vytask:`T3725` ``(feature): show configuration in json format`` + + +2021-11-29 +========== + +* :vytask:`T3946` ``(enhancment): Automatically resize the root partition if the drive has extra space`` + + +2021-11-28 +========== + +* :vytask:`T3999` ``(bug): show lldp neighbor Traceback error`` +* :vytask:`T3928` ``(feature): Add OSPFv3 VRF support`` + + +2021-11-27 +========== + +* :vytask:`T3755` ``(feature): ospf: adjust to new FRR 8 syntax where "no passive-interface " moved to interface section`` +* :vytask:`T3753` ``(feature): frr: upgrade to stable/8.1 release train`` + + +2021-11-26 +========== + +* :vytask:`T3978` ``(bug): containers add network without declaring prefix raise ConfigError`` + + +2021-11-25 +========== + +* :vytask:`T4006` ``(default): Add additional Linux capabilities to container configuration`` +* :vytask:`T3986` ``(bug): Incorrect description for vpn ipsec site-to-site authentication and connection`` + + +2021-11-24 +========== + +* :vytask:`T4015` ``(feature): Update Accel-PPP to a newer revision`` +* :vytask:`T3865` ``(bug): loadkey command help text missing escape sequence`` +* :vytask:`T1083` ``(feature): Implement persistent/random address and port mapping options for NAT rules`` + + +2021-11-23 +========== + +* :vytask:`T3990` ``(bug): WATCHFRR: crashlog and per-thread log buffering unavailable (due to files left behind in /var/tmp/frr/ after reboot)`` + + +2021-11-20 +========== + +* :vytask:`T3998` ``(bug): route-target completion incorrect description`` + + +2021-11-19 +========== + +* :vytask:`T4003` ``(bug): API for "show interfaces ethernet" does not include the interface description`` +* :vytask:`T4011` ``(bug): ethernet: deleting interface should place interface in admin down state`` + + +2021-11-18 +========== + +* :vytask:`T3612` ``(bug): IPoE Server address pool issues.`` +* :vytask:`T3995` ``(feature): OpenVPN: do not stop/start service on configuration change`` +* :vytask:`T4008` ``(feature): dhcp: change client retry interval form 300 -> 60 seconds`` +* :vytask:`T3795` ``(bug): WWAN: issues with non connected interface / no signal`` +* :vytask:`T3510` ``(bug): RADIUS usersname is not shown on CLI`` + + +2021-11-17 +========== + +* :vytask:`T3350` ``(bug): OpenVPN config file generation broken`` +* :vytask:`T3996` ``(bug): SNMP service error in log`` + + +2021-11-15 +========== + +* :vytask:`T3994` ``(bug): VRF: unable to delete vrf when name contains numbers, hyphen or underscore`` +* :vytask:`T3960` ``(bug): FRR Misconfig when using multiple VRF VNI`` +* :vytask:`T3724` ``(feature): Allow setting host-name in l2tp section of accel-ppp`` +* :vytask:`T645` ``(feature): Allow multiple prefixes in ipsec tunnel`` + + +2021-11-10 +========== + +* :vytask:`T3966` ``(default): OpenVPN fix the smoketests`` +* :vytask:`T3834` ``(default): [OPENVPN] Support for Two Factor Authentication totp.`` +* :vytask:`T3982` ``(bug): DHCP server commit fails if static-mapping contains + or .`` + + +2021-11-09 +========== + +* :vytask:`T3962` ``(bug): Image cannot be built without open-vm-tools`` + + +2021-11-07 +========== + +* :vytask:`T3626` ``(bug): Configuring and disabling DHCP Server`` + + +2021-11-06 +========== + +* :vytask:`T3514` ``(bug): NIC flap at any interface change`` + + +2021-11-05 +========== + +* :vytask:`T3972` ``(bug): Removing vif-c interface raises KeyError`` + + +2021-11-04 +========== + +* :vytask:`T3969` ``(bug): Container incorrect raiseError format if network doesn't exist`` +* :vytask:`T3662` ``(bug): Container configuration upgrade destroys system`` +* :vytask:`T3964` ``(bug): SSTP: local-user static-ip CLI node accepts invalid IPv4 addresses`` + + +2021-11-03 +========== + +* :vytask:`T3952` ``(default): Add sh bgp ipv4/ipv6 vpn command`` +* :vytask:`T3610` ``(bug): DHCP-Server creation for not primary IP address fails`` + + +2021-11-01 +========== + +* :vytask:`T3958` ``(default): OpenVPN breaks the smoketests`` +* :vytask:`T3956` ``(bug): GRE tunnel - unable to move from source-interface to source-address, commit error`` + + +2021-10-31 +========== + +* :vytask:`T3945` ``(feature): Add route-map for bgp aggregate-address`` +* :vytask:`T3954` ``(bug): FTDI cable makes VyOS sagitta latest hang, /dev/serial unpopulated, config system error`` +* :vytask:`T3943` ``(bug): "netflow source-ip" prevents image upgrades if IP address does not exist locally`` + + +2021-10-29 +========== + +* :vytask:`T3942` ``(feature): Generate IPSec debug archive from op-mode`` + + +2021-10-28 +========== + +* :vytask:`T3951` ``(bug): After resetting vti ipsec tunnel old child SA still active`` +* :vytask:`T3941` ``(bug): "show vpn ipsec sa" shows established time of parent SA not child SA's`` +* :vytask:`T3916` ``(feature): Add additional Linux capabilities to container configuration`` + + +2021-10-27 +========== + +* :vytask:`T3944` ``(bug): VRRP fails over when adding new group to master`` + + +2021-10-22 +========== + +* :vytask:`T3897` ``(feature): Dynamic DNS doesn't work with IPv6 addresses`` +* :vytask:`T3832` ``(feature): Allow to set DHCP client-id in hexadecimal format`` +* :vytask:`T3188` ``(bug): Tunnel local-ip to dhcp-interface Change Fails to Update`` +* :vytask:`T3917` ``(default): Use Avahi as mDNS repeater for IPv6 support`` + + +2021-10-21 +========== + +* :vytask:`T3926` ``(bug): strip-private does not sanitize "cisco-authentication" from NHRP configuration`` +* :vytask:`T3925` ``(feature): Tunnel: dhcp-interface not implemented - use source-interface instead`` +* :vytask:`T3923` ``(feature): Kernel: Enable TLS/IPSec offload support for Mellanox ConnectX NICs`` +* :vytask:`T3927` ``(feature): Kernel: Enable kernel support for HW offload of the TLS protocol`` + + +2021-10-20 +========== + +* :vytask:`T3918` ``(bug): DHCPv6 prefix delegation incorrect verify error`` +* :vytask:`T3921` ``(bug): tunnel: KeyError when using dhcp-interface`` + + +2021-10-19 +========== + +* :vytask:`T3396` ``(bug): syslog can't be configured with an ipv6 literal destination in 1.2.x`` + + +2021-10-18 +========== + +* :vytask:`T3002` ``(default): VRRP change on IPSec interface causes packet routing issues`` + + +2021-10-17 +========== + +* :vytask:`T3786` ``(bug): GRE tunnel source address 0.0.0.0 error`` +* :vytask:`T3217` ``(default): Save FRR configuration on each commit`` +* :vytask:`T3381` ``(bug): Change GRE tunnel failed`` +* :vytask:`T3254` ``(bug): Dynamic DNS status shows incorrect last update time`` +* :vytask:`T1243` ``(bug): BGP local-as accept wrong values`` +* :vytask:`T697` ``(bug): Clean up and sanitize package dependencies`` +* :vytask:`T578` ``(feature): Support Linux Container`` + + +2021-10-16 +========== + +* :vytask:`T3879` ``(bug): GPG key verification fails when upgrading from a 1.3 beta version`` + + +2021-10-15 +========== + +* :vytask:`T3748` ``(bug): Container deletion bug`` +* :vytask:`T3693` ``(feature): ISIS Route redistribution ipv6 support missing`` +* :vytask:`T3676` ``(feature): Container option to add Linux capabilities`` +* :vytask:`T3613` ``(feature): Selectors for route-based IPsec tunnel (vti)`` +* :vytask:`T3692` ``(bug): VyOS build failing due to repo.saltstack.com`` +* :vytask:`T3673` ``(feature): BGP large-community del operation missing`` + + +2021-10-14 +========== + +* :vytask:`T3811` ``(bug): NAT (op_mode): NAT op_mode command fails.`` +* :vytask:`T3801` ``(feature): containers: do not use podman CLI to create container networks`` + + +2021-10-13 +========== + +* :vytask:`T3904` ``(bug): NTP pool associations silently fail`` +* :vytask:`T3277` ``(feature): DNS Forwarding - reverse zones`` + + +2021-10-12 +========== + +* :vytask:`T3216` ``(bug): Removal of restricted-shell broke configure mode for RADIUS users`` +* :vytask:`T3881` ``(bug): Wrong description for container section restart`` +* :vytask:`T3868` ``(bug): Regex and/or wildcard not accepted with large-community-list`` +* :vytask:`T3701` ``(bug): ipoe server fails to start when configuring radius dynamic-author on ipoe`` + + +2021-10-10 +========== + +* :vytask:`T3750` ``(bug): pdns-recursor 4.4 issue with dont-query and private DNS servers`` +* :vytask:`T3885` ``(default): dhcpv6-pd: randomly generated DUID is not persisted`` +* :vytask:`T3899` ``(enhancment): Add support for hd44780 LCD displays`` + + +2021-10-09 +========== + +* :vytask:`T3894` ``(bug): Tunnel Commit Failed if system does not have `eth0``` + + +2021-10-08 +========== + +* :vytask:`T3893` ``(bug): MGRE Tunnel commit crash If sit tunnel available`` + + +2021-10-05 +========== + +* :vytask:`T3741` ``(feature): [BGP] default no-ipv4-unicast - by default`` + + +2021-10-04 +========== + +* :vytask:`T3888` ``(bug): Incorrect warning when poweroff command executed from configure mode.`` +* :vytask:`T3890` ``(feature): dhcp(v6): provide op-mode commands to retrieve both server and client logfiles`` +* :vytask:`T3889` ``(feature): Migrate to journalctl when reading daemon logs`` + + +2021-10-03 +========== + +* :vytask:`T3880` ``(bug): EFI boot shows error on display`` + + +2021-10-02 +========== + +* :vytask:`T3882` ``(feature): Upgrade PowerDNs recursor to 4.5 series`` +* :vytask:`T3883` ``(bug): VRF - Delette vrf config on interface`` + + +2021-09-30 +========== + +* :vytask:`T3874` ``(bug): D-Link Ethernet Interface not working.`` +* :vytask:`T3869` ``(default): Rewrite vyatta_net_name/vyatta_interface_rescan in Python`` + + +2021-09-28 +========== + +* :vytask:`T3853` ``(default): nat66 rules gets deleted on reboot in 1.4-rolling-202109240217`` + + +2021-09-27 +========== + +* :vytask:`T3863` ``(default): nat66: commit fails/hangs on non existing interface`` + + +2021-09-26 +========== + +* :vytask:`T3860` ``(bug): Error on pppoe, tunnel and wireguard interfaces for IPv6 EUI64 addresses`` +* :vytask:`T3857` ``(feature): reboot: send wall message to all users for information`` +* :vytask:`T3867` ``(bug): vxlan: multicast group address is not validated`` +* :vytask:`T3859` ``(bug): Add "log-adjacency-changes" to ospfv3 process`` +* :vytask:`T3826` ``(bug): PKI: op-mode - do input validation when listing certificates`` + + +2021-09-25 +========== + +* :vytask:`T3657` ``(default): BGP neighbors ipv6 not able to establish with IPv6 link-local addresses`` + + +2021-09-23 +========== + +* :vytask:`T3850` ``(bug): Dots are no longer allowed in SSH public key names`` + + +2021-09-21 +========== + +* :vytask:`T3847` ``(feature): keepalived/vrrp: migrate to get_config_dict() - cleanup`` + + +2021-09-20 +========== + +* :vytask:`T3823` ``(bug): strip-private does not filter public IPv6 addresses`` + + +2021-09-19 +========== + +* :vytask:`T3841` ``(feature): dhcp-server: add ping-check option to CLI`` +* :vytask:`T2738` ``(bug): Modifying configuration in the "interfaces" section from VRRP transition scripts causes configuration lockup and high CPU utilization`` +* :vytask:`T3840` ``(feature): dns forwarding: Cache size should allow values > 10k`` +* :vytask:`T3672` ``(bug): DHCP-FO with multiple subnets results in invalid/non-functioning dhcpd.conf configuration file output`` + + +2021-09-18 +========== + +* :vytask:`T3831` ``(bug): External traffic stops routing when IPSEC tunnel comes up with interface vti0`` +* :vytask:`T1968` ``(default): Allow multiple static routes in dhcp-server`` +* :vytask:`T3838` ``(feature): dhcp-server - sync cli for name-servers to other subsystems`` +* :vytask:`T3839` ``(feature): dhcp-server: Allow configuration of a DNS server and domain name on the shared-network level`` + + +2021-09-17 +========== + +* :vytask:`T3830` ``(bug): ipsec: remote-id no longer included in IKE AUTH if not explicitly specified`` + + +2021-09-11 +========== + +* :vytask:`T3402` ``(feature): Add VyOS programming library for operational level commands`` + + +2021-09-10 +========== + +* :vytask:`T3802` ``(bug): Commit fails if ethernet interface doesn't support flow control`` +* :vytask:`T3819` ``(bug): Upgrade Salt Stack 3002.3 -> 3003 release train`` +* :vytask:`T915` ``(feature): MPLS Support`` + + +2021-09-09 +========== + +* :vytask:`T3812` ``(bug): Vyos and frr route-map config out of sync`` +* :vytask:`T3814` ``(bug): wireguard: commit error showing incorrect peer name from the configured name`` +* :vytask:`T3805` ``(bug): OpenVPN insufficient privileges for rtnetlink when closing TUN/TAP interface`` +* :vytask:`T3815` ``(bug): pki : the file command 'generate pki wireguard key-pair file' is not working`` + + +2021-09-07 +========== + +* :vytask:`T1894` ``(bug): FRR config not loaded after daemons segfault or restart`` +* :vytask:`T3807` ``(bug): Op Command "show interfaces wireguard" does not show the output`` + + +2021-09-06 +========== + +* :vytask:`T3806` ``(bug): Don't set link local ipv6 address if MTU less then 1280`` +* :vytask:`T3803` ``(default): Add source-address option to the ping CLI`` +* :vytask:`T3431` ``(bug): Show version all bug`` +* :vytask:`T2920` ``(bug): Commit crash when adding the second mGRE tunnel with the same key`` + + +2021-09-05 +========== + +* :vytask:`T3804` ``(feature): cli: Migrate and merge "system name-servers-dhcp" into "system name-server"`` + + +2021-09-04 +========== + +* :vytask:`T3619` ``(bug): Performance Degradation 1.2 --> 1.3 | High ksoftirqd CPU usage`` + + +2021-09-03 +========== + +* :vytask:`T3788` ``(bug): Keys are not allowed with ipip and sit tunnels`` +* :vytask:`T3634` ``(feature): Add op command option for ping for do not fragment bit to be set`` +* :vytask:`T3798` ``(feature): bgp: add support for "neighbor local-as replace-as" option`` + + +2021-09-02 +========== + +* :vytask:`T3792` ``(bug): login: A hypen present in a username from "system login user" is replaced by an underscore`` +* :vytask:`T3790` ``(bug): Does not possible to configure PPTP static ip-address to users`` +* :vytask:`T2947` ``(bug): Nat translation many-many with prefix does not map 1-1.`` + + +2021-08-31 +========== + +* :vytask:`T3789` ``(feature): Add custom validator for base64 encoded CLI data`` +* :vytask:`T3782` ``(default): Ingress Shaping with IFB No Longer Functional with 1.3`` + + +2021-08-30 +========== + +* :vytask:`T3768` ``(default): Remove early syntaxVersion implementation`` +* :vytask:`T2941` ``(default): Using a non-ASCII character in the description field causes UnicodeDecodeError in configsource.py`` +* :vytask:`T3787` ``(bug): Remove deprecated UDP fragmentation offloading option`` + + +2021-08-29 +========== + +* :vytask:`T3708` ``(bug): isisd and gre-bridge commit error`` +* :vytask:`T3783` ``(bug): "set protocols isis spf-delay-ietf" is not working`` +* :vytask:`T2750` ``(default): Use m4 as a template processor`` + + +2021-08-28 +========== + +* :vytask:`T3743` ``(bug): l2tp doesn't work after reboot if outside-address not 0.0.0.0`` + + +2021-08-27 +========== + +* :vytask:`T3182` ``(bug): Main blocker Task for FRR 7.4/7.5 series update`` +* :vytask:`T3568` ``(feature): Add XML for firewall conf-mode`` +* :vytask:`T2108` ``(default): Use minisign/signify instead of GPG for release signing`` + + +2021-08-26 +========== + +* :vytask:`T3776` ``(default): Rename FRR daemon restart op-mode commands`` +* :vytask:`T3739` ``(feature): policy: route-map: add EVPN match support`` + + +2021-08-25 +========== + +* :vytask:`T3773` ``(bug): Delete the "show system integrity" command (to prepare for a re-implementation)`` +* :vytask:`T3775` ``(bug): Typo in generated Strongswan VPN-config`` + + +2021-08-24 +========== + +* :vytask:`T3772` ``(bug): VRRP virtual interfaces are not shown in show interfaces`` + + +2021-08-23 +========== + +* :vytask:`T3769` ``(feature): Containers: Network Bridging`` + + +2021-08-22 +========== + +* :vytask:`T3090` ``(feature): Move 'adjust-mss' firewall options to the interface section.`` +* :vytask:`T3765` ``(default): container: additional op-mode commands`` + + +2021-08-20 +========== + +* :vytask:`T1950` ``(default): Store VyOS configuration syntax version data in JSON file`` + + +2021-08-19 +========== + +* :vytask:`T3751` ``(bug): pki generate ca add new line after passphrase`` +* :vytask:`T3764` ``(bug): Unconfigurable IKE and ESP lifetime`` +* :vytask:`T3234` ``(bug): multi_to_list fails in certain cases, with root cause an element redundancy in XML interface-definitions`` +* :vytask:`T3732` ``(feature): override-default helper should support adding defaultValues to default less nodes`` +* :vytask:`T3759` ``(default): [L3VPN] VPNv4/VPNv6 add commands`` + + +2021-08-18 +========== + +* :vytask:`T3752` ``(bug): generate pki certificate file xxx doesn't touch file`` + + +2021-08-16 +========== + +* :vytask:`T3738` ``(default): openvpn fails if server and authentication are configured`` +* :vytask:`T1594` ``(bug): l2tpv3 error on IPv6 local-ip`` + + +2021-08-15 +========== + +* :vytask:`T3756` ``(default): VyOS generates invalid QR code for wireguard clients`` +* :vytask:`T3757` ``(default): OSPF: add support to configure the area at an interface level`` + + +2021-08-14 +========== + +* :vytask:`T3745` ``(feature): op-mode IPSec show vpn ipse sa sorting`` + + +2021-08-13 +========== + +* :vytask:`T3749` ``(bug): V4/V6 Counters in network container validation aren't being reset`` +* :vytask:`T3728` ``(bug): FRR not respect configured RD and RT for L3VNI`` +* :vytask:`T3727` ``(bug): VPN IPsec ESP proposal and ESP presented in config missmatch`` +* :vytask:`T3740` ``(bug): HTTPs API breaks when the address is IPv6`` + + +2021-08-12 +========== + +* :vytask:`T3731` ``(bug): verify_accel_ppp_base_service return wrong config error for SSP`` +* :vytask:`T3405` ``(feature): PPPoE server unit-cache`` +* :vytask:`T2432` ``(default): dhcpd: Can't create new lease file: Permission denied`` +* :vytask:`T3746` ``(feature): Inform users logging into the system about a pending reboot`` +* :vytask:`T3744` ``(default): Dns forwarding statistics formatting missing a new line`` + + +2021-08-11 +========== + +* :vytask:`T3709` ``(feature): Snmp: Allow enable MIDs/OIDs ipCidrRouteTable`` + + +2021-08-09 +========== + +* :vytask:`T3720` ``(bug): IPSec set vti secondary address cause interface disable`` + + +2021-08-08 +========== + +* :vytask:`T3705` ``(bug): IPSec: VTI interface does not honor default-esp-group`` +* :vytask:`T2027` ``(bug): get_config_dict is failing when the configuration section is empty/missing`` + + +2021-08-05 +========== + +* :vytask:`T3719` ``(bug): Restart vpn shows some missed files`` + + +2021-08-04 +========== + +* :vytask:`T3704` ``(feature): Add ability to interact with Areca RAID adapers`` +* :vytask:`T3718` ``(bug): VPN IPsec IKE group by default not use DH-group 2`` + + +2021-08-02 +========== + +* :vytask:`T3601` ``(default): Error in ssh keys for vmware cloud-init if ssh keys is left empty.`` + + +2021-08-01 +========== + +* :vytask:`T3707` ``(bug): Ping incorrect ip host checks`` + + +2021-07-31 +========== + +* :vytask:`T3716` ``(feature): Linux kernel parameters ignore_routes_with_link_down- ignore disconnected routing connections`` + + +2021-07-30 +========== + +* :vytask:`T1176` ``(default): FRR - BGP replicating routes`` +* :vytask:`T1210` ``(feature): About IKEv2 IPSec VPN remote access`` + + +2021-07-23 +========== + +* :vytask:`T3699` ``(bug): login: verify selected "system login user" name is not already used by the base system.`` +* :vytask:`T3698` ``(default): Support bridge monitoring`` + + +2021-07-13 +========== + +* :vytask:`T3679` ``(default): Point the unexpected exception message link to the new rolling release location`` + + +2021-07-11 +========== + +* :vytask:`T3665` ``(bug): Missing VRF support for VxLAN but already documented`` + + +2021-07-10 +========== + +* :vytask:`T3636` ``(feature): SSTP / L2TP ipv6 support broken`` + + +2021-07-09 +========== + +* :vytask:`T3667` ``(bug): brctl is damaged`` + + +2021-07-06 +========== + +* :vytask:`T3660` ``(feature): Conntrack-Sync configuration command to specify destination udp port for peer`` + + +2021-07-03 +========== + +* :vytask:`T57` ``(enhancment): Make it possible to disable the entire IPsec peer`` + + +2021-07-01 +========== + +* :vytask:`T3658` ``(feature): Add support for dhcpdv6 fixed-prefix6`` +* :vytask:`T2035` ``(bug): Executing vyos-smoketest multiple times makes ssh test fail on execution`` + + +2021-06-29 +========== + +* :vytask:`T3593` ``(bug): PPPoE server called-sid format does not work`` +* :vytask:`T1441` ``(feature): Add support for IPSec XFRM interfaces`` + + +2021-06-25 +========== + +* :vytask:`T3641` ``(feature): Upgrade base system from Debian Buster -> Debian Bullseye`` +* :vytask:`T3649` ``(feature): Add bonding additional hash-policy`` + + +2021-06-23 +========== + +* :vytask:`T3647` ``(feature): Bullseye: gcc defaults to passing --as-needed to linker`` + + +2021-06-22 +========== + +* :vytask:`T3629` ``(bug): IPoE server shifting address in the range`` +* :vytask:`T3645` ``(feature): Bullseye: ethtool changed output for ring-buffer information`` + + +2021-06-21 +========== + +* :vytask:`T3563` ``(default): commit-archive breaks with IPv6 source addresses`` + + +2021-06-20 +========== + +* :vytask:`T3637` ``(bug): vrf: bind-to-all didn't work properly`` +* :vytask:`T3639` ``(default): GCC preprocessor clobbers C comments`` + + +2021-06-19 +========== + +* :vytask:`T3633` ``(feature): Add LRO offload for interface ethernet`` + + +2021-06-18 +========== + +* :vytask:`T3599` ``(default): Migrate NHRP to XML/Python`` + + +2021-06-17 +========== + +* :vytask:`T3624` ``(feature): BGP: add support for extended community bandwidth definition`` + + +2021-06-16 +========== + +* :vytask:`T3623` ``(default): Fix for dummy interface option in the operational command "clear interfaces dummy"`` +* :vytask:`T3630` ``(feature): op-mode: add "show version kernel" command`` + + +2021-06-13 +========== + +* :vytask:`T3620` ``(feature): Rename WWAN interface from wirelessmodem to wwan to use QMI interface`` +* :vytask:`T2173` ``(feature): Add the ability to use VRF on VTI interfaces`` +* :vytask:`T3622` ``(feature): WWAN: add support for APN authentication`` +* :vytask:`T3606` ``(bug): SNMP unknown notification OID`` +* :vytask:`T3621` ``(bug): PPPoE interface does not validate if password is supplied when username is set`` + + +2021-06-12 +========== + +* :vytask:`T3611` ``(bug): WWAN interface (MC7710) no longer works on Kernel 5.10`` +* :vytask:`T1534` ``(bug): IPSec w/ IKEv2 Invalid local-address "any"`` +* :vytask:`T3616` ``(bug): Update to FastAPI causes regression in vyos-http-api-server`` + + +2021-06-11 +========== + +* :vytask:`T3614` ``(bug): Container network name with hyphen fail`` + + +2021-06-10 +========== + +* :vytask:`T3250` ``(bug): PPPoE server: wrong local usernames`` +* :vytask:`T3138` ``(bug): ddclient improperly updated when apply rfc2136 config`` +* :vytask:`T2645` ``(default): Editing route-map action requires adding a new rule`` + + +2021-06-08 +========== + +* :vytask:`T3605` ``(default): Allow to set prefer-global for ipv6-next-hop`` +* :vytask:`T3607` ``(feature): [route-map] set ipv6 next-hop prefer-global`` +* :vytask:`T3289` ``(bug): No description for node "service" conf-mode`` + + +2021-06-07 +========== + +* :vytask:`T3461` ``(bug): OpenConnect Server redundancy check`` +* :vytask:`T3455` ``(bug): system users can not be added in "edit"`` +* :vytask:`T3588` ``(default): IPSec: migrate no longer available options from CLI which are now hardcoded/enabled in strongSwan`` + + +2021-06-06 +========== + +* :vytask:`T842` ``(feature): Adopt VyOS CLI to latest StrongSwan options and deprecated Keywords`` + + +2021-06-04 +========== + +* :vytask:`T3595` ``(default): Cannot create new VTI interface`` +* :vytask:`T3592` ``(feature): Set default TTL 64 for tunnels`` + + +2021-06-03 +========== + +* :vytask:`T3384` ``(feature): Support UDP bandwidth testing`` + + +2021-06-02 +========== + +* :vytask:`T3233` ``(bug): Interface redirect to dum0`` + + +2021-06-01 +========== + +* :vytask:`T3585` ``(default): Fix NHRP module for updated interfaces tunnel syntax`` +* :vytask:`T3594` ``(bug): Disable by default service strongswan-starter`` + + +2021-05-30 +========== + +* :vytask:`T3518` ``(bug): Warning messages when using SCP commit-archive`` +* :vytask:`T3093` ``(default): Add xml for vpn ipsec`` +* :vytask:`T1866` ``(bug): Commit archive over SFTP doesn't work with non-standard ports`` +* :vytask:`T3590` ``(feature): bgp: add option for limiting maximum number of prefixes to be sent to a peer`` +* :vytask:`T3589` ``(feature): op-mode: support clearing out logfiles from CLI`` +* :vytask:`T2641` ``(feature): Rewrite vpn ipsec OP commands in new style XML syntax`` +* :vytask:`T3351` ``(feature): Installer checking MD5 checksums on the ISO image`` + + +2021-05-29 +========== + +* :vytask:`T1944` ``(bug): FRR: Invalid route in BGP causes update storm, memory leak, and failure of Zebra`` +* :vytask:`T1888` ``(feature): Update to StrongSwan 5.9.1`` + + +2021-05-27 +========== + +* :vytask:`T3561` ``(feature): router-advert: support advertising specific routes`` +* :vytask:`T2669` ``(bug): DHCP-server overlapping ranges.`` + + +2021-05-26 +========== + +* :vytask:`T3540` ``(bug): Keepalived memory utilisation issue when constantly getting its state in JSON format`` + + +2021-05-24 +========== + +* :vytask:`T3575` ``(bug): pseudo-ethernet: must check source-interface MTU`` +* :vytask:`T3571` ``(bug): Broken Show Tab Complete`` +* :vytask:`T3555` ``(bug): GRE TAP tunnel does not silent fragment packets / kernel fix available`` +* :vytask:`T3576` ``(bug): ISIS does not support IPV6`` + + +2021-05-23 +========== + +* :vytask:`T3570` ``(default): Prevent setting of a larger MTU on child interfaces`` +* :vytask:`T3573` ``(bug): as-path-prepend Description Invalid`` +* :vytask:`T3572` ``(feature): Basic Drive Diagnostic Tools`` + + +2021-05-22 +========== + +* :vytask:`T3564` ``(default): Multiple BGP Confederation Peers Not Allowed`` + + +2021-05-21 +========== + +* :vytask:`T3551` ``(bug): QoS control failure of VLAN sub interface`` + + +2021-05-20 +========== + +* :vytask:`T3554` ``(feature): Add area-type stub for ospfv3`` +* :vytask:`T3565` ``(feature): sysctl: rewrite in XML and Python and drop from vyatta-cfg-system`` + + +2021-05-19 +========== + +* :vytask:`T3562` ``(feature): Update Accel-PPP to a newer revision`` +* :vytask:`T3559` ``(feature): Add restart op-command for OpenConnect Server`` + + +2021-05-18 +========== + +* :vytask:`T3525` ``(default): VMWare resume script syntax errors`` + + +2021-05-15 +========== + +* :vytask:`T3549` ``(bug): DHCPv6 "service dhcpv6-server global-parameters name-server" is not correctly exported to dhcpdv6.conf when multiple name-server entries are present`` +* :vytask:`T3532` ``(bug): Not possible to change ethertype after interface creation`` +* :vytask:`T3550` ``(bug): Router-advert completion typo`` +* :vytask:`T3547` ``(feature): conntrackd: remove deprecated config options`` +* :vytask:`T3535` ``(feature): Rewrite vyatta-conntrack-sync in new XML and Python flavor`` + + +2021-05-14 +========== + +* :vytask:`T3346` ``(bug): nat 4-to-5 migration script fails when a 'source' or 'destination' node exists but there are no rules`` +* :vytask:`T3248` ``(default): Deal with VRRP mode-force command that exists in 1.2 but not in 1.3`` +* :vytask:`T3426` ``(default): add support for script arguments to vyos-configd`` + + +2021-05-13 +========== + +* :vytask:`T3539` ``(bug): Typo in RPKI interface definition`` +* :vytask:`T439` ``(feature): local PBR support`` +* :vytask:`T3544` ``(feature): DHCP server should validate configuration before applying it`` +* :vytask:`T3543` ``(feature): Support for setting lacp_rate on LACP bonded interfaces`` + + +2021-05-12 +========== + +* :vytask:`T3302` ``(default): Make vyos-configd relay stdout from scripts to the user's console`` +* :vytask:`T3542` ``(bug): udev net.rules not installed in image since may 2nd`` + + +2021-05-10 +========== + +* :vytask:`T3374` ``(bug): IPv6 GRE Tunnel issues`` + + +2021-05-09 +========== + +* :vytask:`T3530` ``(bug): BGP peer-group can't contain a hyphen`` + + +2021-05-06 +========== + +* :vytask:`T3523` ``(bug): VRF BGP daemon route-map command missing`` +* :vytask:`T3519` ``(bug): Cannot add / assign L2TPv3 to vrf`` + + +2021-05-05 +========== + +* :vytask:`T3520` ``(bug): Cannot add tunnel interface to isis within vrf`` +* :vytask:`T3335` ``(bug): Some OSPFv3 show commands do not work`` + + +2021-05-04 +========== + +* :vytask:`T3504` ``(feature): BGP Per Peer Graceful Restart`` + + +2021-05-02 +========== + +* :vytask:`T3511` ``(bug): Update libnss-mapuser and libpam-radius packages from CUMULUS Linux`` + + +2021-05-01 +========== + +* :vytask:`T3379` ``(feature): Add global-parameters name-server for dhcpv6-server`` +* :vytask:`T3491` ``(default): Change Kernel HZ to 1000`` + + +2021-04-29 +========== + +* :vytask:`T3503` ``(bug): "route-reflector-client" fails when "remote-as" is "internal"`` +* :vytask:`T3502` ``(bug): "system ip multipath layer4-hashing" doesn't work`` + + +2021-04-28 +========== + +* :vytask:`T3473` ``(bug): IPSec op-mode show sa error`` + + +2021-04-27 +========== + +* :vytask:`T2946` ``(bug): Calling 'stty_size' causes show interfaces API to fail`` + + +2021-04-25 +========== + +* :vytask:`T3490` ``(bug): priority inversion on PBR "policy route" create, breaks default route from dhcp (live iso)`` +* :vytask:`T3468` ``(bug): Tunnel interfaces aren't suggested as being available for bridging (regression)`` +* :vytask:`T3497` ``(bug): Prefix list with rule containing only action is not detected as error during parse`` +* :vytask:`T3492` ``(bug): BGP Configuration Migration failed (badly!) from rolling 202102240218 to rolling 202104221210`` +* :vytask:`T1802` ``(feature): Wireguard QR code in cli for mobile devices`` + + +2021-04-24 +========== + +* :vytask:`T3472` ``(bug): commit-confirm script not found`` +* :vytask:`T3439` ``(bug): Commit-archive location not working for scp`` + + +2021-04-23 +========== + +* :vytask:`T3395` ``(bug): WAN load-balancing fails with nexthop dhcp`` +* :vytask:`T3290` ``(bug): Disabling GRE conntrack module fails`` + + +2021-04-20 +========== + +* :vytask:`T3488` ``(bug): Specifying an invalid "interface address" like dhcph leads to commit error`` + + +2021-04-18 +========== + +* :vytask:`T3481` ``(default): Exclude tag node values from key mangling`` +* :vytask:`T3475` ``(bug): XML dictionary cache unable to process syntaxVersion elements`` + + +2021-04-17 +========== + +* :vytask:`T3470` ``(bug): as-override isn't applied to frr`` + + +2021-04-15 +========== + +* :vytask:`T3386` ``(bug): PPPoE-server don't start with local authentication`` +* :vytask:`T3190` ``(feature): Unable to subtract value from local-preference in route-map`` + + +2021-04-14 +========== + +* :vytask:`T3398` ``(bug): Can't commit`` +* :vytask:`T3055` ``(bug): op-mode incorrect naming for ipsec policy-based tunnels`` + + +2021-04-13 +========== + +* :vytask:`T3436` ``(feature): Refactoring ospf op-mode for support vrf`` +* :vytask:`T3434` ``(feature): Refactoring bgp op-mode for support vrf`` + + +2021-04-12 +========== + +* :vytask:`T3454` ``(enhancment): dhclient reject option`` +* :vytask:`T3328` ``(bug): Bgp not possible to delete bgp route-map`` + + +2021-04-10 +========== + +* :vytask:`T3460` ``(bug): bgp, Configuration FRR failed while commiting code`` + + +2021-04-09 +========== + +* :vytask:`T3464` ``(bug): OSPF: route-map names containing a hypen are not "found"`` + + +2021-04-08 +========== + +* :vytask:`T3462` ``(default): show ipv6 bgp -- missing`` +* :vytask:`T3463` ``(bug): Prevent IPv4 Route exchange with IPv6 neighbors`` + + +2021-04-05 +========== + +* :vytask:`T3438` ``(bug): VRF: removing vif which belongs to a vrf, will delete the entire vrf from the operating system`` +* :vytask:`T3418` ``(bug): BGP: system wide known interface can not be used as neighbor`` + + +2021-04-04 +========== + +* :vytask:`T3457` ``(feature): Output the "monitor log" command in a colorful way`` + + +2021-03-31 +========== + +* :vytask:`T3445` ``(bug): vyos-1x build include not all nodes`` + + +2021-03-30 +========== + +* :vytask:`T3448` ``(bug): Loading vyos on a system without xdp installed fails`` + + +2021-03-29 +========== + +* :vytask:`T3415` ``(feature): bridge: add support for isolated interfaces (private-vlan)`` +* :vytask:`T1711` ``(feature): BGP - migrate from tagNode to node (remove ASN from tagNode)`` + + +2021-03-28 +========== + +* :vytask:`T3440` ``(bug): HTTP API: give uvicorn time to initialize before restarting Nginx proxy`` + + +2021-03-27 +========== + +* :vytask:`T3423` ``(bug): Cannot create ipv4 static route for default gateway in vrf`` + + +2021-03-26 +========== + +* :vytask:`T3412` ``(default): HTTP API: move to FastAPI as web framework`` +* :vytask:`T2397` ``(feature): HTTP API: export OpenAPI definition`` + + +2021-03-24 +========== + +* :vytask:`T3419` ``(bug): show interfaces | strip-private fails`` + + +2021-03-22 +========== + +* :vytask:`T3284` ``(bug): merge/load fail silently if unable to resolve host`` + + +2021-03-21 +========== + +* :vytask:`T3417` ``(default): ISIS: provide per VRF instance support`` +* :vytask:`T3416` ``(bug): NTP: when running inside a VRF op-mode commands do not work`` + + +2021-03-20 +========== + +* :vytask:`T3392` ``(bug): vrrp over dhcp default route bug (unexpected vrf)`` +* :vytask:`T3373` ``(feature): Upgrade to SaltStack version 3002.5`` +* :vytask:`T3329` ``(default): "system conntrack ignore" rules can no longer be created due to an iptables syntax change`` +* :vytask:`T3300` ``(feature): Add DHCP default route distance`` +* :vytask:`T3306` ``(feature): Extend set route-map aggregator as to 4 Bytes`` + + +2021-03-18 +========== + +* :vytask:`T3411` ``(default): Extend the redirect_stdout context manager in vyos-configd to redirect stdout from subprocesses`` +* :vytask:`T3271` ``(bug): qemu-kvm grub issue`` + + +2021-03-17 +========== + +* :vytask:`T3413` ``(bug): Configuring invalid IPv6 EUI64 address results in "OSError: illegal IP address string passed to inet_pton"`` + + +2021-03-14 +========== + +* :vytask:`T3345` ``(default): BGP: add per VRF instance support`` +* :vytask:`T3344` ``(default): Per VRF dynamic routing support`` +* :vytask:`T3325` ``(bug): Bgp listen-range wrong commit message`` +* :vytask:`T1513` ``(default): Move OSPF and RIP interface configuration under protocols`` + + +2021-03-13 +========== + +* :vytask:`T3406` ``(bug): tunnel: interface no longer supports specifying encaplimit none - or migrator is missing`` +* :vytask:`T3407` ``(bug): console-server: do not allow to spawn a console-server session on serial port used by "system console"`` + + +2021-03-11 +========== + +* :vytask:`T3305` ``(bug): Ingress qdisc does not work anymore in 1.3-rolling-202101 snapshot`` +* :vytask:`T2927` ``(bug): isc-dhcpd release and expiry events never execute`` + + +2021-03-09 +========== + +* :vytask:`T3382` ``(bug): Error creating Console Server`` + + +2021-03-08 +========== + +* :vytask:`T3387` ``(bug): Command "Monitor vpn ipsec" is not working`` + + +2021-03-07 +========== + +* :vytask:`T3388` ``(bug): show interfaces doesn't display pppoeX`` +* :vytask:`T3211` ``(feature): ability to redistribute ISIS into other routing protocols`` + + +2021-03-04 +========== + +* :vytask:`T3377` ``(bug): show interfaces throws error`` + + +2021-03-02 +========== + +* :vytask:`T3375` ``(bug): Interface becomes up at boot even when disabled`` + + +2021-02-28 +========== + +* :vytask:`T3370` ``(bug): dhcp: Invalid domain name "private"`` +* :vytask:`T3369` ``(feature): VXLAN: add IPv6 underlay support`` +* :vytask:`T3363` ``(bug): VyOS-Build interactive prompt when using Podman`` +* :vytask:`T3320` ``(bug): Bgp neighbor peer-group without peer-group fail`` + + +2021-02-27 +========== + +* :vytask:`T3365` ``(bug): Bgp neighbor interface ordering for remote-as`` +* :vytask:`T3225` ``(bug): Adding a BGP neighbor with an address on a local interface throws a vyos.frr.CommitError: Configuration FRR failed while committing code: ''`` +* :vytask:`T3368` ``(feature): macsec: add support for gcm-aes-256 cipher`` +* :vytask:`T3173` ``(feature): Need 'nopmtudisc' option for tunnel interface`` + + +2021-02-26 +========== + +* :vytask:`T3324` ``(bug): Bgp space in the password`` +* :vytask:`T3357` ``(default): HTTP-API redirect from http correct https port`` +* :vytask:`T3323` ``(bug): Bgp ttl-security and ebgp-multihop fail`` + + +2021-02-24 +========== + +* :vytask:`T3303` ``(feature): Change welcome message on boot`` + + +2021-02-22 +========== + +* :vytask:`T3322` ``(bug): Bgp neighbor timers not applyed to FRR config`` +* :vytask:`T3327` ``(bug): OSPFv3: Cannot add dummy interface`` + + +2021-02-21 +========== + +* :vytask:`T3331` ``(bug): Bgp unsuppress-map should be as "value leafNode"`` +* :vytask:`T3330` ``(bug): Bgp capability orf prefix-list fail`` +* :vytask:`T3163` ``(feature): ethernet ring-buffer can be set with an invalid value`` + + +2021-02-19 +========== + +* :vytask:`T3326` ``(bug): OSPFv3: Cannot add L2TPv3 interface`` +* :vytask:`T3332` ``(bug): BGP unnumbered - UnboundLocalError: local variable 'peer_group' referenced before assignment`` + + +2021-02-18 +========== + +* :vytask:`T3259` ``(default): many dnat rules makes the vyos http api crash, even showConfig op timeouts`` + + +2021-02-17 +========== + +* :vytask:`T3312` ``(feature): SolarFlare NICs support`` + + +2021-02-16 +========== + +* :vytask:`T3313` ``(bug): ospfv3 interface missing options`` +* :vytask:`T3318` ``(feature): Update Linux Kernel to v5.4.208 / 5.10.142`` + + +2021-02-15 +========== + +* :vytask:`T3311` ``(bug): BGP Error: Remote AS must be set for neighbor or peer-group`` + + +2021-02-14 +========== + +* :vytask:`T2848` ``(feature): bgp-add-path configuration options`` + + +2021-02-12 +========== + +* :vytask:`T3301` ``(bug): Wrong format and valueHelp for policy as-path-list regex`` + + +2021-02-11 +========== + +* :vytask:`T3281` ``(default): Rewrite protocol RIPng [conf-mode] to new XML/Python style`` +* :vytask:`T3282` ``(default): Add XML for [conf-mode] RIPng`` +* :vytask:`T3279` ``(default): Rewrite protocol STATIC [op-mode] to new XML/Python style`` +* :vytask:`T3297` ``(bug): Optimize irrelevant error stack hints`` + + +2021-02-08 +========== + +* :vytask:`T3295` ``(feature): Update Linux Kernel to v5.4.96 / 5.10.14`` + + +2021-02-05 +========== + +* :vytask:`T3030` ``(feature): Support ERSPAN Tunnel Protocol`` + + +2021-02-04 +========== + +* :vytask:`T3283` ``(feature): Support for IPv4 neigh tables`` +* :vytask:`T3280` ``(default): Add XML for [conf-mode] STATIC`` + + +2021-02-03 +========== + +* :vytask:`T3278` ``(feature): Add XML for "protocols vrf" [conf-mode]`` +* :vytask:`T3239` ``(default): XML: override 'defaultValue' for mtu of certain interfaces; remove workarounds`` +* :vytask:`T2910` ``(feature): XML: generator should support override of variables`` + + +2021-02-02 +========== + +* :vytask:`T3018` ``(bug): Unclear behaviour when configuring vif and vif-s interfaces`` +* :vytask:`T3255` ``(default): Rewrite protocol RPKI to new XML/Python style`` +* :vytask:`T3263` ``(feature): OSPF Hello subsecond timer`` + + +2021-01-31 +========== + +* :vytask:`T3276` ``(feature): Update Linux Kernel to v5.4.94 / 5.10.12`` + + +2021-01-30 +========== + +* :vytask:`T3240` ``(feature): Support per-interface DHCPv6 DUIDs`` +* :vytask:`T3273` ``(default): PPPoE static default-routes deleted on interface down when not added by interface up`` + + +2021-01-29 +========== + +* :vytask:`T3261` ``(bug): Does not possible to disable pppoe client interface.`` +* :vytask:`T3272` ``(default): OSPF: interface config is not removed`` + + +2021-01-27 +========== + +* :vytask:`T3257` ``(feature): tcpdump supporting complete protocol`` +* :vytask:`T3244` ``(default): Rewrite protocol OSPFv3 to new XML/Python style`` + + +2021-01-26 +========== + +* :vytask:`T3251` ``(bug): PPPoE client trying to authorize with the wrong username`` +* :vytask:`T3256` ``(default): Add XML for protocol RPKI [conf-mode]`` + + +2021-01-25 +========== + +* :vytask:`T3249` ``(feature): Support operation mode forwarding table output`` + + +2021-01-24 +========== + +* :vytask:`T3227` ``(bug): Latest releases don't work with RPKI (crash)`` +* :vytask:`T3230` ``(bug): RPKI can't be deleted`` +* :vytask:`T3221` ``(bug): FRR config`` +* :vytask:`T3245` ``(default): Add XML for protocol ospfv3 [conf-mode]`` + + +2021-01-23 +========== + +* :vytask:`T3236` ``(default): Add XML for [conf-mode] OSPF`` + + +2021-01-17 +========== + +* :vytask:`T3222` ``(bug): Typo in BGP dampening description`` +* :vytask:`T3226` ``(bug): Repair bridge smoke test damage`` + + +2021-01-16 +========== + +* :vytask:`T3215` ``(bug): Operational command "show ipv6 route" is broken`` +* :vytask:`T3157` ``(bug): salt-minion fails to start due to permission error accessing /root/.salt/minion.log`` +* :vytask:`T3137` ``(feature): Let VLAN aware bridge approach the behavior of professional equipment`` + + +2021-01-15 +========== + +* :vytask:`T3210` ``(feature): ISIS three-way-handshake`` +* :vytask:`T3184` ``(feature): Add correct desctiptions for BGP neighbors`` + + +2021-01-14 +========== + +* :vytask:`T3213` ``(bug): show interface command python error`` + + +2021-01-12 +========== + +* :vytask:`T3205` ``(bug): Does not possible to configure tunnel mode gre-bridge`` + + +2020-12-20 +========== + +* :vytask:`T3132` ``(feature): Enable egress flow accounting`` + + +2020-11-29 +========== + +* :vytask:`T2297` ``(feature): NTP add support for pool configuration`` diff --git a/docs/changelog/rst-1.5.rst b/docs/changelog/rst-1.5.rst new file mode 100644 index 00000000..206d5bde --- /dev/null +++ b/docs/changelog/rst-1.5.rst @@ -0,0 +1,47 @@ +############ +1.5 Circinus +############ + +.. + Please don't add anything by hand. + This file is managed by the script: + _ext/releasenotes.py + + +2023-09-11 +========== + +* :vytask:`T5562` ``(bug): Smoketests fail for vyos:current (test_netns.py)`` +* :vytask:`T5551` ``(bug): Missing check for boot_configuration_complete raises error in vyos-save-config.py`` +* :vytask:`T5353` ``(bug): config-mgmt: normalize archive updates and commit log entries`` + + +2023-09-10 +========== + +* :vytask:`T5555` ``(bug): Fix timezone migrator (system 13-to-14)`` + + +2023-09-09 +========== + +* :vytask:`T5423` ``(bug): ipsec: no output for op-cmd "show vpn ike secrets"`` + + +2023-09-08 +========== + +* :vytask:`T5560` ``(bug): VyOS version in current branch should be changed from 1.4 to 1.5`` + + +2023-09-07 +========== + +* :vytask:`T5556` ``(bug): reboot now and poweroff does not work`` +* :vytask:`T5489` ``(feature): Change to BBR as TCP congestion control, or at least make it an config option`` + + +2023-09-06 +========== + +* :vytask:`T5548` ``(bug): HAProxy renders timeouts incorrectly`` diff --git a/docs/changelog/rst-index.rst b/docs/changelog/rst-index.rst new file mode 100644 index 00000000..9467a716 --- /dev/null +++ b/docs/changelog/rst-index.rst @@ -0,0 +1,21 @@ +.. _release-notes: + + +######### +Changelog +######### + + +.. toctree:: + :maxdepth: 1 + :includehidden: + + 1.5 + 1.4 + 1.3 + 1.2.6 + 1.2.5 + 1.2.4 + 1.2.3 + 1.2.2 + 1.2.1 diff --git a/docs/conf.py b/docs/conf.py index b2bc2c86..feee8d86 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -87,14 +87,14 @@ gettext_uuid = False # This pattern also affects html_static_path and html_extra_path . exclude_patterns = [ u'_build', 'Thumbs.db', '.DS_Store', '_include/vyos-1x', - 'md-*.md', '**/md-*.md', + 'rst-*.rst', '**/rst-*.rst', ] import pathlib _build = pathlib.Path(__file__).parent / '_build' -if (_build / '_swap_state.json').exists() and (_build / '_swap_exclude.txt').exists(): +if (_build / '_rst_override_state.json').exists() and (_build / '_md_exclude.txt').exists(): exclude_patterns.extend( - s for s in (line.strip() for line in (_build / '_swap_exclude.txt').read_text().splitlines()) if s + s for s in (line.strip() for line in (_build / '_md_exclude.txt').read_text().splitlines()) if s ) # The name of the Pygments (syntax highlighting) style to use. diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md new file mode 100644 index 00000000..bf77bcc9 --- /dev/null +++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md @@ -0,0 +1,96 @@ +# DHCP Relay trough GRE-Bridge + +Testdate: 2023-05-11 + +Version: 1.4-rolling-202305100734 + +This simple structure shows how to configure a DHCP Relay over a GRE Bridge +interface. + +## Topology + +The topology has 3 VyOS routers and one client. Between the DHCP Server and +the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large +Network. + +```{image} _include/topology.png +:alt: Ansible Example topology image +``` + +## Configuration + +First, we configure the transport network and the Tunnel interface. + +Transport: + +```{eval-rst} +.. literalinclude:: _include/transport.conf + :language: none + +``` + +DHCP-Server + +```{eval-rst} +.. literalinclude:: _include/dhcp-server.conf + :language: none + :lines: 1-8 + +``` + +DHCP-Relay + +```{eval-rst} +.. literalinclude:: _include/dhcp-relay.conf + :language: none + :lines: 1-8 + +``` + +After this, we need the DHCP-Server and Relay configuration. +To get a testable result, we just have one IP in the DHCP range. +Expand it as you need it. + +DHCP-Server + +```{eval-rst} +.. literalinclude:: _include/dhcp-server.conf + :language: none + :lines: 9-13 + +``` + +DHCP-Relay + +```{eval-rst} +.. literalinclude:: _include/dhcp-relay.conf + :language: none + :lines: 9-10 + +``` + +## Test the result + +Ping the Client from the DHCP Server. + +```none +vyos@dhcp-server:~$ ping 192.168.0.30 count 4 +PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data. +64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms +64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms +64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms +64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms + +--- 192.168.0.30 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3004ms +rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms +``` + +And show all DHCP Leases + +```none +vyos@dhcp-server:~$ show dhcp server leases +IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname +------------ ----------------- ------- ------------------- ------------------- ----------- ---------- ---------- +192.168.0.30 00:50:79:66:68:05 active 2023/05/11 13:08:50 2023/05/12 13:08:50 23:59:16 DHCPTun100 VPCS +``` diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst deleted file mode 100644 index 77f9b118..00000000 --- a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst +++ /dev/null @@ -1,98 +0,0 @@ -############################ -DHCP Relay trough GRE-Bridge -############################ - - -| Testdate: 2023-05-11 -| Version: 1.4-rolling-202305100734 - - -This simple structure shows how to configure a DHCP Relay over a GRE Bridge -interface. - -******** -Topology -******** - -The topology has 3 VyOS routers and one client. Between the DHCP Server and -the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large -Network. - -.. image:: _include/topology.png - :alt: Ansible Example topology image - -************* -Configuration -************* - -First, we configure the transport network and the Tunnel interface. - - -Transport: - -.. literalinclude:: _include/transport.conf - :language: none - - -DHCP-Server - -.. literalinclude:: _include/dhcp-server.conf - :language: none - :lines: 1-8 - - -DHCP-Relay - -.. literalinclude:: _include/dhcp-relay.conf - :language: none - :lines: 1-8 - - -After this, we need the DHCP-Server and Relay configuration. -To get a testable result, we just have one IP in the DHCP range. -Expand it as you need it. - -DHCP-Server - -.. literalinclude:: _include/dhcp-server.conf - :language: none - :lines: 9-13 - - -DHCP-Relay - -.. literalinclude:: _include/dhcp-relay.conf - :language: none - :lines: 9-10 - - -*************** -Test the result -*************** - -Ping the Client from the DHCP Server. - - -.. code-block:: none - - vyos@dhcp-server:~$ ping 192.168.0.30 count 4 - PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data. - 64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms - 64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms - 64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms - 64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms - - --- 192.168.0.30 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3004ms - rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms - - -And show all DHCP Leases - - -.. code-block:: none - - vyos@dhcp-server:~$ show dhcp server leases - IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname - ------------ ----------------- ------- ------------------- ------------------- ----------- ---------- ---------- - 192.168.0.30 00:50:79:66:68:05 active 2023/05/11 13:08:50 2023/05/12 13:08:50 23:59:16 DHCPTun100 VPCS diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md b/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md deleted file mode 100644 index bf77bcc9..00000000 --- a/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md +++ /dev/null @@ -1,96 +0,0 @@ -# DHCP Relay trough GRE-Bridge - -Testdate: 2023-05-11 - -Version: 1.4-rolling-202305100734 - -This simple structure shows how to configure a DHCP Relay over a GRE Bridge -interface. - -## Topology - -The topology has 3 VyOS routers and one client. Between the DHCP Server and -the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large -Network. - -```{image} _include/topology.png -:alt: Ansible Example topology image -``` - -## Configuration - -First, we configure the transport network and the Tunnel interface. - -Transport: - -```{eval-rst} -.. literalinclude:: _include/transport.conf - :language: none - -``` - -DHCP-Server - -```{eval-rst} -.. literalinclude:: _include/dhcp-server.conf - :language: none - :lines: 1-8 - -``` - -DHCP-Relay - -```{eval-rst} -.. literalinclude:: _include/dhcp-relay.conf - :language: none - :lines: 1-8 - -``` - -After this, we need the DHCP-Server and Relay configuration. -To get a testable result, we just have one IP in the DHCP range. -Expand it as you need it. - -DHCP-Server - -```{eval-rst} -.. literalinclude:: _include/dhcp-server.conf - :language: none - :lines: 9-13 - -``` - -DHCP-Relay - -```{eval-rst} -.. literalinclude:: _include/dhcp-relay.conf - :language: none - :lines: 9-10 - -``` - -## Test the result - -Ping the Client from the DHCP Server. - -```none -vyos@dhcp-server:~$ ping 192.168.0.30 count 4 -PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data. -64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms -64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms -64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms -64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms - ---- 192.168.0.30 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3004ms -rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms -``` - -And show all DHCP Leases - -```none -vyos@dhcp-server:~$ show dhcp server leases -IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname ------------- ----------------- ------- ------------------- ------------------- ----------- ---------- ---------- -192.168.0.30 00:50:79:66:68:05 active 2023/05/11 13:08:50 2023/05/12 13:08:50 23:59:16 DHCPTun100 VPCS -``` diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst b/docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst new file mode 100644 index 00000000..77f9b118 --- /dev/null +++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst @@ -0,0 +1,98 @@ +############################ +DHCP Relay trough GRE-Bridge +############################ + + +| Testdate: 2023-05-11 +| Version: 1.4-rolling-202305100734 + + +This simple structure shows how to configure a DHCP Relay over a GRE Bridge +interface. + +******** +Topology +******** + +The topology has 3 VyOS routers and one client. Between the DHCP Server and +the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large +Network. + +.. image:: _include/topology.png + :alt: Ansible Example topology image + +************* +Configuration +************* + +First, we configure the transport network and the Tunnel interface. + + +Transport: + +.. literalinclude:: _include/transport.conf + :language: none + + +DHCP-Server + +.. literalinclude:: _include/dhcp-server.conf + :language: none + :lines: 1-8 + + +DHCP-Relay + +.. literalinclude:: _include/dhcp-relay.conf + :language: none + :lines: 1-8 + + +After this, we need the DHCP-Server and Relay configuration. +To get a testable result, we just have one IP in the DHCP range. +Expand it as you need it. + +DHCP-Server + +.. literalinclude:: _include/dhcp-server.conf + :language: none + :lines: 9-13 + + +DHCP-Relay + +.. literalinclude:: _include/dhcp-relay.conf + :language: none + :lines: 9-10 + + +*************** +Test the result +*************** + +Ping the Client from the DHCP Server. + + +.. code-block:: none + + vyos@dhcp-server:~$ ping 192.168.0.30 count 4 + PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data. + 64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms + 64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms + 64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms + 64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms + + --- 192.168.0.30 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3004ms + rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms + + +And show all DHCP Leases + + +.. code-block:: none + + vyos@dhcp-server:~$ show dhcp server leases + IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname + ------------ ----------------- ------- ------------------- ------------------- ----------- ---------- ---------- + 192.168.0.30 00:50:79:66:68:05 active 2023/05/11 13:08:50 2023/05/12 13:08:50 23:59:16 DHCPTun100 VPCS diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md new file mode 100644 index 00000000..38ae9e8f --- /dev/null +++ b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md @@ -0,0 +1,250 @@ +# L3VPN EVPN with VyOS + +Testdate: 2023-05-11 + +Version: 1.4-rolling-202305100734 + +I spun up a new lab in EVE-NG, which represents this as the +"Foo Bar - Service Provider Inc." that has 3 points of presence (PoP) in random +datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two +customers. + +I named the customers blue, red and green which is common practice in +VRF (Virtual Routing and Forwarding) documentation scenarios. + +- PE1 is located in an industrial area that holds multiple office buildings. + All customers have a site in this area. +- PE2 is located in a smaller area where by coincidence two customers + (blue and red) share an office building. +- PE3 is located in a smaller area where by coincidence two customers + (blue and green) are located. + +## Management VRF + +A brief excursion into VRFs: This has been one of the longest-standing feature +requests of VyOS (dating back to 2016) which can be described as +"a VLAN for layer 2 is what a VRF is for layer 3". +With VRFs, a router/system can hold multiple, isolated routing tables on the +same system. If you wonder what's the difference between multiple tables that +people used for policy-based routing since forever, it's that a VRF also +isolates connected routes rather than just static and dynamically learned +routes, so it allows NICs in different VRFs to use conflicting network +ranges without issues. + +VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing) +and VyOS 1.4 now enables full dynamic routing protocol support for +OSPF, IS-IS, and BGP for individual VRFs. + +The lab I built is using a VRF (called **mgmt**) to provide out-of-band +SSH access to the PE (Provider Edge) routers. + +```{eval-rst} +.. literalinclude:: _include/PE1.conf + :language: none + :lines: 1-6 + +``` + +## Topology + +We use the following network topology in this example: + +```{image} _include/topology.png +:alt: L3VPN EVPN with VyOS topology image +``` + +## Core network + +I chose to run OSPF as the IGP (Interior Gateway Protocol). +All required BGP sessions are established via a dummy interfaces +(similar to the loopback, but in Linux you can have only one loopback, +while there can be many dummy interfaces) on the PE routers. In case of a link +failure, traffic is diverted in the other direction in this triangle setup and +BGP sessions will not go down. One could even enable +BFD (Bidirectional Forwarding Detection) on the links for a faster +failover and resilience in the network. + +Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from +even the prior post about this subject. This is due to T1711, where it was +finally decided to get rid of the redundant BGP ASN (Autonomous System Number) +specification on the CLI and move it to a single leaf node +(set protocols bgp local-as). + +It's important to note that all your existing configurations will be migrated +automatically on image upgrade. Nothing to do on your side. + +PE1 + +```{eval-rst} +.. literalinclude:: _include/PE1.conf + :language: none + :lines: 8-38 +``` + +PE2 + +```{eval-rst} +.. literalinclude:: _include/PE2.conf + :language: none + :lines: 8-38 +``` + +PE3 + +```{eval-rst} +.. literalinclude:: _include/PE3.conf + :language: none + :lines: 8-38 + +``` + +## Tenant networks (VRFs) + +Once all routers can be safely remotely managed and the core network is +operational, we can now setup the tenant networks. + +Every tenant is assigned an individual VRF that would support overlapping +address ranges for customers blue, red and green. In our example, +we do not use overlapping ranges to make it easier when showing debug commands. + +Thus you can easily match it to one of the devices/networks below. + +Every router that provides access to a customer network needs to have the +customer network (VRF + VNI) configured. To make our own lives easier, +we utilize the same VRF table id (local routing table number) and +VNI (Virtual Network Identifier) per tenant on all our routers. + +- blue uses local routing table id and VNI 2000 +- red uses local routing table id and VNI 3000 +- green uses local routing table id and VNI 4000 + +PE1 + +```{eval-rst} +.. literalinclude:: _include/PE1.conf + :language: none + :lines: 40-96 +``` + +PE2 + +```{eval-rst} +.. literalinclude:: _include/PE2.conf + :language: none + :lines: 40-89 +``` + +PE3 + +```{eval-rst} +.. literalinclude:: _include/PE3.conf + :language: none + :lines: 40-89 +``` + +## Testing and debugging + +You managed to come this far, now we want to see the network and routing +tables in action. + +Show routes for all VRFs + +```none +vyos@PE1:~$ show ip route vrf all +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF blue: +C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13 +B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49 +B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49 + +VRF default: +O 172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09 +C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12 +O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46 + * via 172.29.0.7, eth3, weight 1, 00:00:46 +O 172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09 +C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12 +C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14 +O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50 +O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45 + +VRF green: +C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13 +B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49 + +VRF mgmt: +S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45 +C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45 + +VRF red: +C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13 +B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49 +``` + +Information about Ethernet Virtual Private Networks + +```none +vyos@PE1:~$ show bgp l2vpn evpn +BGP table version is 1, local router ID is 172.29.255.1 +Status codes: s suppressed, d damped, h history, * valid, > best, i - internal +Origin codes: i - IGP, e - EGP, ? - incomplete +EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id] +EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP] +EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP] +EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP] +EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP] + + Network Next Hop Metric LocPrf Weight Path +Route Distinguisher: 10.1.1.1:5 +*> [5]:[0]:[24]:[10.1.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6 +Route Distinguisher: 10.1.2.1:4 +*>i[5]:[0]:[24]:[10.1.2.0] + 172.29.255.2 0 100 0 ? + RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea +Route Distinguisher: 10.1.3.1:4 +*>i[5]:[0]:[24]:[10.1.3.0] + 172.29.255.3 0 100 0 ? + RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54 +Route Distinguisher: 10.2.1.1:6 +*> [5]:[0]:[24]:[10.2.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:3000 Rmac:50:00:00:01:00:05 +Route Distinguisher: 10.2.2.1:5 +*>i[5]:[0]:[24]:[10.2.2.0] + 172.29.255.2 0 100 0 ? + RT:100:3000 ET:8 Rmac:50:00:00:02:00:05 +Route Distinguisher: 10.3.1.1:7 +*> [5]:[0]:[24]:[10.3.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:4000 Rmac:50:00:00:01:00:06 +Route Distinguisher: 10.3.3.1:6 +*>i[5]:[0]:[24]:[10.3.3.0] + 172.29.255.3 0 100 0 ? + RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a + +Displayed 7 out of 7 total prefixes +``` + +If we need to retrieve information about a specific host/network inside +the EVPN network we need to run + +```none +vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10 +BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0] +Paths: (1 available, best #1) + Not advertised to any peer + Route [5]:[0]:[24]:[10.3.1.0] VNI 4000 + Local + 172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06 + Last update: Thu May 11 13:31:13 2023 +``` diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst deleted file mode 100644 index 2a528852..00000000 --- a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst +++ /dev/null @@ -1,251 +0,0 @@ - -#################### -L3VPN EVPN with VyOS -#################### - -| Testdate: 2023-05-11 -| Version: 1.4-rolling-202305100734 - -I spun up a new lab in EVE-NG, which represents this as the -"Foo Bar - Service Provider Inc." that has 3 points of presence (PoP) in random -datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two -customers. - -I named the customers blue, red and green which is common practice in -VRF (Virtual Routing and Forwarding) documentation scenarios. - -* PE1 is located in an industrial area that holds multiple office buildings. - All customers have a site in this area. -* PE2 is located in a smaller area where by coincidence two customers - (blue and red) share an office building. -* PE3 is located in a smaller area where by coincidence two customers - (blue and green) are located. - -************** -Management VRF -************** - -A brief excursion into VRFs: This has been one of the longest-standing feature -requests of VyOS (dating back to 2016) which can be described as -"a VLAN for layer 2 is what a VRF is for layer 3". -With VRFs, a router/system can hold multiple, isolated routing tables on the -same system. If you wonder what's the difference between multiple tables that -people used for policy-based routing since forever, it's that a VRF also -isolates connected routes rather than just static and dynamically learned -routes, so it allows NICs in different VRFs to use conflicting network -ranges without issues. - -VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing) -and VyOS 1.4 now enables full dynamic routing protocol support for -OSPF, IS-IS, and BGP for individual VRFs. - -The lab I built is using a VRF (called **mgmt**) to provide out-of-band -SSH access to the PE (Provider Edge) routers. - -.. literalinclude:: _include/PE1.conf - :language: none - :lines: 1-6 - - -******** -Topology -******** - -We use the following network topology in this example: - -.. image:: _include/topology.png - :alt: L3VPN EVPN with VyOS topology image - - -************ -Core network -************ - -I chose to run OSPF as the IGP (Interior Gateway Protocol). -All required BGP sessions are established via a dummy interfaces -(similar to the loopback, but in Linux you can have only one loopback, -while there can be many dummy interfaces) on the PE routers. In case of a link -failure, traffic is diverted in the other direction in this triangle setup and -BGP sessions will not go down. One could even enable -BFD (Bidirectional Forwarding Detection) on the links for a faster -failover and resilience in the network. - -Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from -even the prior post about this subject. This is due to T1711, where it was -finally decided to get rid of the redundant BGP ASN (Autonomous System Number) -specification on the CLI and move it to a single leaf node -(set protocols bgp local-as). - -It's important to note that all your existing configurations will be migrated -automatically on image upgrade. Nothing to do on your side. - -PE1 - -.. literalinclude:: _include/PE1.conf - :language: none - :lines: 8-38 - -PE2 - -.. literalinclude:: _include/PE2.conf - :language: none - :lines: 8-38 - -PE3 - -.. literalinclude:: _include/PE3.conf - :language: none - :lines: 8-38 - - -********************** -Tenant networks (VRFs) -********************** - -Once all routers can be safely remotely managed and the core network is -operational, we can now setup the tenant networks. - -Every tenant is assigned an individual VRF that would support overlapping -address ranges for customers blue, red and green. In our example, -we do not use overlapping ranges to make it easier when showing debug commands. - -Thus you can easily match it to one of the devices/networks below. - -Every router that provides access to a customer network needs to have the -customer network (VRF + VNI) configured. To make our own lives easier, -we utilize the same VRF table id (local routing table number) and -VNI (Virtual Network Identifier) per tenant on all our routers. - -* blue uses local routing table id and VNI 2000 -* red uses local routing table id and VNI 3000 -* green uses local routing table id and VNI 4000 - -PE1 - -.. literalinclude:: _include/PE1.conf - :language: none - :lines: 40-96 - -PE2 - -.. literalinclude:: _include/PE2.conf - :language: none - :lines: 40-89 - -PE3 - -.. literalinclude:: _include/PE3.conf - :language: none - :lines: 40-89 - -********************* -Testing and debugging -********************* - -You managed to come this far, now we want to see the network and routing -tables in action. - -Show routes for all VRFs - - -.. code-block:: none - - vyos@PE1:~$ show ip route vrf all - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF blue: - C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13 - B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49 - B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49 - - VRF default: - O 172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09 - C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12 - O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46 - * via 172.29.0.7, eth3, weight 1, 00:00:46 - O 172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09 - C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12 - C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14 - O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50 - O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45 - - VRF green: - C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13 - B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49 - - VRF mgmt: - S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45 - C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45 - - VRF red: - C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13 - B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49 - -Information about Ethernet Virtual Private Networks - - -.. code-block:: none - - vyos@PE1:~$ show bgp l2vpn evpn - BGP table version is 1, local router ID is 172.29.255.1 - Status codes: s suppressed, d damped, h history, * valid, > best, i - internal - Origin codes: i - IGP, e - EGP, ? - incomplete - EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id] - EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP] - EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP] - EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP] - EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP] - - Network Next Hop Metric LocPrf Weight Path - Route Distinguisher: 10.1.1.1:5 - *> [5]:[0]:[24]:[10.1.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6 - Route Distinguisher: 10.1.2.1:4 - *>i[5]:[0]:[24]:[10.1.2.0] - 172.29.255.2 0 100 0 ? - RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea - Route Distinguisher: 10.1.3.1:4 - *>i[5]:[0]:[24]:[10.1.3.0] - 172.29.255.3 0 100 0 ? - RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54 - Route Distinguisher: 10.2.1.1:6 - *> [5]:[0]:[24]:[10.2.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:3000 Rmac:50:00:00:01:00:05 - Route Distinguisher: 10.2.2.1:5 - *>i[5]:[0]:[24]:[10.2.2.0] - 172.29.255.2 0 100 0 ? - RT:100:3000 ET:8 Rmac:50:00:00:02:00:05 - Route Distinguisher: 10.3.1.1:7 - *> [5]:[0]:[24]:[10.3.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:4000 Rmac:50:00:00:01:00:06 - Route Distinguisher: 10.3.3.1:6 - *>i[5]:[0]:[24]:[10.3.3.0] - 172.29.255.3 0 100 0 ? - RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a - - Displayed 7 out of 7 total prefixes - -If we need to retrieve information about a specific host/network inside -the EVPN network we need to run - - -.. code-block:: none - - vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10 - BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0] - Paths: (1 available, best #1) - Not advertised to any peer - Route [5]:[0]:[24]:[10.3.1.0] VNI 4000 - Local - 172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06 - Last update: Thu May 11 13:31:13 2023 diff --git a/docs/configexamples/autotest/L3VPN_EVPN/md-L3VPN_EVPN.md b/docs/configexamples/autotest/L3VPN_EVPN/md-L3VPN_EVPN.md deleted file mode 100644 index 38ae9e8f..00000000 --- a/docs/configexamples/autotest/L3VPN_EVPN/md-L3VPN_EVPN.md +++ /dev/null @@ -1,250 +0,0 @@ -# L3VPN EVPN with VyOS - -Testdate: 2023-05-11 - -Version: 1.4-rolling-202305100734 - -I spun up a new lab in EVE-NG, which represents this as the -"Foo Bar - Service Provider Inc." that has 3 points of presence (PoP) in random -datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two -customers. - -I named the customers blue, red and green which is common practice in -VRF (Virtual Routing and Forwarding) documentation scenarios. - -- PE1 is located in an industrial area that holds multiple office buildings. - All customers have a site in this area. -- PE2 is located in a smaller area where by coincidence two customers - (blue and red) share an office building. -- PE3 is located in a smaller area where by coincidence two customers - (blue and green) are located. - -## Management VRF - -A brief excursion into VRFs: This has been one of the longest-standing feature -requests of VyOS (dating back to 2016) which can be described as -"a VLAN for layer 2 is what a VRF is for layer 3". -With VRFs, a router/system can hold multiple, isolated routing tables on the -same system. If you wonder what's the difference between multiple tables that -people used for policy-based routing since forever, it's that a VRF also -isolates connected routes rather than just static and dynamically learned -routes, so it allows NICs in different VRFs to use conflicting network -ranges without issues. - -VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing) -and VyOS 1.4 now enables full dynamic routing protocol support for -OSPF, IS-IS, and BGP for individual VRFs. - -The lab I built is using a VRF (called **mgmt**) to provide out-of-band -SSH access to the PE (Provider Edge) routers. - -```{eval-rst} -.. literalinclude:: _include/PE1.conf - :language: none - :lines: 1-6 - -``` - -## Topology - -We use the following network topology in this example: - -```{image} _include/topology.png -:alt: L3VPN EVPN with VyOS topology image -``` - -## Core network - -I chose to run OSPF as the IGP (Interior Gateway Protocol). -All required BGP sessions are established via a dummy interfaces -(similar to the loopback, but in Linux you can have only one loopback, -while there can be many dummy interfaces) on the PE routers. In case of a link -failure, traffic is diverted in the other direction in this triangle setup and -BGP sessions will not go down. One could even enable -BFD (Bidirectional Forwarding Detection) on the links for a faster -failover and resilience in the network. - -Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from -even the prior post about this subject. This is due to T1711, where it was -finally decided to get rid of the redundant BGP ASN (Autonomous System Number) -specification on the CLI and move it to a single leaf node -(set protocols bgp local-as). - -It's important to note that all your existing configurations will be migrated -automatically on image upgrade. Nothing to do on your side. - -PE1 - -```{eval-rst} -.. literalinclude:: _include/PE1.conf - :language: none - :lines: 8-38 -``` - -PE2 - -```{eval-rst} -.. literalinclude:: _include/PE2.conf - :language: none - :lines: 8-38 -``` - -PE3 - -```{eval-rst} -.. literalinclude:: _include/PE3.conf - :language: none - :lines: 8-38 - -``` - -## Tenant networks (VRFs) - -Once all routers can be safely remotely managed and the core network is -operational, we can now setup the tenant networks. - -Every tenant is assigned an individual VRF that would support overlapping -address ranges for customers blue, red and green. In our example, -we do not use overlapping ranges to make it easier when showing debug commands. - -Thus you can easily match it to one of the devices/networks below. - -Every router that provides access to a customer network needs to have the -customer network (VRF + VNI) configured. To make our own lives easier, -we utilize the same VRF table id (local routing table number) and -VNI (Virtual Network Identifier) per tenant on all our routers. - -- blue uses local routing table id and VNI 2000 -- red uses local routing table id and VNI 3000 -- green uses local routing table id and VNI 4000 - -PE1 - -```{eval-rst} -.. literalinclude:: _include/PE1.conf - :language: none - :lines: 40-96 -``` - -PE2 - -```{eval-rst} -.. literalinclude:: _include/PE2.conf - :language: none - :lines: 40-89 -``` - -PE3 - -```{eval-rst} -.. literalinclude:: _include/PE3.conf - :language: none - :lines: 40-89 -``` - -## Testing and debugging - -You managed to come this far, now we want to see the network and routing -tables in action. - -Show routes for all VRFs - -```none -vyos@PE1:~$ show ip route vrf all -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF blue: -C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13 -B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49 -B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49 - -VRF default: -O 172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09 -C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12 -O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46 - * via 172.29.0.7, eth3, weight 1, 00:00:46 -O 172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09 -C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12 -C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14 -O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50 -O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45 - -VRF green: -C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13 -B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49 - -VRF mgmt: -S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45 -C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45 - -VRF red: -C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13 -B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49 -``` - -Information about Ethernet Virtual Private Networks - -```none -vyos@PE1:~$ show bgp l2vpn evpn -BGP table version is 1, local router ID is 172.29.255.1 -Status codes: s suppressed, d damped, h history, * valid, > best, i - internal -Origin codes: i - IGP, e - EGP, ? - incomplete -EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id] -EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP] -EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP] -EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP] -EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP] - - Network Next Hop Metric LocPrf Weight Path -Route Distinguisher: 10.1.1.1:5 -*> [5]:[0]:[24]:[10.1.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6 -Route Distinguisher: 10.1.2.1:4 -*>i[5]:[0]:[24]:[10.1.2.0] - 172.29.255.2 0 100 0 ? - RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea -Route Distinguisher: 10.1.3.1:4 -*>i[5]:[0]:[24]:[10.1.3.0] - 172.29.255.3 0 100 0 ? - RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54 -Route Distinguisher: 10.2.1.1:6 -*> [5]:[0]:[24]:[10.2.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:3000 Rmac:50:00:00:01:00:05 -Route Distinguisher: 10.2.2.1:5 -*>i[5]:[0]:[24]:[10.2.2.0] - 172.29.255.2 0 100 0 ? - RT:100:3000 ET:8 Rmac:50:00:00:02:00:05 -Route Distinguisher: 10.3.1.1:7 -*> [5]:[0]:[24]:[10.3.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:4000 Rmac:50:00:00:01:00:06 -Route Distinguisher: 10.3.3.1:6 -*>i[5]:[0]:[24]:[10.3.3.0] - 172.29.255.3 0 100 0 ? - RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a - -Displayed 7 out of 7 total prefixes -``` - -If we need to retrieve information about a specific host/network inside -the EVPN network we need to run - -```none -vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10 -BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0] -Paths: (1 available, best #1) - Not advertised to any peer - Route [5]:[0]:[24]:[10.3.1.0] VNI 4000 - Local - 172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06 - Last update: Thu May 11 13:31:13 2023 -``` diff --git a/docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst b/docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst new file mode 100644 index 00000000..2a528852 --- /dev/null +++ b/docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst @@ -0,0 +1,251 @@ + +#################### +L3VPN EVPN with VyOS +#################### + +| Testdate: 2023-05-11 +| Version: 1.4-rolling-202305100734 + +I spun up a new lab in EVE-NG, which represents this as the +"Foo Bar - Service Provider Inc." that has 3 points of presence (PoP) in random +datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two +customers. + +I named the customers blue, red and green which is common practice in +VRF (Virtual Routing and Forwarding) documentation scenarios. + +* PE1 is located in an industrial area that holds multiple office buildings. + All customers have a site in this area. +* PE2 is located in a smaller area where by coincidence two customers + (blue and red) share an office building. +* PE3 is located in a smaller area where by coincidence two customers + (blue and green) are located. + +************** +Management VRF +************** + +A brief excursion into VRFs: This has been one of the longest-standing feature +requests of VyOS (dating back to 2016) which can be described as +"a VLAN for layer 2 is what a VRF is for layer 3". +With VRFs, a router/system can hold multiple, isolated routing tables on the +same system. If you wonder what's the difference between multiple tables that +people used for policy-based routing since forever, it's that a VRF also +isolates connected routes rather than just static and dynamically learned +routes, so it allows NICs in different VRFs to use conflicting network +ranges without issues. + +VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing) +and VyOS 1.4 now enables full dynamic routing protocol support for +OSPF, IS-IS, and BGP for individual VRFs. + +The lab I built is using a VRF (called **mgmt**) to provide out-of-band +SSH access to the PE (Provider Edge) routers. + +.. literalinclude:: _include/PE1.conf + :language: none + :lines: 1-6 + + +******** +Topology +******** + +We use the following network topology in this example: + +.. image:: _include/topology.png + :alt: L3VPN EVPN with VyOS topology image + + +************ +Core network +************ + +I chose to run OSPF as the IGP (Interior Gateway Protocol). +All required BGP sessions are established via a dummy interfaces +(similar to the loopback, but in Linux you can have only one loopback, +while there can be many dummy interfaces) on the PE routers. In case of a link +failure, traffic is diverted in the other direction in this triangle setup and +BGP sessions will not go down. One could even enable +BFD (Bidirectional Forwarding Detection) on the links for a faster +failover and resilience in the network. + +Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from +even the prior post about this subject. This is due to T1711, where it was +finally decided to get rid of the redundant BGP ASN (Autonomous System Number) +specification on the CLI and move it to a single leaf node +(set protocols bgp local-as). + +It's important to note that all your existing configurations will be migrated +automatically on image upgrade. Nothing to do on your side. + +PE1 + +.. literalinclude:: _include/PE1.conf + :language: none + :lines: 8-38 + +PE2 + +.. literalinclude:: _include/PE2.conf + :language: none + :lines: 8-38 + +PE3 + +.. literalinclude:: _include/PE3.conf + :language: none + :lines: 8-38 + + +********************** +Tenant networks (VRFs) +********************** + +Once all routers can be safely remotely managed and the core network is +operational, we can now setup the tenant networks. + +Every tenant is assigned an individual VRF that would support overlapping +address ranges for customers blue, red and green. In our example, +we do not use overlapping ranges to make it easier when showing debug commands. + +Thus you can easily match it to one of the devices/networks below. + +Every router that provides access to a customer network needs to have the +customer network (VRF + VNI) configured. To make our own lives easier, +we utilize the same VRF table id (local routing table number) and +VNI (Virtual Network Identifier) per tenant on all our routers. + +* blue uses local routing table id and VNI 2000 +* red uses local routing table id and VNI 3000 +* green uses local routing table id and VNI 4000 + +PE1 + +.. literalinclude:: _include/PE1.conf + :language: none + :lines: 40-96 + +PE2 + +.. literalinclude:: _include/PE2.conf + :language: none + :lines: 40-89 + +PE3 + +.. literalinclude:: _include/PE3.conf + :language: none + :lines: 40-89 + +********************* +Testing and debugging +********************* + +You managed to come this far, now we want to see the network and routing +tables in action. + +Show routes for all VRFs + + +.. code-block:: none + + vyos@PE1:~$ show ip route vrf all + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF blue: + C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13 + B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49 + B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49 + + VRF default: + O 172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09 + C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12 + O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46 + * via 172.29.0.7, eth3, weight 1, 00:00:46 + O 172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09 + C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12 + C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14 + O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50 + O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45 + + VRF green: + C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13 + B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49 + + VRF mgmt: + S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45 + C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45 + + VRF red: + C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13 + B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49 + +Information about Ethernet Virtual Private Networks + + +.. code-block:: none + + vyos@PE1:~$ show bgp l2vpn evpn + BGP table version is 1, local router ID is 172.29.255.1 + Status codes: s suppressed, d damped, h history, * valid, > best, i - internal + Origin codes: i - IGP, e - EGP, ? - incomplete + EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id] + EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP] + EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP] + EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP] + EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP] + + Network Next Hop Metric LocPrf Weight Path + Route Distinguisher: 10.1.1.1:5 + *> [5]:[0]:[24]:[10.1.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6 + Route Distinguisher: 10.1.2.1:4 + *>i[5]:[0]:[24]:[10.1.2.0] + 172.29.255.2 0 100 0 ? + RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea + Route Distinguisher: 10.1.3.1:4 + *>i[5]:[0]:[24]:[10.1.3.0] + 172.29.255.3 0 100 0 ? + RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54 + Route Distinguisher: 10.2.1.1:6 + *> [5]:[0]:[24]:[10.2.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:3000 Rmac:50:00:00:01:00:05 + Route Distinguisher: 10.2.2.1:5 + *>i[5]:[0]:[24]:[10.2.2.0] + 172.29.255.2 0 100 0 ? + RT:100:3000 ET:8 Rmac:50:00:00:02:00:05 + Route Distinguisher: 10.3.1.1:7 + *> [5]:[0]:[24]:[10.3.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:4000 Rmac:50:00:00:01:00:06 + Route Distinguisher: 10.3.3.1:6 + *>i[5]:[0]:[24]:[10.3.3.0] + 172.29.255.3 0 100 0 ? + RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a + + Displayed 7 out of 7 total prefixes + +If we need to retrieve information about a specific host/network inside +the EVPN network we need to run + + +.. code-block:: none + + vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10 + BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0] + Paths: (1 available, best #1) + Not advertised to any peer + Route [5]:[0]:[24]:[10.3.1.0] VNI 4000 + Local + 172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06 + Last update: Thu May 11 13:31:13 2023 diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md new file mode 100644 index 00000000..afc4e5af --- /dev/null +++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md @@ -0,0 +1,284 @@ +(examples-openvpn-with-ldap)= + +# OpenVPN with LDAP + +Testdate: 2023-05-11 + +Version: 1.4-rolling-202305100734 + +This LAB shows how to use OpenVPN with a Active Directory authentication method. + +Topology consists of: +: - Windows Server 2019 with a running Active Directory + - VyOS as a OpenVPN Server + - VyOS as Client + +```{image} _include/topology.png +:alt: OpenVPN with LDAP topology image +``` + +## Active Directory on Windows server + +The lab assumes a full running Active Directory on the Windows Server. +Here are some PowerShell commands to quickly add a Test Active Directory. + +```powershell +# install the Active Directory Server role +Install-WindowsFeature AD-Domain-Services -IncludeManagementTools + +# install the Active Directory Server role +Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -NoRebootCompletion:$true + +# create test user01 and binduser +New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true +New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true +``` + +## Configure VyOS as OpenVPN Server + +In this example OpenVPN will be setup with a client certificate and username / password authentication. + +First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed. +Please look {ref}`here ` for more information. + +Add the LDAP plugin configuration file + +`/config/auth/ldap-auth.config` + +Check all possible settings + +[here](https://github.com/threerings/openvpn-auth-ldap/blob/master/auth-ldap.conf) + +```{eval-rst} +.. literalinclude:: _include/ldap-auth.config + :language: none + +``` + +Now generate all required certificates on the ovpn-server: + +First the CA + +```none +vyos@ovpn-server# run generate pki ca install OVPN-CA +``` + +after this create a signed server and a client certificate + +```none +vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV +vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT +``` + +and last the DH Key + +```none +vyos@ovpn-server# run generate pki dh install DH +``` + +after all these steps the config look like this: + +```none +set pki ca OVPN-CA certificate 'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/DNfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCqPg==' +set pki ca OVPN-CA private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABAoICACVsewzYmD6RU2pKJYSPX4pl1aO6ADqNZHZi0GR4K+FyXUqDiHTwA+cLz8K7aWV/WWeUC6j5ZcH4XH+Gg0yumfCgNsnyNhDlyUNHIjPZBT4Cywvg/QTwEfK8//wEHYudT6aam0IIF1O12UW8VgmEiAwMN5Kz476lNQjbgg3efujmJaQhpnULKE2q3V51BC8qhe05JdafDOEE11vOmGj/ARYcbCQhoFJQpDzyTLB8RuEj0cTCe7oVXwwTUF1O4wcmoMCHNvsJxqKwFrER5m+giu83NcKTT13yRlg9LVg094XoGDFtRgmW1dD6ONHzi3Yd28UOIoII8sRYugLU6YcnjXfrgxvKJHJywEEJobfS2o/2/mHh6kjv7pvppWdDhjkf+dWZ0frx2YyF5/dUgGG6e94hzOwRunEu4JVKl0Qr+Vfsqt/STVDA3vbhaMdMuIR2Ir0OkoYiqGBdiEGVx82lf4uDy2TXveqKUADXU5SchjP0JZpBANO4RVoxFpY2r1tEh/sRBu9wY+Fjk4FqdjjOmsbmFwhyG/j2VvKkVsq5itsxG/Rg1nTThE2LN+R6LUquujtn94rIaz6lukEr7Yq9qy14Prj5A7tYnuHbcN36b0A3xN7bxxeX6w12naVp0KZPmey6W4HNeNOOfTLh8BpG+TMPZLJq6U+fryHD2nIhk1mxAoIBAQD88A7vo3LIzas83bYaCa1BgjtJ6WUsqsriuG55pt8olzF/X0THkcDiozCy1IJchL4+GxxA0dp+NBispflvbFWZFAHMnbJx4cc7qMR9k8DDSHNQVgfV6nBa4xBvjBp+sanOOOLV4p+fQZW+n6VMzCcKC74awjbIKgPY0LhUQxIVjtzFyor+MLLoqeavxWzBVVBslwR2oyjbTtTMkeNuTyC4kQAJcfWDN/s2bl6P8Mldpik2WhW0GdxHyK3sgZWXIrnkTlQg3EMPb2sPhFZm6pQKpxXwl8gGgFzEx4mEpHxHm/igZPVRTnYfGwkPmHu3caF59IWHq4jsUAxRQperRgStAoIBAQDjnJ4dZgcnI4PxiDKDKXeb5ZgjnIL0eyxMZoLtaVYnO2lLG0uMlACUEuRwGz4acQcjRoW4FOh3NSberobSHOVBO9Y3qgEcTtgJvzkso5IXD76/vmpiYFdPo9aGaVR/fr+yPZ0h4S9wFShRBtDZapjAlds68ROQsvF/fdU4kqtfyIAst1lwtqMPeTmiZJxVubE0h2YEXOpwIEFcu3+MUvqtCd8X/T+VyF4ZQqn64NvYvkoWpfIiKmOGsCBc4agYuPs4Cy1QvN6oLXp+0b8mSzp+ot35n1lBGTSY2l4/9k6sIzWY7x23GS2g3AUJ2kYUTpQIq2pow8Sc8ptxLwZSQZwrAoIBABqhW7E3UDp8DO9XmHidVDR1dbCOdiyBvuKn8Fm2jABGCtwSN7ebTOePruzlGuSKxUzcpdjdP1fSPFbRErX8ffaj+JyGbec3kjZhym4+RClLU3i91g1bpYCsL2rPIWr9YZdovdkvBwdJbG6peEnhpKqWGenPUN06LzWApCea+Ch05iGc9Y1Vq0B7wuH2s0CXruP/8mRbQU31usnfAkb25ccI3SwhZ2vtVPGiJSqae1j0yZoDWg2gO2UDZ+xiqFFFQrUa2hirmBPj8y2rDT3ArN2CQfkWweSNVzcQmxXwC3Wuojqg5oMs85rKyeVudHgX6pxgdj6WfNAEjYdwr29E6/ECggEBAIHl7i7k/YwOrsx3aCyGy+ZC39LjDbGtYhiwIGSRy0NUmsDscO9nv/TB23FHeufoPaSaKNJnzEvMH8TSYcskBop2NclK0ptvO8hEQ8MADu3uZHRVna1LQkkHPfUzw6+HjKuSkky1kTcsO/gSJbsPJOI0JAu9becU2NJj4/4HZpqheNUMRpUXBnRcQNI3DSm3cjSCWWyAAqO/JM5hi2dwK/P5QEMWmuVGlr1f2FZ/YbiO0QWf61IoUuiZN78KYb7KQ0U2y8PaJlBgtBoQZkDaiiWfmYNOt8d5NRVO+p8SWM/QwFPpk1Hdora9GnsHARuxxLY17eKgZ2MS6jdsGPV00EUCggEBAPuNZ3peHYhIo2EMb6wpnAFV2fAUajymwenr+Bmv5BlAnW7bE2bSNuK0P342H047On8pSEHD4tk9C/GedKiUyxP2UnaFS24mWpe44X3UlC+KJLqJG+zVGXryC7bvhS3N1KlI6H2pRY1fPAhlfUk2KAe+ZP5C7iWwtR6FlPpjB3JoS77qFVhnYdlfnQEuJ7woEKD1TXQH0Sb2OGfPQW1UjIYoEp+9p2F5scB8rV6WaOIpwLY1H0ODvo1JYdTruWGHMKqhuLs5L2MeOluUOyHW7HkJLdLuyDIR9nA4+vNB1RNF3rz83L4Xs/NA1CW3iFWIyG57oFMX1td3i3xJwhjd40M=' +set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzFaFw0zMzA1MDgxMjM4MzFaMFsxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxFDASBgNVBAMMC292cG4tc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApDWzTcB5LFM/tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DMn/Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/ItrfEadvgxrYR9gfhX79AkK0VHmZ/hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H//U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8nLnU0FnqpMMY14r7LZE/mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1ALqGrNUGFH4bEioTjDDx2GieOtp9rUwJMlkAyUEe0k/wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHpyzpwsA0WjA6sDTyWthgNYSxb1ikNGO8STCA==' +set pki certificate SRV private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCkNbNNwHksUz+1pxpEe+lyEEouKAnkWWo018na+c/zsp8KZMDm2RYXsy25j33S0dm2XW9Dc+Kbh3pcE6eCJCZrDu1l5YAiu/Uvb9UGM5FSsutCGSSD2dKlxgXGjJRDO6RNjvk9zCFguRLpk7+889IG6H3t/ddHrjkBq5/tkiTY2xSJ0/a4ZnP9KvlULui8faXfPPWQgc8KKd++k8RVvmhO3uoR9+Ti+cqPL1Fj4fWFmjC9wCnXN8to6391dorq98261ubAMdtgCUhqWzQRyO1Ov7rfKbGa6mftEGOBa0rsyChwZme3ocongnq14/daCJJ34j2l0UbjAdk5JUvdrF/esHHurT0Myf9Ke99uXL5KWFfD0RuTfrwnqPquE1STGj8z19t+DFLQmc2McidE0C9FBbkKBB9P0rJR3FHrcF5KeeCTZdhf5sOKdvSKD5UOllyvo+A4FHxo0WwI9tdHAPLRua4WcVgzOz/tmYVCHMTqtDKQe9W8CzK/sViuVbQTTYfj5d7psRWkTV8twfw4IZjZx+5N+rUDHpHiv610dhbWTMUuPB2He6pMsXXXNxuQDB3vwT8i2t8Rp2+DGthH2B+Ffv0CQrRUeZn+HOssV4bOedVyqhMqCrbV18x9AbY/XdC+pLu0ITmzAz03T0BJWuJ/JUO6gvqNpb3rCB6pHp4cwQIDAQABAoICAQCgNLAZhFX0E8hNbplnBUltek0VGQUFnuLKaVlLZXwn8zXNCx1UW6l9N9e9eSw1uXzhueiqc247dQLAwIAlrSU6P9cHGdBYku4T+NRpd3gpqdtyolsItEQabccGvfKMYazb6khqrTRHTGkSL47aRzq6eKsbvRMCoQyG/61JN9LxK1SvX3gO0g4Jipq0MgvokeF5mdyuvqaC8PWU1k+vo9PaVwsguqy5cSDZbz3F6BcE4Lj693cavRmb5F52+E9yDI/P4IhCLKIt4QCgmxiC3XgA43fq75+SV21LUTjzc/0mY+VoO9CmzJcQ0vDrclzJnyFfCwBAPZweL5iBc0zAGcNxTA5/k86ejHdLlASH0dRf55F8ALeO22um21F7cEqOSYBtl009LDvpHte9wKWp9MpHABeDCigYMc05/IgVPQemtd6NtQ0ZVWHWUiWWqh5cY4v8d0CHWAv4HJZI5JuGWdWUc1QufMfu9UbTuNJe0RGQ/N9OJZzzwX+Vpuflrg9K0CT47Yo3NGFbYOuxn12JQBEYDNl5VHWZGAe1x/ljD0OjWmw3xkLNyRqwZnSTTJ4salCSW6qLrsqHWEeNyx+J4t2gBY0TNoylQ8hECxozFu/CYNIlY7+dJjFFe29r+FNBK+WOuUcSoyrABbqCkQH3iXOC97SQSyxdXMNvkkl9X8gvQQKCAQEA2VKt5k7HqvUTC26DNswNQGfd89GcQSeWaipzOBe0Oq12QA0G4ZfPTR00F6CqYnEOSuu2Qa++KEkTBsgl9mE0tdWCAXTTWuqmnsvX2FYQ8rD8FMce+Hs8nn3qNtxAkqPjIY0uEe5AJDzeB0ct7A5w5K5f6MUE/2rWhCeBGVqJKQ+qRjgk0KeVTcnTGzyujaHN1akUA1CRKEqtrCCspZjollWhxDygevMbXs/0QlDkUxaflPOzit6B5vDJqLGJUgvPI3Hc+9eDZXeCyCCdXOVGY8FUxMQ84RnDO8sVOthgahHsdbxjdUb0KcgaV5xNuMyuYsA++QG7fnsHCHnKT0c4eQKCAQEAwW8ppE0K/EmTp2OXKq+cuZHRZWaBtm3zDwfOz3FLVBXi3JGX9M6Hv6q/2cgLDudYiE3LCNagNkI7rRRO8Gfqd2i9KVRQHWCTl4mpTOwwmKWONNgS34aTPjD5UptNUzTvIItGGSMfg/DNrYg6G9HA666aIqpvodSfUv1ryJViml/3NtvmlRmRKEYe03txKhAN1Reuq30BoOGs4Tu5Hy8ijws9hOSCdZbOyte4EhDRSNyZB45YXooJOHEWTLjrZZqgGH3B/uUAUmyHbutPF/Wkep7M1LVeU8KS4HeVmwMRgPL10nxoHPE/UGBuqL09p4a1muXQ+TMHvnI59Shkn9cEiQKCAQEA10v/l/BoAse0TFj5iSnx3uKHkmsQX8P2UcsoRmPFW3RJd/7v2EJrTrwlxVqYMdpLDJIkB0MyIfry7H8QjNuUOqgAmazBToq08xCDD4GEXMpVkcgKuKRuU53ukNb26c+Ozshs4bqktMHQPGmZ5wgPc54EyjeVUezoBBiW3yVASPuJ9vLcFhJP6baOe6dMTmgD4S4V84q3o7EICUR9hbjMg1LmZeCiI+wAK5fdJm25JU9+XTRppKP3EXFudr8bibrFRRoikSTauYUCfX1CKKvDZkQ71IuMvHynW+8/YwLF0Y9cMO+noKHgdhwVbMIehXvRL2fBezLqKs17FDyD3rJyEQKCAQAdwFtHShJGe4qaVFcL2bbhU+xBDGMnDAI2bZ0BiwtrA3LBOiOFI779W+XmOT56LFsRm+V+loRN1CIZnOYHU/RcKV/u22j3G8OXqzS/ABT5ZX1Z42IDv08mYaH3cquSALJG7yT4+M4AHSmFZ06IuNpTZaePbWd+HJXkzdWmJFPmKpx7c5cjl6sb5q0XGgVt0spN3Dahabi2Zf+RJP50LWvDVJdBuWPXcjqcOFG3dZ669jMTVnGBGPoSFFK5ujd6iS3WloEgE1jZVJgAF3Ey3jVOJt6aWMsJVwQAQmRgUzh9/OCSX1AkI3b5hdt/WJwDCFUmXfKmYZLvV+JSMsRHUWsBAoIBAC2ZuZ3hYmSFMq+rZme72lIl3PUiOWPO9VVbs+PsRk58/ceCWnGCO647+KGb4jFw0vKPwP5RKmPny9a6ZSpYB2jsgWItKewdah+VPEOSLZQT/aPB5f61eiazCnuUuWrrycQVyLlELD0pj29mMxAJ0Nr1CIVboYp+YYA7dWNVSUT6T+EV6ASEC6jflb//UUUmCjOfxILGMkqvNJ2T7WguaPLOw21wLx0eDvQA/N8ZTiyKmE+GVRkDwGzC/yLeelgzyBgmyr15hfo7Q41VtAso6rzzExc4GasmgQe8z4Y0Gm7t3RDL3GXxBmonZtxNZt0vwvVyS/kAJedmPgcfxJunPnM=' +set pki certificate CLIENT certificate 'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yUqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NEtYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pYb4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64=' +set pki certificate CLIENT private key 'MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7xlX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKlZcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUzHcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYlDRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEMCS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUWvcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6TkEetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5+oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfKw2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWNB0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGMCKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLEczAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7AgySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde39I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1gon8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2Ov5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsmorc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSKKY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaRcbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIVWjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7TsQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VPyRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJLj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpjnCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPKNb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCotUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVyab1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQziWKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsphNOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1RunLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addXk/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDefdkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74uckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nCSgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNPimfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl' +set pki dh DH parameters 'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWAKh2iwNRwyeXIEOtUDBkfcLGSNNfK0kQsos/J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg==' +``` + +Once all the required certificates and keys are installed, the remaining +OpenVPN Server configuration can be carried out. + +```{eval-rst} +.. literalinclude:: _include/ovpn-server.conf + :language: none +``` + +## Client configuration + +One advantage of having the client certificate stored is the ability to create the client configuration. + +```none +vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA certificate CLIENT +``` + +save the output to a file and import it in nearly all openvpn clients. + +```none +client +nobind +remote 198.51.100.254 1194 +remote-cert-tls server +proto udp +dev tun +dev-type tun +persist-key +persist-tun +verb 3 + +# Encryption options + +keysize 256 +comp-lzo no + + +-----BEGIN CERTIFICATE----- +MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL +BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM +CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y +MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD +VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 +T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK +AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8 +gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z +CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA +sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU +5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL +c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG +oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC +8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1 +cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00 +uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O +u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP +BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF +BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G +CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy +O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR +IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo +lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ +7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH +bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU +rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld +a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D +NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I +Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI +V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq +Pg== +-----END CERTIFICATE----- + + + + +-----BEGIN CERTIFICATE----- +MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL +BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM +CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y +MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD +VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 +T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC +ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7 +fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD +pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP +5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem +TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y +Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et ++/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY +ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE +euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE +tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD +Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG +A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC +MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n +P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj +6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp +v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY +b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560 +jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc +xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz +4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4 +MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO +xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4 +BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W +OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs +24+4XwZYb8mbM31j7Nx8YvhR+64= +-----END CERTIFICATE----- + + + + +-----BEGIN PRIVATE KEY----- +MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4 +i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7x +lX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKl +Zcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUz +HcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1 +PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYl +DRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEM +CS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUW +vcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm +2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6Tk +EetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5 ++oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfK +w2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWN +B0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGM +CKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ +6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLE +czAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7A +gySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV +7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+ +VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD +5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde3 +9I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1go +n8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2O +v5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/ +5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y +6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5 +ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsm +orc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSK +KY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaR +cbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIV +Wjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7T +sQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8 +ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VP +yRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJ +Lj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpj +nCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPK +Nb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCo +tUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT +1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVya +b1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQzi +WKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2 +qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsph +NOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1R +unLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addX +k/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDef +dkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74u +ckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nC +SgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNP +imfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp +2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl +-----END PRIVATE KEY----- + + +``` + +### Configure VyOS as client + +```none +set interfaces openvpn vtun10 authentication username 'user01' +set interfaces openvpn vtun10 authentication password '$ecret' +set interfaces openvpn vtun10 encryption cipher 'aes256' +set interfaces openvpn vtun10 hash 'sha512' +set interfaces openvpn vtun10 mode 'client' +set interfaces openvpn vtun10 persistent-tunnel +set interfaces openvpn vtun10 protocol 'udp' +set interfaces openvpn vtun10 remote-host '198.51.100.254' +set interfaces openvpn vtun10 remote-port '1194' +set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA' +set interfaces openvpn vtun10 tls certificate 'CLIENT' +``` + +## Monitoring + +If the client is connected successfully you can check the status + +```none +vyos@ovpn-server:~$ show openvpn server +OpenVPN status on vtun10 + +Client CN Remote Host Tunnel IP Local Host TX bytes RX bytes Connected Since +----------- ------------------ ----------- ------------------- ---------- ---------- ------------------- +client 198.51.100.1:55150 10.23.1.6 198.51.100.254:1194 4.7 KB 4.7 KB 2023-05-11 12:47:11 +``` diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst deleted file mode 100644 index 6666399d..00000000 --- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst +++ /dev/null @@ -1,281 +0,0 @@ -.. _examples-OpenVPN-with-LDAP: - -################# -OpenVPN with LDAP -################# - -| Testdate: 2023-05-11 -| Version: 1.4-rolling-202305100734 - -This LAB shows how to use OpenVPN with a Active Directory authentication method. - -Topology consists of: - * Windows Server 2019 with a running Active Directory - * VyOS as a OpenVPN Server - * VyOS as Client - -.. image:: _include/topology.png - :alt: OpenVPN with LDAP topology image - -Active Directory on Windows server -================================== - -The lab assumes a full running Active Directory on the Windows Server. -Here are some PowerShell commands to quickly add a Test Active Directory. - -.. code-block:: powershell - - # install the Active Directory Server role - Install-WindowsFeature AD-Domain-Services -IncludeManagementTools - - # install the Active Directory Server role - Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -NoRebootCompletion:$true - - # create test user01 and binduser - New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true - New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true - - -Configure VyOS as OpenVPN Server -==================================== - -In this example OpenVPN will be setup with a client certificate and username / password authentication. - -First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed. -Please look :ref:`here ` for more information. - -| Add the LDAP plugin configuration file `/config/auth/ldap-auth.config` -| Check all possible settings `here `_ - -.. literalinclude:: _include/ldap-auth.config - :language: none - - -Now generate all required certificates on the ovpn-server: - -First the CA - -.. code-block:: none - - vyos@ovpn-server# run generate pki ca install OVPN-CA - -after this create a signed server and a client certificate - -.. code-block:: none - - vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV - vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT - -and last the DH Key - -.. code-block:: none - - vyos@ovpn-server# run generate pki dh install DH - -after all these steps the config look like this: - -.. code-block:: none - - set pki ca OVPN-CA certificate 'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/DNfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCqPg==' - set pki ca OVPN-CA private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABAoICACVsewzYmD6RU2pKJYSPX4pl1aO6ADqNZHZi0GR4K+FyXUqDiHTwA+cLz8K7aWV/WWeUC6j5ZcH4XH+Gg0yumfCgNsnyNhDlyUNHIjPZBT4Cywvg/QTwEfK8//wEHYudT6aam0IIF1O12UW8VgmEiAwMN5Kz476lNQjbgg3efujmJaQhpnULKE2q3V51BC8qhe05JdafDOEE11vOmGj/ARYcbCQhoFJQpDzyTLB8RuEj0cTCe7oVXwwTUF1O4wcmoMCHNvsJxqKwFrER5m+giu83NcKTT13yRlg9LVg094XoGDFtRgmW1dD6ONHzi3Yd28UOIoII8sRYugLU6YcnjXfrgxvKJHJywEEJobfS2o/2/mHh6kjv7pvppWdDhjkf+dWZ0frx2YyF5/dUgGG6e94hzOwRunEu4JVKl0Qr+Vfsqt/STVDA3vbhaMdMuIR2Ir0OkoYiqGBdiEGVx82lf4uDy2TXveqKUADXU5SchjP0JZpBANO4RVoxFpY2r1tEh/sRBu9wY+Fjk4FqdjjOmsbmFwhyG/j2VvKkVsq5itsxG/Rg1nTThE2LN+R6LUquujtn94rIaz6lukEr7Yq9qy14Prj5A7tYnuHbcN36b0A3xN7bxxeX6w12naVp0KZPmey6W4HNeNOOfTLh8BpG+TMPZLJq6U+fryHD2nIhk1mxAoIBAQD88A7vo3LIzas83bYaCa1BgjtJ6WUsqsriuG55pt8olzF/X0THkcDiozCy1IJchL4+GxxA0dp+NBispflvbFWZFAHMnbJx4cc7qMR9k8DDSHNQVgfV6nBa4xBvjBp+sanOOOLV4p+fQZW+n6VMzCcKC74awjbIKgPY0LhUQxIVjtzFyor+MLLoqeavxWzBVVBslwR2oyjbTtTMkeNuTyC4kQAJcfWDN/s2bl6P8Mldpik2WhW0GdxHyK3sgZWXIrnkTlQg3EMPb2sPhFZm6pQKpxXwl8gGgFzEx4mEpHxHm/igZPVRTnYfGwkPmHu3caF59IWHq4jsUAxRQperRgStAoIBAQDjnJ4dZgcnI4PxiDKDKXeb5ZgjnIL0eyxMZoLtaVYnO2lLG0uMlACUEuRwGz4acQcjRoW4FOh3NSberobSHOVBO9Y3qgEcTtgJvzkso5IXD76/vmpiYFdPo9aGaVR/fr+yPZ0h4S9wFShRBtDZapjAlds68ROQsvF/fdU4kqtfyIAst1lwtqMPeTmiZJxVubE0h2YEXOpwIEFcu3+MUvqtCd8X/T+VyF4ZQqn64NvYvkoWpfIiKmOGsCBc4agYuPs4Cy1QvN6oLXp+0b8mSzp+ot35n1lBGTSY2l4/9k6sIzWY7x23GS2g3AUJ2kYUTpQIq2pow8Sc8ptxLwZSQZwrAoIBABqhW7E3UDp8DO9XmHidVDR1dbCOdiyBvuKn8Fm2jABGCtwSN7ebTOePruzlGuSKxUzcpdjdP1fSPFbRErX8ffaj+JyGbec3kjZhym4+RClLU3i91g1bpYCsL2rPIWr9YZdovdkvBwdJbG6peEnhpKqWGenPUN06LzWApCea+Ch05iGc9Y1Vq0B7wuH2s0CXruP/8mRbQU31usnfAkb25ccI3SwhZ2vtVPGiJSqae1j0yZoDWg2gO2UDZ+xiqFFFQrUa2hirmBPj8y2rDT3ArN2CQfkWweSNVzcQmxXwC3Wuojqg5oMs85rKyeVudHgX6pxgdj6WfNAEjYdwr29E6/ECggEBAIHl7i7k/YwOrsx3aCyGy+ZC39LjDbGtYhiwIGSRy0NUmsDscO9nv/TB23FHeufoPaSaKNJnzEvMH8TSYcskBop2NclK0ptvO8hEQ8MADu3uZHRVna1LQkkHPfUzw6+HjKuSkky1kTcsO/gSJbsPJOI0JAu9becU2NJj4/4HZpqheNUMRpUXBnRcQNI3DSm3cjSCWWyAAqO/JM5hi2dwK/P5QEMWmuVGlr1f2FZ/YbiO0QWf61IoUuiZN78KYb7KQ0U2y8PaJlBgtBoQZkDaiiWfmYNOt8d5NRVO+p8SWM/QwFPpk1Hdora9GnsHARuxxLY17eKgZ2MS6jdsGPV00EUCggEBAPuNZ3peHYhIo2EMb6wpnAFV2fAUajymwenr+Bmv5BlAnW7bE2bSNuK0P342H047On8pSEHD4tk9C/GedKiUyxP2UnaFS24mWpe44X3UlC+KJLqJG+zVGXryC7bvhS3N1KlI6H2pRY1fPAhlfUk2KAe+ZP5C7iWwtR6FlPpjB3JoS77qFVhnYdlfnQEuJ7woEKD1TXQH0Sb2OGfPQW1UjIYoEp+9p2F5scB8rV6WaOIpwLY1H0ODvo1JYdTruWGHMKqhuLs5L2MeOluUOyHW7HkJLdLuyDIR9nA4+vNB1RNF3rz83L4Xs/NA1CW3iFWIyG57oFMX1td3i3xJwhjd40M=' - set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzFaFw0zMzA1MDgxMjM4MzFaMFsxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxFDASBgNVBAMMC292cG4tc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApDWzTcB5LFM/tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DMn/Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/ItrfEadvgxrYR9gfhX79AkK0VHmZ/hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H//U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8nLnU0FnqpMMY14r7LZE/mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1ALqGrNUGFH4bEioTjDDx2GieOtp9rUwJMlkAyUEe0k/wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHpyzpwsA0WjA6sDTyWthgNYSxb1ikNGO8STCA==' - set pki certificate SRV private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCkNbNNwHksUz+1pxpEe+lyEEouKAnkWWo018na+c/zsp8KZMDm2RYXsy25j33S0dm2XW9Dc+Kbh3pcE6eCJCZrDu1l5YAiu/Uvb9UGM5FSsutCGSSD2dKlxgXGjJRDO6RNjvk9zCFguRLpk7+889IG6H3t/ddHrjkBq5/tkiTY2xSJ0/a4ZnP9KvlULui8faXfPPWQgc8KKd++k8RVvmhO3uoR9+Ti+cqPL1Fj4fWFmjC9wCnXN8to6391dorq98261ubAMdtgCUhqWzQRyO1Ov7rfKbGa6mftEGOBa0rsyChwZme3ocongnq14/daCJJ34j2l0UbjAdk5JUvdrF/esHHurT0Myf9Ke99uXL5KWFfD0RuTfrwnqPquE1STGj8z19t+DFLQmc2McidE0C9FBbkKBB9P0rJR3FHrcF5KeeCTZdhf5sOKdvSKD5UOllyvo+A4FHxo0WwI9tdHAPLRua4WcVgzOz/tmYVCHMTqtDKQe9W8CzK/sViuVbQTTYfj5d7psRWkTV8twfw4IZjZx+5N+rUDHpHiv610dhbWTMUuPB2He6pMsXXXNxuQDB3vwT8i2t8Rp2+DGthH2B+Ffv0CQrRUeZn+HOssV4bOedVyqhMqCrbV18x9AbY/XdC+pLu0ITmzAz03T0BJWuJ/JUO6gvqNpb3rCB6pHp4cwQIDAQABAoICAQCgNLAZhFX0E8hNbplnBUltek0VGQUFnuLKaVlLZXwn8zXNCx1UW6l9N9e9eSw1uXzhueiqc247dQLAwIAlrSU6P9cHGdBYku4T+NRpd3gpqdtyolsItEQabccGvfKMYazb6khqrTRHTGkSL47aRzq6eKsbvRMCoQyG/61JN9LxK1SvX3gO0g4Jipq0MgvokeF5mdyuvqaC8PWU1k+vo9PaVwsguqy5cSDZbz3F6BcE4Lj693cavRmb5F52+E9yDI/P4IhCLKIt4QCgmxiC3XgA43fq75+SV21LUTjzc/0mY+VoO9CmzJcQ0vDrclzJnyFfCwBAPZweL5iBc0zAGcNxTA5/k86ejHdLlASH0dRf55F8ALeO22um21F7cEqOSYBtl009LDvpHte9wKWp9MpHABeDCigYMc05/IgVPQemtd6NtQ0ZVWHWUiWWqh5cY4v8d0CHWAv4HJZI5JuGWdWUc1QufMfu9UbTuNJe0RGQ/N9OJZzzwX+Vpuflrg9K0CT47Yo3NGFbYOuxn12JQBEYDNl5VHWZGAe1x/ljD0OjWmw3xkLNyRqwZnSTTJ4salCSW6qLrsqHWEeNyx+J4t2gBY0TNoylQ8hECxozFu/CYNIlY7+dJjFFe29r+FNBK+WOuUcSoyrABbqCkQH3iXOC97SQSyxdXMNvkkl9X8gvQQKCAQEA2VKt5k7HqvUTC26DNswNQGfd89GcQSeWaipzOBe0Oq12QA0G4ZfPTR00F6CqYnEOSuu2Qa++KEkTBsgl9mE0tdWCAXTTWuqmnsvX2FYQ8rD8FMce+Hs8nn3qNtxAkqPjIY0uEe5AJDzeB0ct7A5w5K5f6MUE/2rWhCeBGVqJKQ+qRjgk0KeVTcnTGzyujaHN1akUA1CRKEqtrCCspZjollWhxDygevMbXs/0QlDkUxaflPOzit6B5vDJqLGJUgvPI3Hc+9eDZXeCyCCdXOVGY8FUxMQ84RnDO8sVOthgahHsdbxjdUb0KcgaV5xNuMyuYsA++QG7fnsHCHnKT0c4eQKCAQEAwW8ppE0K/EmTp2OXKq+cuZHRZWaBtm3zDwfOz3FLVBXi3JGX9M6Hv6q/2cgLDudYiE3LCNagNkI7rRRO8Gfqd2i9KVRQHWCTl4mpTOwwmKWONNgS34aTPjD5UptNUzTvIItGGSMfg/DNrYg6G9HA666aIqpvodSfUv1ryJViml/3NtvmlRmRKEYe03txKhAN1Reuq30BoOGs4Tu5Hy8ijws9hOSCdZbOyte4EhDRSNyZB45YXooJOHEWTLjrZZqgGH3B/uUAUmyHbutPF/Wkep7M1LVeU8KS4HeVmwMRgPL10nxoHPE/UGBuqL09p4a1muXQ+TMHvnI59Shkn9cEiQKCAQEA10v/l/BoAse0TFj5iSnx3uKHkmsQX8P2UcsoRmPFW3RJd/7v2EJrTrwlxVqYMdpLDJIkB0MyIfry7H8QjNuUOqgAmazBToq08xCDD4GEXMpVkcgKuKRuU53ukNb26c+Ozshs4bqktMHQPGmZ5wgPc54EyjeVUezoBBiW3yVASPuJ9vLcFhJP6baOe6dMTmgD4S4V84q3o7EICUR9hbjMg1LmZeCiI+wAK5fdJm25JU9+XTRppKP3EXFudr8bibrFRRoikSTauYUCfX1CKKvDZkQ71IuMvHynW+8/YwLF0Y9cMO+noKHgdhwVbMIehXvRL2fBezLqKs17FDyD3rJyEQKCAQAdwFtHShJGe4qaVFcL2bbhU+xBDGMnDAI2bZ0BiwtrA3LBOiOFI779W+XmOT56LFsRm+V+loRN1CIZnOYHU/RcKV/u22j3G8OXqzS/ABT5ZX1Z42IDv08mYaH3cquSALJG7yT4+M4AHSmFZ06IuNpTZaePbWd+HJXkzdWmJFPmKpx7c5cjl6sb5q0XGgVt0spN3Dahabi2Zf+RJP50LWvDVJdBuWPXcjqcOFG3dZ669jMTVnGBGPoSFFK5ujd6iS3WloEgE1jZVJgAF3Ey3jVOJt6aWMsJVwQAQmRgUzh9/OCSX1AkI3b5hdt/WJwDCFUmXfKmYZLvV+JSMsRHUWsBAoIBAC2ZuZ3hYmSFMq+rZme72lIl3PUiOWPO9VVbs+PsRk58/ceCWnGCO647+KGb4jFw0vKPwP5RKmPny9a6ZSpYB2jsgWItKewdah+VPEOSLZQT/aPB5f61eiazCnuUuWrrycQVyLlELD0pj29mMxAJ0Nr1CIVboYp+YYA7dWNVSUT6T+EV6ASEC6jflb//UUUmCjOfxILGMkqvNJ2T7WguaPLOw21wLx0eDvQA/N8ZTiyKmE+GVRkDwGzC/yLeelgzyBgmyr15hfo7Q41VtAso6rzzExc4GasmgQe8z4Y0Gm7t3RDL3GXxBmonZtxNZt0vwvVyS/kAJedmPgcfxJunPnM=' - set pki certificate CLIENT certificate 'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yUqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NEtYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pYb4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64=' - set pki certificate CLIENT private key 'MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7xlX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKlZcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUzHcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYlDRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEMCS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUWvcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6TkEetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5+oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfKw2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWNB0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGMCKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLEczAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7AgySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde39I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1gon8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2Ov5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsmorc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSKKY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaRcbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIVWjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7TsQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VPyRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJLj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpjnCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPKNb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCotUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVyab1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQziWKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsphNOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1RunLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addXk/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDefdkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74uckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nCSgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNPimfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl' - set pki dh DH parameters 'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWAKh2iwNRwyeXIEOtUDBkfcLGSNNfK0kQsos/J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg==' - -Once all the required certificates and keys are installed, the remaining -OpenVPN Server configuration can be carried out. - -.. literalinclude:: _include/ovpn-server.conf - :language: none - -Client configuration -==================== - -One advantage of having the client certificate stored is the ability to create the client configuration. - -.. code-block:: none - - vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA certificate CLIENT - -save the output to a file and import it in nearly all openvpn clients. - -.. code-block:: none - - client - nobind - remote 198.51.100.254 1194 - remote-cert-tls server - proto udp - dev tun - dev-type tun - persist-key - persist-tun - verb 3 - - # Encryption options - - keysize 256 - comp-lzo no - - - -----BEGIN CERTIFICATE----- - MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL - BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM - CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y - MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD - VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 - T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK - AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8 - gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z - CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA - sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU - 5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL - c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG - oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC - 8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1 - cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00 - uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O - u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP - BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF - BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G - CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy - O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR - IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo - lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ - 7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH - bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU - rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld - a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D - NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I - Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI - V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq - Pg== - -----END CERTIFICATE----- - - - - - -----BEGIN CERTIFICATE----- - MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL - BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM - CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y - MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD - VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 - T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC - ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7 - fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD - pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP - 5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem - TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y - Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et - +/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY - ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE - euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE - tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD - Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG - A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC - MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n - P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj - 6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp - v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY - b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560 - jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc - xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz - 4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4 - MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO - xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4 - BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W - OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs - 24+4XwZYb8mbM31j7Nx8YvhR+64= - -----END CERTIFICATE----- - - - - - -----BEGIN PRIVATE KEY----- - MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4 - i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7x - lX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKl - Zcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUz - HcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1 - PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYl - DRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEM - CS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUW - vcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm - 2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6Tk - EetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5 - +oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfK - w2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWN - B0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGM - CKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ - 6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLE - czAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7A - gySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV - 7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+ - VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD - 5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde3 - 9I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1go - n8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2O - v5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/ - 5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y - 6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5 - ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsm - orc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSK - KY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaR - cbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIV - Wjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7T - sQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8 - ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VP - yRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJ - Lj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpj - nCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPK - Nb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCo - tUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT - 1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVya - b1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQzi - WKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2 - qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsph - NOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1R - unLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addX - k/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDef - dkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74u - ckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nC - SgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNP - imfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp - 2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl - -----END PRIVATE KEY----- - - - -Configure VyOS as client ------------------------- - -.. code-block:: none - - set interfaces openvpn vtun10 authentication username 'user01' - set interfaces openvpn vtun10 authentication password '$ecret' - set interfaces openvpn vtun10 encryption cipher 'aes256' - set interfaces openvpn vtun10 hash 'sha512' - set interfaces openvpn vtun10 mode 'client' - set interfaces openvpn vtun10 persistent-tunnel - set interfaces openvpn vtun10 protocol 'udp' - set interfaces openvpn vtun10 remote-host '198.51.100.254' - set interfaces openvpn vtun10 remote-port '1194' - set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA' - set interfaces openvpn vtun10 tls certificate 'CLIENT' - -Monitoring -========== - -If the client is connected successfully you can check the status - -.. code-block:: none - - vyos@ovpn-server:~$ show openvpn server - OpenVPN status on vtun10 - - Client CN Remote Host Tunnel IP Local Host TX bytes RX bytes Connected Since - ----------- ------------------ ----------- ------------------- ---------- ---------- ------------------- - client 198.51.100.1:55150 10.23.1.6 198.51.100.254:1194 4.7 KB 4.7 KB 2023-05-11 12:47:11 diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md b/docs/configexamples/autotest/OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md deleted file mode 100644 index afc4e5af..00000000 --- a/docs/configexamples/autotest/OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md +++ /dev/null @@ -1,284 +0,0 @@ -(examples-openvpn-with-ldap)= - -# OpenVPN with LDAP - -Testdate: 2023-05-11 - -Version: 1.4-rolling-202305100734 - -This LAB shows how to use OpenVPN with a Active Directory authentication method. - -Topology consists of: -: - Windows Server 2019 with a running Active Directory - - VyOS as a OpenVPN Server - - VyOS as Client - -```{image} _include/topology.png -:alt: OpenVPN with LDAP topology image -``` - -## Active Directory on Windows server - -The lab assumes a full running Active Directory on the Windows Server. -Here are some PowerShell commands to quickly add a Test Active Directory. - -```powershell -# install the Active Directory Server role -Install-WindowsFeature AD-Domain-Services -IncludeManagementTools - -# install the Active Directory Server role -Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -NoRebootCompletion:$true - -# create test user01 and binduser -New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true -New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true -``` - -## Configure VyOS as OpenVPN Server - -In this example OpenVPN will be setup with a client certificate and username / password authentication. - -First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed. -Please look {ref}`here ` for more information. - -Add the LDAP plugin configuration file - -`/config/auth/ldap-auth.config` - -Check all possible settings - -[here](https://github.com/threerings/openvpn-auth-ldap/blob/master/auth-ldap.conf) - -```{eval-rst} -.. literalinclude:: _include/ldap-auth.config - :language: none - -``` - -Now generate all required certificates on the ovpn-server: - -First the CA - -```none -vyos@ovpn-server# run generate pki ca install OVPN-CA -``` - -after this create a signed server and a client certificate - -```none -vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV -vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT -``` - -and last the DH Key - -```none -vyos@ovpn-server# run generate pki dh install DH -``` - -after all these steps the config look like this: - -```none -set pki ca OVPN-CA certificate 'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/DNfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCqPg==' -set pki ca OVPN-CA private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABAoICACVsewzYmD6RU2pKJYSPX4pl1aO6ADqNZHZi0GR4K+FyXUqDiHTwA+cLz8K7aWV/WWeUC6j5ZcH4XH+Gg0yumfCgNsnyNhDlyUNHIjPZBT4Cywvg/QTwEfK8//wEHYudT6aam0IIF1O12UW8VgmEiAwMN5Kz476lNQjbgg3efujmJaQhpnULKE2q3V51BC8qhe05JdafDOEE11vOmGj/ARYcbCQhoFJQpDzyTLB8RuEj0cTCe7oVXwwTUF1O4wcmoMCHNvsJxqKwFrER5m+giu83NcKTT13yRlg9LVg094XoGDFtRgmW1dD6ONHzi3Yd28UOIoII8sRYugLU6YcnjXfrgxvKJHJywEEJobfS2o/2/mHh6kjv7pvppWdDhjkf+dWZ0frx2YyF5/dUgGG6e94hzOwRunEu4JVKl0Qr+Vfsqt/STVDA3vbhaMdMuIR2Ir0OkoYiqGBdiEGVx82lf4uDy2TXveqKUADXU5SchjP0JZpBANO4RVoxFpY2r1tEh/sRBu9wY+Fjk4FqdjjOmsbmFwhyG/j2VvKkVsq5itsxG/Rg1nTThE2LN+R6LUquujtn94rIaz6lukEr7Yq9qy14Prj5A7tYnuHbcN36b0A3xN7bxxeX6w12naVp0KZPmey6W4HNeNOOfTLh8BpG+TMPZLJq6U+fryHD2nIhk1mxAoIBAQD88A7vo3LIzas83bYaCa1BgjtJ6WUsqsriuG55pt8olzF/X0THkcDiozCy1IJchL4+GxxA0dp+NBispflvbFWZFAHMnbJx4cc7qMR9k8DDSHNQVgfV6nBa4xBvjBp+sanOOOLV4p+fQZW+n6VMzCcKC74awjbIKgPY0LhUQxIVjtzFyor+MLLoqeavxWzBVVBslwR2oyjbTtTMkeNuTyC4kQAJcfWDN/s2bl6P8Mldpik2WhW0GdxHyK3sgZWXIrnkTlQg3EMPb2sPhFZm6pQKpxXwl8gGgFzEx4mEpHxHm/igZPVRTnYfGwkPmHu3caF59IWHq4jsUAxRQperRgStAoIBAQDjnJ4dZgcnI4PxiDKDKXeb5ZgjnIL0eyxMZoLtaVYnO2lLG0uMlACUEuRwGz4acQcjRoW4FOh3NSberobSHOVBO9Y3qgEcTtgJvzkso5IXD76/vmpiYFdPo9aGaVR/fr+yPZ0h4S9wFShRBtDZapjAlds68ROQsvF/fdU4kqtfyIAst1lwtqMPeTmiZJxVubE0h2YEXOpwIEFcu3+MUvqtCd8X/T+VyF4ZQqn64NvYvkoWpfIiKmOGsCBc4agYuPs4Cy1QvN6oLXp+0b8mSzp+ot35n1lBGTSY2l4/9k6sIzWY7x23GS2g3AUJ2kYUTpQIq2pow8Sc8ptxLwZSQZwrAoIBABqhW7E3UDp8DO9XmHidVDR1dbCOdiyBvuKn8Fm2jABGCtwSN7ebTOePruzlGuSKxUzcpdjdP1fSPFbRErX8ffaj+JyGbec3kjZhym4+RClLU3i91g1bpYCsL2rPIWr9YZdovdkvBwdJbG6peEnhpKqWGenPUN06LzWApCea+Ch05iGc9Y1Vq0B7wuH2s0CXruP/8mRbQU31usnfAkb25ccI3SwhZ2vtVPGiJSqae1j0yZoDWg2gO2UDZ+xiqFFFQrUa2hirmBPj8y2rDT3ArN2CQfkWweSNVzcQmxXwC3Wuojqg5oMs85rKyeVudHgX6pxgdj6WfNAEjYdwr29E6/ECggEBAIHl7i7k/YwOrsx3aCyGy+ZC39LjDbGtYhiwIGSRy0NUmsDscO9nv/TB23FHeufoPaSaKNJnzEvMH8TSYcskBop2NclK0ptvO8hEQ8MADu3uZHRVna1LQkkHPfUzw6+HjKuSkky1kTcsO/gSJbsPJOI0JAu9becU2NJj4/4HZpqheNUMRpUXBnRcQNI3DSm3cjSCWWyAAqO/JM5hi2dwK/P5QEMWmuVGlr1f2FZ/YbiO0QWf61IoUuiZN78KYb7KQ0U2y8PaJlBgtBoQZkDaiiWfmYNOt8d5NRVO+p8SWM/QwFPpk1Hdora9GnsHARuxxLY17eKgZ2MS6jdsGPV00EUCggEBAPuNZ3peHYhIo2EMb6wpnAFV2fAUajymwenr+Bmv5BlAnW7bE2bSNuK0P342H047On8pSEHD4tk9C/GedKiUyxP2UnaFS24mWpe44X3UlC+KJLqJG+zVGXryC7bvhS3N1KlI6H2pRY1fPAhlfUk2KAe+ZP5C7iWwtR6FlPpjB3JoS77qFVhnYdlfnQEuJ7woEKD1TXQH0Sb2OGfPQW1UjIYoEp+9p2F5scB8rV6WaOIpwLY1H0ODvo1JYdTruWGHMKqhuLs5L2MeOluUOyHW7HkJLdLuyDIR9nA4+vNB1RNF3rz83L4Xs/NA1CW3iFWIyG57oFMX1td3i3xJwhjd40M=' -set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzFaFw0zMzA1MDgxMjM4MzFaMFsxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxFDASBgNVBAMMC292cG4tc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApDWzTcB5LFM/tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DMn/Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/ItrfEadvgxrYR9gfhX79AkK0VHmZ/hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H//U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8nLnU0FnqpMMY14r7LZE/mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1ALqGrNUGFH4bEioTjDDx2GieOtp9rUwJMlkAyUEe0k/wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHpyzpwsA0WjA6sDTyWthgNYSxb1ikNGO8STCA==' -set pki certificate SRV private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCkNbNNwHksUz+1pxpEe+lyEEouKAnkWWo018na+c/zsp8KZMDm2RYXsy25j33S0dm2XW9Dc+Kbh3pcE6eCJCZrDu1l5YAiu/Uvb9UGM5FSsutCGSSD2dKlxgXGjJRDO6RNjvk9zCFguRLpk7+889IG6H3t/ddHrjkBq5/tkiTY2xSJ0/a4ZnP9KvlULui8faXfPPWQgc8KKd++k8RVvmhO3uoR9+Ti+cqPL1Fj4fWFmjC9wCnXN8to6391dorq98261ubAMdtgCUhqWzQRyO1Ov7rfKbGa6mftEGOBa0rsyChwZme3ocongnq14/daCJJ34j2l0UbjAdk5JUvdrF/esHHurT0Myf9Ke99uXL5KWFfD0RuTfrwnqPquE1STGj8z19t+DFLQmc2McidE0C9FBbkKBB9P0rJR3FHrcF5KeeCTZdhf5sOKdvSKD5UOllyvo+A4FHxo0WwI9tdHAPLRua4WcVgzOz/tmYVCHMTqtDKQe9W8CzK/sViuVbQTTYfj5d7psRWkTV8twfw4IZjZx+5N+rUDHpHiv610dhbWTMUuPB2He6pMsXXXNxuQDB3vwT8i2t8Rp2+DGthH2B+Ffv0CQrRUeZn+HOssV4bOedVyqhMqCrbV18x9AbY/XdC+pLu0ITmzAz03T0BJWuJ/JUO6gvqNpb3rCB6pHp4cwQIDAQABAoICAQCgNLAZhFX0E8hNbplnBUltek0VGQUFnuLKaVlLZXwn8zXNCx1UW6l9N9e9eSw1uXzhueiqc247dQLAwIAlrSU6P9cHGdBYku4T+NRpd3gpqdtyolsItEQabccGvfKMYazb6khqrTRHTGkSL47aRzq6eKsbvRMCoQyG/61JN9LxK1SvX3gO0g4Jipq0MgvokeF5mdyuvqaC8PWU1k+vo9PaVwsguqy5cSDZbz3F6BcE4Lj693cavRmb5F52+E9yDI/P4IhCLKIt4QCgmxiC3XgA43fq75+SV21LUTjzc/0mY+VoO9CmzJcQ0vDrclzJnyFfCwBAPZweL5iBc0zAGcNxTA5/k86ejHdLlASH0dRf55F8ALeO22um21F7cEqOSYBtl009LDvpHte9wKWp9MpHABeDCigYMc05/IgVPQemtd6NtQ0ZVWHWUiWWqh5cY4v8d0CHWAv4HJZI5JuGWdWUc1QufMfu9UbTuNJe0RGQ/N9OJZzzwX+Vpuflrg9K0CT47Yo3NGFbYOuxn12JQBEYDNl5VHWZGAe1x/ljD0OjWmw3xkLNyRqwZnSTTJ4salCSW6qLrsqHWEeNyx+J4t2gBY0TNoylQ8hECxozFu/CYNIlY7+dJjFFe29r+FNBK+WOuUcSoyrABbqCkQH3iXOC97SQSyxdXMNvkkl9X8gvQQKCAQEA2VKt5k7HqvUTC26DNswNQGfd89GcQSeWaipzOBe0Oq12QA0G4ZfPTR00F6CqYnEOSuu2Qa++KEkTBsgl9mE0tdWCAXTTWuqmnsvX2FYQ8rD8FMce+Hs8nn3qNtxAkqPjIY0uEe5AJDzeB0ct7A5w5K5f6MUE/2rWhCeBGVqJKQ+qRjgk0KeVTcnTGzyujaHN1akUA1CRKEqtrCCspZjollWhxDygevMbXs/0QlDkUxaflPOzit6B5vDJqLGJUgvPI3Hc+9eDZXeCyCCdXOVGY8FUxMQ84RnDO8sVOthgahHsdbxjdUb0KcgaV5xNuMyuYsA++QG7fnsHCHnKT0c4eQKCAQEAwW8ppE0K/EmTp2OXKq+cuZHRZWaBtm3zDwfOz3FLVBXi3JGX9M6Hv6q/2cgLDudYiE3LCNagNkI7rRRO8Gfqd2i9KVRQHWCTl4mpTOwwmKWONNgS34aTPjD5UptNUzTvIItGGSMfg/DNrYg6G9HA666aIqpvodSfUv1ryJViml/3NtvmlRmRKEYe03txKhAN1Reuq30BoOGs4Tu5Hy8ijws9hOSCdZbOyte4EhDRSNyZB45YXooJOHEWTLjrZZqgGH3B/uUAUmyHbutPF/Wkep7M1LVeU8KS4HeVmwMRgPL10nxoHPE/UGBuqL09p4a1muXQ+TMHvnI59Shkn9cEiQKCAQEA10v/l/BoAse0TFj5iSnx3uKHkmsQX8P2UcsoRmPFW3RJd/7v2EJrTrwlxVqYMdpLDJIkB0MyIfry7H8QjNuUOqgAmazBToq08xCDD4GEXMpVkcgKuKRuU53ukNb26c+Ozshs4bqktMHQPGmZ5wgPc54EyjeVUezoBBiW3yVASPuJ9vLcFhJP6baOe6dMTmgD4S4V84q3o7EICUR9hbjMg1LmZeCiI+wAK5fdJm25JU9+XTRppKP3EXFudr8bibrFRRoikSTauYUCfX1CKKvDZkQ71IuMvHynW+8/YwLF0Y9cMO+noKHgdhwVbMIehXvRL2fBezLqKs17FDyD3rJyEQKCAQAdwFtHShJGe4qaVFcL2bbhU+xBDGMnDAI2bZ0BiwtrA3LBOiOFI779W+XmOT56LFsRm+V+loRN1CIZnOYHU/RcKV/u22j3G8OXqzS/ABT5ZX1Z42IDv08mYaH3cquSALJG7yT4+M4AHSmFZ06IuNpTZaePbWd+HJXkzdWmJFPmKpx7c5cjl6sb5q0XGgVt0spN3Dahabi2Zf+RJP50LWvDVJdBuWPXcjqcOFG3dZ669jMTVnGBGPoSFFK5ujd6iS3WloEgE1jZVJgAF3Ey3jVOJt6aWMsJVwQAQmRgUzh9/OCSX1AkI3b5hdt/WJwDCFUmXfKmYZLvV+JSMsRHUWsBAoIBAC2ZuZ3hYmSFMq+rZme72lIl3PUiOWPO9VVbs+PsRk58/ceCWnGCO647+KGb4jFw0vKPwP5RKmPny9a6ZSpYB2jsgWItKewdah+VPEOSLZQT/aPB5f61eiazCnuUuWrrycQVyLlELD0pj29mMxAJ0Nr1CIVboYp+YYA7dWNVSUT6T+EV6ASEC6jflb//UUUmCjOfxILGMkqvNJ2T7WguaPLOw21wLx0eDvQA/N8ZTiyKmE+GVRkDwGzC/yLeelgzyBgmyr15hfo7Q41VtAso6rzzExc4GasmgQe8z4Y0Gm7t3RDL3GXxBmonZtxNZt0vwvVyS/kAJedmPgcfxJunPnM=' -set pki certificate CLIENT certificate 'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yUqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NEtYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pYb4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64=' -set pki certificate CLIENT private key 'MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7xlX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKlZcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUzHcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYlDRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEMCS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUWvcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6TkEetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5+oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfKw2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWNB0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGMCKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLEczAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7AgySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde39I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1gon8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2Ov5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsmorc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSKKY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaRcbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIVWjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7TsQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VPyRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJLj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpjnCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPKNb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCotUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVyab1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQziWKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsphNOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1RunLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addXk/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDefdkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74uckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nCSgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNPimfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl' -set pki dh DH parameters 'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWAKh2iwNRwyeXIEOtUDBkfcLGSNNfK0kQsos/J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg==' -``` - -Once all the required certificates and keys are installed, the remaining -OpenVPN Server configuration can be carried out. - -```{eval-rst} -.. literalinclude:: _include/ovpn-server.conf - :language: none -``` - -## Client configuration - -One advantage of having the client certificate stored is the ability to create the client configuration. - -```none -vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA certificate CLIENT -``` - -save the output to a file and import it in nearly all openvpn clients. - -```none -client -nobind -remote 198.51.100.254 1194 -remote-cert-tls server -proto udp -dev tun -dev-type tun -persist-key -persist-tun -verb 3 - -# Encryption options - -keysize 256 -comp-lzo no - - ------BEGIN CERTIFICATE----- -MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL -BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM -CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y -MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD -VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 -T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK -AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8 -gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z -CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA -sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU -5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL -c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG -oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC -8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1 -cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00 -uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O -u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP -BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF -BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G -CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy -O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR -IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo -lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ -7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH -bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU -rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld -a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D -NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I -Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI -V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq -Pg== ------END CERTIFICATE----- - - - - ------BEGIN CERTIFICATE----- -MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL -BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM -CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y -MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD -VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 -T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC -ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7 -fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD -pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP -5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem -TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y -Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et -+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY -ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE -euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE -tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD -Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG -A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC -MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n -P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj -6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp -v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY -b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560 -jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc -xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz -4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4 -MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO -xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4 -BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W -OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs -24+4XwZYb8mbM31j7Nx8YvhR+64= ------END CERTIFICATE----- - - - - ------BEGIN PRIVATE KEY----- -MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4 -i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7x -lX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKl -Zcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUz -HcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1 -PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYl -DRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEM -CS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUW -vcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm -2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6Tk -EetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5 -+oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfK -w2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWN -B0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGM -CKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ -6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLE -czAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7A -gySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV -7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+ -VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD -5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde3 -9I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1go -n8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2O -v5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/ -5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y -6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5 -ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsm -orc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSK -KY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaR -cbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIV -Wjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7T -sQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8 -ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VP -yRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJ -Lj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpj -nCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPK -Nb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCo -tUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT -1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVya -b1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQzi -WKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2 -qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsph -NOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1R -unLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addX -k/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDef -dkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74u -ckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nC -SgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNP -imfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp -2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl ------END PRIVATE KEY----- - - -``` - -### Configure VyOS as client - -```none -set interfaces openvpn vtun10 authentication username 'user01' -set interfaces openvpn vtun10 authentication password '$ecret' -set interfaces openvpn vtun10 encryption cipher 'aes256' -set interfaces openvpn vtun10 hash 'sha512' -set interfaces openvpn vtun10 mode 'client' -set interfaces openvpn vtun10 persistent-tunnel -set interfaces openvpn vtun10 protocol 'udp' -set interfaces openvpn vtun10 remote-host '198.51.100.254' -set interfaces openvpn vtun10 remote-port '1194' -set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA' -set interfaces openvpn vtun10 tls certificate 'CLIENT' -``` - -## Monitoring - -If the client is connected successfully you can check the status - -```none -vyos@ovpn-server:~$ show openvpn server -OpenVPN status on vtun10 - -Client CN Remote Host Tunnel IP Local Host TX bytes RX bytes Connected Since ------------ ------------------ ----------- ------------------- ---------- ---------- ------------------- -client 198.51.100.1:55150 10.23.1.6 198.51.100.254:1194 4.7 KB 4.7 KB 2023-05-11 12:47:11 -``` diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst new file mode 100644 index 00000000..6666399d --- /dev/null +++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst @@ -0,0 +1,281 @@ +.. _examples-OpenVPN-with-LDAP: + +################# +OpenVPN with LDAP +################# + +| Testdate: 2023-05-11 +| Version: 1.4-rolling-202305100734 + +This LAB shows how to use OpenVPN with a Active Directory authentication method. + +Topology consists of: + * Windows Server 2019 with a running Active Directory + * VyOS as a OpenVPN Server + * VyOS as Client + +.. image:: _include/topology.png + :alt: OpenVPN with LDAP topology image + +Active Directory on Windows server +================================== + +The lab assumes a full running Active Directory on the Windows Server. +Here are some PowerShell commands to quickly add a Test Active Directory. + +.. code-block:: powershell + + # install the Active Directory Server role + Install-WindowsFeature AD-Domain-Services -IncludeManagementTools + + # install the Active Directory Server role + Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -NoRebootCompletion:$true + + # create test user01 and binduser + New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true + New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true + + +Configure VyOS as OpenVPN Server +==================================== + +In this example OpenVPN will be setup with a client certificate and username / password authentication. + +First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed. +Please look :ref:`here ` for more information. + +| Add the LDAP plugin configuration file `/config/auth/ldap-auth.config` +| Check all possible settings `here `_ + +.. literalinclude:: _include/ldap-auth.config + :language: none + + +Now generate all required certificates on the ovpn-server: + +First the CA + +.. code-block:: none + + vyos@ovpn-server# run generate pki ca install OVPN-CA + +after this create a signed server and a client certificate + +.. code-block:: none + + vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV + vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT + +and last the DH Key + +.. code-block:: none + + vyos@ovpn-server# run generate pki dh install DH + +after all these steps the config look like this: + +.. code-block:: none + + set pki ca OVPN-CA certificate 'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/DNfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCqPg==' + set pki ca OVPN-CA private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABAoICACVsewzYmD6RU2pKJYSPX4pl1aO6ADqNZHZi0GR4K+FyXUqDiHTwA+cLz8K7aWV/WWeUC6j5ZcH4XH+Gg0yumfCgNsnyNhDlyUNHIjPZBT4Cywvg/QTwEfK8//wEHYudT6aam0IIF1O12UW8VgmEiAwMN5Kz476lNQjbgg3efujmJaQhpnULKE2q3V51BC8qhe05JdafDOEE11vOmGj/ARYcbCQhoFJQpDzyTLB8RuEj0cTCe7oVXwwTUF1O4wcmoMCHNvsJxqKwFrER5m+giu83NcKTT13yRlg9LVg094XoGDFtRgmW1dD6ONHzi3Yd28UOIoII8sRYugLU6YcnjXfrgxvKJHJywEEJobfS2o/2/mHh6kjv7pvppWdDhjkf+dWZ0frx2YyF5/dUgGG6e94hzOwRunEu4JVKl0Qr+Vfsqt/STVDA3vbhaMdMuIR2Ir0OkoYiqGBdiEGVx82lf4uDy2TXveqKUADXU5SchjP0JZpBANO4RVoxFpY2r1tEh/sRBu9wY+Fjk4FqdjjOmsbmFwhyG/j2VvKkVsq5itsxG/Rg1nTThE2LN+R6LUquujtn94rIaz6lukEr7Yq9qy14Prj5A7tYnuHbcN36b0A3xN7bxxeX6w12naVp0KZPmey6W4HNeNOOfTLh8BpG+TMPZLJq6U+fryHD2nIhk1mxAoIBAQD88A7vo3LIzas83bYaCa1BgjtJ6WUsqsriuG55pt8olzF/X0THkcDiozCy1IJchL4+GxxA0dp+NBispflvbFWZFAHMnbJx4cc7qMR9k8DDSHNQVgfV6nBa4xBvjBp+sanOOOLV4p+fQZW+n6VMzCcKC74awjbIKgPY0LhUQxIVjtzFyor+MLLoqeavxWzBVVBslwR2oyjbTtTMkeNuTyC4kQAJcfWDN/s2bl6P8Mldpik2WhW0GdxHyK3sgZWXIrnkTlQg3EMPb2sPhFZm6pQKpxXwl8gGgFzEx4mEpHxHm/igZPVRTnYfGwkPmHu3caF59IWHq4jsUAxRQperRgStAoIBAQDjnJ4dZgcnI4PxiDKDKXeb5ZgjnIL0eyxMZoLtaVYnO2lLG0uMlACUEuRwGz4acQcjRoW4FOh3NSberobSHOVBO9Y3qgEcTtgJvzkso5IXD76/vmpiYFdPo9aGaVR/fr+yPZ0h4S9wFShRBtDZapjAlds68ROQsvF/fdU4kqtfyIAst1lwtqMPeTmiZJxVubE0h2YEXOpwIEFcu3+MUvqtCd8X/T+VyF4ZQqn64NvYvkoWpfIiKmOGsCBc4agYuPs4Cy1QvN6oLXp+0b8mSzp+ot35n1lBGTSY2l4/9k6sIzWY7x23GS2g3AUJ2kYUTpQIq2pow8Sc8ptxLwZSQZwrAoIBABqhW7E3UDp8DO9XmHidVDR1dbCOdiyBvuKn8Fm2jABGCtwSN7ebTOePruzlGuSKxUzcpdjdP1fSPFbRErX8ffaj+JyGbec3kjZhym4+RClLU3i91g1bpYCsL2rPIWr9YZdovdkvBwdJbG6peEnhpKqWGenPUN06LzWApCea+Ch05iGc9Y1Vq0B7wuH2s0CXruP/8mRbQU31usnfAkb25ccI3SwhZ2vtVPGiJSqae1j0yZoDWg2gO2UDZ+xiqFFFQrUa2hirmBPj8y2rDT3ArN2CQfkWweSNVzcQmxXwC3Wuojqg5oMs85rKyeVudHgX6pxgdj6WfNAEjYdwr29E6/ECggEBAIHl7i7k/YwOrsx3aCyGy+ZC39LjDbGtYhiwIGSRy0NUmsDscO9nv/TB23FHeufoPaSaKNJnzEvMH8TSYcskBop2NclK0ptvO8hEQ8MADu3uZHRVna1LQkkHPfUzw6+HjKuSkky1kTcsO/gSJbsPJOI0JAu9becU2NJj4/4HZpqheNUMRpUXBnRcQNI3DSm3cjSCWWyAAqO/JM5hi2dwK/P5QEMWmuVGlr1f2FZ/YbiO0QWf61IoUuiZN78KYb7KQ0U2y8PaJlBgtBoQZkDaiiWfmYNOt8d5NRVO+p8SWM/QwFPpk1Hdora9GnsHARuxxLY17eKgZ2MS6jdsGPV00EUCggEBAPuNZ3peHYhIo2EMb6wpnAFV2fAUajymwenr+Bmv5BlAnW7bE2bSNuK0P342H047On8pSEHD4tk9C/GedKiUyxP2UnaFS24mWpe44X3UlC+KJLqJG+zVGXryC7bvhS3N1KlI6H2pRY1fPAhlfUk2KAe+ZP5C7iWwtR6FlPpjB3JoS77qFVhnYdlfnQEuJ7woEKD1TXQH0Sb2OGfPQW1UjIYoEp+9p2F5scB8rV6WaOIpwLY1H0ODvo1JYdTruWGHMKqhuLs5L2MeOluUOyHW7HkJLdLuyDIR9nA4+vNB1RNF3rz83L4Xs/NA1CW3iFWIyG57oFMX1td3i3xJwhjd40M=' + set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzFaFw0zMzA1MDgxMjM4MzFaMFsxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxFDASBgNVBAMMC292cG4tc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApDWzTcB5LFM/tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DMn/Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/ItrfEadvgxrYR9gfhX79AkK0VHmZ/hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H//U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8nLnU0FnqpMMY14r7LZE/mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1ALqGrNUGFH4bEioTjDDx2GieOtp9rUwJMlkAyUEe0k/wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHpyzpwsA0WjA6sDTyWthgNYSxb1ikNGO8STCA==' + set pki certificate SRV private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCkNbNNwHksUz+1pxpEe+lyEEouKAnkWWo018na+c/zsp8KZMDm2RYXsy25j33S0dm2XW9Dc+Kbh3pcE6eCJCZrDu1l5YAiu/Uvb9UGM5FSsutCGSSD2dKlxgXGjJRDO6RNjvk9zCFguRLpk7+889IG6H3t/ddHrjkBq5/tkiTY2xSJ0/a4ZnP9KvlULui8faXfPPWQgc8KKd++k8RVvmhO3uoR9+Ti+cqPL1Fj4fWFmjC9wCnXN8to6391dorq98261ubAMdtgCUhqWzQRyO1Ov7rfKbGa6mftEGOBa0rsyChwZme3ocongnq14/daCJJ34j2l0UbjAdk5JUvdrF/esHHurT0Myf9Ke99uXL5KWFfD0RuTfrwnqPquE1STGj8z19t+DFLQmc2McidE0C9FBbkKBB9P0rJR3FHrcF5KeeCTZdhf5sOKdvSKD5UOllyvo+A4FHxo0WwI9tdHAPLRua4WcVgzOz/tmYVCHMTqtDKQe9W8CzK/sViuVbQTTYfj5d7psRWkTV8twfw4IZjZx+5N+rUDHpHiv610dhbWTMUuPB2He6pMsXXXNxuQDB3vwT8i2t8Rp2+DGthH2B+Ffv0CQrRUeZn+HOssV4bOedVyqhMqCrbV18x9AbY/XdC+pLu0ITmzAz03T0BJWuJ/JUO6gvqNpb3rCB6pHp4cwQIDAQABAoICAQCgNLAZhFX0E8hNbplnBUltek0VGQUFnuLKaVlLZXwn8zXNCx1UW6l9N9e9eSw1uXzhueiqc247dQLAwIAlrSU6P9cHGdBYku4T+NRpd3gpqdtyolsItEQabccGvfKMYazb6khqrTRHTGkSL47aRzq6eKsbvRMCoQyG/61JN9LxK1SvX3gO0g4Jipq0MgvokeF5mdyuvqaC8PWU1k+vo9PaVwsguqy5cSDZbz3F6BcE4Lj693cavRmb5F52+E9yDI/P4IhCLKIt4QCgmxiC3XgA43fq75+SV21LUTjzc/0mY+VoO9CmzJcQ0vDrclzJnyFfCwBAPZweL5iBc0zAGcNxTA5/k86ejHdLlASH0dRf55F8ALeO22um21F7cEqOSYBtl009LDvpHte9wKWp9MpHABeDCigYMc05/IgVPQemtd6NtQ0ZVWHWUiWWqh5cY4v8d0CHWAv4HJZI5JuGWdWUc1QufMfu9UbTuNJe0RGQ/N9OJZzzwX+Vpuflrg9K0CT47Yo3NGFbYOuxn12JQBEYDNl5VHWZGAe1x/ljD0OjWmw3xkLNyRqwZnSTTJ4salCSW6qLrsqHWEeNyx+J4t2gBY0TNoylQ8hECxozFu/CYNIlY7+dJjFFe29r+FNBK+WOuUcSoyrABbqCkQH3iXOC97SQSyxdXMNvkkl9X8gvQQKCAQEA2VKt5k7HqvUTC26DNswNQGfd89GcQSeWaipzOBe0Oq12QA0G4ZfPTR00F6CqYnEOSuu2Qa++KEkTBsgl9mE0tdWCAXTTWuqmnsvX2FYQ8rD8FMce+Hs8nn3qNtxAkqPjIY0uEe5AJDzeB0ct7A5w5K5f6MUE/2rWhCeBGVqJKQ+qRjgk0KeVTcnTGzyujaHN1akUA1CRKEqtrCCspZjollWhxDygevMbXs/0QlDkUxaflPOzit6B5vDJqLGJUgvPI3Hc+9eDZXeCyCCdXOVGY8FUxMQ84RnDO8sVOthgahHsdbxjdUb0KcgaV5xNuMyuYsA++QG7fnsHCHnKT0c4eQKCAQEAwW8ppE0K/EmTp2OXKq+cuZHRZWaBtm3zDwfOz3FLVBXi3JGX9M6Hv6q/2cgLDudYiE3LCNagNkI7rRRO8Gfqd2i9KVRQHWCTl4mpTOwwmKWONNgS34aTPjD5UptNUzTvIItGGSMfg/DNrYg6G9HA666aIqpvodSfUv1ryJViml/3NtvmlRmRKEYe03txKhAN1Reuq30BoOGs4Tu5Hy8ijws9hOSCdZbOyte4EhDRSNyZB45YXooJOHEWTLjrZZqgGH3B/uUAUmyHbutPF/Wkep7M1LVeU8KS4HeVmwMRgPL10nxoHPE/UGBuqL09p4a1muXQ+TMHvnI59Shkn9cEiQKCAQEA10v/l/BoAse0TFj5iSnx3uKHkmsQX8P2UcsoRmPFW3RJd/7v2EJrTrwlxVqYMdpLDJIkB0MyIfry7H8QjNuUOqgAmazBToq08xCDD4GEXMpVkcgKuKRuU53ukNb26c+Ozshs4bqktMHQPGmZ5wgPc54EyjeVUezoBBiW3yVASPuJ9vLcFhJP6baOe6dMTmgD4S4V84q3o7EICUR9hbjMg1LmZeCiI+wAK5fdJm25JU9+XTRppKP3EXFudr8bibrFRRoikSTauYUCfX1CKKvDZkQ71IuMvHynW+8/YwLF0Y9cMO+noKHgdhwVbMIehXvRL2fBezLqKs17FDyD3rJyEQKCAQAdwFtHShJGe4qaVFcL2bbhU+xBDGMnDAI2bZ0BiwtrA3LBOiOFI779W+XmOT56LFsRm+V+loRN1CIZnOYHU/RcKV/u22j3G8OXqzS/ABT5ZX1Z42IDv08mYaH3cquSALJG7yT4+M4AHSmFZ06IuNpTZaePbWd+HJXkzdWmJFPmKpx7c5cjl6sb5q0XGgVt0spN3Dahabi2Zf+RJP50LWvDVJdBuWPXcjqcOFG3dZ669jMTVnGBGPoSFFK5ujd6iS3WloEgE1jZVJgAF3Ey3jVOJt6aWMsJVwQAQmRgUzh9/OCSX1AkI3b5hdt/WJwDCFUmXfKmYZLvV+JSMsRHUWsBAoIBAC2ZuZ3hYmSFMq+rZme72lIl3PUiOWPO9VVbs+PsRk58/ceCWnGCO647+KGb4jFw0vKPwP5RKmPny9a6ZSpYB2jsgWItKewdah+VPEOSLZQT/aPB5f61eiazCnuUuWrrycQVyLlELD0pj29mMxAJ0Nr1CIVboYp+YYA7dWNVSUT6T+EV6ASEC6jflb//UUUmCjOfxILGMkqvNJ2T7WguaPLOw21wLx0eDvQA/N8ZTiyKmE+GVRkDwGzC/yLeelgzyBgmyr15hfo7Q41VtAso6rzzExc4GasmgQe8z4Y0Gm7t3RDL3GXxBmonZtxNZt0vwvVyS/kAJedmPgcfxJunPnM=' + set pki certificate CLIENT certificate 'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yUqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NEtYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pYb4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64=' + set pki certificate CLIENT private key 'MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7xlX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKlZcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUzHcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYlDRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEMCS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUWvcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6TkEetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5+oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfKw2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWNB0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGMCKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLEczAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7AgySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde39I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1gon8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2Ov5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsmorc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSKKY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaRcbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIVWjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7TsQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VPyRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJLj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpjnCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPKNb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCotUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVyab1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQziWKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsphNOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1RunLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addXk/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDefdkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74uckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nCSgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNPimfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl' + set pki dh DH parameters 'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWAKh2iwNRwyeXIEOtUDBkfcLGSNNfK0kQsos/J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg==' + +Once all the required certificates and keys are installed, the remaining +OpenVPN Server configuration can be carried out. + +.. literalinclude:: _include/ovpn-server.conf + :language: none + +Client configuration +==================== + +One advantage of having the client certificate stored is the ability to create the client configuration. + +.. code-block:: none + + vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA certificate CLIENT + +save the output to a file and import it in nearly all openvpn clients. + +.. code-block:: none + + client + nobind + remote 198.51.100.254 1194 + remote-cert-tls server + proto udp + dev tun + dev-type tun + persist-key + persist-tun + verb 3 + + # Encryption options + + keysize 256 + comp-lzo no + + + -----BEGIN CERTIFICATE----- + MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL + BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM + CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y + MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD + VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 + T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK + AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8 + gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z + CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA + sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU + 5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL + c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG + oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC + 8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1 + cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00 + uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O + u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP + BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF + BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G + CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy + O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR + IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo + lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ + 7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH + bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU + rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld + a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D + NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I + Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI + V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq + Pg== + -----END CERTIFICATE----- + + + + + -----BEGIN CERTIFICATE----- + MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL + BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM + CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y + MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD + VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 + T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC + ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7 + fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD + pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP + 5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem + TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y + Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et + +/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY + ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE + euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE + tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD + Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG + A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC + MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n + P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj + 6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp + v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY + b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560 + jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc + xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz + 4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4 + MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO + xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4 + BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W + OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs + 24+4XwZYb8mbM31j7Nx8YvhR+64= + -----END CERTIFICATE----- + + + + + -----BEGIN PRIVATE KEY----- + MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4 + i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7x + lX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKl + Zcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUz + HcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1 + PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYl + DRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEM + CS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUW + vcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm + 2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6Tk + EetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5 + +oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfK + w2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWN + B0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGM + CKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ + 6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLE + czAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7A + gySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV + 7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+ + VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD + 5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde3 + 9I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1go + n8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2O + v5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/ + 5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y + 6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5 + ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsm + orc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSK + KY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaR + cbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIV + Wjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7T + sQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8 + ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VP + yRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJ + Lj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpj + nCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPK + Nb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCo + tUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT + 1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVya + b1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQzi + WKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2 + qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsph + NOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1R + unLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addX + k/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDef + dkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74u + ckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nC + SgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNP + imfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp + 2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl + -----END PRIVATE KEY----- + + + +Configure VyOS as client +------------------------ + +.. code-block:: none + + set interfaces openvpn vtun10 authentication username 'user01' + set interfaces openvpn vtun10 authentication password '$ecret' + set interfaces openvpn vtun10 encryption cipher 'aes256' + set interfaces openvpn vtun10 hash 'sha512' + set interfaces openvpn vtun10 mode 'client' + set interfaces openvpn vtun10 persistent-tunnel + set interfaces openvpn vtun10 protocol 'udp' + set interfaces openvpn vtun10 remote-host '198.51.100.254' + set interfaces openvpn vtun10 remote-port '1194' + set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA' + set interfaces openvpn vtun10 tls certificate 'CLIENT' + +Monitoring +========== + +If the client is connected successfully you can check the status + +.. code-block:: none + + vyos@ovpn-server:~$ show openvpn server + OpenVPN status on vtun10 + + Client CN Remote Host Tunnel IP Local Host TX bytes RX bytes Connected Since + ----------- ------------------ ----------- ------------------- ---------- ---------- ------------------- + client 198.51.100.1:55150 10.23.1.6 198.51.100.254:1194 4.7 KB 4.7 KB 2023-05-11 12:47:11 diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.md b/docs/configexamples/autotest/Wireguard/Wireguard.md new file mode 100644 index 00000000..73d354d2 --- /dev/null +++ b/docs/configexamples/autotest/Wireguard/Wireguard.md @@ -0,0 +1,113 @@ +# Wireguard + +Testdate: 2023-08-31 + +Version: 1.4-rolling-202308240020 + +This simple structure show how to connect two offices. One remote branch and the +central office. + +## Topology + +The topology have a central and a branch VyOS router and one client, to +test, in each site. + +```{image} _include/topology.png +:alt: Ansible Example topology image +``` + +## Configuration + +Set the local subnet on eth2 and the public ip address eth1 on each site. + +Central + +```{eval-rst} +.. literalinclude:: _include/central.conf + :language: none + :lines: 1-2 +``` + +Branch + +```{eval-rst} +.. literalinclude:: _include/branch.conf + :language: none + :lines: 1-2 + +``` + +Next thing to do, is to create a wireguard keypair on each side. +After this, the public key can be displayed, to save for later. + +```none +vyos@central:~$ generate pki wireguard +Private key: cMNGHtb5dW92ORG3HS8JJlvQF8pmVGt2Ydny8hTBLnY= +Public key: WyfLCTXi31gL+YbYOwoAHCl2RgS+y56cYHEK6pQsTQ8= +``` + +After you have each public key. The wireguard interfaces can be setup. + +Central + +```{eval-rst} +.. literalinclude:: _include/central.conf + :language: none + :lines: 4-12 +``` + +Branch + +```{eval-rst} +.. literalinclude:: _include/branch.conf + :language: none + :lines: 4-12 + +``` + +To reach the network, a route must be set on each VyOS host. +In this structure, a static interface route will fit the requirements. + +Central + +```{eval-rst} +.. literalinclude:: _include/central.conf + :language: none + :lines: 14 +``` + +Branch + +```{eval-rst} +.. literalinclude:: _include/branch.conf + :language: none + :lines: 14 +``` + +## Testing and debugging + +After all is done and commit, let's take a look if the Wireguard interface is +up and running. + +```none +vyos@central:~$ show interfaces wireguard +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +wg01 192.168.0.1/24 u/u VPN-to-Branch +``` + +And ping the Branch PC from your central router to check the response. + +```none +vyos@central:~$ ping 10.0.2.100 count 4 +PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data. +64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.641 ms +64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.836 ms +64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.792 ms +64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=1.09 ms + +--- 10.0.2.100 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3013ms +rtt min/avg/max/mdev = 0.641/0.838/1.086/0.160 ms +``` diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.rst b/docs/configexamples/autotest/Wireguard/Wireguard.rst deleted file mode 100644 index 93092afe..00000000 --- a/docs/configexamples/autotest/Wireguard/Wireguard.rst +++ /dev/null @@ -1,112 +0,0 @@ -######### -Wireguard -######### - - -| Testdate: 2023-08-31 -| Version: 1.4-rolling-202308240020 - - -This simple structure show how to connect two offices. One remote branch and the -central office. - -******** -Topology -******** - -The topology have a central and a branch VyOS router and one client, to -test, in each site. - -.. image:: _include/topology.png - :alt: Ansible Example topology image - -************* -Configuration -************* - -Set the local subnet on eth2 and the public ip address eth1 on each site. - -Central - -.. literalinclude:: _include/central.conf - :language: none - :lines: 1-2 - -Branch - -.. literalinclude:: _include/branch.conf - :language: none - :lines: 1-2 - - -Next thing to do, is to create a wireguard keypair on each side. -After this, the public key can be displayed, to save for later. - -.. code-block:: none - - vyos@central:~$ generate pki wireguard - Private key: cMNGHtb5dW92ORG3HS8JJlvQF8pmVGt2Ydny8hTBLnY= - Public key: WyfLCTXi31gL+YbYOwoAHCl2RgS+y56cYHEK6pQsTQ8= - - -After you have each public key. The wireguard interfaces can be setup. - - -Central - -.. literalinclude:: _include/central.conf - :language: none - :lines: 4-12 - -Branch - -.. literalinclude:: _include/branch.conf - :language: none - :lines: 4-12 - - -To reach the network, a route must be set on each VyOS host. -In this structure, a static interface route will fit the requirements. - -Central - -.. literalinclude:: _include/central.conf - :language: none - :lines: 14 - -Branch - -.. literalinclude:: _include/branch.conf - :language: none - :lines: 14 - -********************* -Testing and debugging -********************* - -After all is done and commit, let's take a look if the Wireguard interface is -up and running. - -.. code-block:: none - - vyos@central:~$ show interfaces wireguard - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - wg01 192.168.0.1/24 u/u VPN-to-Branch - - -And ping the Branch PC from your central router to check the response. - -.. code-block:: none - - vyos@central:~$ ping 10.0.2.100 count 4 - PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data. - 64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.641 ms - 64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.836 ms - 64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.792 ms - 64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=1.09 ms - - --- 10.0.2.100 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3013ms - rtt min/avg/max/mdev = 0.641/0.838/1.086/0.160 ms diff --git a/docs/configexamples/autotest/Wireguard/md-Wireguard.md b/docs/configexamples/autotest/Wireguard/md-Wireguard.md deleted file mode 100644 index 73d354d2..00000000 --- a/docs/configexamples/autotest/Wireguard/md-Wireguard.md +++ /dev/null @@ -1,113 +0,0 @@ -# Wireguard - -Testdate: 2023-08-31 - -Version: 1.4-rolling-202308240020 - -This simple structure show how to connect two offices. One remote branch and the -central office. - -## Topology - -The topology have a central and a branch VyOS router and one client, to -test, in each site. - -```{image} _include/topology.png -:alt: Ansible Example topology image -``` - -## Configuration - -Set the local subnet on eth2 and the public ip address eth1 on each site. - -Central - -```{eval-rst} -.. literalinclude:: _include/central.conf - :language: none - :lines: 1-2 -``` - -Branch - -```{eval-rst} -.. literalinclude:: _include/branch.conf - :language: none - :lines: 1-2 - -``` - -Next thing to do, is to create a wireguard keypair on each side. -After this, the public key can be displayed, to save for later. - -```none -vyos@central:~$ generate pki wireguard -Private key: cMNGHtb5dW92ORG3HS8JJlvQF8pmVGt2Ydny8hTBLnY= -Public key: WyfLCTXi31gL+YbYOwoAHCl2RgS+y56cYHEK6pQsTQ8= -``` - -After you have each public key. The wireguard interfaces can be setup. - -Central - -```{eval-rst} -.. literalinclude:: _include/central.conf - :language: none - :lines: 4-12 -``` - -Branch - -```{eval-rst} -.. literalinclude:: _include/branch.conf - :language: none - :lines: 4-12 - -``` - -To reach the network, a route must be set on each VyOS host. -In this structure, a static interface route will fit the requirements. - -Central - -```{eval-rst} -.. literalinclude:: _include/central.conf - :language: none - :lines: 14 -``` - -Branch - -```{eval-rst} -.. literalinclude:: _include/branch.conf - :language: none - :lines: 14 -``` - -## Testing and debugging - -After all is done and commit, let's take a look if the Wireguard interface is -up and running. - -```none -vyos@central:~$ show interfaces wireguard -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -wg01 192.168.0.1/24 u/u VPN-to-Branch -``` - -And ping the Branch PC from your central router to check the response. - -```none -vyos@central:~$ ping 10.0.2.100 count 4 -PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data. -64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.641 ms -64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.836 ms -64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.792 ms -64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=1.09 ms - ---- 10.0.2.100 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3013ms -rtt min/avg/max/mdev = 0.641/0.838/1.086/0.160 ms -``` diff --git a/docs/configexamples/autotest/Wireguard/rst-Wireguard.rst b/docs/configexamples/autotest/Wireguard/rst-Wireguard.rst new file mode 100644 index 00000000..93092afe --- /dev/null +++ b/docs/configexamples/autotest/Wireguard/rst-Wireguard.rst @@ -0,0 +1,112 @@ +######### +Wireguard +######### + + +| Testdate: 2023-08-31 +| Version: 1.4-rolling-202308240020 + + +This simple structure show how to connect two offices. One remote branch and the +central office. + +******** +Topology +******** + +The topology have a central and a branch VyOS router and one client, to +test, in each site. + +.. image:: _include/topology.png + :alt: Ansible Example topology image + +************* +Configuration +************* + +Set the local subnet on eth2 and the public ip address eth1 on each site. + +Central + +.. literalinclude:: _include/central.conf + :language: none + :lines: 1-2 + +Branch + +.. literalinclude:: _include/branch.conf + :language: none + :lines: 1-2 + + +Next thing to do, is to create a wireguard keypair on each side. +After this, the public key can be displayed, to save for later. + +.. code-block:: none + + vyos@central:~$ generate pki wireguard + Private key: cMNGHtb5dW92ORG3HS8JJlvQF8pmVGt2Ydny8hTBLnY= + Public key: WyfLCTXi31gL+YbYOwoAHCl2RgS+y56cYHEK6pQsTQ8= + + +After you have each public key. The wireguard interfaces can be setup. + + +Central + +.. literalinclude:: _include/central.conf + :language: none + :lines: 4-12 + +Branch + +.. literalinclude:: _include/branch.conf + :language: none + :lines: 4-12 + + +To reach the network, a route must be set on each VyOS host. +In this structure, a static interface route will fit the requirements. + +Central + +.. literalinclude:: _include/central.conf + :language: none + :lines: 14 + +Branch + +.. literalinclude:: _include/branch.conf + :language: none + :lines: 14 + +********************* +Testing and debugging +********************* + +After all is done and commit, let's take a look if the Wireguard interface is +up and running. + +.. code-block:: none + + vyos@central:~$ show interfaces wireguard + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + wg01 192.168.0.1/24 u/u VPN-to-Branch + + +And ping the Branch PC from your central router to check the response. + +.. code-block:: none + + vyos@central:~$ ping 10.0.2.100 count 4 + PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data. + 64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.641 ms + 64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.836 ms + 64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.792 ms + 64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=1.09 ms + + --- 10.0.2.100 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3013ms + rtt min/avg/max/mdev = 0.641/0.838/1.086/0.160 ms diff --git a/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md b/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md deleted file mode 100644 index 37a89b3f..00000000 --- a/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md +++ /dev/null @@ -1,199 +0,0 @@ -(examples-tunnelbroker-ipv6)= - -# Tunnelbroker.net (IPv6) - -Testdate: 2023-08-31 - -Version: 1.4-rolling-202308240020 - -This guide walks through the setup of for an -IPv6 Tunnel. - -## Prerequisites - -- A public, routable IPv4 address. This does not necessarily need to be static, - but you will need to update the tunnel endpoint when/if your IP address - changes, which can be done with a script and a scheduled task. -- Account at -- Requested a "Regular Tunnel". You want to choose a location that is closest - to your physical location for the best response time. - -### Topology - -The example topology has 2 VyOS routers. One as The WAN Router and on as a -Client, to test a single LAN setup - -```{image} _include/topology.png -:alt: Tunnelbroker topology image -``` - -### Configuration - -First, we configure the `vyos-wan` interface to get a DHCP address. - -```{eval-rst} -.. literalinclude:: _include/vyos-wan.conf - :language: none - -``` - -Now we are able to setup the tunnel interface. - -```{eval-rst} -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 1-5 -``` - -Setup the ipv6 default route to the tunnel interface - -```{eval-rst} -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 7 -``` - -Now you should be able to ping a public IPv6 Address - -```none -vyos@vyos-wan:~$ ping 2001:470:20::2 count 4 -PING 2001:470:20::2(2001:470:20::2) 56 data bytes -64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=39.4 ms -64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=29.9 ms -64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=30.0 ms -64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=29.9 ms - ---- 2001:470:20::2 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3005ms -rtt min/avg/max/mdev = 29.885/32.293/39.371/4.086 ms -``` - -Assuming the pings are successful, you need to add some DNS servers. -Some options: - -```{eval-rst} -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 13 -``` - -You should now be able to ping something by IPv6 DNS name: - -```none -vyos@vyos-wan:~$ ping tunnelbroker.net count 4 -PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes -64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=46 time=200 ms -64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=46 time=176 ms -64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=46 time=244 ms -64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=46 time=176 ms - ---- tunnelbroker.net ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3002ms -rtt min/avg/max/mdev = 175.737/198.653/243.621/27.714 ms -``` - -### LAN Configuration - -At this point, your VyOS install should have full IPv6, but now your LAN devices -need access. - -With Tunnelbroker.net, you have two options: - -- Routed /64. This is the default assignment. In IPv6-land, it's good for a - single "LAN", and is somewhat equivalent to a /24. -- Routed /48. This is something you can request by clicking the "Assign /48" - link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k - -Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So -if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore -the assigned /64, and request the /48 and use that. - -## Single LAN Setup - -Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker -Routed /64 prefix: - -```{eval-rst} -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 9-11 -``` - -Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, -'valid-lifetime' and 'preferred-lifetime' are set to default values of -30 days and 4 hours respectively. - -And the `client` to receive an IPv6 address with stateless autoconfig. - -```{eval-rst} -.. literalinclude:: _include/client.conf - :language: none -``` - -This accomplishes a few things: - -- Sets your LAN interface's IP address -- Enables router advertisements. This is an IPv6 alternative for DHCP (though - DHCPv6 can still be used). With RAs, Your devices will automatically find the - information they need for routing and DNS. - -Now the Client is able to ping a public IPv6 address - -```none -vyos@client:~$ ping 2001:470:20::2 count 4 -PING 2001:470:20::2(2001:470:20::2) 56 data bytes -64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=30.5 ms -64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=29.6 ms -64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=29.9 ms -64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=29.8 ms - ---- 2001:470:20::2 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3005ms -rtt min/avg/max/mdev = 29.578/29.959/30.490/0.333 ms -``` - -## Multiple LAN/DMZ Setup - -That's how you can expand the example above. -Use the `Routed /48` information. This allows you to assign a -different /64 to every interface, LAN, or even device. Or you could break your -network into smaller chunks like /56 or /60. - -The format of these addresses: - -- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker. -- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN -- `2001:470:xxxx:2::/64`: Another subnet -- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet. - -In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff -(1-65535). - -So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: - -```none -set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' -set service router-advert interface eth1 name-server '2001:470:20::2' -set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64 - -set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64' -set service router-advert interface eth2 name-server '2001:470:20::2' -set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 - -set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64' -set service router-advert interface eth3 name-server '2001:470:20::2' -set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 -``` - -Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, -'valid-lifetime' and 'preferred-lifetime' are set to default values of -30 days and 4 hours respectively. - -## Firewall - -Finally, don't forget the {ref}`firewall`. The usage is identical, except for -instead of `set firewall name NAME`, you would use `set firewall ipv6-name -NAME`. - -Similarly, to attach the firewall, you would use `set interfaces ethernet eth0 -firewall in ipv6-name` or `et firewall zone LOCAL from WAN firewall ipv6-name`. diff --git a/docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst new file mode 100644 index 00000000..4a822b04 --- /dev/null +++ b/docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst @@ -0,0 +1,207 @@ +.. _examples-tunnelbroker-ipv6: + +####################### +Tunnelbroker.net (IPv6) +####################### + +| Testdate: 2023-08-31 +| Version: 1.4-rolling-202308240020 + +This guide walks through the setup of https://www.tunnelbroker.net/ for an +IPv6 Tunnel. + +Prerequisites +============= + +- A public, routable IPv4 address. This does not necessarily need to be static, + but you will need to update the tunnel endpoint when/if your IP address + changes, which can be done with a script and a scheduled task. +- Account at https://www.tunnelbroker.net/ +- Requested a "Regular Tunnel". You want to choose a location that is closest + to your physical location for the best response time. + + +******** +Topology +******** + +The example topology has 2 VyOS routers. One as The WAN Router and on as a +Client, to test a single LAN setup + +.. image:: _include/topology.png + :alt: Tunnelbroker topology image + + +************* +Configuration +************* + +First, we configure the ``vyos-wan`` interface to get a DHCP address. + +.. literalinclude:: _include/vyos-wan.conf + :language: none + + +Now we are able to setup the tunnel interface. + +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 1-5 + +Setup the ipv6 default route to the tunnel interface + +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 7 + +Now you should be able to ping a public IPv6 Address + + +.. code-block:: none + + vyos@vyos-wan:~$ ping 2001:470:20::2 count 4 + PING 2001:470:20::2(2001:470:20::2) 56 data bytes + 64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=39.4 ms + 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=29.9 ms + 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=30.0 ms + 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=29.9 ms + + --- 2001:470:20::2 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3005ms + rtt min/avg/max/mdev = 29.885/32.293/39.371/4.086 ms + + +Assuming the pings are successful, you need to add some DNS servers. +Some options: + +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 13 + +You should now be able to ping something by IPv6 DNS name: + + +.. code-block:: none + + vyos@vyos-wan:~$ ping tunnelbroker.net count 4 + PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes + 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=46 time=200 ms + 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=46 time=176 ms + 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=46 time=244 ms + 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=46 time=176 ms + + --- tunnelbroker.net ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3002ms + rtt min/avg/max/mdev = 175.737/198.653/243.621/27.714 ms + + +***************** +LAN Configuration +***************** + +At this point, your VyOS install should have full IPv6, but now your LAN devices +need access. + +With Tunnelbroker.net, you have two options: + +- Routed /64. This is the default assignment. In IPv6-land, it's good for a + single "LAN", and is somewhat equivalent to a /24. + +- Routed /48. This is something you can request by clicking the "Assign /48" + link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k + +Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So +if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore +the assigned /64, and request the /48 and use that. + + +Single LAN Setup +================ + +Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker +Routed /64 prefix: + +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 9-11 + +Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, +'valid-lifetime' and 'preferred-lifetime' are set to default values of +30 days and 4 hours respectively. + +And the ``client`` to receive an IPv6 address with stateless autoconfig. + +.. literalinclude:: _include/client.conf + :language: none + +This accomplishes a few things: + +- Sets your LAN interface's IP address +- Enables router advertisements. This is an IPv6 alternative for DHCP (though + DHCPv6 can still be used). With RAs, Your devices will automatically find the + information they need for routing and DNS. + +Now the Client is able to ping a public IPv6 address + + +.. code-block:: none + + vyos@client:~$ ping 2001:470:20::2 count 4 + PING 2001:470:20::2(2001:470:20::2) 56 data bytes + 64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=30.5 ms + 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=29.6 ms + 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=29.9 ms + 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=29.8 ms + + --- 2001:470:20::2 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3005ms + rtt min/avg/max/mdev = 29.578/29.959/30.490/0.333 ms + + +Multiple LAN/DMZ Setup +====================== + +That's how you can expand the example above. +Use the `Routed /48` information. This allows you to assign a +different /64 to every interface, LAN, or even device. Or you could break your +network into smaller chunks like /56 or /60. + +The format of these addresses: + +- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker. +- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN +- `2001:470:xxxx:2::/64`: Another subnet +- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet. + +In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff +(1-65535). + +So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: + +.. code-block:: none + + set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' + set service router-advert interface eth1 name-server '2001:470:20::2' + set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64 + + set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64' + set service router-advert interface eth2 name-server '2001:470:20::2' + set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 + + set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64' + set service router-advert interface eth3 name-server '2001:470:20::2' + set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 + +Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, +'valid-lifetime' and 'preferred-lifetime' are set to default values of +30 days and 4 hours respectively. + +Firewall +======== + +Finally, don't forget the :ref:`firewall`. The usage is identical, except for +instead of `set firewall name NAME`, you would use `set firewall ipv6-name +NAME`. + +Similarly, to attach the firewall, you would use `set interfaces ethernet eth0 +firewall in ipv6-name` or `et firewall zone LOCAL from WAN firewall ipv6-name`. \ No newline at end of file diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.md b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.md new file mode 100644 index 00000000..37a89b3f --- /dev/null +++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.md @@ -0,0 +1,199 @@ +(examples-tunnelbroker-ipv6)= + +# Tunnelbroker.net (IPv6) + +Testdate: 2023-08-31 + +Version: 1.4-rolling-202308240020 + +This guide walks through the setup of for an +IPv6 Tunnel. + +## Prerequisites + +- A public, routable IPv4 address. This does not necessarily need to be static, + but you will need to update the tunnel endpoint when/if your IP address + changes, which can be done with a script and a scheduled task. +- Account at +- Requested a "Regular Tunnel". You want to choose a location that is closest + to your physical location for the best response time. + +### Topology + +The example topology has 2 VyOS routers. One as The WAN Router and on as a +Client, to test a single LAN setup + +```{image} _include/topology.png +:alt: Tunnelbroker topology image +``` + +### Configuration + +First, we configure the `vyos-wan` interface to get a DHCP address. + +```{eval-rst} +.. literalinclude:: _include/vyos-wan.conf + :language: none + +``` + +Now we are able to setup the tunnel interface. + +```{eval-rst} +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 1-5 +``` + +Setup the ipv6 default route to the tunnel interface + +```{eval-rst} +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 7 +``` + +Now you should be able to ping a public IPv6 Address + +```none +vyos@vyos-wan:~$ ping 2001:470:20::2 count 4 +PING 2001:470:20::2(2001:470:20::2) 56 data bytes +64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=39.4 ms +64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=29.9 ms +64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=30.0 ms +64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=29.9 ms + +--- 2001:470:20::2 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3005ms +rtt min/avg/max/mdev = 29.885/32.293/39.371/4.086 ms +``` + +Assuming the pings are successful, you need to add some DNS servers. +Some options: + +```{eval-rst} +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 13 +``` + +You should now be able to ping something by IPv6 DNS name: + +```none +vyos@vyos-wan:~$ ping tunnelbroker.net count 4 +PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes +64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=46 time=200 ms +64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=46 time=176 ms +64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=46 time=244 ms +64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=46 time=176 ms + +--- tunnelbroker.net ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3002ms +rtt min/avg/max/mdev = 175.737/198.653/243.621/27.714 ms +``` + +### LAN Configuration + +At this point, your VyOS install should have full IPv6, but now your LAN devices +need access. + +With Tunnelbroker.net, you have two options: + +- Routed /64. This is the default assignment. In IPv6-land, it's good for a + single "LAN", and is somewhat equivalent to a /24. +- Routed /48. This is something you can request by clicking the "Assign /48" + link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k + +Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So +if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore +the assigned /64, and request the /48 and use that. + +## Single LAN Setup + +Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker +Routed /64 prefix: + +```{eval-rst} +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 9-11 +``` + +Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, +'valid-lifetime' and 'preferred-lifetime' are set to default values of +30 days and 4 hours respectively. + +And the `client` to receive an IPv6 address with stateless autoconfig. + +```{eval-rst} +.. literalinclude:: _include/client.conf + :language: none +``` + +This accomplishes a few things: + +- Sets your LAN interface's IP address +- Enables router advertisements. This is an IPv6 alternative for DHCP (though + DHCPv6 can still be used). With RAs, Your devices will automatically find the + information they need for routing and DNS. + +Now the Client is able to ping a public IPv6 address + +```none +vyos@client:~$ ping 2001:470:20::2 count 4 +PING 2001:470:20::2(2001:470:20::2) 56 data bytes +64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=30.5 ms +64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=29.6 ms +64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=29.9 ms +64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=29.8 ms + +--- 2001:470:20::2 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3005ms +rtt min/avg/max/mdev = 29.578/29.959/30.490/0.333 ms +``` + +## Multiple LAN/DMZ Setup + +That's how you can expand the example above. +Use the `Routed /48` information. This allows you to assign a +different /64 to every interface, LAN, or even device. Or you could break your +network into smaller chunks like /56 or /60. + +The format of these addresses: + +- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker. +- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN +- `2001:470:xxxx:2::/64`: Another subnet +- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet. + +In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff +(1-65535). + +So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: + +```none +set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' +set service router-advert interface eth1 name-server '2001:470:20::2' +set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64 + +set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64' +set service router-advert interface eth2 name-server '2001:470:20::2' +set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 + +set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64' +set service router-advert interface eth3 name-server '2001:470:20::2' +set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 +``` + +Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, +'valid-lifetime' and 'preferred-lifetime' are set to default values of +30 days and 4 hours respectively. + +## Firewall + +Finally, don't forget the {ref}`firewall`. The usage is identical, except for +instead of `set firewall name NAME`, you would use `set firewall ipv6-name +NAME`. + +Similarly, to attach the firewall, you would use `set interfaces ethernet eth0 +firewall in ipv6-name` or `et firewall zone LOCAL from WAN firewall ipv6-name`. diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst deleted file mode 100644 index 4a822b04..00000000 --- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst +++ /dev/null @@ -1,207 +0,0 @@ -.. _examples-tunnelbroker-ipv6: - -####################### -Tunnelbroker.net (IPv6) -####################### - -| Testdate: 2023-08-31 -| Version: 1.4-rolling-202308240020 - -This guide walks through the setup of https://www.tunnelbroker.net/ for an -IPv6 Tunnel. - -Prerequisites -============= - -- A public, routable IPv4 address. This does not necessarily need to be static, - but you will need to update the tunnel endpoint when/if your IP address - changes, which can be done with a script and a scheduled task. -- Account at https://www.tunnelbroker.net/ -- Requested a "Regular Tunnel". You want to choose a location that is closest - to your physical location for the best response time. - - -******** -Topology -******** - -The example topology has 2 VyOS routers. One as The WAN Router and on as a -Client, to test a single LAN setup - -.. image:: _include/topology.png - :alt: Tunnelbroker topology image - - -************* -Configuration -************* - -First, we configure the ``vyos-wan`` interface to get a DHCP address. - -.. literalinclude:: _include/vyos-wan.conf - :language: none - - -Now we are able to setup the tunnel interface. - -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 1-5 - -Setup the ipv6 default route to the tunnel interface - -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 7 - -Now you should be able to ping a public IPv6 Address - - -.. code-block:: none - - vyos@vyos-wan:~$ ping 2001:470:20::2 count 4 - PING 2001:470:20::2(2001:470:20::2) 56 data bytes - 64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=39.4 ms - 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=29.9 ms - 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=30.0 ms - 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=29.9 ms - - --- 2001:470:20::2 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3005ms - rtt min/avg/max/mdev = 29.885/32.293/39.371/4.086 ms - - -Assuming the pings are successful, you need to add some DNS servers. -Some options: - -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 13 - -You should now be able to ping something by IPv6 DNS name: - - -.. code-block:: none - - vyos@vyos-wan:~$ ping tunnelbroker.net count 4 - PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes - 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=46 time=200 ms - 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=46 time=176 ms - 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=46 time=244 ms - 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=46 time=176 ms - - --- tunnelbroker.net ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3002ms - rtt min/avg/max/mdev = 175.737/198.653/243.621/27.714 ms - - -***************** -LAN Configuration -***************** - -At this point, your VyOS install should have full IPv6, but now your LAN devices -need access. - -With Tunnelbroker.net, you have two options: - -- Routed /64. This is the default assignment. In IPv6-land, it's good for a - single "LAN", and is somewhat equivalent to a /24. - -- Routed /48. This is something you can request by clicking the "Assign /48" - link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k - -Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So -if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore -the assigned /64, and request the /48 and use that. - - -Single LAN Setup -================ - -Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker -Routed /64 prefix: - -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 9-11 - -Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, -'valid-lifetime' and 'preferred-lifetime' are set to default values of -30 days and 4 hours respectively. - -And the ``client`` to receive an IPv6 address with stateless autoconfig. - -.. literalinclude:: _include/client.conf - :language: none - -This accomplishes a few things: - -- Sets your LAN interface's IP address -- Enables router advertisements. This is an IPv6 alternative for DHCP (though - DHCPv6 can still be used). With RAs, Your devices will automatically find the - information they need for routing and DNS. - -Now the Client is able to ping a public IPv6 address - - -.. code-block:: none - - vyos@client:~$ ping 2001:470:20::2 count 4 - PING 2001:470:20::2(2001:470:20::2) 56 data bytes - 64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=30.5 ms - 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=29.6 ms - 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=29.9 ms - 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=29.8 ms - - --- 2001:470:20::2 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3005ms - rtt min/avg/max/mdev = 29.578/29.959/30.490/0.333 ms - - -Multiple LAN/DMZ Setup -====================== - -That's how you can expand the example above. -Use the `Routed /48` information. This allows you to assign a -different /64 to every interface, LAN, or even device. Or you could break your -network into smaller chunks like /56 or /60. - -The format of these addresses: - -- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker. -- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN -- `2001:470:xxxx:2::/64`: Another subnet -- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet. - -In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff -(1-65535). - -So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: - -.. code-block:: none - - set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' - set service router-advert interface eth1 name-server '2001:470:20::2' - set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64 - - set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64' - set service router-advert interface eth2 name-server '2001:470:20::2' - set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 - - set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64' - set service router-advert interface eth3 name-server '2001:470:20::2' - set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 - -Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, -'valid-lifetime' and 'preferred-lifetime' are set to default values of -30 days and 4 hours respectively. - -Firewall -======== - -Finally, don't forget the :ref:`firewall`. The usage is identical, except for -instead of `set firewall name NAME`, you would use `set firewall ipv6-name -NAME`. - -Similarly, to attach the firewall, you would use `set interfaces ethernet eth0 -firewall in ipv6-name` or `et firewall zone LOCAL from WAN firewall ipv6-name`. \ No newline at end of file diff --git a/docs/configexamples/azure-vpn-bgp.md b/docs/configexamples/azure-vpn-bgp.md new file mode 100644 index 00000000..0b4132d8 --- /dev/null +++ b/docs/configexamples/azure-vpn-bgp.md @@ -0,0 +1,134 @@ +--- +lastproofread: '2021-06-28' +--- + +(examples-azure-vpn-bgp)= + +# Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) + +This guide shows an example of a route-based IKEv2 site-to-site VPN to +Azure using VTI and BGP for dynamic routing updates. + +For redundant / active-active configurations see +{ref}`examples-azure-vpn-dual-bgp` + +## Prerequisites + +- A pair of Azure VNet Gateways deployed in active-passive + configuration with BGP enabled. +- A local network gateway deployed in Azure representing + the Vyos device, matching the below Vyos settings except for + address space, which only requires the Vyos private IP, in + this example 10.10.0.5/32 +- A connection resource deployed in Azure linking the + Azure VNet gateway and the local network gateway representing + the Vyos device. + +## Example + +```{eval-rst} ++---------------------------------------+---------------------+ +| WAN Interface | eth0 | ++---------------------------------------+---------------------+ +| On-premises address space | 10.10.0.0/16 | ++---------------------------------------+---------------------+ +| Azure address space | 10.0.0.0/16 | ++---------------------------------------+---------------------+ +| Vyos public IP | 198.51.100.3 | ++---------------------------------------+---------------------+ +| Vyos private IP | 10.10.0.5 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway public IP | 203.0.113.2 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway BGP IP | 10.0.0.4 | ++---------------------------------------+---------------------+ +| Pre-shared key | ch00s3-4-s3cur3-psk | ++---------------------------------------+---------------------+ +| Vyos ASN | 64499 | ++---------------------------------------+---------------------+ +| Azure ASN | 65540 | ++---------------------------------------+---------------------+ +``` + +## Vyos configuration + +- Configure the IKE and ESP settings to match a subset + of those supported by Azure: + +```none +set vpn ipsec esp-group AZURE lifetime '3600' +set vpn ipsec esp-group AZURE mode 'tunnel' +set vpn ipsec esp-group AZURE pfs 'dh-group2' +set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' +set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' + +set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' +set vpn ipsec ike-group AZURE dead-peer-detection interval '15' +set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' +set vpn ipsec ike-group AZURE ikev2-reauth +set vpn ipsec ike-group AZURE key-exchange 'ikev2' +set vpn ipsec ike-group AZURE lifetime '28800' +set vpn ipsec ike-group AZURE proposal 1 dh-group '2' +set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' +set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' +``` + +- Enable IPsec on eth0 + +```none +set vpn ipsec interface 'eth0' +``` + +- Configure a VTI with a dummy IP address + +```none +set interfaces vti vti1 address '10.10.1.5/32' +set interfaces vti vti1 description 'Azure Tunnel' +``` + +- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. + +```none +set interfaces vti vti1 ip adjust-mss 1350 +``` + +- Configure the VPN tunnel + +```none +set vpn ipsec authentication psk azure id '198.51.100.3' +set vpn ipsec authentication psk azure id '203.0.113.2' +set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' +set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' +set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond' +set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' +set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' +set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' +set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' +set vpn ipsec site-to-site peer azure remote-address '203.0.113.2' +set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' +set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' +``` + +- **Important**: Add an interface route to reach Azure's BGP listener + +```none +set protocols static route 10.0.0.4/32 interface vti1 +``` + +- Configure your BGP settings + +```none +set protocols bgp system-as 64499 +set protocols bgp neighbor 10.0.0.4 remote-as '65540' +set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' +set protocols bgp neighbor 10.0.0.4 timers holdtime '30' +set protocols bgp neighbor 10.0.0.4 timers keepalive '10' +``` + +- **Important**: Disable connected check + +```none +set protocols bgp neighbor 10.0.0.4 disable-connected-check +``` diff --git a/docs/configexamples/azure-vpn-bgp.rst b/docs/configexamples/azure-vpn-bgp.rst deleted file mode 100644 index f272aafd..00000000 --- a/docs/configexamples/azure-vpn-bgp.rst +++ /dev/null @@ -1,137 +0,0 @@ -:lastproofread: 2021-06-28 - -.. _examples-azure-vpn-bgp: - -Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) ------------------------------------------------------------- - -This guide shows an example of a route-based IKEv2 site-to-site VPN to -Azure using VTI and BGP for dynamic routing updates. - -For redundant / active-active configurations see -:ref:`examples-azure-vpn-dual-bgp` - - -Prerequisites -^^^^^^^^^^^^^ - -- A pair of Azure VNet Gateways deployed in active-passive - configuration with BGP enabled. - -- A local network gateway deployed in Azure representing - the Vyos device, matching the below Vyos settings except for - address space, which only requires the Vyos private IP, in - this example 10.10.0.5/32 - -- A connection resource deployed in Azure linking the - Azure VNet gateway and the local network gateway representing - the Vyos device. - -Example -^^^^^^^ - -+---------------------------------------+---------------------+ -| WAN Interface | eth0 | -+---------------------------------------+---------------------+ -| On-premises address space | 10.10.0.0/16 | -+---------------------------------------+---------------------+ -| Azure address space | 10.0.0.0/16 | -+---------------------------------------+---------------------+ -| Vyos public IP | 198.51.100.3 | -+---------------------------------------+---------------------+ -| Vyos private IP | 10.10.0.5 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway public IP | 203.0.113.2 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway BGP IP | 10.0.0.4 | -+---------------------------------------+---------------------+ -| Pre-shared key | ch00s3-4-s3cur3-psk | -+---------------------------------------+---------------------+ -| Vyos ASN | 64499 | -+---------------------------------------+---------------------+ -| Azure ASN | 65540 | -+---------------------------------------+---------------------+ - -Vyos configuration -^^^^^^^^^^^^^^^^^^ - -- Configure the IKE and ESP settings to match a subset - of those supported by Azure: - -.. code-block:: none - - set vpn ipsec esp-group AZURE lifetime '3600' - set vpn ipsec esp-group AZURE mode 'tunnel' - set vpn ipsec esp-group AZURE pfs 'dh-group2' - set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' - set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' - - set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' - set vpn ipsec ike-group AZURE dead-peer-detection interval '15' - set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' - set vpn ipsec ike-group AZURE ikev2-reauth - set vpn ipsec ike-group AZURE key-exchange 'ikev2' - set vpn ipsec ike-group AZURE lifetime '28800' - set vpn ipsec ike-group AZURE proposal 1 dh-group '2' - set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' - set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' - -- Enable IPsec on eth0 - -.. code-block:: none - - set vpn ipsec interface 'eth0' - -- Configure a VTI with a dummy IP address - -.. code-block:: none - - set interfaces vti vti1 address '10.10.1.5/32' - set interfaces vti vti1 description 'Azure Tunnel' - -- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. - -.. code-block:: none - - set interfaces vti vti1 ip adjust-mss 1350 - -- Configure the VPN tunnel - -.. code-block:: none - - set vpn ipsec authentication psk azure id '198.51.100.3' - set vpn ipsec authentication psk azure id '203.0.113.2' - set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' - set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3' - set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' - set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond' - set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' - set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' - set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' - set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' - set vpn ipsec site-to-site peer azure remote-address '203.0.113.2' - set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' - set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' - -- **Important**: Add an interface route to reach Azure's BGP listener - -.. code-block:: none - - set protocols static route 10.0.0.4/32 interface vti1 - -- Configure your BGP settings - -.. code-block:: none - - set protocols bgp system-as 64499 - set protocols bgp neighbor 10.0.0.4 remote-as '65540' - set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' - set protocols bgp neighbor 10.0.0.4 timers holdtime '30' - set protocols bgp neighbor 10.0.0.4 timers keepalive '10' - -- **Important**: Disable connected check \ - -.. code-block:: none - - set protocols bgp neighbor 10.0.0.4 disable-connected-check diff --git a/docs/configexamples/azure-vpn-dual-bgp.md b/docs/configexamples/azure-vpn-dual-bgp.md new file mode 100644 index 00000000..e81b25f3 --- /dev/null +++ b/docs/configexamples/azure-vpn-dual-bgp.md @@ -0,0 +1,160 @@ +--- +lastproofread: '2021-06-28' +--- + +(examples-azure-vpn-dual-bgp)= + +# Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) + +This guide shows an example of a redundant (active-active) route-based IKEv2 +site-to-site VPN to Azure using VTI +and BGP for dynamic routing updates. + +## Prerequisites + +- A pair of Azure VNet Gateways deployed in active-active + configuration with BGP enabled. +- A local network gateway deployed in Azure representing + the Vyos device, matching the below Vyos settings except for + address space, which only requires the Vyos private IP, in + this example 10.10.0.5/32 +- A connection resource deployed in Azure linking the + Azure VNet gateway and the local network gateway representing + the Vyos device. + +## Example + +```{eval-rst} ++---------------------------------------+---------------------+ +| WAN Interface | eth0 | ++---------------------------------------+---------------------+ +| On-premises address space | 10.10.0.0/16 | ++---------------------------------------+---------------------+ +| Azure address space | 10.0.0.0/16 | ++---------------------------------------+---------------------+ +| Vyos public IP | 198.51.100.3 | ++---------------------------------------+---------------------+ +| Vyos private IP | 10.10.0.5 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway 1 public IP | 203.0.113.2 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway 2 public IP | 203.0.113.3 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway BGP IP | 10.0.0.4,10.0.0.5 | ++---------------------------------------+---------------------+ +| Pre-shared key | ch00s3-4-s3cur3-psk | ++---------------------------------------+---------------------+ +| Vyos ASN | 64499 | ++---------------------------------------+---------------------+ +| Azure ASN | 65540 | ++---------------------------------------+---------------------+ +``` + +## Vyos configuration + +- Configure the IKE and ESP settings to match a subset + of those supported by Azure: + +```none +set vpn ipsec esp-group AZURE lifetime '3600' +set vpn ipsec esp-group AZURE mode 'tunnel' +set vpn ipsec esp-group AZURE pfs 'dh-group2' +set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' +set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' + +set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' +set vpn ipsec ike-group AZURE dead-peer-detection interval '15' +set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' +set vpn ipsec ike-group AZURE ikev2-reauth +set vpn ipsec ike-group AZURE key-exchange 'ikev2' +set vpn ipsec ike-group AZURE lifetime '28800' +set vpn ipsec ike-group AZURE proposal 1 dh-group '2' +set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' +set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' +``` + +- Enable IPsec on eth0 + +```none +set vpn ipsec interface 'eth0' +``` + +- Configure two VTIs with a dummy IP address each + +```none +set interfaces vti vti1 address '10.10.1.5/32' +set interfaces vti vti1 description 'Azure Primary Tunnel' + +set interfaces vti vti2 address '10.10.1.6/32' +set interfaces vti vti2 description 'Azure Secondary Tunnel' +``` + +- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. + +```none +set interfaces vti vti1 ip adjust-mss 1350 +set interfaces vti vti2 ip adjust-mss 1350 +``` + +- Configure the VPN tunnels + +```none +set vpn ipsec authentication psk azure id '198.51.100.3' +set vpn ipsec authentication psk azure id '203.0.113.2' +set vpn ipsec authentication psk azure id '203.0.113.3' +set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' + +set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2' +set vpn ipsec site-to-site peer azure-primary connection-type 'respond' +set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL' +set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE' +set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit' +set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5' +set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2' +set vpn ipsec site-to-site peer azure-primary vti bind 'vti1' +set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE' + +set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3' +set vpn ipsec site-to-site peer azure-secondary connection-type 'respond' +set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL' +set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE' +set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit' +set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5' +set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3' +set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2' +set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE' +``` + +- **Important**: Add an interface route to reach both Azure's BGP listeners + +```none +set protocols static route 10.0.0.4/32 interface vti1 +set protocols static route 10.0.0.5/32 interface vti2 +``` + +- Configure your BGP settings + +```none +set protocols bgp system-as 64499 +set protocols bgp neighbor 10.0.0.4 remote-as '65540' +set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' +set protocols bgp neighbor 10.0.0.4 timers holdtime '30' +set protocols bgp neighbor 10.0.0.4 timers keepalive '10' + +set protocols bgp neighbor 10.0.0.5 remote-as '65540' +set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound' +set protocols bgp neighbor 10.0.0.5 timers holdtime '30' +set protocols bgp neighbor 10.0.0.5 timers keepalive '10' +``` + +- **Important**: Disable connected check, otherwise the routes learned + from Azure will not be imported into the routing table. + +```none +set protocols bgp neighbor 10.0.0.4 disable-connected-check +set protocols bgp neighbor 10.0.0.5 disable-connected-check +``` diff --git a/docs/configexamples/azure-vpn-dual-bgp.rst b/docs/configexamples/azure-vpn-dual-bgp.rst deleted file mode 100644 index d019092c..00000000 --- a/docs/configexamples/azure-vpn-dual-bgp.rst +++ /dev/null @@ -1,162 +0,0 @@ -:lastproofread: 2021-06-28 - -.. _examples-azure-vpn-dual-bgp: - -Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) ----------------------------------------------------------------------- - -This guide shows an example of a redundant (active-active) route-based IKEv2 -site-to-site VPN to Azure using VTI -and BGP for dynamic routing updates. - -Prerequisites -^^^^^^^^^^^^^ - -- A pair of Azure VNet Gateways deployed in active-active - configuration with BGP enabled. - -- A local network gateway deployed in Azure representing - the Vyos device, matching the below Vyos settings except for - address space, which only requires the Vyos private IP, in - this example 10.10.0.5/32 - -- A connection resource deployed in Azure linking the - Azure VNet gateway and the local network gateway representing - the Vyos device. - -Example -^^^^^^^ - -+---------------------------------------+---------------------+ -| WAN Interface | eth0 | -+---------------------------------------+---------------------+ -| On-premises address space | 10.10.0.0/16 | -+---------------------------------------+---------------------+ -| Azure address space | 10.0.0.0/16 | -+---------------------------------------+---------------------+ -| Vyos public IP | 198.51.100.3 | -+---------------------------------------+---------------------+ -| Vyos private IP | 10.10.0.5 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway 1 public IP | 203.0.113.2 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway 2 public IP | 203.0.113.3 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway BGP IP | 10.0.0.4,10.0.0.5 | -+---------------------------------------+---------------------+ -| Pre-shared key | ch00s3-4-s3cur3-psk | -+---------------------------------------+---------------------+ -| Vyos ASN | 64499 | -+---------------------------------------+---------------------+ -| Azure ASN | 65540 | -+---------------------------------------+---------------------+ - -Vyos configuration -^^^^^^^^^^^^^^^^^^ - -- Configure the IKE and ESP settings to match a subset - of those supported by Azure: - -.. code-block:: none - - set vpn ipsec esp-group AZURE lifetime '3600' - set vpn ipsec esp-group AZURE mode 'tunnel' - set vpn ipsec esp-group AZURE pfs 'dh-group2' - set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' - set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' - - set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' - set vpn ipsec ike-group AZURE dead-peer-detection interval '15' - set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' - set vpn ipsec ike-group AZURE ikev2-reauth - set vpn ipsec ike-group AZURE key-exchange 'ikev2' - set vpn ipsec ike-group AZURE lifetime '28800' - set vpn ipsec ike-group AZURE proposal 1 dh-group '2' - set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' - set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' - -- Enable IPsec on eth0 - -.. code-block:: none - - set vpn ipsec interface 'eth0' - -- Configure two VTIs with a dummy IP address each - -.. code-block:: none - - set interfaces vti vti1 address '10.10.1.5/32' - set interfaces vti vti1 description 'Azure Primary Tunnel' - - set interfaces vti vti2 address '10.10.1.6/32' - set interfaces vti vti2 description 'Azure Secondary Tunnel' - -- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. - -.. code-block:: none - - set interfaces vti vti1 ip adjust-mss 1350 - set interfaces vti vti2 ip adjust-mss 1350 - -- Configure the VPN tunnels - -.. code-block:: none - - set vpn ipsec authentication psk azure id '198.51.100.3' - set vpn ipsec authentication psk azure id '203.0.113.2' - set vpn ipsec authentication psk azure id '203.0.113.3' - set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' - - set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3' - set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2' - set vpn ipsec site-to-site peer azure-primary connection-type 'respond' - set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL' - set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE' - set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit' - set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5' - set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2' - set vpn ipsec site-to-site peer azure-primary vti bind 'vti1' - set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE' - - set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3' - set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3' - set vpn ipsec site-to-site peer azure-secondary connection-type 'respond' - set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL' - set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE' - set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit' - set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5' - set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3' - set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2' - set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE' - -- **Important**: Add an interface route to reach both Azure's BGP listeners - -.. code-block:: none - - set protocols static route 10.0.0.4/32 interface vti1 - set protocols static route 10.0.0.5/32 interface vti2 - -- Configure your BGP settings - -.. code-block:: none - - set protocols bgp system-as 64499 - set protocols bgp neighbor 10.0.0.4 remote-as '65540' - set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' - set protocols bgp neighbor 10.0.0.4 timers holdtime '30' - set protocols bgp neighbor 10.0.0.4 timers keepalive '10' - - set protocols bgp neighbor 10.0.0.5 remote-as '65540' - set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound' - set protocols bgp neighbor 10.0.0.5 timers holdtime '30' - set protocols bgp neighbor 10.0.0.5 timers keepalive '10' - -- **Important**: Disable connected check, otherwise the routes learned - from Azure will not be imported into the routing table. - -.. code-block:: none - - set protocols bgp neighbor 10.0.0.4 disable-connected-check - set protocols bgp neighbor 10.0.0.5 disable-connected-check diff --git a/docs/configexamples/bgp-ipv6-unnumbered.md b/docs/configexamples/bgp-ipv6-unnumbered.md new file mode 100644 index 00000000..4fa29834 --- /dev/null +++ b/docs/configexamples/bgp-ipv6-unnumbered.md @@ -0,0 +1,174 @@ +--- +lastproofread: '2021-06-28' +--- + +(examples-bgp-ipv6-unnumbered)= + +# BGP IPv6 unnumbered with extended nexthop + +General information can be found in the {ref}`routing-bgp` chapter. + +## Configuration + +- Router A: + +```none +set protocols bgp system-as 64496 +set protocols bgp address-family ipv4-unicast redistribute connected +set protocols bgp address-family ipv6-unicast redistribute connected +set protocols bgp neighbor eth1 interface v6only +set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' +set protocols bgp neighbor eth2 interface v6only +set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' +set protocols bgp parameters bestpath as-path multipath-relax +set protocols bgp parameters bestpath compare-routerid +set protocols bgp parameters default no-ipv4-unicast +set protocols bgp parameters router-id '192.168.0.1' +set protocols bgp peer-group fabric address-family ipv4-unicast +set protocols bgp peer-group fabric address-family ipv6-unicast +set protocols bgp peer-group fabric capability extended-nexthop +set protocols bgp peer-group fabric remote-as 'external' +``` + +- Router B: + +```none +set protocols bgp system-as 64499 +set protocols bgp address-family ipv4-unicast redistribute connected +set protocols bgp address-family ipv6-unicast redistribute connected +set protocols bgp neighbor eth1 interface v6only +set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' +set protocols bgp neighbor eth2 interface v6only +set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' +set protocols bgp parameters bestpath as-path multipath-relax +set protocols bgp parameters bestpath compare-routerid +set protocols bgp parameters default no-ipv4-unicast +set protocols bgp parameters router-id '192.168.0.2' +set protocols bgp peer-group fabric address-family ipv4-unicast +set protocols bgp peer-group fabric address-family ipv6-unicast +set protocols bgp peer-group fabric capability extended-nexthop +set protocols bgp peer-group fabric remote-as 'external' +``` + + +## Results + +- Router A: + +```none +vyos@vyos:~$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 198.51.100.34/24 u/u +eth1 - u/u +eth2 - u/u +lo 127.0.0.1/8 u/u + 192.168.0.1/32 + ::1/128 +``` + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route + +S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53 +C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53 +C>* 192.168.0.1/32 is directly connected, lo, 03:21:56 +B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07 + * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07 +``` + +```none +vyos@vyos:~$ ping 192.168.0.2 +PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data. +64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms +64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms +64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms +64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms +64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms + +--- 192.168.0.2 ping statistics --- +5 packets transmitted, 5 received, 0% packet loss, time 4086ms +rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms +``` + +```none +vyos@vyos:~$ show ip bgp summary + +IPv4 Unicast Summary: +BGP router identifier 192.168.0.1, local AS number 64496 vrf-id 0 +BGP table version 4 +RIB entries 5, using 800 bytes of memory +Peers 2, using 41 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd +eth1 4 64499 13 13 0 0 0 00:05:33 2 +eth2 4 64499 13 14 0 0 0 00:05:29 2 + +Total number of neighbors 2 +``` + +- Router B: + +```none +vyos@vyos:~$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 198.51.100.33/24 u/u +eth1 - u/u +eth2 - u/u +lo 127.0.0.1/8 u/u + 192.168.0.2/32 + ::1/128 +``` + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route + +S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08 +C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09 +B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18 + * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18 +C>* 192.168.0.2/32 is directly connected, lo, 00:44:11 +``` + +```none +vyos@vyos:~$ ping 192.168.0.1 +PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. +64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms +64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms +64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms +64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms + +--- 192.168.0.1 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3051ms +rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms +``` + +```none +vyos@vyos:~$ show ip bgp summary +IPv4 Unicast Summary: +BGP router identifier 192.168.0.2, local AS number 64499 vrf-id 0 +BGP table version 4 +RIB entries 5, using 800 bytes of memory +Peers 2, using 41 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd +eth1 4 64496 14 14 0 0 0 00:06:40 2 +eth2 4 64496 14 14 0 0 0 00:06:37 2 + +Total number of neighbors 2 +``` diff --git a/docs/configexamples/bgp-ipv6-unnumbered.rst b/docs/configexamples/bgp-ipv6-unnumbered.rst deleted file mode 100644 index f7a530d8..00000000 --- a/docs/configexamples/bgp-ipv6-unnumbered.rst +++ /dev/null @@ -1,176 +0,0 @@ -:lastproofread: 2021-06-28 - -.. _examples-bgp-ipv6-unnumbered: - -######################################### -BGP IPv6 unnumbered with extended nexthop -######################################### - -General information can be found in the :ref:`routing-bgp` chapter. - -Configuration -============= - -- Router A: - -.. code-block:: none - - set protocols bgp system-as 64496 - set protocols bgp address-family ipv4-unicast redistribute connected - set protocols bgp address-family ipv6-unicast redistribute connected - set protocols bgp neighbor eth1 interface v6only - set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' - set protocols bgp neighbor eth2 interface v6only - set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' - set protocols bgp parameters bestpath as-path multipath-relax - set protocols bgp parameters bestpath compare-routerid - set protocols bgp parameters default no-ipv4-unicast - set protocols bgp parameters router-id '192.168.0.1' - set protocols bgp peer-group fabric address-family ipv4-unicast - set protocols bgp peer-group fabric address-family ipv6-unicast - set protocols bgp peer-group fabric capability extended-nexthop - set protocols bgp peer-group fabric remote-as 'external' - -- Router B: - -.. code-block:: none - - set protocols bgp system-as 64499 - set protocols bgp address-family ipv4-unicast redistribute connected - set protocols bgp address-family ipv6-unicast redistribute connected - set protocols bgp neighbor eth1 interface v6only - set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' - set protocols bgp neighbor eth2 interface v6only - set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' - set protocols bgp parameters bestpath as-path multipath-relax - set protocols bgp parameters bestpath compare-routerid - set protocols bgp parameters default no-ipv4-unicast - set protocols bgp parameters router-id '192.168.0.2' - set protocols bgp peer-group fabric address-family ipv4-unicast - set protocols bgp peer-group fabric address-family ipv6-unicast - set protocols bgp peer-group fabric capability extended-nexthop - set protocols bgp peer-group fabric remote-as 'external' - -Results -======= - -- Router A: - -.. code-block:: none - - vyos@vyos:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 198.51.100.34/24 u/u - eth1 - u/u - eth2 - u/u - lo 127.0.0.1/8 u/u - 192.168.0.1/32 - ::1/128 - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route - - S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53 - C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53 - C>* 192.168.0.1/32 is directly connected, lo, 03:21:56 - B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07 - * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07 - -.. code-block:: none - - vyos@vyos:~$ ping 192.168.0.2 - PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data. - 64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms - 64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms - 64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms - 64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms - 64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms - - --- 192.168.0.2 ping statistics --- - 5 packets transmitted, 5 received, 0% packet loss, time 4086ms - rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms - -.. code-block:: none - - vyos@vyos:~$ show ip bgp summary - - IPv4 Unicast Summary: - BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0 - BGP table version 4 - RIB entries 5, using 800 bytes of memory - Peers 2, using 41 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd - eth1 4 64499 13 13 0 0 0 00:05:33 2 - eth2 4 64499 13 14 0 0 0 00:05:29 2 - - Total number of neighbors 2 - -- Router B: - -.. code-block:: none - - vyos@vyos:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 198.51.100.33/24 u/u - eth1 - u/u - eth2 - u/u - lo 127.0.0.1/8 u/u - 192.168.0.2/32 - ::1/128 - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route - - S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08 - C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09 - B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18 - * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18 - C>* 192.168.0.2/32 is directly connected, lo, 00:44:11 - -.. code-block:: none - - vyos@vyos:~$ ping 192.168.0.1 - PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. - 64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms - 64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms - 64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms - 64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms - - --- 192.168.0.1 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3051ms - rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms - -.. code-block:: none - - vyos@vyos:~$ show ip bgp summary - IPv4 Unicast Summary: - BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0 - BGP table version 4 - RIB entries 5, using 800 bytes of memory - Peers 2, using 41 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd - eth1 4 64496 14 14 0 0 0 00:06:40 2 - eth2 4 64496 14 14 0 0 0 00:06:37 2 - - Total number of neighbors 2 - diff --git a/docs/configexamples/firewall.md b/docs/configexamples/firewall.md new file mode 100644 index 00000000..1f6f0b9a --- /dev/null +++ b/docs/configexamples/firewall.md @@ -0,0 +1,15 @@ +--- +lastproofread: '2024-06-14' +--- + +# Firewall Examples + +This section contains examples of firewall configurations for various deployments. + +```{eval-rst} +.. toctree:: + :maxdepth: 2 + + fwall-and-vrf + zone-policy +``` diff --git a/docs/configexamples/firewall.rst b/docs/configexamples/firewall.rst deleted file mode 100644 index e0a4ca55..00000000 --- a/docs/configexamples/firewall.rst +++ /dev/null @@ -1,12 +0,0 @@ -:lastproofread: 2024-06-14 - -Firewall Examples -================= - -This section contains examples of firewall configurations for various deployments. - -.. toctree:: - :maxdepth: 2 - - fwall-and-vrf - zone-policy diff --git a/docs/configexamples/fwall-and-vrf.md b/docs/configexamples/fwall-and-vrf.md new file mode 100644 index 00000000..f1be96a2 --- /dev/null +++ b/docs/configexamples/fwall-and-vrf.md @@ -0,0 +1,119 @@ +# VRF and firewall example + +## Scenario and requirements + +This example shows how to configure a VyOS router with VRFs and firewall rules. + +Diagram used in this example: + +```{image} /_static/images/firewall-and-vrf-blueprints.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +As exposed in the diagram, there are four VRFs. These VRFs are `MGMT`, +`WAN`, `LAN` and `PROD`, and their requirements are: + +- VRF MGMT: + : - Allow connections to LAN and PROD. + - Deny connections to internet(WAN). + - Allow connections to the router. +- VRF LAN: + : - Allow connections to PROD. + - Allow connections to internet(WAN). +- VRF PROD: + : - Only accepts connections. +- VRF WAN: + : - Allow connection to PROD. + +## Configuration + +First, we need to configure the interfaces and VRFs: + +```none +set interfaces ethernet eth1 address '10.100.100.1/24' +set interfaces ethernet eth1 vrf 'MGMT' +set interfaces ethernet eth2 vif 150 address '10.150.150.1/24' +set interfaces ethernet eth2 vif 150 vrf 'LAN' +set interfaces ethernet eth2 vif 160 address '10.160.160.1/24' +set interfaces ethernet eth2 vif 160 vrf 'LAN' +set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24' +set interfaces ethernet eth2 vif 3500 vrf 'PROD' +set interfaces loopback lo +set interfaces pppoe pppoe0 authentication password 'p4ssw0rd' +set interfaces pppoe pppoe0 authentication username 'vyos' +set interfaces pppoe pppoe0 source-interface 'eth0' +set interfaces pppoe pppoe0 vrf 'WAN' +set vrf bind-to-all +set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' +set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' +set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' +set vrf name LAN table '103' +set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' +set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' +set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' +set vrf name MGMT table '102' +set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' +set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' +set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' +set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' +set vrf name PROD table '104' +set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' +set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' +set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' +set vrf name WAN table '101' +``` + +And before firewall rules are shown, we need to pay attention how to configure +and match interfaces and VRFs. In case where an interface is assigned to a +non-default VRF, if we want to use inbound-interface or outbound-interface in +firewall rules, we need to: + +- For **inbound-interface**: use the interface name with the VRF name, like + `MGMT` or `LAN`. +- For **outbound-interface**: use the interface name, like `eth0`, `vtun0`, + `eth2*` or similar. + +Next, we need to configure the firewall rules. First we will define all rules +for transit traffic between VRFs. + +```none +set firewall ipv4 forward filter default-action 'drop' +set firewall ipv4 forward filter default-log +set firewall ipv4 forward filter rule 10 action 'accept' +set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD' +set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT' +set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*' +set firewall ipv4 forward filter rule 99 action 'drop' +set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt' +set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1' +set firewall ipv4 forward filter rule 120 action 'accept' +set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD' +set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN' +set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500' +set firewall ipv4 forward filter rule 130 action 'accept' +set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet' +set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN' +set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0' +``` + +Also, we are adding global state policies, in order to allow established and +related traffic, in order not to drop valid responses: + +```none +set firewall global-options state-policy established action 'accept' +set firewall global-options state-policy invalid action 'drop' +set firewall global-options state-policy related action 'accept' +``` + +And finally, we need to allow input connections to the router itself only from +vrf MGMT: + +```none +set firewall ipv4 input filter default-action 'drop' +set firewall ipv4 input filter default-log +set firewall ipv4 input filter rule 10 action 'accept' +set firewall ipv4 input filter rule 10 description 'MGMT - Allow input' +set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT' +``` diff --git a/docs/configexamples/fwall-and-vrf.rst b/docs/configexamples/fwall-and-vrf.rst deleted file mode 100644 index 38663a18..00000000 --- a/docs/configexamples/fwall-and-vrf.rst +++ /dev/null @@ -1,121 +0,0 @@ -VRF and firewall example ------------------------- - -Scenario and requirements -^^^^^^^^^^^^^^^^^^^^^^^^^ - -This example shows how to configure a VyOS router with VRFs and firewall rules. - -Diagram used in this example: - -.. image:: /_static/images/firewall-and-vrf-blueprints.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -As exposed in the diagram, there are four VRFs. These VRFs are ``MGMT``, -``WAN``, ``LAN`` and ``PROD``, and their requirements are: - -* VRF MGMT: - * Allow connections to LAN and PROD. - * Deny connections to internet(WAN). - * Allow connections to the router. -* VRF LAN: - * Allow connections to PROD. - * Allow connections to internet(WAN). -* VRF PROD: - * Only accepts connections. -* VRF WAN: - * Allow connection to PROD. - -Configuration -^^^^^^^^^^^^^ - -First, we need to configure the interfaces and VRFs: - -.. code-block:: none - - set interfaces ethernet eth1 address '10.100.100.1/24' - set interfaces ethernet eth1 vrf 'MGMT' - set interfaces ethernet eth2 vif 150 address '10.150.150.1/24' - set interfaces ethernet eth2 vif 150 vrf 'LAN' - set interfaces ethernet eth2 vif 160 address '10.160.160.1/24' - set interfaces ethernet eth2 vif 160 vrf 'LAN' - set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24' - set interfaces ethernet eth2 vif 3500 vrf 'PROD' - set interfaces loopback lo - set interfaces pppoe pppoe0 authentication password 'p4ssw0rd' - set interfaces pppoe pppoe0 authentication username 'vyos' - set interfaces pppoe pppoe0 source-interface 'eth0' - set interfaces pppoe pppoe0 vrf 'WAN' - set vrf bind-to-all - set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' - set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' - set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' - set vrf name LAN table '103' - set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' - set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' - set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' - set vrf name MGMT table '102' - set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' - set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' - set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' - set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' - set vrf name PROD table '104' - set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' - set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' - set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' - set vrf name WAN table '101' - -And before firewall rules are shown, we need to pay attention how to configure -and match interfaces and VRFs. In case where an interface is assigned to a -non-default VRF, if we want to use inbound-interface or outbound-interface in -firewall rules, we need to: - -* For **inbound-interface**: use the interface name with the VRF name, like - ``MGMT`` or ``LAN``. -* For **outbound-interface**: use the interface name, like ``eth0``, ``vtun0``, - ``eth2*`` or similar. - -Next, we need to configure the firewall rules. First we will define all rules -for transit traffic between VRFs. - -.. code-block:: none - - set firewall ipv4 forward filter default-action 'drop' - set firewall ipv4 forward filter default-log - set firewall ipv4 forward filter rule 10 action 'accept' - set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD' - set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT' - set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*' - set firewall ipv4 forward filter rule 99 action 'drop' - set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt' - set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1' - set firewall ipv4 forward filter rule 120 action 'accept' - set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD' - set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN' - set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500' - set firewall ipv4 forward filter rule 130 action 'accept' - set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet' - set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN' - set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0' - -Also, we are adding global state policies, in order to allow established and -related traffic, in order not to drop valid responses: - -.. code-block:: none - - set firewall global-options state-policy established action 'accept' - set firewall global-options state-policy invalid action 'drop' - set firewall global-options state-policy related action 'accept' - -And finally, we need to allow input connections to the router itself only from -vrf MGMT: - -.. code-block:: none - - set firewall ipv4 input filter default-action 'drop' - set firewall ipv4 input filter default-log - set firewall ipv4 input filter rule 10 action 'accept' - set firewall ipv4 input filter rule 10 description 'MGMT - Allow input' - set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT' \ No newline at end of file diff --git a/docs/configexamples/ha.md b/docs/configexamples/ha.md new file mode 100644 index 00000000..83e3b65e --- /dev/null +++ b/docs/configexamples/ha.md @@ -0,0 +1,545 @@ +--- +lastproofread: '2021-06-28' +--- + +(example-high-availability)= + +# High Availability Walkthrough + +This document walks you through a complete HA setup of two VyOS machines. This +design is based on a VM as the primary router and a physical machine as a +backup, using VRRP, BGP, OSPF, and conntrack sharing. + +This document aims to walk you through setting everything up, so +at a point where you can reboot any machine and not lose more than a few +seconds worth of connectivity. + +## Design + +This is based on a real-life production design. One of the complex issues +is ensuring you have redundant data INTO your network. We do this with a pair +of Cisco Nexus switches and using Virtual PortChannels that are spanned across +them. As a bonus, this also allows for complete switch failure without +an outage. How you achieve this yourself is left as an exercise to the reader. +But our setup is documented here. + +### Walkthrough suggestion + +The `commit` command is implied after every section. If you make an error, +`commit` will warn you and you can fix it before getting too far into things. +Please ensure you commit early and commit often. + +If you are following through this document, it is strongly suggested you +complete the entire document, ONLY doing the virtual router1 steps, and then +come back and walk through it AGAIN on the backup hardware router. + +This ensures you don't go too fast or miss a step. However, it will make your +life easier to configure the fixed IP address and default route now on the +hardware router. + +### Example Network + +In this document, we have been allocated 203.0.113.0/24 by our upstream +provider, which we are publishing on VLAN100. + +They want us to establish a BGP session to their routers on 192.0.2.11 and +192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and +we are AS 65551. + +Our routers are going to have a floating IP address of 203.0.113.1, and use +.2 and .3 as their fixed IPs. + +We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201. + +When traffic is originated from the 10.200.201.0/24 network, it will be +masqueraded to 203.0.113.1 + +For connection between sites, we are running a WireGuard link to two REMOTE +routers and using OSPF over those links to distribute routes. That remote +site is expected to send traffic from anything in 10.201.0.0/16 + +### VLANs + +These are the vlans we will be using: + +- 50: Upstream, using the 192.0.2.0/24 network allocated by them. +- 100: 'Public' network, using our 203.0.113.0/24 network. +- 201: 'Internal' network, using 10.200.201.0/24 + +### Hardware + +- switch1 (Nexus 10gb Switch) +- switch2 (Nexus 10gb Switch) +- compute1 (VMware ESXi 6.5) +- compute2 (VMware ESXi 6.5) +- compute3 (VMware ESXi 6.5) +- router2 (Random 1RU machine with 4 NICs) + +Note that router1 is a VM that runs on one of the compute nodes. + +### Network Cabling + +- From Datacenter - This connects into port 1 on both switches, and is tagged + as VLAN 50 +- Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch +- Hardware Router - Port 8 of each switch +- compute1 - Port 9 of each switch +- compute2 - Port 10 of each switch +- compute3 - Port 11 of each switch + +This is ignoring the extra Out-of-band management networking, which should be +on totally different switches, and a different feed into the rack, and is out +of scope of this. + +:::{note} +Our implementation uses VMware's Distributed Port Groups, which allows +VMware to use LACP. This is a part of the ENTERPRISE licence, and is not +available on a free licence. If you are implementing this and do not have +access to DPGs, you should not use VMware, and use some other virtualization +platform instead. +::: + +## Basic Setup (via console) + +Create your router1 VM. So it can withstand a VM Host failing or a +network link failing. Using VMware, this is achieved by enabling vSphere DRS, +vSphere Availability, and creating a Distributed Port Group that uses LACP. + +Many other Hypervisors do this, and I'm hoping that this document will be +expanded to document how to do this for others. + +Create an 'All VLANs' network group, that passes all trunked traffic through +to the VM. Attach this network group to router1 as eth0. + +:::{note} +VMware: You must DISABLE SECURITY on this Port group. Make sure that +`Promiscuous Mode`, `MAC address changes` and `Forged transmits` are +enabled. All of these will be done as part of failover. +::: + +### Bonding on Hardware Router + +Create a LACP bond on the hardware router. We are assuming that eth0 and eth1 +are connected to port 8 on both switches, and that those ports are configured +as a Port-Channel. + +```none +set interfaces bonding bond0 description 'Switch Port-Channel' +set interfaces bonding bond0 hash-policy 'layer2' +set interfaces bonding bond0 member interface 'eth0' +set interfaces bonding bond0 member interface 'eth1' +set interfaces bonding bond0 mode '802.3ad' +``` + +### Assign external IP addresses + +VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this +is talking directly to upstream. Create our IP address on vlan50. + +For the hardware router, replace `eth0` with `bond0`. As (almost) every +command is identical, this will not be specified unless different things need +to be performed on different hosts. + +```none +set interfaces ethernet eth0 vif 50 address '192.0.2.21/24' +``` + +In this case, the hardware router has a different IP, so it would be + +```none +set interfaces ethernet bond0 vif 50 address '192.0.2.22/24' +``` + +### Add (temporary) default route + +It is assumed that the routers provided by upstream are capable of acting as a +default router, add that as a static route. + +```none +set protocols static route 0.0.0.0/0 next-hop 192.0.2.11 +commit +save +``` + +### Enable SSH + +Enable SSH so you can now SSH into the routers, rather than using the console. + +```none +set service ssh +commit +save +``` + +At this point, you should be able to SSH into both of them, and will no longer +need access to the console (unless you break something!) + +## VRRP Configuration + +We are setting up VRRP so that it does NOT fail back when a machine returns into +service, and it prioritizes router1 over router2. + +### Internal Network + +This has a floating IP address of 10.200.201.1/24, using virtual router ID 201. +The difference between them is the interface name, hello-source-address, and +peer-address. + +**router1** + +```none +set interfaces ethernet eth0 vif 201 address 10.200.201.2/24 +set high-availability vrrp group int hello-source-address '10.200.201.2' +set high-availability vrrp group int interface 'eth0.201' +set high-availability vrrp group int peer-address '10.200.201.3' +set high-availability vrrp group int no-preempt +set high-availability vrrp group int priority '200' +set high-availability vrrp group int address '10.200.201.1/24' +set high-availability vrrp group int vrid '201' +``` + +**router2** + +```none +set interfaces ethernet bond0 vif 201 address 10.200.201.3/24 +set high-availability vrrp group int hello-source-address '10.200.201.3' +set high-availability vrrp group int interface 'bond0.201' +set high-availability vrrp group int peer-address '10.200.201.2' +set high-availability vrrp group int no-preempt +set high-availability vrrp group int priority '100' +set high-availability vrrp group int address '10.200.201.1/24' +set high-availability vrrp group int vrid '201' +``` + +### Public Network + +This has a floating IP address of 203.0.113.1/24, using virtual router ID 113. +The virtual router ID is just a random number between 1 and 254, and can be set +to whatever you want. Best practices suggest you try to keep them unique +enterprise-wide. + +**router1** + +```none +set interfaces ethernet eth0 vif 100 address 203.0.113.2/24 +set high-availability vrrp group public hello-source-address '203.0.113.2' +set high-availability vrrp group public interface 'eth0.100' +set high-availability vrrp group public peer-address '203.0.113.3' +set high-availability vrrp group public no-preempt +set high-availability vrrp group public priority '200' +set high-availability vrrp group public address '203.0.113.1/24' +set high-availability vrrp group public vrid '113' +``` + +**router2** + +```none +set interfaces ethernet bond0 vif 100 address 203.0.113.3/24 +set high-availability vrrp group public hello-source-address '203.0.113.3' +set high-availability vrrp group public interface 'bond0.100' +set high-availability vrrp group public peer-address '203.0.113.2' +set high-availability vrrp group public no-preempt +set high-availability vrrp group public priority '100' +set high-availability vrrp group public address '203.0.113.1/24' +set high-availability vrrp group public vrid '113' +``` + +### Create VRRP sync-group + +The sync group is used to replicate connection tracking. It needs to be assigned +to a random VRRP group, and we are creating a sync group called `sync` using +the vrrp group `int`. + +```none +set high-availability vrrp sync-group sync member 'int' +``` + +### Testing + +At this point, you should be able to see both IP addresses when you run +`show interfaces`, and `show vrrp` should show both interfaces in MASTER +state (and SLAVE state on router2). + +```none +vyos@router1:~$ show vrrp +Name Interface VRID State Last Transition +-------- ----------- ------ ------- ----------------- +int eth0.201 201 MASTER 100s +public eth0.100 113 MASTER 200s +vyos@router1:~$ +``` + +You should be able to ping to and from all the IPs you have allocated. + +## NAT and conntrack-sync + +Masquerade Traffic originating from 10.200.201.0/24 that is heading out the +public interface. + +:::{note} +We explicitly exclude the primary upstream network so that BGP or +OSPF traffic doesn't accidentally get NAT'ed. +::: + +```none +set nat source rule 10 destination address '!192.0.2.0/24' +set nat source rule 10 outbound-interface 'eth0.50' +set nat source rule 10 source address '10.200.201.0/24' +set nat source rule 10 translation address '203.0.113.1' +``` + +### Configure conntrack-sync and enable helpers + +Conntrack helper modules are enabled by default, but they tend to cause more +problems than they're worth in complex networks. You can disable all of them +at one go. + +```none +delete system conntrack modules +``` + +Now enable replication between nodes. Replace eth0.201 with bond0.201 on the +hardware router. + +```none +set service conntrack-sync accept-protocol 'tcp,udp,icmp' +set service conntrack-sync event-listen-queue-size '8' +set service conntrack-sync failover-mechanism vrrp sync-group 'sync' +set service conntrack-sync interface eth0.201 +set service conntrack-sync mcast-group '224.0.0.50' +set service conntrack-sync sync-queue-size '8' +``` + +(ha-contracktesting)= + +### Testing + +The simplest way to test is to look at the connection tracking stats on the +standby hardware router with the command `show conntrack-sync statistics`. +The numbers should be very close to the numbers on the primary router. + +When you have both routers up, you should be able to establish a connection +from a NAT'ed machine out to the internet, reboot the active machine, and that +connection should be preserved, and will not drop out. + +## OSPF Over WireGuard + +Wireguard doesn't have the concept of an up or down link, due to its design. +This complicates AND simplifies using it for network transport, as for reliable +state detection you need to use SOMETHING to detect when the link is down. + +If you use a routing protocol itself, you solve two problems at once. This is +only a basic example, and is provided as a starting point. + +### Configure Wireguard + +There is plenty of instructions and documentation on setting up Wireguard. The +only important thing you need to remember is to only use one WireGuard +interface per OSPF connection. + +We use small /30's from 10.254.60/24 for the point-to-point links. + +**router1** + +Replace the 203.0.113.3 with whatever the other router's IP address is. + +```none +set interfaces wireguard wg01 address '10.254.60.1/30' +set interfaces wireguard wg01 description 'router1-to-offsite1' +set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001' +set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' +set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' +set interfaces wireguard wg01 port '50001' +set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' +set protocols ospf interface wg01 cost '11' +set protocols ospf interface wg01 dead-interval '5' +set protocols ospf interface wg01 hello-interval '1' +set protocols ospf interface wg01 network 'point-to-point' +set protocols ospf interface wg01 priority '1' +set protocols ospf interface wg01 retransmit-interval '5' +set protocols ospf interface wg01 transmit-delay '1' +``` + +**offsite1** + +This is connecting back to the STATIC IP of router1, not the floating. + +```none +set interfaces wireguard wg01 address '10.254.60.2/30' +set interfaces wireguard wg01 description 'offsite1-to-router1' +set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001' +set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15' +set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=' +set interfaces wireguard wg01 port '50001' +set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' +set protocols ospf interface wg01 cost '11' +set protocols ospf interface wg01 dead-interval '5' +set protocols ospf interface wg01 hello-interval '1' +set protocols ospf interface wg01 network 'point-to-point' +set protocols ospf interface wg01 priority '1' +set protocols ospf interface wg01 retransmit-interval '5' +set protocols ospf interface wg01 transmit-delay '1' +``` + +### Test WireGuard + +Make sure you can ping 10.254.60.1 and .2 from both routers. + +### Create Export Filter + +We only want to export the networks we know. Always do a whitelist on your route +filters, both importing and exporting. A good rule of thumb is +**'If you are not the default router for a network, don't advertise +it'**. This means we explicitly do not want to advertise the 192.0.2.0/24 +network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE +the default route for). This filter is applied to `redistribute connected`. +If we WERE to advertise it, the remote machines would see 192.0.2.21 available +via their default route, establish the connection, and then OSPF would say +'192.0.2.0/24 is available via this tunnel', at which point the tunnel would +break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via +default again. This is called 'flapping'. + +```none +set policy access-list 150 description 'Outbound OSPF Redistribution' +set policy access-list 150 rule 10 action 'permit' +set policy access-list 150 rule 10 destination any +set policy access-list 150 rule 10 source inverse-mask '0.0.0.255' +set policy access-list 150 rule 10 source network '10.200.201.0' +set policy access-list 150 rule 20 action 'permit' +set policy access-list 150 rule 20 destination any +set policy access-list 150 rule 20 source inverse-mask '0.0.0.255' +set policy access-list 150 rule 20 source network '203.0.113.0' +set policy access-list 150 rule 100 action 'deny' +set policy access-list 150 rule 100 destination any +set policy access-list 150 rule 100 source any +``` + +### Create Import Filter + +We only want to import networks we know. Our OSPF peer should only be +advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE +MATCH. You deny in access-list 100 to accept the route. + +```none +set policy access-list 100 description 'Inbound OSPF Routes from Peers' +set policy access-list 100 rule 10 action 'deny' +set policy access-list 100 rule 10 destination any +set policy access-list 100 rule 10 source inverse-mask '0.0.255.255' +set policy access-list 100 rule 10 source network '10.201.0.0' +set policy access-list 100 rule 100 action 'permit' +set policy access-list 100 rule 100 destination any +set policy access-list 100 rule 100 source any +set policy route-map PUBOSPF rule 100 action 'deny' +set policy route-map PUBOSPF rule 100 match ip address access-list '100' +set policy route-map PUBOSPF rule 500 action 'permit' +``` + +### Enable OSPF + +Every router **must** have a unique router-id. +The 'reference-bandwidth' is used because when OSPF was originally designed, +the idea of a link faster than 1gbit was unheard of, and it does not scale +correctly. + +```none +set protocols ospf area 0.0.0.0 authentication 'md5' +set protocols ospf area 0.0.0.0 network '10.254.60.0/24' +set protocols ospf auto-cost reference-bandwidth '10000' +set protocols ospf log-adjacency-changes +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.254.60.2' +set protocols ospf route-map PUBOSPF +``` + +### Test OSPF + +When you have enabled OSPF on both routers, you should be able to see each +other with the command `show ip ospf neighbour`. The state must be 'Full' +or '2-Way'. If it is not, then there is a network connectivity issue between the +hosts. This is often caused by NAT or MTU issues. You should not see any new +routes (unless this is the second pass) in the output of `show ip route` + +## Advertise connected routes + +As a reminder, only advertise routes that you are the default router for. This +is why we are NOT announcing the 192.0.2.0/24 network, because if that was +announced into OSPF, the other routers would try to connect to that network +over a tunnel that connects to that network! + +```none +set protocols ospf access-list 150 export 'connected' +set protocols ospf redistribute connected +``` + +You should now be able to see the advertised network on the other host. + +### Duplicate configuration + +At this point, you now need to create the X link between all four routers. +Use amdifferent /30 for each link. + +### Priorities + +Set the cost on the secondary links to be 200. This means that they will not +be used unless the primary links are down. + +```none +set protocols ospf interface wg01 cost '10' +set protocols ospf interface wg01 cost '200' +``` + +This will be visible in 'show ip route'. + +## BGP + +BGP is an extremely complex network protocol. An example is provided here. + +:::{note} +Router id's must be unique. +::: + +**router1** + +The `redistribute ospf` command is there purely as an example of how this can +be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as +it is not 203.0.113.0/24. + +```none +set policy prefix-list BGPOUT description 'BGP Export List' +set policy prefix-list BGPOUT rule 10 action 'deny' +set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' +set policy prefix-list BGPOUT rule 10 ge '25' +set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' +set policy prefix-list BGPOUT rule 100 action 'permit' +set policy prefix-list BGPOUT rule 100 description 'Our network' +set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' +set policy prefix-list BGPOUT rule 10000 action 'deny' +set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' + +set policy route-map BGPOUT description 'BGP Export Filter' +set policy route-map BGPOUT rule 10 action 'permit' +set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT' +set policy route-map BGPOUT rule 10000 action 'deny' +set policy route-map BGPPREPENDOUT description 'BGP Export Filter' +set policy route-map BGPPREPENDOUT rule 10 action 'permit' +set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' +set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT' +set policy route-map BGPPREPENDOUT rule 10000 action 'deny' + +set protocols bgp system-as 65551 +set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 +set protocols bgp address-family ipv4-unicast redistribute connected metric '50' +set protocols bgp address-family ipv4-unicast redistribute ospf metric '50' +set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT' +set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound +set protocols bgp neighbor 192.0.2.11 remote-as '65550' +set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21' +set protocols bgp parameters router-id '192.0.2.21' +``` + +**router2** + +This is identical, but you use the BGPPREPENDOUT route-map to advertise the +route with a longer path. diff --git a/docs/configexamples/ha.rst b/docs/configexamples/ha.rst deleted file mode 100644 index 1ceda8e9..00000000 --- a/docs/configexamples/ha.rst +++ /dev/null @@ -1,584 +0,0 @@ -:lastproofread: 2021-06-28 - -.. _example-high-availability: - -############################# -High Availability Walkthrough -############################# - -This document walks you through a complete HA setup of two VyOS machines. This -design is based on a VM as the primary router and a physical machine as a -backup, using VRRP, BGP, OSPF, and conntrack sharing. - -This document aims to walk you through setting everything up, so -at a point where you can reboot any machine and not lose more than a few -seconds worth of connectivity. - -Design -====== - -This is based on a real-life production design. One of the complex issues -is ensuring you have redundant data INTO your network. We do this with a pair -of Cisco Nexus switches and using Virtual PortChannels that are spanned across -them. As a bonus, this also allows for complete switch failure without -an outage. How you achieve this yourself is left as an exercise to the reader. -But our setup is documented here. - -Walkthrough suggestion ----------------------- - -The ``commit`` command is implied after every section. If you make an error, -``commit`` will warn you and you can fix it before getting too far into things. -Please ensure you commit early and commit often. - -If you are following through this document, it is strongly suggested you -complete the entire document, ONLY doing the virtual router1 steps, and then -come back and walk through it AGAIN on the backup hardware router. - -This ensures you don't go too fast or miss a step. However, it will make your -life easier to configure the fixed IP address and default route now on the -hardware router. - -Example Network ---------------- - -In this document, we have been allocated 203.0.113.0/24 by our upstream -provider, which we are publishing on VLAN100. - -They want us to establish a BGP session to their routers on 192.0.2.11 and -192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and -we are AS 65551. - -Our routers are going to have a floating IP address of 203.0.113.1, and use -.2 and .3 as their fixed IPs. - -We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201. - -When traffic is originated from the 10.200.201.0/24 network, it will be -masqueraded to 203.0.113.1 - -For connection between sites, we are running a WireGuard link to two REMOTE -routers and using OSPF over those links to distribute routes. That remote -site is expected to send traffic from anything in 10.201.0.0/16 - -VLANs ------ - -These are the vlans we will be using: - -* 50: Upstream, using the 192.0.2.0/24 network allocated by them. -* 100: 'Public' network, using our 203.0.113.0/24 network. -* 201: 'Internal' network, using 10.200.201.0/24 - -Hardware --------- - -* switch1 (Nexus 10gb Switch) -* switch2 (Nexus 10gb Switch) -* compute1 (VMware ESXi 6.5) -* compute2 (VMware ESXi 6.5) -* compute3 (VMware ESXi 6.5) -* router2 (Random 1RU machine with 4 NICs) - -Note that router1 is a VM that runs on one of the compute nodes. - -Network Cabling ---------------- - -* From Datacenter - This connects into port 1 on both switches, and is tagged - as VLAN 50 -* Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch -* Hardware Router - Port 8 of each switch -* compute1 - Port 9 of each switch -* compute2 - Port 10 of each switch -* compute3 - Port 11 of each switch - -This is ignoring the extra Out-of-band management networking, which should be -on totally different switches, and a different feed into the rack, and is out -of scope of this. - -.. note:: Our implementation uses VMware's Distributed Port Groups, which allows - VMware to use LACP. This is a part of the ENTERPRISE licence, and is not - available on a free licence. If you are implementing this and do not have - access to DPGs, you should not use VMware, and use some other virtualization - platform instead. - - -Basic Setup (via console) -========================= - -Create your router1 VM. So it can withstand a VM Host failing or a -network link failing. Using VMware, this is achieved by enabling vSphere DRS, -vSphere Availability, and creating a Distributed Port Group that uses LACP. - -Many other Hypervisors do this, and I'm hoping that this document will be -expanded to document how to do this for others. - -Create an 'All VLANs' network group, that passes all trunked traffic through -to the VM. Attach this network group to router1 as eth0. - -.. note:: VMware: You must DISABLE SECURITY on this Port group. Make sure that - ``Promiscuous Mode``\ , ``MAC address changes`` and ``Forged transmits`` are - enabled. All of these will be done as part of failover. - -Bonding on Hardware Router --------------------------- - -Create a LACP bond on the hardware router. We are assuming that eth0 and eth1 -are connected to port 8 on both switches, and that those ports are configured -as a Port-Channel. - -.. code-block:: none - - set interfaces bonding bond0 description 'Switch Port-Channel' - set interfaces bonding bond0 hash-policy 'layer2' - set interfaces bonding bond0 member interface 'eth0' - set interfaces bonding bond0 member interface 'eth1' - set interfaces bonding bond0 mode '802.3ad' - - -Assign external IP addresses ----------------------------- - -VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this -is talking directly to upstream. Create our IP address on vlan50. - -For the hardware router, replace ``eth0`` with ``bond0``. As (almost) every -command is identical, this will not be specified unless different things need -to be performed on different hosts. - -.. code-block:: none - - set interfaces ethernet eth0 vif 50 address '192.0.2.21/24' - -In this case, the hardware router has a different IP, so it would be - -.. code-block:: none - - set interfaces ethernet bond0 vif 50 address '192.0.2.22/24' - -Add (temporary) default route ------------------------------ - -It is assumed that the routers provided by upstream are capable of acting as a -default router, add that as a static route. - -.. code-block:: none - - set protocols static route 0.0.0.0/0 next-hop 192.0.2.11 - commit - save - - -Enable SSH ----------- - -Enable SSH so you can now SSH into the routers, rather than using the console. - -.. code-block:: none - - set service ssh - commit - save - -At this point, you should be able to SSH into both of them, and will no longer -need access to the console (unless you break something!) - - -VRRP Configuration -================== - -We are setting up VRRP so that it does NOT fail back when a machine returns into -service, and it prioritizes router1 over router2. - -Internal Network ----------------- - -This has a floating IP address of 10.200.201.1/24, using virtual router ID 201. -The difference between them is the interface name, hello-source-address, and -peer-address. - -**router1** - -.. code-block:: none - - set interfaces ethernet eth0 vif 201 address 10.200.201.2/24 - set high-availability vrrp group int hello-source-address '10.200.201.2' - set high-availability vrrp group int interface 'eth0.201' - set high-availability vrrp group int peer-address '10.200.201.3' - set high-availability vrrp group int no-preempt - set high-availability vrrp group int priority '200' - set high-availability vrrp group int address '10.200.201.1/24' - set high-availability vrrp group int vrid '201' - - -**router2** - -.. code-block:: none - - set interfaces ethernet bond0 vif 201 address 10.200.201.3/24 - set high-availability vrrp group int hello-source-address '10.200.201.3' - set high-availability vrrp group int interface 'bond0.201' - set high-availability vrrp group int peer-address '10.200.201.2' - set high-availability vrrp group int no-preempt - set high-availability vrrp group int priority '100' - set high-availability vrrp group int address '10.200.201.1/24' - set high-availability vrrp group int vrid '201' - - -Public Network --------------- - -This has a floating IP address of 203.0.113.1/24, using virtual router ID 113. -The virtual router ID is just a random number between 1 and 254, and can be set -to whatever you want. Best practices suggest you try to keep them unique -enterprise-wide. - -**router1** - -.. code-block:: none - - set interfaces ethernet eth0 vif 100 address 203.0.113.2/24 - set high-availability vrrp group public hello-source-address '203.0.113.2' - set high-availability vrrp group public interface 'eth0.100' - set high-availability vrrp group public peer-address '203.0.113.3' - set high-availability vrrp group public no-preempt - set high-availability vrrp group public priority '200' - set high-availability vrrp group public address '203.0.113.1/24' - set high-availability vrrp group public vrid '113' - -**router2** - -.. code-block:: none - - set interfaces ethernet bond0 vif 100 address 203.0.113.3/24 - set high-availability vrrp group public hello-source-address '203.0.113.3' - set high-availability vrrp group public interface 'bond0.100' - set high-availability vrrp group public peer-address '203.0.113.2' - set high-availability vrrp group public no-preempt - set high-availability vrrp group public priority '100' - set high-availability vrrp group public address '203.0.113.1/24' - set high-availability vrrp group public vrid '113' - - -Create VRRP sync-group ----------------------- - -The sync group is used to replicate connection tracking. It needs to be assigned -to a random VRRP group, and we are creating a sync group called ``sync`` using -the vrrp group ``int``. - -.. code-block:: none - - set high-availability vrrp sync-group sync member 'int' - -Testing -------- - -At this point, you should be able to see both IP addresses when you run -``show interfaces``\ , and ``show vrrp`` should show both interfaces in MASTER -state (and SLAVE state on router2). - -.. code-block:: none - - vyos@router1:~$ show vrrp - Name Interface VRID State Last Transition - -------- ----------- ------ ------- ----------------- - int eth0.201 201 MASTER 100s - public eth0.100 113 MASTER 200s - vyos@router1:~$ - - -You should be able to ping to and from all the IPs you have allocated. - -NAT and conntrack-sync -====================== - -Masquerade Traffic originating from 10.200.201.0/24 that is heading out the -public interface. - -.. note:: We explicitly exclude the primary upstream network so that BGP or - OSPF traffic doesn't accidentally get NAT'ed. - -.. code-block:: none - - set nat source rule 10 destination address '!192.0.2.0/24' - set nat source rule 10 outbound-interface 'eth0.50' - set nat source rule 10 source address '10.200.201.0/24' - set nat source rule 10 translation address '203.0.113.1' - - -Configure conntrack-sync and enable helpers --------------------------------------------- - -Conntrack helper modules are enabled by default, but they tend to cause more -problems than they're worth in complex networks. You can disable all of them -at one go. - -.. code-block:: none - - delete system conntrack modules - -Now enable replication between nodes. Replace eth0.201 with bond0.201 on the -hardware router. - -.. code-block:: none - - set service conntrack-sync accept-protocol 'tcp,udp,icmp' - set service conntrack-sync event-listen-queue-size '8' - set service conntrack-sync failover-mechanism vrrp sync-group 'sync' - set service conntrack-sync interface eth0.201 - set service conntrack-sync mcast-group '224.0.0.50' - set service conntrack-sync sync-queue-size '8' - -.. _ha:contracktesting: - -Testing -------- - -The simplest way to test is to look at the connection tracking stats on the -standby hardware router with the command ``show conntrack-sync statistics``. -The numbers should be very close to the numbers on the primary router. - -When you have both routers up, you should be able to establish a connection -from a NAT'ed machine out to the internet, reboot the active machine, and that -connection should be preserved, and will not drop out. - -OSPF Over WireGuard -=================== - -Wireguard doesn't have the concept of an up or down link, due to its design. -This complicates AND simplifies using it for network transport, as for reliable -state detection you need to use SOMETHING to detect when the link is down. - -If you use a routing protocol itself, you solve two problems at once. This is -only a basic example, and is provided as a starting point. - -Configure Wireguard -------------------- - -There is plenty of instructions and documentation on setting up Wireguard. The -only important thing you need to remember is to only use one WireGuard -interface per OSPF connection. - -We use small /30's from 10.254.60/24 for the point-to-point links. - -**router1** - -Replace the 203.0.113.3 with whatever the other router's IP address is. - -.. code-block:: none - - set interfaces wireguard wg01 address '10.254.60.1/30' - set interfaces wireguard wg01 description 'router1-to-offsite1' - set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' - set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001' - set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' - set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' - set interfaces wireguard wg01 port '50001' - set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' - set protocols ospf interface wg01 cost '11' - set protocols ospf interface wg01 dead-interval '5' - set protocols ospf interface wg01 hello-interval '1' - set protocols ospf interface wg01 network 'point-to-point' - set protocols ospf interface wg01 priority '1' - set protocols ospf interface wg01 retransmit-interval '5' - set protocols ospf interface wg01 transmit-delay '1' - - -**offsite1** - -This is connecting back to the STATIC IP of router1, not the floating. - -.. code-block:: none - - set interfaces wireguard wg01 address '10.254.60.2/30' - set interfaces wireguard wg01 description 'offsite1-to-router1' - set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0' - set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001' - set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15' - set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=' - set interfaces wireguard wg01 port '50001' - set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' - set protocols ospf interface wg01 cost '11' - set protocols ospf interface wg01 dead-interval '5' - set protocols ospf interface wg01 hello-interval '1' - set protocols ospf interface wg01 network 'point-to-point' - set protocols ospf interface wg01 priority '1' - set protocols ospf interface wg01 retransmit-interval '5' - set protocols ospf interface wg01 transmit-delay '1' - -Test WireGuard --------------- - -Make sure you can ping 10.254.60.1 and .2 from both routers. - -Create Export Filter --------------------- - -We only want to export the networks we know. Always do a whitelist on your route -filters, both importing and exporting. A good rule of thumb is -**'If you are not the default router for a network, don't advertise -it'**. This means we explicitly do not want to advertise the 192.0.2.0/24 -network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE -the default route for). This filter is applied to ``redistribute connected``. -If we WERE to advertise it, the remote machines would see 192.0.2.21 available -via their default route, establish the connection, and then OSPF would say -'192.0.2.0/24 is available via this tunnel', at which point the tunnel would -break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via -default again. This is called 'flapping'. - -.. code-block:: none - - set policy access-list 150 description 'Outbound OSPF Redistribution' - set policy access-list 150 rule 10 action 'permit' - set policy access-list 150 rule 10 destination any - set policy access-list 150 rule 10 source inverse-mask '0.0.0.255' - set policy access-list 150 rule 10 source network '10.200.201.0' - set policy access-list 150 rule 20 action 'permit' - set policy access-list 150 rule 20 destination any - set policy access-list 150 rule 20 source inverse-mask '0.0.0.255' - set policy access-list 150 rule 20 source network '203.0.113.0' - set policy access-list 150 rule 100 action 'deny' - set policy access-list 150 rule 100 destination any - set policy access-list 150 rule 100 source any - - -Create Import Filter --------------------- - -We only want to import networks we know. Our OSPF peer should only be -advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE -MATCH. You deny in access-list 100 to accept the route. - -.. code-block:: none - - set policy access-list 100 description 'Inbound OSPF Routes from Peers' - set policy access-list 100 rule 10 action 'deny' - set policy access-list 100 rule 10 destination any - set policy access-list 100 rule 10 source inverse-mask '0.0.255.255' - set policy access-list 100 rule 10 source network '10.201.0.0' - set policy access-list 100 rule 100 action 'permit' - set policy access-list 100 rule 100 destination any - set policy access-list 100 rule 100 source any - set policy route-map PUBOSPF rule 100 action 'deny' - set policy route-map PUBOSPF rule 100 match ip address access-list '100' - set policy route-map PUBOSPF rule 500 action 'permit' - - -Enable OSPF ------------ - -Every router **must** have a unique router-id. -The 'reference-bandwidth' is used because when OSPF was originally designed, -the idea of a link faster than 1gbit was unheard of, and it does not scale -correctly. - -.. code-block:: none - - set protocols ospf area 0.0.0.0 authentication 'md5' - set protocols ospf area 0.0.0.0 network '10.254.60.0/24' - set protocols ospf auto-cost reference-bandwidth '10000' - set protocols ospf log-adjacency-changes - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.254.60.2' - set protocols ospf route-map PUBOSPF - - -Test OSPF ---------- - -When you have enabled OSPF on both routers, you should be able to see each -other with the command ``show ip ospf neighbour``. The state must be 'Full' -or '2-Way'. If it is not, then there is a network connectivity issue between the -hosts. This is often caused by NAT or MTU issues. You should not see any new -routes (unless this is the second pass) in the output of ``show ip route`` - -Advertise connected routes -========================== - -As a reminder, only advertise routes that you are the default router for. This -is why we are NOT announcing the 192.0.2.0/24 network, because if that was -announced into OSPF, the other routers would try to connect to that network -over a tunnel that connects to that network! - -.. code-block:: none - - set protocols ospf access-list 150 export 'connected' - set protocols ospf redistribute connected - - -You should now be able to see the advertised network on the other host. - -Duplicate configuration ------------------------ - -At this point, you now need to create the X link between all four routers. -Use amdifferent /30 for each link. - -Priorities ----------- - -Set the cost on the secondary links to be 200. This means that they will not -be used unless the primary links are down. - -.. code-block:: none - - set protocols ospf interface wg01 cost '10' - set protocols ospf interface wg01 cost '200' - - -This will be visible in 'show ip route'. - -BGP -=== - -BGP is an extremely complex network protocol. An example is provided here. - -.. note:: Router id's must be unique. - -**router1** - - -The ``redistribute ospf`` command is there purely as an example of how this can -be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as -it is not 203.0.113.0/24. - -.. code-block:: none - - set policy prefix-list BGPOUT description 'BGP Export List' - set policy prefix-list BGPOUT rule 10 action 'deny' - set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' - set policy prefix-list BGPOUT rule 10 ge '25' - set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' - set policy prefix-list BGPOUT rule 100 action 'permit' - set policy prefix-list BGPOUT rule 100 description 'Our network' - set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' - set policy prefix-list BGPOUT rule 10000 action 'deny' - set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' - - set policy route-map BGPOUT description 'BGP Export Filter' - set policy route-map BGPOUT rule 10 action 'permit' - set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT' - set policy route-map BGPOUT rule 10000 action 'deny' - set policy route-map BGPPREPENDOUT description 'BGP Export Filter' - set policy route-map BGPPREPENDOUT rule 10 action 'permit' - set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' - set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT' - set policy route-map BGPPREPENDOUT rule 10000 action 'deny' - - set protocols bgp system-as 65551 - set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 - set protocols bgp address-family ipv4-unicast redistribute connected metric '50' - set protocols bgp address-family ipv4-unicast redistribute ospf metric '50' - set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT' - set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound - set protocols bgp neighbor 192.0.2.11 remote-as '65550' - set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21' - set protocols bgp parameters router-id '192.0.2.21' - - -**router2** - -This is identical, but you use the BGPPREPENDOUT route-map to advertise the -route with a longer path. diff --git a/docs/configexamples/index.md b/docs/configexamples/index.md new file mode 100644 index 00000000..78490de4 --- /dev/null +++ b/docs/configexamples/index.md @@ -0,0 +1,59 @@ +(examples)= + +# Configuration Blueprints + +This chapter contains various configuration examples: + +```{eval-rst} +.. toctree:: + :maxdepth: 2 + + firewall + bgp-ipv6-unnumbered + ospf-unnumbered + azure-vpn-bgp + azure-vpn-dual-bgp + ha + wan-load-balancing + pppoe-ipv6-basic + l3vpn-hub-and-spoke + lac-lns + inter-vrf-routing-vrf-lite + qos + segment-routing-isis + nmp + ipsec-cisco-policy-based + ipsec-cisco-route-based + ipsec-pa-route-based + +``` + +# Configuration Blueprints (autotest) + +The next pages contains automatic full tested configuration examples. + +Each lab will build an test from an external script. +The page content will generate, so changes will not take an effect. + +A host `vyos-oobm` will use as a ssh proxy. This host is just +necessary for the Lab test. + +The process will do the following steps: + +1. create the lab on a eve-ng server +2. configure each host in the lab +3. do some defined tests +4. optional do an upgrade to a higher version and do step 3 again. +5. generate the documentation and include files +6. shutdown and destroy the lab, if there is no error + +```{eval-rst} +.. toctree:: + :maxdepth: 1 + + autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE + autotest/tunnelbroker/tunnelbroker + autotest/L3VPN_EVPN/L3VPN_EVPN + autotest/Wireguard/Wireguard + autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP +``` diff --git a/docs/configexamples/index.rst b/docs/configexamples/index.rst deleted file mode 100644 index 0b585972..00000000 --- a/docs/configexamples/index.rst +++ /dev/null @@ -1,58 +0,0 @@ -.. _examples: - -Configuration Blueprints -======================== - -This chapter contains various configuration examples: - -.. toctree:: - :maxdepth: 2 - - firewall - bgp-ipv6-unnumbered - ospf-unnumbered - azure-vpn-bgp - azure-vpn-dual-bgp - ha - wan-load-balancing - pppoe-ipv6-basic - l3vpn-hub-and-spoke - lac-lns - inter-vrf-routing-vrf-lite - qos - segment-routing-isis - nmp - ipsec-cisco-policy-based - ipsec-cisco-route-based - ipsec-pa-route-based - - -Configuration Blueprints (autotest) -=================================== - -The next pages contains automatic full tested configuration examples. - -Each lab will build an test from an external script. -The page content will generate, so changes will not take an effect. - -A host ``vyos-oobm`` will use as a ssh proxy. This host is just -necessary for the Lab test. - -The process will do the following steps: - -1. create the lab on a eve-ng server -2. configure each host in the lab -3. do some defined tests -4. optional do an upgrade to a higher version and do step 3 again. -5. generate the documentation and include files -6. shutdown and destroy the lab, if there is no error - - -.. toctree:: - :maxdepth: 1 - - autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE - autotest/tunnelbroker/tunnelbroker - autotest/L3VPN_EVPN/L3VPN_EVPN - autotest/Wireguard/Wireguard - autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.md b/docs/configexamples/inter-vrf-routing-vrf-lite.md new file mode 100644 index 00000000..50e666a9 --- /dev/null +++ b/docs/configexamples/inter-vrf-routing-vrf-lite.md @@ -0,0 +1,798 @@ +# Inter-VRF Routing over VRF Lite + +**Virtual Routing and Forwarding** is a technology that allow multiple instance +of a routing table to exist within a single device. One of the key aspect of +**VRFs** is that do not share the same routes or interfaces, therefore packets +are forwarded between interfaces that belong to the same VRF only. + +Any information related to a VRF is not exchanged between devices -or in the +same device- by default, this is a technique called **VRF-Lite**. + +Keep networks isolated is -in general- a good principle, but there are cases +where you might need that some network can access other in a different VRF. + +The scope of this document is to cover such cases in a dynamic way without the +use of MPLS-LDP. + +General information about L3VPNs can be found in the {ref}`configuration/vrf/index:L3VPN VRFs` chapter. + +## Overview + +Let’s say we have a requirement to have multiple networks. + +- LAN 1 +- LAN 2 +- Management +- Internet + +Both LANs have to be able to route between each other, both will have managed +devices through a dedicated management network and both will need Internet +access yet the LAN2 will need access to some set of outside networks, not all. +The management network will need access to both LANs but cannot have access +to/from the outside. + +This scenario could be a nightmare applying regular routing and might need +filtering in multiple interfaces. + +A simple solution could be using different routing tables, or VRFs +for all the networks so we can keep the routing restrictions. +But for us to route between the different VRFs we would need a cable or a +logical connection between each other: + +- One cable/logical connection between LAN1 and LAN2 +- One cable/logical connection between LAN1 and Internet +- One cable/logical connection between LAN2 and Internet +- One cable/logical connection between LAN1 and Management +- One cable/logical connection between LAN2 and Management + +As we can see this is unpractical. + +To address this scenario we will use to our advantage an extension of the BGP +routing protocol that will help us in the “Export” between VRFs without the +need for MPLS. + +MP-BGP or MultiProtocol BGP introduces two main concepts to solve this +limitation: +\- Route Distinguisher (RD): Is used to distinguish between different VRFs +–called VPNs- inside the BGP Process. The RD is appended to each IPv4 Network +that is advertised into BGP for that VPN making it a unique VPNv4 route. +\- Route Target (RT): This is an extended BGP community append to the VPNv4 route +in the Import/Export process. When a route passes from the VRF routing table +into the BGP process it will add the configured export extended community(ies) +for that VPN. When that route needs to go from BGP into the VRF routing table +will only pass if that given VPN import policy matches any of the appended +community(ies) into that prefix. + +## Topology + +```{image} /_static/images/inter-vrf-routing-vrf-lite.png +:align: center +:alt: Network Topology Diagram +:width: 70% +``` + +### IP Schema + +```{eval-rst} ++----------+------------+----------------+------------------+ +| Device-A | Device-B | IPv4 Network | IPv6 Network | ++----------+------------+----------------+------------------+ +| Core | LAN1 | 10.1.1.0/30 | 2001:db8::/127 | ++----------+------------+----------------+------------------+ +| Core | LAN2 | 172.16.2.0/30 | 2001:db8::2/127 | ++----------+------------+----------------+------------------+ +| Core | Management | 192.168.3.0/30 | 2001:db8::4/127 | ++----------+------------+----------------+------------------+ +| Core | ISP | 10.2.2.0/30 | 2001:db8::6/127 | ++----------+------------+----------------+------------------+ +``` + +### RD & RT Schema + +```{eval-rst} ++------------+-----------+-----------+ +| VRF | RD | RT | ++------------+-----------+-----------+ +| LAN1 | 64496:1 | 64496:1 | ++------------+-----------+-----------+ +| LAN2 | 64496:2 | 64496:2 | ++------------+-----------+-----------+ +| Management | 64496:50 | 64496:50 | ++------------+-----------+-----------+ +| Internet | 64496:100 | 64496:100 | ++------------+-----------+-----------+ +``` + +## Configurations + +:::{note} +We use a static route configuration in between the Core and each +LAN and Management router, and BGP between the Core router and the ISP router +but any dynamic routing protocol can be used. +::: + +### Remote Networks + +The following template configuration can be used in each remote router based +in our topology. + +```none +# Interface Configuration +set interface eth eth address + +# Static default route back to Core +set procotols static route 0.0.0.0/0 next-hop +``` + +### Core Router + +#### Step 1: VRF and Configurations to remote networks + +- Configuration + +Set the VRF name and Table ID, set interface address and bind it to the VRF. +Last add the static route to the remote network. + +```none +# VRF name and table ID (MANDATORY) +set vrf name table + +# Interface Configuration +set interface eth eth address + +# Assign interface to VRF +set interface eth eth vrf + +# Static route to remote Network +set vrf name protocols static route next-hop +``` + +- Verification + +Checking the routing table of the VRF should reveal both static and connected +entries active. A PING test between the Core and remote router is a way to +validate connectivity within the VRF. + +```none +# show ip route vrf +# show ipv6 route vrf + +vyos@Core:~$ show ip route vrf LAN1 +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF LAN1: +S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41 +C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44 + +vyos@Core:~$ show ipv6 route vrf LAN1 +Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF LAN1: +C>* 2001:db8::/127 is directly connected, eth0, 00:18:43 +S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03 +C>* fe80::/64 is directly connected, eth0, 00:18:43 + +# ping vrf + +vyos@Core:~$ ping 10.1.1.2 vrf LAN1 +PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data. +64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms +64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms +^C +--- 10.1.1.2 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1002ms +rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms +vyos@Core:~$ ping 10.0.0.1 vrf LAN1 +PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. +64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms +64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms +^C +--- 10.0.0.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1002ms +rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms + +vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1 +PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes +64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms +64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms +64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms +^C +--- 2001:db8:0:1::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2004ms +rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms +``` + +#### Step 2: BGP Configuration for VRF-Lite + +- Configuration + +Setting BGP global local-as as well inside the VRF. Redistribute static routes +to inject configured networks into the BGP process but still inside the VRF. + +```none +# set BGP global local-as +set protocols bgp system-as + +# set BGP VRF local-as and redistribution +set vrf name protocols bgp system-as +set vrf name protocols bgp address-family redistribute static +``` + +- Verification + +Check the BGP VRF table and verify if the static routes are injected showing +the correct next-hop information. + +```none +# show ip bgp vrf +# show bgp vrf ipv6 + +vyos@Core:~$ show ip bgp vrf LAN1 +BGP table version is 3, local router ID is 10.1.1.1, vrf id 8 +Default local pref 100, local AS 64496 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete +RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path +*> 10.0.0.0/24 10.1.1.2 0 32768 ? + +vyos@Core# run show bgp vrf LAN1 ipv6 +BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 +Default local pref 100, local AS 64496 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete +RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path +*> 2001:db8:0:1::/64 + 2001:db8::1 0 32768 ? +``` + +#### Step 3: VPN Configuration + +- Configuration + +Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT), then +we enable the export/import VPN. + +```none +# set Route-distinguisher +set vrf name protocols bgp address-family rd vpn export '' + +# set route-target for import/export +# Note: RT are a list that can be more than one community between apostrophe +# and separated by blank space. Ex: ' ' +set vrf name protocols bgp address-family route-target vpn export '' +set vrf name protocols bgp address-family route-target vpn import '' + +# Enable VPN export/import under this VRF +set vrf name protocols bgp address-family export vpn +set vrf name protocols bgp address-family import vpn +``` + +A key point to understand is that if we need two VRFs to communicate between +each other EXPORT rt from VRF1 has to be in the IMPORT rt list from VRF2. But +this is only in ONE direction, to complete the communication the EXPORT rt from +VRF2 has to be in the IMPORT rt list from VRF1. + +There are some cases where this is not needed -for example, in some +DDoS appliance- but most inter-vrf routing designs use the above configurations. + +- Verification + +After configured all the VRFs involved in this topology we take a deeper look +at both BGP and Routing table for the VRF LAN1 + +```none +# show ip bgp vrf +# show bgp vrf ipv6 + +vyos@Core# run show ip bgp vrf LAN1 +BGP table version is 53, local router ID is 10.1.1.1, vrf id 8 +Default local pref 100, local AS 64496 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete +RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path +*> 0.0.0.0/0 10.2.2.2@7< 0 64497 i +*> 10.0.0.0/24 10.1.1.2 0 32768 ? +*> 10.2.2.0/30 10.2.2.2@7< 0 0 64497 ? +*> 192.0.2.0/24 10.2.2.2@7< 0 0 64497 ? +*> 192.168.0.0/24 192.168.3.2@11< 0 32768 ? +*> 198.51.100.0/24 10.2.2.2@7< 0 0 64497 ? +*> 203.0.113.0/24 10.2.2.2@7< 0 0 64497 ? + +vyos@Core# run show bgp vrf LAN1 ipv6 +BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 +Default local pref 100, local AS 64496 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete +RPKI validation codes: V valid, I invalid, N Not found + +Network Next Hop Metric LocPrf Weight Path +*> ::/0 fe80::5200:ff:fe02:3@7< + 0 64497 i +*> 2001:db8::6/127 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? +*> 2001:db8:0:1::/64 + 2001:db8::1 0 32768 ? +*> 2001:db8:0:3::/64 + 2001:db8::5@11< 0 32768 ? +*> 2001:db8:1::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? +*> 2001:db8:2::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? +*> 2001:db8:3::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + + +# show ip route vrf +# show ipv6 route vrf + +vyos@Core:~$ show ip route vrf LAN1 +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF LAN1: +B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 +S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57 +C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59 +B 10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38 +B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38 +B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 +B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 +B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + +vyos@Core# run show ipv6 route vrf LAN1 +Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF LAN1: +B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +C>* 2001:db8::/127 is directly connected, eth0, 05:33:43 +B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03 +B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50 +B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +C>* fe80::/64 is directly connected, eth0, 05:33:43 +``` + +As we can see in the BGP table any imported route has been injected with a "@" +followed by the VPN id; In the routing table of the VRF, if the route was +installed, we can see -between round brackets- the exported VRF table. + +#### Step 4: End to End verification + +Now we perform some end-to-end testing + +- From Management to LAN1/LAN2 + +```none +vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1 +PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data. +64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms +64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms +64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms +^C +--- 10.0.0.1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2005ms +rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms +vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1 +PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data. +64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms +64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms +^C +--- 172.16.0.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1001ms +rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms +vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1 +PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes +64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms +64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms +64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms +^C +--- 2001:db8:0:1::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2003ms +rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms +vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1 +PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes +64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms +^C +--- 2001:db8:0:2::1 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3005ms +rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms +``` + +- From Management to Outside (fails as intended) + +```none +vyos@Management:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58 +C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05 +C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03 +vyos@Management:~$ ping 192.0.2.1 +PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data. +From 192.168.3.1 icmp_seq=1 Destination Net Unreachable +From 192.168.3.1 icmp_seq=2 Destination Net Unreachable +^C +--- 192.0.2.1 ping statistics --- +2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + +vyos@Management:~$ ping 195.51.100.1 +PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data. +From 192.168.3.1 icmp_seq=1 Destination Net Unreachable +From 192.168.3.1 icmp_seq=2 Destination Net Unreachable +From 192.168.3.1 icmp_seq=3 Destination Net Unreachable +^C +--- 195.51.100.1 ping statistics --- +3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms + +vyos@Management:~$ ping 2001:db8:1::1 +PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes +From 2001:db8::4 icmp_seq=1 Destination unreachable: No route +From 2001:db8::4 icmp_seq=2 Destination unreachable: No route +^C +--- 2001:db8:1::1 ping statistics --- +2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + +vyos@Management:~$ ping 2001:db8:2::1 +PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes +From 2001:db8::4 icmp_seq=1 Destination unreachable: No route +From 2001:db8::4 icmp_seq=2 Destination unreachable: No route +^C +--- 2001:db8:2::1 ping statistics --- +2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms +``` + +- LAN1 to Outside + +```none +vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1 +PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data. +64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms +64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms +64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms +^C +--- 192.0.2.1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2004ms +rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms +vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1 +PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data. +64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms +64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms +^C +--- 198.51.100.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1002ms +rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms +vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1 +PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data. +64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms +64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms +^C +--- 203.0.113.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1003ms +rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms +vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1 +PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes +64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms +64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms +64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms +^C +--- 2001:db8:1::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2004ms +rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms +vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1 +PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes +64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms +64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms +64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms +^C +--- 2001:db8:2::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2003ms +rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms +``` + +:::{note} +we are using "source-address" option cause we are not redistributing +connected interfaces into BGP on the Core router hence there is no comeback +route and ping will fail. +::: + +- LAN1 to LAN2 + +```none +vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1 +PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data. +64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms +64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms +^C +--- 172.16.0.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1002ms +rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms +vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1 +PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes +64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms +^C +--- 2001:db8:0:2::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2003ms +rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms +``` + +## Conclusions + +Inter-VRF routing is a well-known solution to address complex routing scenarios +that enable -in a dynamic way- to leak routes between VRFs. Is recommended to +take special consideration while designing route-targets and its application as +it can minimize future interventions while creating a new VRF will automatically +take the desired effect in its propagation. + +## Appendix-A + +### Full configuration from all devices + +- Core + +```none +set interfaces ethernet eth0 address '10.1.1.1/30' +set interfaces ethernet eth0 address '2001:db8::/127' +set interfaces ethernet eth0 vrf 'LAN1' +set interfaces ethernet eth1 address '172.16.2.1/30' +set interfaces ethernet eth1 address '2001:db8::2/127' +set interfaces ethernet eth1 vrf 'LAN2' +set interfaces ethernet eth2 address '192.168.3.1/30' +set interfaces ethernet eth2 address '2001:db8::4/127' +set interfaces ethernet eth2 vrf 'Management' +set interfaces ethernet eth3 address '10.2.2.1/30' +set interfaces ethernet eth3 address '2001:db8::6/127' +set interfaces ethernet eth3 vrf 'Internet' +set protocols bgp address-family ipv4-unicast +set protocols bgp system-as '64496' +set vrf name Internet protocols bgp address-family ipv4-unicast export vpn +set vrf name Internet protocols bgp address-family ipv4-unicast import vpn +set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' +set vrf name Internet protocols bgp address-family ipv6-unicast export vpn +set vrf name Internet protocols bgp address-family ipv6-unicast import vpn +set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' +set vrf name Internet protocols bgp system-as '64496' +set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast +set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497' +set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast +set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497' +set vrf name Internet table '104' +set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn +set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn +set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static +set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' +set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn +set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn +set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static +set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' +set vrf name LAN1 protocols bgp system-as '64496' +set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2 +set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1 +set vrf name LAN1 table '101' +set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn +set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn +set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' +set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn +set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn +set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' +set vrf name LAN2 protocols bgp system-as '64496' +set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2 +set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3 +set vrf name LAN2 table '102' +set vrf name Management protocols bgp address-family ipv4-unicast export vpn +set vrf name Management protocols bgp address-family ipv4-unicast import vpn +set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv4-unicast redistribute static +set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' +set vrf name Management protocols bgp address-family ipv6-unicast export vpn +set vrf name Management protocols bgp address-family ipv6-unicast import vpn +set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv6-unicast redistribute static +set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' +set vrf name Management protocols bgp system-as '64496' +set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2 +set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5 +set vrf name Management table '103' +``` + +- LAN1 + +```none +set interfaces dummy dum0 address '10.0.0.1/24' +set interfaces dummy dum0 address '2001:db8:0:1::1/64' +set interfaces ethernet eth0 address '10.1.1.2/30' +set interfaces ethernet eth0 address '2001:db8::1/127' +set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 +set protocols static route6 ::/0 next-hop 2001:db8::* +``` + +- LAN2 + +```none +set interfaces dummy dum0 address '172.16.0.1/24' +set interfaces dummy dum0 address '2001:db8:0:2::1/64' +set interfaces ethernet eth0 hw-id '50:00:00:03:00:00' +set interfaces ethernet eth1 address '172.16.2.2/30' +set interfaces ethernet eth1 address '2001:db8::3/127' +set protocols static route 0.0.0.0/0 next-hop 172.16.2.1 +set protocols static route6 ::/0 next-hop 2001:db8::2 +``` + +- Management + +```none +set interfaces dummy dum0 address '192.168.0.1/24' +set interfaces dummy dum0 address '2001:db8:0:3::1/64' +set interfaces ethernet eth2 address '192.168.3.2/30' +set interfaces ethernet eth2 address '2001:db8::5/127' +set protocols static route 0.0.0.0/0 next-hop 192.168.3.1 +set protocols static route6 ::/0 next-hop 2001:db8::4 +``` + +- ISP + +```none +set interfaces dummy dum0 address '192.0.2.1/24' +set interfaces dummy dum0 address '2001:db8:1::1/48' +set interfaces dummy dum1 address '198.51.100.1/24' +set interfaces dummy dum1 address '2001:db8:2::1/48' +set interfaces dummy dum2 address '203.0.113.1/24' +set interfaces dummy dum2 address '2001:db8:3::1/48' +set interfaces ethernet eth3 address '10.2.2.2/30' +set interfaces ethernet eth3 address '2001:db8::7/127' +set protocols bgp address-family ipv4-unicast redistribute connected +set protocols bgp address-family ipv6-unicast redistribute connected +set protocols bgp system-as '64497' +set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate +set protocols bgp neighbor 10.2.2.1 remote-as '64496' +set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate +set protocols bgp neighbor 2001:db8::6 remote-as '64496' +set protocols static route 0.0.0.0/0 next-hop 10.2.2.1 +set protocols static route6 ::/0 next-hop 2001:db8::6 +``` + +## Appendix-B + +### Route-Filtering + +When importing routes using MP-BGP it is possible to filter a subset of them +before are injected in the BGP table. One of the most common case is to use a +route-map with an prefix-list. + +- Configuration + +We create a prefix-list first and add all the routes we need to. + +```none +# set both ipv4 and ipv6 policies + +set policy prefix-list LAN2-Internet rule 1 action 'permit' +set policy prefix-list LAN2-Internet rule 1 le '24' +set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16' +set policy prefix-list LAN2-Internet rule 2 action 'permit' +set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24' +set policy prefix-list LAN2-Internet rule 3 action 'permit' +set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24' +set policy prefix-list LAN2-Internet rule 4 action 'permit' +set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24' + +set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48' +set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48' +set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64' +set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' +``` + +Then add a route-map and reference to above prefix. Consider that the actions +taken inside the prefix will MATCH the routes that will be affected by the +actions inside the rules of the route-map. + +```none +set policy route-map LAN2-Internet rule 1 action 'permit' +set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet' + +set policy route-map LAN2-Internet-v6 rule 1 action 'permit' +set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-Internet-v6' +``` + +We are using a "white list" approach by allowing only what is necessary. In case +that need to implement a "black list" approach then you will need to change the +action in the route-map for a deny BUT you need to add a rule that permits the +rest due to the implicit deny in the route-map. + +Then we need to attach the policy to the BGP process. This needs to be under +the import statement in the vrf we need to filter. + +```none +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet' +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6' +``` + +- Verification + +```none +# show ip route vrf LAN2 + +B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28 +S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32 +C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39 +B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 +B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Managment), weight 1, 00:45:27 +B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 + +# show ipv6 route vrf LAN2 + +C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26 +B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17 +S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21 +B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Managment), weight 1, 00:46:16 +B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 +B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 +C>* fe80::/64 is directly connected, eth1, 00:46:27 +``` + +As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able +to select which routes are effectively imported and installed. diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst deleted file mode 100644 index 0e442ab3..00000000 --- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst +++ /dev/null @@ -1,855 +0,0 @@ -################################ -Inter-VRF Routing over VRF Lite -################################ - -**Virtual Routing and Forwarding** is a technology that allow multiple instance -of a routing table to exist within a single device. One of the key aspect of -**VRFs** is that do not share the same routes or interfaces, therefore packets -are forwarded between interfaces that belong to the same VRF only. - -Any information related to a VRF is not exchanged between devices -or in the -same device- by default, this is a technique called **VRF-Lite**. - -Keep networks isolated is -in general- a good principle, but there are cases -where you might need that some network can access other in a different VRF. - -The scope of this document is to cover such cases in a dynamic way without the -use of MPLS-LDP. - -General information about L3VPNs can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter. - -******** -Overview -******** - -Let’s say we have a requirement to have multiple networks. - -* LAN 1 -* LAN 2 -* Management -* Internet - -Both LANs have to be able to route between each other, both will have managed -devices through a dedicated management network and both will need Internet -access yet the LAN2 will need access to some set of outside networks, not all. -The management network will need access to both LANs but cannot have access -to/from the outside. - -This scenario could be a nightmare applying regular routing and might need -filtering in multiple interfaces. - -A simple solution could be using different routing tables, or VRFs -for all the networks so we can keep the routing restrictions. -But for us to route between the different VRFs we would need a cable or a -logical connection between each other: - -* One cable/logical connection between LAN1 and LAN2 -* One cable/logical connection between LAN1 and Internet -* One cable/logical connection between LAN2 and Internet -* One cable/logical connection between LAN1 and Management -* One cable/logical connection between LAN2 and Management - -As we can see this is unpractical. - -To address this scenario we will use to our advantage an extension of the BGP -routing protocol that will help us in the “Export” between VRFs without the -need for MPLS. - -MP-BGP or MultiProtocol BGP introduces two main concepts to solve this -limitation: -- Route Distinguisher (RD): Is used to distinguish between different VRFs -–called VPNs- inside the BGP Process. The RD is appended to each IPv4 Network -that is advertised into BGP for that VPN making it a unique VPNv4 route. -- Route Target (RT): This is an extended BGP community append to the VPNv4 route -in the Import/Export process. When a route passes from the VRF routing table -into the BGP process it will add the configured export extended community(ies) -for that VPN. When that route needs to go from BGP into the VRF routing table -will only pass if that given VPN import policy matches any of the appended -community(ies) into that prefix. - -******** -Topology -******** -.. image:: /_static/images/inter-vrf-routing-vrf-lite.png - :width: 70% - :align: center - :alt: Network Topology Diagram - - - - -IP Schema -========= - -+----------+------------+----------------+------------------+ -| Device-A | Device-B | IPv4 Network | IPv6 Network | -+----------+------------+----------------+------------------+ -| Core | LAN1 | 10.1.1.0/30 | 2001:db8::/127 | -+----------+------------+----------------+------------------+ -| Core | LAN2 | 172.16.2.0/30 | 2001:db8::2/127 | -+----------+------------+----------------+------------------+ -| Core | Management | 192.168.3.0/30 | 2001:db8::4/127 | -+----------+------------+----------------+------------------+ -| Core | ISP | 10.2.2.0/30 | 2001:db8::6/127 | -+----------+------------+----------------+------------------+ - -RD & RT Schema -============== - -+------------+-----------+-----------+ -| VRF | RD | RT | -+------------+-----------+-----------+ -| LAN1 | 64496:1 | 64496:1 | -+------------+-----------+-----------+ -| LAN2 | 64496:2 | 64496:2 | -+------------+-----------+-----------+ -| Management | 64496:50 | 64496:50 | -+------------+-----------+-----------+ -| Internet | 64496:100 | 64496:100 | -+------------+-----------+-----------+ - -************** -Configurations -************** - -.. note:: We use a static route configuration in between the Core and each - LAN and Management router, and BGP between the Core router and the ISP router - but any dynamic routing protocol can be used. - -Remote Networks -=============== - -The following template configuration can be used in each remote router based -in our topology. - -.. code-block:: none - - # Interface Configuration - set interface eth eth address - - # Static default route back to Core - set procotols static route 0.0.0.0/0 next-hop - -Core Router -=========== - -Step 1: VRF and Configurations to remote networks -------------------------------------------------- - -- Configuration - - - -Set the VRF name and Table ID, set interface address and bind it to the VRF. -Last add the static route to the remote network. - -.. code-block:: none - - # VRF name and table ID (MANDATORY) - set vrf name table - - # Interface Configuration - set interface eth eth address - - # Assign interface to VRF - set interface eth eth vrf - - # Static route to remote Network - set vrf name protocols static route next-hop - -- Verification - - - -Checking the routing table of the VRF should reveal both static and connected -entries active. A PING test between the Core and remote router is a way to -validate connectivity within the VRF. - -.. code-block:: none - - # show ip route vrf - # show ipv6 route vrf - - vyos@Core:~$ show ip route vrf LAN1 - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF LAN1: - S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41 - C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44 - - vyos@Core:~$ show ipv6 route vrf LAN1 - Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF LAN1: - C>* 2001:db8::/127 is directly connected, eth0, 00:18:43 - S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03 - C>* fe80::/64 is directly connected, eth0, 00:18:43 - - # ping vrf - - vyos@Core:~$ ping 10.1.1.2 vrf LAN1 - PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data. - 64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms - 64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms - ^C - --- 10.1.1.2 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1002ms - rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms - vyos@Core:~$ ping 10.0.0.1 vrf LAN1 - PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. - 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms - 64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms - ^C - --- 10.0.0.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1002ms - rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms - - vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1 - PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes - 64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms - 64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms - 64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms - ^C - --- 2001:db8:0:1::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2004ms - rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms - -Step 2: BGP Configuration for VRF-Lite --------------------------------------- - - -- Configuration - - - -Setting BGP global local-as as well inside the VRF. Redistribute static routes -to inject configured networks into the BGP process but still inside the VRF. - - -.. code-block:: none - - # set BGP global local-as - set protocols bgp system-as - - # set BGP VRF local-as and redistribution - set vrf name protocols bgp system-as - set vrf name protocols bgp address-family redistribute static - -- Verification - - - -Check the BGP VRF table and verify if the static routes are injected showing -the correct next-hop information. - -.. code-block:: none - - # show ip bgp vrf - # show bgp vrf ipv6 - - vyos@Core:~$ show ip bgp vrf LAN1 - BGP table version is 3, local router ID is 10.1.1.1, vrf id 8 - Default local pref 100, local AS 64496 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path - *> 10.0.0.0/24 10.1.1.2 0 32768 ? - - vyos@Core# run show bgp vrf LAN1 ipv6 - BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 - Default local pref 100, local AS 64496 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path - *> 2001:db8:0:1::/64 - 2001:db8::1 0 32768 ? - - -Step 3: VPN Configuration -------------------------- - - -- Configuration - - -Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT), then -we enable the export/import VPN. - - -.. code-block:: none - - # set Route-distinguisher - set vrf name protocols bgp address-family rd vpn export '' - - # set route-target for import/export - # Note: RT are a list that can be more than one community between apostrophe - # and separated by blank space. Ex: ' ' - set vrf name protocols bgp address-family route-target vpn export '' - set vrf name protocols bgp address-family route-target vpn import '' - - # Enable VPN export/import under this VRF - set vrf name protocols bgp address-family export vpn - set vrf name protocols bgp address-family import vpn - -A key point to understand is that if we need two VRFs to communicate between -each other EXPORT rt from VRF1 has to be in the IMPORT rt list from VRF2. But -this is only in ONE direction, to complete the communication the EXPORT rt from -VRF2 has to be in the IMPORT rt list from VRF1. - -There are some cases where this is not needed -for example, in some -DDoS appliance- but most inter-vrf routing designs use the above configurations. - -- Verification - - - -After configured all the VRFs involved in this topology we take a deeper look -at both BGP and Routing table for the VRF LAN1 - -.. code-block:: none - - # show ip bgp vrf - # show bgp vrf ipv6 - - vyos@Core# run show ip bgp vrf LAN1 - BGP table version is 53, local router ID is 10.1.1.1, vrf id 8 - Default local pref 100, local AS 64496 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path - *> 0.0.0.0/0 10.2.2.2@7< 0 64497 i - *> 10.0.0.0/24 10.1.1.2 0 32768 ? - *> 10.2.2.0/30 10.2.2.2@7< 0 0 64497 ? - *> 192.0.2.0/24 10.2.2.2@7< 0 0 64497 ? - *> 192.168.0.0/24 192.168.3.2@11< 0 32768 ? - *> 198.51.100.0/24 10.2.2.2@7< 0 0 64497 ? - *> 203.0.113.0/24 10.2.2.2@7< 0 0 64497 ? - - vyos@Core# run show bgp vrf LAN1 ipv6 - BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 - Default local pref 100, local AS 64496 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path - *> ::/0 fe80::5200:ff:fe02:3@7< - 0 64497 i - *> 2001:db8::6/127 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - *> 2001:db8:0:1::/64 - 2001:db8::1 0 32768 ? - *> 2001:db8:0:3::/64 - 2001:db8::5@11< 0 32768 ? - *> 2001:db8:1::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - *> 2001:db8:2::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - *> 2001:db8:3::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - - - # show ip route vrf - # show ipv6 route vrf - - vyos@Core:~$ show ip route vrf LAN1 - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF LAN1: - B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57 - C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59 - B 10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38 - B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38 - B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - - vyos@Core# run show ipv6 route vrf LAN1 - Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF LAN1: - B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - C>* 2001:db8::/127 is directly connected, eth0, 05:33:43 - B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03 - B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50 - B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - C>* fe80::/64 is directly connected, eth0, 05:33:43 - - -As we can see in the BGP table any imported route has been injected with a "@" -followed by the VPN id; In the routing table of the VRF, if the route was -installed, we can see -between round brackets- the exported VRF table. - -Step 4: End to End verification -------------------------------- - - -Now we perform some end-to-end testing - -- From Management to LAN1/LAN2 - - -.. code-block:: none - - vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1 - PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data. - 64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms - 64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms - 64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms - ^C - --- 10.0.0.1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2005ms - rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms - vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1 - PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data. - 64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms - 64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms - ^C - --- 172.16.0.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1001ms - rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms - vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1 - PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes - 64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms - 64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms - 64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms - ^C - --- 2001:db8:0:1::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2003ms - rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms - vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1 - PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes - 64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms - ^C - --- 2001:db8:0:2::1 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3005ms - rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms - -- From Management to Outside (fails as intended) - - - -.. code-block:: none - - vyos@Management:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58 - C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05 - C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03 - vyos@Management:~$ ping 192.0.2.1 - PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data. - From 192.168.3.1 icmp_seq=1 Destination Net Unreachable - From 192.168.3.1 icmp_seq=2 Destination Net Unreachable - ^C - --- 192.0.2.1 ping statistics --- - 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - - vyos@Management:~$ ping 195.51.100.1 - PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data. - From 192.168.3.1 icmp_seq=1 Destination Net Unreachable - From 192.168.3.1 icmp_seq=2 Destination Net Unreachable - From 192.168.3.1 icmp_seq=3 Destination Net Unreachable - ^C - --- 195.51.100.1 ping statistics --- - 3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms - - vyos@Management:~$ ping 2001:db8:1::1 - PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes - From 2001:db8::4 icmp_seq=1 Destination unreachable: No route - From 2001:db8::4 icmp_seq=2 Destination unreachable: No route - ^C - --- 2001:db8:1::1 ping statistics --- - 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - - vyos@Management:~$ ping 2001:db8:2::1 - PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes - From 2001:db8::4 icmp_seq=1 Destination unreachable: No route - From 2001:db8::4 icmp_seq=2 Destination unreachable: No route - ^C - --- 2001:db8:2::1 ping statistics --- - 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - - -- LAN1 to Outside - - - -.. code-block:: none - - vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1 - PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data. - 64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms - 64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms - 64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms - ^C - --- 192.0.2.1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2004ms - rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms - vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1 - PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data. - 64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms - 64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms - ^C - --- 198.51.100.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1002ms - rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms - vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1 - PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data. - 64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms - 64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms - ^C - --- 203.0.113.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1003ms - rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms - vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1 - PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes - 64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms - 64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms - 64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms - ^C - --- 2001:db8:1::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2004ms - rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms - vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1 - PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes - 64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms - 64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms - 64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms - ^C - --- 2001:db8:2::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2003ms - rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms - - -.. note:: we are using "source-address" option cause we are not redistributing - connected interfaces into BGP on the Core router hence there is no comeback - route and ping will fail. - -- LAN1 to LAN2 - - - -.. code-block:: none - - vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1 - PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data. - 64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms - 64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms - ^C - --- 172.16.0.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1002ms - rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms - vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1 - PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes - 64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms - ^C - --- 2001:db8:0:2::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2003ms - rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms - -*********** -Conclusions -*********** - -Inter-VRF routing is a well-known solution to address complex routing scenarios -that enable -in a dynamic way- to leak routes between VRFs. Is recommended to -take special consideration while designing route-targets and its application as -it can minimize future interventions while creating a new VRF will automatically -take the desired effect in its propagation. - -********** -Appendix-A -********** - -Full configuration from all devices -=================================== - -- Core - - -.. code-block:: none - - set interfaces ethernet eth0 address '10.1.1.1/30' - set interfaces ethernet eth0 address '2001:db8::/127' - set interfaces ethernet eth0 vrf 'LAN1' - set interfaces ethernet eth1 address '172.16.2.1/30' - set interfaces ethernet eth1 address '2001:db8::2/127' - set interfaces ethernet eth1 vrf 'LAN2' - set interfaces ethernet eth2 address '192.168.3.1/30' - set interfaces ethernet eth2 address '2001:db8::4/127' - set interfaces ethernet eth2 vrf 'Management' - set interfaces ethernet eth3 address '10.2.2.1/30' - set interfaces ethernet eth3 address '2001:db8::6/127' - set interfaces ethernet eth3 vrf 'Internet' - set protocols bgp address-family ipv4-unicast - set protocols bgp system-as '64496' - set vrf name Internet protocols bgp address-family ipv4-unicast export vpn - set vrf name Internet protocols bgp address-family ipv4-unicast import vpn - set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' - set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' - set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' - set vrf name Internet protocols bgp address-family ipv6-unicast export vpn - set vrf name Internet protocols bgp address-family ipv6-unicast import vpn - set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' - set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' - set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' - set vrf name Internet protocols bgp system-as '64496' - set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast - set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497' - set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast - set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497' - set vrf name Internet table '104' - set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn - set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn - set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' - set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static - set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' - set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' - set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn - set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn - set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' - set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static - set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' - set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' - set vrf name LAN1 protocols bgp system-as '64496' - set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2 - set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1 - set vrf name LAN1 table '101' - set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn - set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn - set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' - set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static - set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' - set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' - set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn - set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn - set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' - set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static - set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' - set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' - set vrf name LAN2 protocols bgp system-as '64496' - set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2 - set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3 - set vrf name LAN2 table '102' - set vrf name Management protocols bgp address-family ipv4-unicast export vpn - set vrf name Management protocols bgp address-family ipv4-unicast import vpn - set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' - set vrf name Management protocols bgp address-family ipv4-unicast redistribute static - set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' - set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' - set vrf name Management protocols bgp address-family ipv6-unicast export vpn - set vrf name Management protocols bgp address-family ipv6-unicast import vpn - set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' - set vrf name Management protocols bgp address-family ipv6-unicast redistribute static - set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' - set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' - set vrf name Management protocols bgp system-as '64496' - set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2 - set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5 - set vrf name Management table '103' - - -- LAN1 - - -.. code-block:: none - - set interfaces dummy dum0 address '10.0.0.1/24' - set interfaces dummy dum0 address '2001:db8:0:1::1/64' - set interfaces ethernet eth0 address '10.1.1.2/30' - set interfaces ethernet eth0 address '2001:db8::1/127' - set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 - set protocols static route6 ::/0 next-hop 2001:db8::* - -- LAN2 - - - -.. code-block:: none - - set interfaces dummy dum0 address '172.16.0.1/24' - set interfaces dummy dum0 address '2001:db8:0:2::1/64' - set interfaces ethernet eth0 hw-id '50:00:00:03:00:00' - set interfaces ethernet eth1 address '172.16.2.2/30' - set interfaces ethernet eth1 address '2001:db8::3/127' - set protocols static route 0.0.0.0/0 next-hop 172.16.2.1 - set protocols static route6 ::/0 next-hop 2001:db8::2 - -- Management - - -.. code-block:: none - - set interfaces dummy dum0 address '192.168.0.1/24' - set interfaces dummy dum0 address '2001:db8:0:3::1/64' - set interfaces ethernet eth2 address '192.168.3.2/30' - set interfaces ethernet eth2 address '2001:db8::5/127' - set protocols static route 0.0.0.0/0 next-hop 192.168.3.1 - set protocols static route6 ::/0 next-hop 2001:db8::4 - -- ISP - - -.. code-block:: none - - set interfaces dummy dum0 address '192.0.2.1/24' - set interfaces dummy dum0 address '2001:db8:1::1/48' - set interfaces dummy dum1 address '198.51.100.1/24' - set interfaces dummy dum1 address '2001:db8:2::1/48' - set interfaces dummy dum2 address '203.0.113.1/24' - set interfaces dummy dum2 address '2001:db8:3::1/48' - set interfaces ethernet eth3 address '10.2.2.2/30' - set interfaces ethernet eth3 address '2001:db8::7/127' - set protocols bgp address-family ipv4-unicast redistribute connected - set protocols bgp address-family ipv6-unicast redistribute connected - set protocols bgp system-as '64497' - set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate - set protocols bgp neighbor 10.2.2.1 remote-as '64496' - set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate - set protocols bgp neighbor 2001:db8::6 remote-as '64496' - set protocols static route 0.0.0.0/0 next-hop 10.2.2.1 - set protocols static route6 ::/0 next-hop 2001:db8::6 - -********** -Appendix-B -********** - -Route-Filtering -=============== - - -When importing routes using MP-BGP it is possible to filter a subset of them -before are injected in the BGP table. One of the most common case is to use a -route-map with an prefix-list. - -- Configuration - - - -We create a prefix-list first and add all the routes we need to. - -.. code-block:: none - - # set both ipv4 and ipv6 policies - - set policy prefix-list LAN2-Internet rule 1 action 'permit' - set policy prefix-list LAN2-Internet rule 1 le '24' - set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16' - set policy prefix-list LAN2-Internet rule 2 action 'permit' - set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24' - set policy prefix-list LAN2-Internet rule 3 action 'permit' - set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24' - set policy prefix-list LAN2-Internet rule 4 action 'permit' - set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24' - - set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit' - set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48' - set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit' - set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48' - set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit' - set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64' - set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' - set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' - -Then add a route-map and reference to above prefix. Consider that the actions -taken inside the prefix will MATCH the routes that will be affected by the -actions inside the rules of the route-map. - -.. code-block:: none - - set policy route-map LAN2-Internet rule 1 action 'permit' - set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet' - - set policy route-map LAN2-Internet-v6 rule 1 action 'permit' - set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-Internet-v6' - -We are using a "white list" approach by allowing only what is necessary. In case -that need to implement a "black list" approach then you will need to change the -action in the route-map for a deny BUT you need to add a rule that permits the -rest due to the implicit deny in the route-map. - -Then we need to attach the policy to the BGP process. This needs to be under -the import statement in the vrf we need to filter. - -.. code-block:: none - - set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet' - set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6' - - -- Verification - - -.. code-block:: none - - # show ip route vrf LAN2 - - B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28 - S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32 - C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39 - B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 - B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Managment), weight 1, 00:45:27 - B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 - - # show ipv6 route vrf LAN2 - - C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26 - B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17 - S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21 - B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Managment), weight 1, 00:46:16 - B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 - B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 - C>* fe80::/64 is directly connected, eth1, 00:46:27 - -As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able -to select which routes are effectively imported and installed. - diff --git a/docs/configexamples/ipsec-cisco-policy-based.md b/docs/configexamples/ipsec-cisco-policy-based.md new file mode 100644 index 00000000..2a12a252 --- /dev/null +++ b/docs/configexamples/ipsec-cisco-policy-based.md @@ -0,0 +1,357 @@ +--- +lastproofread: '2025-06-26' +--- + +(examples-ipsec-cisco-policy-based)= + +# Policy-based Site-to-Site VPN IPsec between VyOS and Cisco + +This document is to describe a basic setup using policy-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +Cisco IOS. Cisco initiates IPsec connection only if interesting +traffic present. For stable work we recommend configuring an +initiator role on VyOS side. + +## Network Topology + +```{image} /_static/images/cisco-vpn-ipsec.png +:align: center +:alt: Network Topology Diagram +``` + +## Prerequirements + +**VyOS:** + +```{eval-rst} ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ +``` + +**Cisco:** + +```{eval-rst} ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ +``` + +**IKE parameters:** + +```{eval-rst} ++-------------------+---------+ +| Encryption | AES-256 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 2 | ++-------------------+---------+ +``` + +**IPsec parameters:** + +```{eval-rst} ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ +``` + +**Traffic Selectors** + +: 192.168.0.0/24 \<==> 192.168.10.0/24 + + 192.168.1.0/24 \<==> 192.168.11.0/24 + +**Hosts configuration** + +```{eval-rst} ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ +``` + +## Configuration + +:::{note} +Pfs is disabled in Cisco by default. +::: + +### VyOS + +```none +set interfaces ethernet eth0 address '10.0.1.2/30' +set interfaces ethernet eth1 address '192.168.0.1/24' +set interfaces ethernet eth2 address '192.168.1.1/24' +set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 +set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' +set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' +set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' +set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' +set vpn ipsec esp-group ESP-GROUP lifetime '3600' +set vpn ipsec esp-group ESP-GROUP pfs 'disable' +set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' +set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' +set vpn ipsec ike-group IKE-GROUP close-action 'start' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' +set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' +set vpn ipsec ike-group IKE-GROUP lifetime '28800' +set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' +set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes256' +set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' +set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' +set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' +set vpn ipsec site-to-site peer CISCO connection-type 'initiate' +set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' +set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' +set vpn ipsec site-to-site peer CISCO tunnel 1 local prefix '192.168.0.0/24' +set vpn ipsec site-to-site peer CISCO tunnel 1 remote prefix '192.168.10.0/24' +set vpn ipsec site-to-site peer CISCO tunnel 2 local prefix '192.168.1.0/24' +set vpn ipsec site-to-site peer CISCO tunnel 2 remote prefix '192.168.11.0/24' +``` + +### Cisco + +```none +crypto ikev2 proposal aes-cbc-256-proposal + encryption aes-cbc-256 + integrity sha1 + group 14 +! +crypto ikev2 policy policy1 + match address local 10.0.2.2 + proposal aes-cbc-256-proposal +! +crypto ikev2 keyring keys + peer VyOS + address 10.0.1.2 + pre-shared-key local test + pre-shared-key remote test +! +crypto ikev2 profile IKEv2-profile + match identity remote address 10.0.1.2 255.255.255.255 + authentication remote pre-share + authentication local pre-share + keyring local keys + lifetime 28800 +! +crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac + mode tunnel +! +crypto map IPSEC-map 10 ipsec-isakmp + set peer 10.0.1.2 + set security-association lifetime seconds 3600 + set transform-set TS + set ikev2-profile IKEv2-profile + match address cryptoacl +! +interface GigabitEthernet0/0 + ip address 10.0.2.2 255.255.255.252 + crypto map IPSEC-map +! +interface GigabitEthernet0/1 + ip address 192.168.10.1 255.255.255.0 +! +interface GigabitEthernet0/2 + ip address 192.168.11.1 255.255.255.0 +! +ip route 0.0.0.0 0.0.0.0 10.0.2.1 +! +ip access-list extended cryptoacl + permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255 + permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255 +``` + +## Monitoring + +### Monitoring on VyOS side + +IKE SAs: + +```none +vyos@vyos:~$ show vpn ike sa +Peer ID / IP Local ID / IP +------------ ------------- +10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv2 AES_CBC_256 HMAC_SHA1_96 MODP_2048 no 304 26528 +``` + +IPsec SAs: + +```none +vyos@vyos:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +-------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- +CISCO-tunnel-1 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 +CISCO-tunnel-2 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 +``` + +### Monitoring on Cisco side + +IKE SAs: + +```none +Cisco#show crypto ikev2 sa + IPv4 Crypto IKEv2 SA + +Tunnel-id Local Remote fvrf/ivrf Status +1 10.0.2.2/4500 10.0.1.2/4500 none/none READY + Encr: AES-CBC, keysize: 256, PRF: SHA1, Hash: SHA96, DH Grp:14, Auth sign: PSK, Auth verify: PSK + Life/Active Time: 28800/471 sec + + IPv6 Crypto IKEv2 SA +``` + +IPsec SAs: + +```none + Cisco#show crypto ipsec sa + +interface: GigabitEthernet0/0 + Crypto map tag: IPSEC-map, local addr 10.0.2.2 + + protected vrf: (none) + local ident (addr/mask/prot/port): (192.168.11.0/255.255.255.0/0/0) + remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) + current_peer 10.0.1.2 port 4500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 + #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC81F83DA(3357508570) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x8C63C51E(2355348766) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 23, flow_id: SW:23, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4231729/3585) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC81F83DA(3357508570) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 24, flow_id: SW:24, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4231729/3585) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: + + protected vrf: (none) + local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0) + remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0) + current_peer 10.0.1.2 port 4500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 + #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC40C7A20(3289152032) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x2948B6CB(692631243) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 21, flow_id: SW:21, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4194891/3581) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC40C7A20(3289152032) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 22, flow_id: SW:22, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4194891/3581) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: +``` + +### Checking Connectivity + +ICMP packets from PC1 to PC3. + +```none +PC1> ping 192.168.10.2 + +84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms +84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms +84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms +84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms +84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms +``` + +ICMP packets from PC2 to PC4. + +```none +PC2> ping 192.168.11.2 + +84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms +84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms +84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms +``` diff --git a/docs/configexamples/ipsec-cisco-policy-based.rst b/docs/configexamples/ipsec-cisco-policy-based.rst deleted file mode 100644 index 787c1140..00000000 --- a/docs/configexamples/ipsec-cisco-policy-based.rst +++ /dev/null @@ -1,355 +0,0 @@ -:lastproofread: 2025-06-26 - -.. _examples-ipsec-cisco-policy-based: - -########################################################## -Policy-based Site-to-Site VPN IPsec between VyOS and Cisco -########################################################## - -This document is to describe a basic setup using policy-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -Cisco IOS. Cisco initiates IPsec connection only if interesting -traffic present. For stable work we recommend configuring an -initiator role on VyOS side. - -Network Topology -================ - -.. image:: /_static/images/cisco-vpn-ipsec.png - :align: center - :alt: Network Topology Diagram - -Prerequirements -=============== - -**VyOS:** - -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ - -**Cisco:** - -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ - -**IKE parameters:** - -+-------------------+---------+ -| Encryption | AES-256 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 2 | -+-------------------+---------+ - -**IPsec parameters:** - -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ - -**Traffic Selectors** - 192.168.0.0/24 <==> 192.168.10.0/24 - - 192.168.1.0/24 <==> 192.168.11.0/24 - -**Hosts configuration** - -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ - -Configuration -============= - -.. note:: Pfs is disabled in Cisco by default. - -VyOS ----- - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.1.2/30' - set interfaces ethernet eth1 address '192.168.0.1/24' - set interfaces ethernet eth2 address '192.168.1.1/24' - set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 - set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' - set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' - set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' - set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' - set vpn ipsec esp-group ESP-GROUP lifetime '3600' - set vpn ipsec esp-group ESP-GROUP pfs 'disable' - set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' - set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' - set vpn ipsec ike-group IKE-GROUP close-action 'start' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' - set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' - set vpn ipsec ike-group IKE-GROUP lifetime '28800' - set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' - set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes256' - set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' - set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' - set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' - set vpn ipsec site-to-site peer CISCO connection-type 'initiate' - set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' - set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' - set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' - set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' - set vpn ipsec site-to-site peer CISCO tunnel 1 local prefix '192.168.0.0/24' - set vpn ipsec site-to-site peer CISCO tunnel 1 remote prefix '192.168.10.0/24' - set vpn ipsec site-to-site peer CISCO tunnel 2 local prefix '192.168.1.0/24' - set vpn ipsec site-to-site peer CISCO tunnel 2 remote prefix '192.168.11.0/24' - -Cisco ------ - -.. code-block:: none - - crypto ikev2 proposal aes-cbc-256-proposal - encryption aes-cbc-256 - integrity sha1 - group 14 - ! - crypto ikev2 policy policy1 - match address local 10.0.2.2 - proposal aes-cbc-256-proposal - ! - crypto ikev2 keyring keys - peer VyOS - address 10.0.1.2 - pre-shared-key local test - pre-shared-key remote test - ! - crypto ikev2 profile IKEv2-profile - match identity remote address 10.0.1.2 255.255.255.255 - authentication remote pre-share - authentication local pre-share - keyring local keys - lifetime 28800 - ! - crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac - mode tunnel - ! - crypto map IPSEC-map 10 ipsec-isakmp - set peer 10.0.1.2 - set security-association lifetime seconds 3600 - set transform-set TS - set ikev2-profile IKEv2-profile - match address cryptoacl - ! - interface GigabitEthernet0/0 - ip address 10.0.2.2 255.255.255.252 - crypto map IPSEC-map - ! - interface GigabitEthernet0/1 - ip address 192.168.10.1 255.255.255.0 - ! - interface GigabitEthernet0/2 - ip address 192.168.11.1 255.255.255.0 - ! - ip route 0.0.0.0 0.0.0.0 10.0.2.1 - ! - ip access-list extended cryptoacl - permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255 - permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255 - - - -Monitoring -========== - -Monitoring on VyOS side ------------------------ - -IKE SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ike sa - Peer ID / IP Local ID / IP - ------------ ------------- - 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv2 AES_CBC_256 HMAC_SHA1_96 MODP_2048 no 304 26528 - -IPsec SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - -------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- - CISCO-tunnel-1 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 - CISCO-tunnel-2 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 - -Monitoring on Cisco side ------------------------- - -IKE SAs: - -.. code-block:: none - - Cisco#show crypto ikev2 sa - IPv4 Crypto IKEv2 SA - - Tunnel-id Local Remote fvrf/ivrf Status - 1 10.0.2.2/4500 10.0.1.2/4500 none/none READY - Encr: AES-CBC, keysize: 256, PRF: SHA1, Hash: SHA96, DH Grp:14, Auth sign: PSK, Auth verify: PSK - Life/Active Time: 28800/471 sec - - IPv6 Crypto IKEv2 SA - - -IPsec SAs: - -.. code-block:: none - - Cisco#show crypto ipsec sa - - interface: GigabitEthernet0/0 - Crypto map tag: IPSEC-map, local addr 10.0.2.2 - - protected vrf: (none) - local ident (addr/mask/prot/port): (192.168.11.0/255.255.255.0/0/0) - remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) - current_peer 10.0.1.2 port 4500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 - #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC81F83DA(3357508570) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x8C63C51E(2355348766) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 23, flow_id: SW:23, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4231729/3585) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC81F83DA(3357508570) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 24, flow_id: SW:24, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4231729/3585) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: - - protected vrf: (none) - local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0) - remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0) - current_peer 10.0.1.2 port 4500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 - #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC40C7A20(3289152032) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x2948B6CB(692631243) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 21, flow_id: SW:21, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4194891/3581) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC40C7A20(3289152032) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 22, flow_id: SW:22, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4194891/3581) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: - -Checking Connectivity ---------------------- - -ICMP packets from PC1 to PC3. - -.. code-block:: none - - PC1> ping 192.168.10.2 - - 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms - 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms - 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms - 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms - 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms - -ICMP packets from PC2 to PC4. - -.. code-block:: none - - PC2> ping 192.168.11.2 - - 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms - 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms - 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/ipsec-cisco-route-based.md b/docs/configexamples/ipsec-cisco-route-based.md new file mode 100644 index 00000000..abd4fb3e --- /dev/null +++ b/docs/configexamples/ipsec-cisco-route-based.md @@ -0,0 +1,402 @@ +--- +lastproofread: '2025-06-26' +--- + +(examples-ipsec-cisco-route-based)= + +# Route-based Site-to-Site VPN IPsec between VyOS and Cisco + +This document is to describe a basic setup using route-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +Cisco IOS. Cisco initiates IPsec connection only if interesting +traffic present. For stable work we recommend configuring an +initiator role on VyOS side. OSPF is selected as routing protocol +inside the tunnel. + +## Network Topology + +```{image} /_static/images/cisco-vpn-ipsec.png +:align: center +:alt: Network Topology Diagram +``` + +## Prerequirements + +**VyOS:** + +```{eval-rst} ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ +``` + +**Cisco:** + +```{eval-rst} ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ +``` + +**IKE parameters:** + +```{eval-rst} ++-------------------+---------+ +| Encryption | AES-128 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 1 | ++-------------------+---------+ +``` + +**IPsec parameters:** + +```{eval-rst} ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ +``` + +**Hosts configuration** + +```{eval-rst} ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ +``` + +## Configuration + +:::{note} +Pfs is disabled in Cisco by default. +::: + +### VyOS + +```none +set interfaces ethernet eth0 address '10.0.1.2/30' +set interfaces ethernet eth1 address '192.168.0.1/24' +set interfaces ethernet eth2 address '192.168.1.1/24' +set interfaces vti vti1 address '10.100.100.1/30' +set interfaces vti vti1 mtu '1438' +set protocols ospf area 0 network '10.100.100.0/30' +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '192.168.1.0/24' +set protocols ospf interface eth1 passive +set protocols ospf interface eth2 passive +set protocols ospf interface vti1 network 'point-to-point' +set protocols ospf parameters router-id '2.2.2.2' +set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 +set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' +set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' +set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' +set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' +set vpn ipsec esp-group ESP-GROUP lifetime '3600' +set vpn ipsec esp-group ESP-GROUP pfs 'disable' +set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' +set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' +set vpn ipsec ike-group IKE-GROUP close-action 'start' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' +set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' +set vpn ipsec ike-group IKE-GROUP lifetime '28800' +set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' +set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' +set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' +set vpn ipsec options disable-route-autoinstall +set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' +set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' +set vpn ipsec site-to-site peer CISCO connection-type 'initiate' +set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' +set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' +set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +``` + +### Cisco + +```none +crypto isakmp policy 10 + encr aes + authentication pre-share + group 14 + lifetime 28800 +crypto isakmp key test address 10.0.1.2 +! +! +crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac + mode transport +! +crypto ipsec profile IPsec-profile + set transform-set TS +! +! +! +! +! +! +! +interface Loopback0 + ip address 1.1.1.1 255.255.255.255 +! +interface Tunnel10 + ip address 10.100.100.2 255.255.255.252 + ip ospf network point-to-point + tunnel source GigabitEthernet0/0 + tunnel mode ipsec ipv4 + tunnel destination 10.0.1.2 + tunnel protection ipsec profile IPsec-profile +! +interface GigabitEthernet0/0 + ip address 10.0.2.2 255.255.255.252 + duplex auto + speed auto + media-type rj45 +! +interface GigabitEthernet0/1 + ip address 192.168.10.1 255.255.255.0 + duplex auto + speed auto + media-type rj45 +! +interface GigabitEthernet0/2 + ip address 192.168.11.1 255.255.255.0 + duplex auto + speed auto + media-type rj45 +! +router ospf 1 + router-id 1.1.1.1 + passive-interface GigabitEthernet0/1 + passive-interface GigabitEthernet0/2 + network 10.100.100.0 0.0.0.3 area 0 + network 192.168.10.0 0.0.0.255 area 0 + network 192.168.11.0 0.0.0.255 area 0 +! +ip route 0.0.0.0 0.0.0.0 10.0.2.1 +``` + +## Monitoring + +### Monitoring on VyOS side + +IKE SAs: + +```none +vyos@vyos:~$ show vpn ike sa +Peer ID / IP Local ID / IP +------------ ------------- +10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 8175 18439 +``` + +IPsec SAs: + +```none +vyos@vyos:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- +CISCO-vti up 34m59s 17K/14K 224/213 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 +``` + +OSPF Neighbor Status: + +```none +vyos@vyos:~$ show ip ospf neighbor + +Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL +1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 +``` + +Routing Table: + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + +S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54 +C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59 +L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59 +O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50 +C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50 +L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50 +O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54 +C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59 +L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59 +O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54 +C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59 +L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59 +O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 +O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 +``` + +### Monitoring on Cisco side + +IKE SAs: + +```none +Cisco#show crypto isakmp sa +IPv4 Crypto ISAKMP SA +dst src state conn-id status +10.0.1.2 10.0.2.2 QM_IDLE 1002 ACTIVE + +IPv6 Crypto ISAKMP SA +``` + +IPsec SAs: + +```none +Cisco#show crypto ipsec sa + +interface: Tunnel10 + Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2 + + protected vrf: (none) + local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) + remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) + current_peer 10.0.1.2 port 500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295 + #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC3E9B307(3286872839) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x2740C328(658555688) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0 + sa timing: remaining key lifetime (k/sec): (4173824/1401) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC3E9B307(3286872839) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0 + sa timing: remaining key lifetime (k/sec): (4173819/1401) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: +``` + +OSPF Neighbor Status: + +```none +Cisco# show ip ospf neighbor + +Neighbor ID Pri State Dead Time Address Interface +2.2.2.2 0 FULL/ - 00:00:35 10.100.100.1 Tunnel10 +``` + +Routing Table: + +```none +Cisco#show ip route +Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP + D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area + N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 + E1 - OSPF external type 1, E2 - OSPF external type 2 + i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 + ia - IS-IS inter area, * - candidate default, U - per-user static route + o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + a - application route + + - replicated route, % - next hop override, p - overrides from PfR + +Gateway of last resort is 10.0.2.1 to network 0.0.0.0 + +S* 0.0.0.0/0 [1/0] via 10.0.2.1 + 1.0.0.0/32 is subnetted, 1 subnets +C 1.1.1.1 is directly connected, Loopback0 + 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks +C 10.0.2.0/30 is directly connected, GigabitEthernet0/0 +L 10.0.2.2/32 is directly connected, GigabitEthernet0/0 +C 10.100.100.0/30 is directly connected, Tunnel10 +L 10.100.100.2/32 is directly connected, Tunnel10 +O 192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 +O 192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 + 192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks +C 192.168.10.0/24 is directly connected, GigabitEthernet0/1 +L 192.168.10.1/32 is directly connected, GigabitEthernet0/1 + 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks +C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 +L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 +``` + +### Checking Connectivity + +ICMP packets from PC1 to PC3. + +```none +PC1> ping 192.168.10.2 + +84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms +84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms +84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms +84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms +84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms +``` + +ICMP packets from PC2 to PC4. + +```none +PC2> ping 192.168.11.2 + +84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms +84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms +84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms +``` diff --git a/docs/configexamples/ipsec-cisco-route-based.rst b/docs/configexamples/ipsec-cisco-route-based.rst deleted file mode 100644 index f7c3cb08..00000000 --- a/docs/configexamples/ipsec-cisco-route-based.rst +++ /dev/null @@ -1,405 +0,0 @@ -:lastproofread: 2025-06-26 - -.. _examples-ipsec-cisco-route-based: - -######################################################### -Route-based Site-to-Site VPN IPsec between VyOS and Cisco -######################################################### - -This document is to describe a basic setup using route-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -Cisco IOS. Cisco initiates IPsec connection only if interesting -traffic present. For stable work we recommend configuring an -initiator role on VyOS side. OSPF is selected as routing protocol -inside the tunnel. - -Network Topology -================ - -.. image:: /_static/images/cisco-vpn-ipsec.png - :align: center - :alt: Network Topology Diagram - -Prerequirements -=============== - -**VyOS:** - -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ - -**Cisco:** - -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ - -**IKE parameters:** - -+-------------------+---------+ -| Encryption | AES-128 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 1 | -+-------------------+---------+ - -**IPsec parameters:** - -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ - -**Hosts configuration** - -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ - -Configuration -============= - -.. note:: Pfs is disabled in Cisco by default. - -VyOS ----- - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.1.2/30' - set interfaces ethernet eth1 address '192.168.0.1/24' - set interfaces ethernet eth2 address '192.168.1.1/24' - set interfaces vti vti1 address '10.100.100.1/30' - set interfaces vti vti1 mtu '1438' - set protocols ospf area 0 network '10.100.100.0/30' - set protocols ospf area 0 network '192.168.0.0/24' - set protocols ospf area 0 network '192.168.1.0/24' - set protocols ospf interface eth1 passive - set protocols ospf interface eth2 passive - set protocols ospf interface vti1 network 'point-to-point' - set protocols ospf parameters router-id '2.2.2.2' - set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 - set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' - set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' - set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' - set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' - set vpn ipsec esp-group ESP-GROUP lifetime '3600' - set vpn ipsec esp-group ESP-GROUP pfs 'disable' - set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' - set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' - set vpn ipsec ike-group IKE-GROUP close-action 'start' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' - set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' - set vpn ipsec ike-group IKE-GROUP lifetime '28800' - set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' - set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' - set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' - set vpn ipsec options disable-route-autoinstall - set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' - set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' - set vpn ipsec site-to-site peer CISCO connection-type 'initiate' - set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' - set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' - set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' - set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' - set vpn ipsec site-to-site peer CISCO vti bind 'vti1' - -Cisco ------ - -.. code-block:: none - - crypto isakmp policy 10 - encr aes - authentication pre-share - group 14 - lifetime 28800 - crypto isakmp key test address 10.0.1.2 - ! - ! - crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac - mode transport - ! - crypto ipsec profile IPsec-profile - set transform-set TS - ! - ! - ! - ! - ! - ! - ! - interface Loopback0 - ip address 1.1.1.1 255.255.255.255 - ! - interface Tunnel10 - ip address 10.100.100.2 255.255.255.252 - ip ospf network point-to-point - tunnel source GigabitEthernet0/0 - tunnel mode ipsec ipv4 - tunnel destination 10.0.1.2 - tunnel protection ipsec profile IPsec-profile - ! - interface GigabitEthernet0/0 - ip address 10.0.2.2 255.255.255.252 - duplex auto - speed auto - media-type rj45 - ! - interface GigabitEthernet0/1 - ip address 192.168.10.1 255.255.255.0 - duplex auto - speed auto - media-type rj45 - ! - interface GigabitEthernet0/2 - ip address 192.168.11.1 255.255.255.0 - duplex auto - speed auto - media-type rj45 - ! - router ospf 1 - router-id 1.1.1.1 - passive-interface GigabitEthernet0/1 - passive-interface GigabitEthernet0/2 - network 10.100.100.0 0.0.0.3 area 0 - network 192.168.10.0 0.0.0.255 area 0 - network 192.168.11.0 0.0.0.255 area 0 - ! - ip route 0.0.0.0 0.0.0.0 10.0.2.1 - - - -Monitoring -========== - -Monitoring on VyOS side ------------------------ - -IKE SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ike sa - Peer ID / IP Local ID / IP - ------------ ------------- - 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 8175 18439 - - - -IPsec SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - ------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- - CISCO-vti up 34m59s 17K/14K 224/213 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 - -OSPF Neighbor Status: - -.. code-block:: none - - vyos@vyos:~$ show ip ospf neighbor - - Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL - 1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 - -Routing Table: - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - - S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54 - C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59 - L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59 - O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50 - C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50 - L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50 - O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54 - C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59 - L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59 - O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54 - C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59 - L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59 - O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 - O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 - -Monitoring on Cisco side ------------------------- - -IKE SAs: - -.. code-block:: none - - Cisco#show crypto isakmp sa - IPv4 Crypto ISAKMP SA - dst src state conn-id status - 10.0.1.2 10.0.2.2 QM_IDLE 1002 ACTIVE - - IPv6 Crypto ISAKMP SA - - - -IPsec SAs: - -.. code-block:: none - - Cisco#show crypto ipsec sa - - interface: Tunnel10 - Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2 - - protected vrf: (none) - local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) - remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) - current_peer 10.0.1.2 port 500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295 - #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC3E9B307(3286872839) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x2740C328(658555688) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0 - sa timing: remaining key lifetime (k/sec): (4173824/1401) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC3E9B307(3286872839) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0 - sa timing: remaining key lifetime (k/sec): (4173819/1401) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: - -OSPF Neighbor Status: - -.. code-block:: none - - Cisco# show ip ospf neighbor - - Neighbor ID Pri State Dead Time Address Interface - 2.2.2.2 0 FULL/ - 00:00:35 10.100.100.1 Tunnel10 - -Routing Table: - -.. code-block:: none - - Cisco#show ip route - Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP - D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area - N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 - E1 - OSPF external type 1, E2 - OSPF external type 2 - i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 - ia - IS-IS inter area, * - candidate default, U - per-user static route - o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP - a - application route - + - replicated route, % - next hop override, p - overrides from PfR - - Gateway of last resort is 10.0.2.1 to network 0.0.0.0 - - S* 0.0.0.0/0 [1/0] via 10.0.2.1 - 1.0.0.0/32 is subnetted, 1 subnets - C 1.1.1.1 is directly connected, Loopback0 - 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks - C 10.0.2.0/30 is directly connected, GigabitEthernet0/0 - L 10.0.2.2/32 is directly connected, GigabitEthernet0/0 - C 10.100.100.0/30 is directly connected, Tunnel10 - L 10.100.100.2/32 is directly connected, Tunnel10 - O 192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 - O 192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 - 192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks - C 192.168.10.0/24 is directly connected, GigabitEthernet0/1 - L 192.168.10.1/32 is directly connected, GigabitEthernet0/1 - 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks - C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 - L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 - - -Checking Connectivity ---------------------- - -ICMP packets from PC1 to PC3. - -.. code-block:: none - - PC1> ping 192.168.10.2 - - 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms - 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms - 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms - 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms - 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms - -ICMP packets from PC2 to PC4. - -.. code-block:: none - - PC2> ping 192.168.11.2 - - 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms - 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms - 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/ipsec-pa-route-based.md b/docs/configexamples/ipsec-pa-route-based.md new file mode 100644 index 00000000..ce21a9d3 --- /dev/null +++ b/docs/configexamples/ipsec-pa-route-based.md @@ -0,0 +1,420 @@ +--- +lastproofread: '2025-06-26' +--- + +(examples-ipsec-pa-route-based)= + +# Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto + +This document is to describe a basic setup using route-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +PA 11.0.0. OSPF is selected as routing protocol inside the +tunnel. + +Since this example focuses on IPsec configuration it does not +include firewall configuration. + +## Network Topology + +```{image} /_static/images/ipsec-vyos-pa.png +:align: center +:alt: Network Topology Diagram +``` + +## Prerequirements + +**VyOS:** + +```{eval-rst} ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ +``` + +**Cisco:** + +```{eval-rst} ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ +``` + +**IKE parameters:** + +```{eval-rst} ++-------------------+---------+ +| Encryption | AES-128 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 1 | ++-------------------+---------+ +``` + +**IPsec parameters:** + +```{eval-rst} ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ +``` + +**Hosts configuration** + +```{eval-rst} ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ +``` + +## Configuration + +### VyOS + +```none +set interfaces ethernet eth0 address '10.0.1.2/30' +set interfaces ethernet eth1 address '192.168.0.1/24' +set interfaces ethernet eth2 address '192.168.1.1/24' +set interfaces vti vti1 address '10.100.100.1/30' +set interfaces vti vti1 mtu '1438' +set protocols ospf area 0 network '10.100.100.0/30' +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '192.168.1.0/24' +set protocols ospf interface eth1 passive +set protocols ospf interface eth2 passive +set protocols ospf interface vti1 network 'point-to-point' +set protocols ospf parameters router-id '2.2.2.2' +set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 +set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' +set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' +set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' +set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' +set vpn ipsec esp-group ESP-GROUP lifetime '3600' +set vpn ipsec esp-group ESP-GROUP pfs 'disable' +set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' +set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' +set vpn ipsec ike-group IKE-GROUP close-action 'start' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' +set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' +set vpn ipsec ike-group IKE-GROUP lifetime '28800' +set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' +set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' +set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' +set vpn ipsec options disable-route-autoinstall +set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' +set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' +set vpn ipsec site-to-site peer CISCO connection-type 'initiate' +set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' +set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' +set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +``` + +### Palo Alto + +GUI Configuration: + +: Network -> Network Profiles -> IKE Crypto + + ```{image} /_static/images/PA-IKE-group.png + :align: center + ``` + + Network -> Network Profiles -> IKE Gateways + + ```{image} /_static/images/PA-IKE-GW-1.png + :align: center + ``` + + ```{image} /_static/images/PA-IKE-GW-2.png + :align: center + ``` + + Network -> Network Profiles -> IPSec Crypto + + ```{image} /_static/images/PA-ESP-group.png + :align: center + ``` + + Network -> Interfaces + + ```{image} /_static/images/PA-tunnel-1.png + :align: center + ``` + + ```{image} /_static/images/PA-tunnel-2.png + :align: center + ``` + + ```{image} /_static/images/PA-tunnel-3.png + :align: center + ``` + + Network -> IPSec Tunnels + + ```{image} /_static/images/PA-IPsec-tunnel.png + :align: center + ``` + +CLI configuration with OSPF: + +```none +set network interface ethernet ethernet1/1 layer3 ip 10.0.2.2/30 +set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow +set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24 +set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow +set network interface ethernet ethernet1/3 layer3 ip 192.168.11.1/24 +set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow +set network interface tunnel units tunnel.1 ip 10.100.100.2/30 +set network interface tunnel units tunnel.1 interface-management-profile Allow +set network interface tunnel units tunnel.1 mtu 1438 +set network profiles interface-management-profile Allow ping yes +set network ike crypto-profiles ike-crypto-profiles IKE-GROUP hash sha1 +set network ike crypto-profiles ike-crypto-profiles IKE-GROUP dh-group group14 +set network ike crypto-profiles ike-crypto-profiles IKE-GROUP encryption aes-128-cbc +set network ike crypto-profiles ike-crypto-profiles IKE-GROUP lifetime seconds 28800 +set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp authentication sha256 +set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp encryption aes-256-cbc +set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP lifetime seconds 3600 +set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP dh-group no-pfs +set network ike gateway VyOS authentication pre-shared-key key test +set network ike gateway VyOS protocol ikev1 dpd enable yes +set network ike gateway VyOS protocol ikev1 exchange-mode main +set network ike gateway VyOS protocol ikev1 ike-crypto-profile IKE-GROUP +set network ike gateway VyOS protocol ikev2 dpd enable yes +set network ike gateway VyOS protocol version ikev1 +set network ike gateway VyOS protocol-common nat-traversal enable yes +set network ike gateway VyOS protocol-common fragmentation enable no +set network ike gateway VyOS protocol-common passive-mode yes +set network ike gateway VyOS local-address interface ethernet1/1 +set network ike gateway VyOS peer-address ip 10.0.1.2 +set network ike gateway VyOS local-id id 10.0.2.2 +set network ike gateway VyOS local-id type ipaddr +set network ike gateway VyOS peer-id id 10.0.1.2 +set network ike gateway VyOS peer-id type ipaddr +set network tunnel ipsec VyOS-tunnel auto-key ike-gateway VyOS +set network tunnel ipsec VyOS-tunnel auto-key ipsec-crypto-profile ESP-GROUP +set network tunnel ipsec VyOS-tunnel tunnel-monitor enable no +set network tunnel ipsec VyOS-tunnel tunnel-interface tunnel.1 +set network tunnel ipsec VyOS-tunnel anti-replay no +set network virtual-router default protocol ospf enable yes +set network virtual-router default protocol ospf area 0.0.0.0 type normal +set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 enable yes +set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 passive no +set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 link-type p2p +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 enable yes +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 passive yes +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 link-type broadcast +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 enable yes +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 passive yes +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 link-type broadcast +set network virtual-router default protocol ospf router-id 1.1.1.1 +set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] +``` + +## Monitoring + +### Monitoring on VyOS side + +IKE SAs: + +```none +vyos@vyos:~$ show vpn ike sa +Peer ID / IP Local ID / IP +------------ ------------- +10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 1372 25802 +``` + +IPsec SAs: + +```none +vyos@vyos:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- +PA-vti up 23m27s 9K/10K 149/151 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 +``` + +OSPF Neighbor Status: + +```none +vyos@vyos:~$ show ip ospf neighbor + +Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL +1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 +``` + +Routing Table: + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:27:30 +C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:27:34 +L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:27:34 +O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:24:34 +C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:24:34 +L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:24:34 +O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:27:29 +C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:27:34 +L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:27:34 +O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:27:29 +C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:27:34 +L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:27:34 +O>* 192.168.10.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 +O>* 192.168.11.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 +``` + +### Monitoring on Cisco side + +IKE SAs: + +```none +admin@PA-VM> show vpn ike-sa + +IKEv1 phase-1 SAs +GwID/client IP Peer-Address Gateway Name Role Mode Algorithm Established Expiration V ST Xt Phase2 +-------------- ------------ ------------ ---- ---- --------- ----------- ---------- - -- -- ------ +1 10.0.1.2 VyOS Resp Main PSK/DH14/A128/SHA1 Jul.31 01:35:00 Jul.31 09:35:00 v1 13 1 1 + +Show IKEv1 IKE SA: Total 1 gateways found. 1 ike sa found. + + +IKEv1 phase-2 SAs +Gateway Name TnID Tunnel GwID/IP Role Algorithm SPI(in) SPI(out) MsgID ST Xt +------------ ---- ------ ------- ---- --------- ------- -------- ----- -- -- +VyOS 1 VyOS-tunnel 1 Resp ESP/ /tunl/SHA2 8827A3D9 C204F4FA BD202829 9 1 + +Show IKEv1 phase2 SA: Total 1 gateways found. 1 ike sa found. + + +There is no IKEv2 SA found. +``` + +IPsec SAs: + +```none +admin@PA-VM> show vpn ipsec-sa + +GwID/client IP TnID Peer-Address Tunnel(Gateway) Algorithm SPI(in) SPI(out) life(Sec/KB) remain-time(Sec) +-------------- ---- ------------ --------------- --------- ------- -------- ------------ ---------------- +1 1 10.0.1.2 VyOS-tunnel(VyOS) ESP/A256/SHA256 8827A3D9 C204F4FA 3600/Unlimited 2733 + +Show IPSec SA: Total 1 tunnels found. 1 ipsec sa found. +``` + +OSPF Neighbor Status: + +```none +admin@PA-VM> show routing protocol ospf neighbor + + Options: 0x80:reserved, O:Opaq-LSA capability, DC:demand circuits, EA:Ext-Attr LSA capability, + N/P:NSSA option, MC:multicase, E:AS external LSA capability, T:TOS capability + ========== + virtual router: default + neighbor address: 10.100.100.1 + local address binding: 0.0.0.0 + type: dynamic + status: full + neighbor router ID: 2.2.2.2 + area id: 0.0.0.0 + neighbor priority: 1 + lifetime remain: 32 + messages pending: 0 + LSA request pending: 0 + options: 0x02: E + hello suppressed: no + restart helper status: not helping + restart helper time remaining: 0 + restart helper exit reason: none +``` + +Routing Table: + +```none +admin@PA-VM> show routing route + +flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, + Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast + + +VIRTUAL ROUTER: default (id 1) + ========== +destination nexthop metric flags age interface next-AS +0.0.0.0/0 10.0.2.1 10 A S ethernet1/1 +10.0.2.0/30 10.0.2.2 0 A C ethernet1/1 +10.0.2.2/32 0.0.0.0 0 A H +10.100.100.0/30 0.0.0.0 10 Oi 1273 tunnel.1 +10.100.100.0/30 10.100.100.2 0 A C tunnel.1 +10.100.100.2/32 0.0.0.0 0 A H +192.168.0.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 +192.168.1.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 +192.168.10.0/24 0.0.0.0 10 Oi 1273 ethernet1/2 +192.168.10.0/24 192.168.10.1 0 A C ethernet1/2 +192.168.10.1/32 0.0.0.0 0 A H +192.168.11.0/24 0.0.0.0 10 Oi 1273 ethernet1/3 +192.168.11.0/24 192.168.11.1 0 A C ethernet1/3 +192.168.11.1/32 0.0.0.0 0 A H +total routes shown: 14 +``` + +### Checking Connectivity + +ICMP packets from PC1 to PC3. + +```none +PC1> ping 192.168.10.2 + +84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms +84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms +84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms +84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms +84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms +``` + +ICMP packets from PC2 to PC4. + +```none +PC2> ping 192.168.11.2 + +84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms +84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms +84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms +``` diff --git a/docs/configexamples/ipsec-pa-route-based.rst b/docs/configexamples/ipsec-pa-route-based.rst deleted file mode 100644 index b6f6f3a7..00000000 --- a/docs/configexamples/ipsec-pa-route-based.rst +++ /dev/null @@ -1,420 +0,0 @@ -:lastproofread: 2025-06-26 - -.. _examples-ipsec-pa-route-based: - -############################################################# -Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto -############################################################# - -This document is to describe a basic setup using route-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -PA 11.0.0. OSPF is selected as routing protocol inside the -tunnel. - -Since this example focuses on IPsec configuration it does not -include firewall configuration. - -Network Topology -================ - -.. image:: /_static/images/ipsec-vyos-pa.png - :align: center - :alt: Network Topology Diagram - -Prerequirements -=============== - -**VyOS:** - -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ - -**Cisco:** - -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ - -**IKE parameters:** - -+-------------------+---------+ -| Encryption | AES-128 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 1 | -+-------------------+---------+ - -**IPsec parameters:** - -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ - -**Hosts configuration** - -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ - -Configuration -============= - -VyOS ----- - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.1.2/30' - set interfaces ethernet eth1 address '192.168.0.1/24' - set interfaces ethernet eth2 address '192.168.1.1/24' - set interfaces vti vti1 address '10.100.100.1/30' - set interfaces vti vti1 mtu '1438' - set protocols ospf area 0 network '10.100.100.0/30' - set protocols ospf area 0 network '192.168.0.0/24' - set protocols ospf area 0 network '192.168.1.0/24' - set protocols ospf interface eth1 passive - set protocols ospf interface eth2 passive - set protocols ospf interface vti1 network 'point-to-point' - set protocols ospf parameters router-id '2.2.2.2' - set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 - set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' - set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' - set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' - set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' - set vpn ipsec esp-group ESP-GROUP lifetime '3600' - set vpn ipsec esp-group ESP-GROUP pfs 'disable' - set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' - set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' - set vpn ipsec ike-group IKE-GROUP close-action 'start' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' - set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' - set vpn ipsec ike-group IKE-GROUP lifetime '28800' - set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' - set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' - set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' - set vpn ipsec options disable-route-autoinstall - set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' - set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' - set vpn ipsec site-to-site peer CISCO connection-type 'initiate' - set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' - set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' - set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' - set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' - set vpn ipsec site-to-site peer CISCO vti bind 'vti1' - -Palo Alto ---------- - -GUI Configuration: - Network -> Network Profiles -> IKE Crypto - - .. image:: /_static/images/PA-IKE-group.png - :align: center - - Network -> Network Profiles -> IKE Gateways - - .. image:: /_static/images/PA-IKE-GW-1.png - :align: center - - .. image:: /_static/images/PA-IKE-GW-2.png - :align: center - - Network -> Network Profiles -> IPSec Crypto - - .. image:: /_static/images/PA-ESP-group.png - :align: center - - Network -> Interfaces - - .. image:: /_static/images/PA-tunnel-1.png - :align: center - - .. image:: /_static/images/PA-tunnel-2.png - :align: center - - .. image:: /_static/images/PA-tunnel-3.png - :align: center - - Network -> IPSec Tunnels - - .. image:: /_static/images/PA-IPsec-tunnel.png - :align: center - -CLI configuration with OSPF: - -.. code-block:: none - - set network interface ethernet ethernet1/1 layer3 ip 10.0.2.2/30 - set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow - set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24 - set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow - set network interface ethernet ethernet1/3 layer3 ip 192.168.11.1/24 - set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow - set network interface tunnel units tunnel.1 ip 10.100.100.2/30 - set network interface tunnel units tunnel.1 interface-management-profile Allow - set network interface tunnel units tunnel.1 mtu 1438 - set network profiles interface-management-profile Allow ping yes - set network ike crypto-profiles ike-crypto-profiles IKE-GROUP hash sha1 - set network ike crypto-profiles ike-crypto-profiles IKE-GROUP dh-group group14 - set network ike crypto-profiles ike-crypto-profiles IKE-GROUP encryption aes-128-cbc - set network ike crypto-profiles ike-crypto-profiles IKE-GROUP lifetime seconds 28800 - set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp authentication sha256 - set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp encryption aes-256-cbc - set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP lifetime seconds 3600 - set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP dh-group no-pfs - set network ike gateway VyOS authentication pre-shared-key key test - set network ike gateway VyOS protocol ikev1 dpd enable yes - set network ike gateway VyOS protocol ikev1 exchange-mode main - set network ike gateway VyOS protocol ikev1 ike-crypto-profile IKE-GROUP - set network ike gateway VyOS protocol ikev2 dpd enable yes - set network ike gateway VyOS protocol version ikev1 - set network ike gateway VyOS protocol-common nat-traversal enable yes - set network ike gateway VyOS protocol-common fragmentation enable no - set network ike gateway VyOS protocol-common passive-mode yes - set network ike gateway VyOS local-address interface ethernet1/1 - set network ike gateway VyOS peer-address ip 10.0.1.2 - set network ike gateway VyOS local-id id 10.0.2.2 - set network ike gateway VyOS local-id type ipaddr - set network ike gateway VyOS peer-id id 10.0.1.2 - set network ike gateway VyOS peer-id type ipaddr - set network tunnel ipsec VyOS-tunnel auto-key ike-gateway VyOS - set network tunnel ipsec VyOS-tunnel auto-key ipsec-crypto-profile ESP-GROUP - set network tunnel ipsec VyOS-tunnel tunnel-monitor enable no - set network tunnel ipsec VyOS-tunnel tunnel-interface tunnel.1 - set network tunnel ipsec VyOS-tunnel anti-replay no - set network virtual-router default protocol ospf enable yes - set network virtual-router default protocol ospf area 0.0.0.0 type normal - set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 enable yes - set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 passive no - set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 link-type p2p - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 enable yes - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 passive yes - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 link-type broadcast - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 enable yes - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 passive yes - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 link-type broadcast - set network virtual-router default protocol ospf router-id 1.1.1.1 - set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] - - -Monitoring -========== - -Monitoring on VyOS side ------------------------ - -IKE SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ike sa - Peer ID / IP Local ID / IP - ------------ ------------- - 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 1372 25802 - - - - -IPsec SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - ------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- - PA-vti up 23m27s 9K/10K 149/151 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 - - -OSPF Neighbor Status: - -.. code-block:: none - - vyos@vyos:~$ show ip ospf neighbor - - Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL - 1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 - - -Routing Table: - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:27:30 - C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:27:34 - L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:27:34 - O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:24:34 - C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:24:34 - L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:24:34 - O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:27:29 - C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:27:34 - L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:27:34 - O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:27:29 - C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:27:34 - L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:27:34 - O>* 192.168.10.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 - O>* 192.168.11.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 - - -Monitoring on Cisco side ------------------------- - -IKE SAs: - -.. code-block:: none - - admin@PA-VM> show vpn ike-sa - - IKEv1 phase-1 SAs - GwID/client IP Peer-Address Gateway Name Role Mode Algorithm Established Expiration V ST Xt Phase2 - -------------- ------------ ------------ ---- ---- --------- ----------- ---------- - -- -- ------ - 1 10.0.1.2 VyOS Resp Main PSK/DH14/A128/SHA1 Jul.31 01:35:00 Jul.31 09:35:00 v1 13 1 1 - - Show IKEv1 IKE SA: Total 1 gateways found. 1 ike sa found. - - - IKEv1 phase-2 SAs - Gateway Name TnID Tunnel GwID/IP Role Algorithm SPI(in) SPI(out) MsgID ST Xt - ------------ ---- ------ ------- ---- --------- ------- -------- ----- -- -- - VyOS 1 VyOS-tunnel 1 Resp ESP/ /tunl/SHA2 8827A3D9 C204F4FA BD202829 9 1 - - Show IKEv1 phase2 SA: Total 1 gateways found. 1 ike sa found. - - - There is no IKEv2 SA found. - -IPsec SAs: - -.. code-block:: none - - admin@PA-VM> show vpn ipsec-sa - - GwID/client IP TnID Peer-Address Tunnel(Gateway) Algorithm SPI(in) SPI(out) life(Sec/KB) remain-time(Sec) - -------------- ---- ------------ --------------- --------- ------- -------- ------------ ---------------- - 1 1 10.0.1.2 VyOS-tunnel(VyOS) ESP/A256/SHA256 8827A3D9 C204F4FA 3600/Unlimited 2733 - - Show IPSec SA: Total 1 tunnels found. 1 ipsec sa found. - -OSPF Neighbor Status: - -.. code-block:: none - - admin@PA-VM> show routing protocol ospf neighbor - - Options: 0x80:reserved, O:Opaq-LSA capability, DC:demand circuits, EA:Ext-Attr LSA capability, - N/P:NSSA option, MC:multicase, E:AS external LSA capability, T:TOS capability - ========== - virtual router: default - neighbor address: 10.100.100.1 - local address binding: 0.0.0.0 - type: dynamic - status: full - neighbor router ID: 2.2.2.2 - area id: 0.0.0.0 - neighbor priority: 1 - lifetime remain: 32 - messages pending: 0 - LSA request pending: 0 - options: 0x02: E - hello suppressed: no - restart helper status: not helping - restart helper time remaining: 0 - restart helper exit reason: none - - - -Routing Table: - -.. code-block:: none - - admin@PA-VM> show routing route - - flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, - Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast - - - VIRTUAL ROUTER: default (id 1) - ========== - destination nexthop metric flags age interface next-AS - 0.0.0.0/0 10.0.2.1 10 A S ethernet1/1 - 10.0.2.0/30 10.0.2.2 0 A C ethernet1/1 - 10.0.2.2/32 0.0.0.0 0 A H - 10.100.100.0/30 0.0.0.0 10 Oi 1273 tunnel.1 - 10.100.100.0/30 10.100.100.2 0 A C tunnel.1 - 10.100.100.2/32 0.0.0.0 0 A H - 192.168.0.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 - 192.168.1.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 - 192.168.10.0/24 0.0.0.0 10 Oi 1273 ethernet1/2 - 192.168.10.0/24 192.168.10.1 0 A C ethernet1/2 - 192.168.10.1/32 0.0.0.0 0 A H - 192.168.11.0/24 0.0.0.0 10 Oi 1273 ethernet1/3 - 192.168.11.0/24 192.168.11.1 0 A C ethernet1/3 - 192.168.11.1/32 0.0.0.0 0 A H - total routes shown: 14 - - - -Checking Connectivity ---------------------- - -ICMP packets from PC1 to PC3. - -.. code-block:: none - - PC1> ping 192.168.10.2 - - 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms - 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms - 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms - 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms - 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms - -ICMP packets from PC2 to PC4. - -.. code-block:: none - - PC2> ping 192.168.11.2 - - 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms - 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms - 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/l3vpn-hub-and-spoke.md b/docs/configexamples/l3vpn-hub-and-spoke.md new file mode 100644 index 00000000..bdd62ada --- /dev/null +++ b/docs/configexamples/l3vpn-hub-and-spoke.md @@ -0,0 +1,1094 @@ +# L3VPN for Hub-and-Spoke connectivity with VyOS + +IP/MPLS technology is widely used by various service providers and large +enterprises in order to achieve better network scalability, manageability +and flexibility. It also provides the possibility to deliver different +services for the customers in a seamless manner. +Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered +through OSI layer 3 networking technologies. Often the border gateway +protocol (BGP) is used to send and receive VPN-related data that is +responsible for the control plane. L3VPN utilizes virtual routing and +forwarding (VRF) techniques to receive and deliver user data as well as +separate data planes of the end-users. It is built using a combination of +IP- and MPLS-based information. Generally, L3VPNs are used to send data +on back-end VPN infrastructures, such as for VPN connections between data +centres, HQs and branches. + +An L3VPN consists of multiple access links, multiple VPN routing and +forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs. +An L3VPN can be configured to connect two or more customer sites. +In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have +unique Route Distinguishers (RDs). In order to use the hub site as a +transit point for connectivity in such an environment, the spoke sites +export their routes to the hub. Spokes can talk to hubs, but never have +direct paths to other spokes. All traffic between spokes is controlled +and delivered over the hub site. + +To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple +requirements in order to properly implement the solution. +We'll use the following nodes in our LAB environment: + +- 2 x Route reflectors (VyOS-RRx) +- 4 x Provider routers (VyOS-Px) +- 3 x Provider Edge (VyOs-PEx) +- 3 x Customer Edge (VyOS-CEx) + +The following software was used in the creation of this document: + +- Operating system: VyOS +- Version: 1.4-rolling-202110310317 +- Image name: vyos-1.4-rolling-202110310317-amd64.iso + +**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) +– The configurations below are specifically for VyOS 1.4.x. + +General information can be found in the {ref}`configuration/vrf/index:L3VPN VRFs` chapter. + +## Topology + +```{image} /_static/images/L3VPN_hub_and_spoke.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +## How does it work? + +As we know the main assumption of L3VPN “Hub and Spoke” is, that the traffic +between spokes have to pass via hub, in our scenario VyOS-PE2 is the Hub PE +and the VyOS-CE1-HUB is the central customer office device that is responsible +for controlling access between all spokes and announcing its network prefixes +(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its +own Route-Distinguisher(RD) and route-target import/export lists. +Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to +the nodes across network where PEs Spokes import the route-target 60535:1030 +(this is export route-target of vrf BLUE_HUB) and export its own route-target +60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the +Customer edge nodes can only learn the network prefixes of the HUB site +[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes +[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. +Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network +routes exchange and minimize iBGP peerings between devices. + +L3VPN configuration parameters table: + +```{eval-rst} ++----------+-------+------------+-----------------+-------------+-------------+ +| Node | Role | VRF | RD | RT import | RT export | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE2 | Hub | BLUE_HUB | 10.80.80.1:1011 | 65035:1011 | 65035:1030 | +| | | | | 65035:1030 | | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ +``` + +## Configuration + +### Step-1: Configuring IGP and enabling MPLS LDP + +At the first step we need to configure the IP/MPLS backbone network using OSPF +as IGP protocol and LDP as label-switching protocol for the base connectivity +between **P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R** +(eflector) nodes: + +- VyOS-P1: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.3/32' +set interfaces ethernet eth0 address '172.16.30.1/24' +set interfaces ethernet eth1 address '172.16.40.1/24' +set interfaces ethernet eth2 address '172.16.90.1/24' +set interfaces ethernet eth3 address '172.16.10.1/24' +set interfaces ethernet eth5 address '172.16.100.1/24' + +# protocols ospf+ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth5' +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp interface 'eth5' +set protocols mpls ldp router-id '10.0.0.3' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.3 +``` + +- VyOS-P2: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.4/32' +set interfaces ethernet eth0 address '172.16.30.2/24' +set interfaces ethernet eth1 address '172.16.20.1/24' +set interfaces ethernet eth2 address '172.16.120.1/24' +set interfaces ethernet eth3 address '172.16.60.1/24' + +# protocols ospf+ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp router-id '10.0.0.4' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.4' +``` + +- VyOS-P3: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.5/32' +set interfaces ethernet eth0 address '172.16.110.1/24' +set interfaces ethernet eth1 address '172.16.40.2/24' +set interfaces ethernet eth2 address '172.16.50.1/24' +set interfaces ethernet eth3 address '172.16.70.1/24' + +# protocols ospf + ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp router-id '10.0.0.5' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.5' +``` + +- VyOS-P4: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.6/32' +set interfaces ethernet eth0 address '172.16.80.2/24' +set interfaces ethernet eth1 address '172.16.130.1/24' +set interfaces ethernet eth2 address '172.16.50.2/24' +set interfaces ethernet eth3 address '172.16.60.2/24' +set interfaces ethernet eth5 address '172.16.140.1/24' + + +# protocols ospf + ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth5' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp interface 'eth5' +set protocols mpls ldp router-id '10.0.0.6' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.6' +``` + +- VyOS-PE1: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.7/32' +set interfaces ethernet eth0 address '172.16.90.2/24' + +# protocols ospf + ldp +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp router-id '10.0.0.7' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.7' +``` + +- VyOS-PE2: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.8/32' +set interfaces ethernet eth0 address '172.16.110.2/24' +set interfaces ethernet eth1 address '172.16.100.2/24' +set interfaces ethernet eth2 address '172.16.80.1/24' + +# protocols ospf + ldp +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp router-id '10.0.0.8' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.8' +``` + +- VyOS-PE3: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.10/32' +set interfaces ethernet eth0 address '172.16.140.2/24' + +# protocols ospf + ldp +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp router-id '10.0.0.10' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.10' +``` + +- VyOS-RR1: + +```none +# interfaces +set interfaces ethernet eth1 address '172.16.20.2/24' +set interfaces ethernet eth2 address '172.16.10.2/24' +set interfaces dummy dum10 address '10.0.0.1/32' + +# protocols ospf + ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp router-id '10.0.0.1' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.1' +``` + +- VyOS-RR2: + +```none +# interfaces +set interfaces ethernet eth0 address '172.16.80.1/24' +set interfaces ethernet eth1 address '172.16.70.2/24' +set interfaces dummy dum10 address '10.0.0.2/32' + +# protocols ospf + ldp +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp router-id '10.0.0.2' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.2' +``` + +### Step-2: Configuring iBGP for L3VPN control-plane + +At this step we are going to enable iBGP protocol on MPLS nodes and +Route Reflectors (two routers for redundancy) that will deliver IPv4 +VPN (L3VPN) routes between them: + +- VyOS-RR1: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' +set protocols bgp parameters cluster-id '10.0.0.1' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.1' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + +- VyOS-RR2: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' +set protocols bgp parameters cluster-id '10.0.0.1' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.2' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + +- VyOS-PE1: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.7' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + +- VyOS-PE2: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.8' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + +- VyOS-PE3: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.10' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + +### Step-3: Configuring L3VPN VRFs on PE nodes + +This section provides configuration steps for setting up VRFs on our +PE nodes including CE facing interfaces, BGP, rd and route-target +import/export based on the pre-defined parameters. + +- VyOS-PE1: + +```none +# VRF settings +set vrf name BLUE_SPOKE table '200' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' +set vrf name BLUE_SPOKE protocols bgp system-as '65001' +set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override +set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035' + +# interfaces +set interfaces ethernet eth3 address '10.50.50.1/24' +set interfaces ethernet eth3 vrf 'BLUE_SPOKE' +``` + +- VyOS-PE2: + +```none +# VRF settings +set vrf name BLUE_HUB table '400' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' +set vrf name BLUE_HUB protocols bgp system-as '65001' +set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override +set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035' + +# interfaces +set interfaces ethernet eth3 address '10.80.80.1/24' +set interfaces ethernet eth3 vrf 'BLUE_HUB' +``` + +- VyOS-PE3: + +```none +# VRF settings +set vrf name BLUE_SPOKE table '200' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' +set vrf name BLUE_SPOKE protocols bgp system-as '65001' +set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override +set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035' + +# interfaces +set interfaces ethernet eth3 address '10.60.60.1/24' +set interfaces ethernet eth3 vrf 'BLUE_SPOKE' +``` + +### Step-4: Configuring CE nodes + +Dynamic routing used between CE and PE nodes and eBGP peering +established for the route exchanging between them. All routes +received by PEs are then exported to L3VPN and delivered from +Spoke sites to Hub and vise-versa based on previously +configured L3VPN parameters. + +- VyOS-CE1-SPOKE: + +```none +# interfaces +set interfaces dummy dum20 address '10.0.0.80/32' +set interfaces ethernet eth0 address '10.50.50.2/24' + +# BGP for peering with PE +set protocols bgp system-as 65035 +set protocols bgp address-family ipv4-unicast network 10.0.0.80/32 +set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2' +set protocols bgp neighbor 10.50.50.1 remote-as '65001' +set protocols bgp neighbor 10.50.50.1 update-source 'eth0' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.50.50.2' +``` + +- VyOS-CE1-HUB: + +```none +# interfaces +set interfaces dummy dum20 address '10.0.0.100/32' +set interfaces ethernet eth0 address '10.80.80.2/24' + +# BGP for peering with PE +set protocols bgp system-as 65035 +set protocols bgp address-family ipv4-unicast network 10.0.0.100/32 +set protocols bgp address-family ipv4-unicast redistribute connected +set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2' +set protocols bgp neighbor 10.80.80.1 remote-as '65001' +set protocols bgp neighbor 10.80.80.1 update-source 'eth0' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.80.80.2' +``` + +- VyOS-CE2-SPOKE: + +```none +# interfaces +set interfaces dummy dum20 address '10.0.0.90/32' +set interfaces ethernet eth0 address '10.60.60.2/24' + +# BGP for peering with PE +set protocols bgp system-as 65035 +set protocols bgp address-family ipv4-unicast network 10.0.0.90/32 +set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2' +set protocols bgp neighbor 10.60.60.1 remote-as '65001' +set protocols bgp neighbor 10.60.60.1 update-source 'eth0' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.60.60.2' +``` + +### Step-5: Verification + +This section describes verification commands for MPLS/BGP/LDP +protocols and L3VPN related routes as well as diagnosis and +reachability checks between CE nodes. + +Let’s check IPv4 routing and MPLS information on provider nodes +(same procedure for all P nodes): + +- “show ip ospf neighbor” for checking ospf relationship + +```none +vyos@VyOS-P1:~$ show ip ospf neighbor + +Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL +10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 +10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 +10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 +10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 +10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 +``` + +- “show mpls ldp neighbor “ for checking ldp neighbors + +```none +vyos@VyOS-P1:~$ show mpls ldp neighbor +AF ID State Remote Address Uptime +ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h +ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h +ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h +ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h +ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h +``` + +- “show mpls ldp binding” for checking mpls label assignment + +```none +vyos@VyOS-P1:~$ show mpls ldp discovery +AF Destination Nexthop Local Label Remote Label In Use +ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes +ipv4 10.0.0.1/32 10.0.0.4 23 20 no +ipv4 10.0.0.1/32 10.0.0.5 23 17 no +ipv4 10.0.0.1/32 10.0.0.7 23 16 no +ipv4 10.0.0.1/32 10.0.0.8 23 16 no +ipv4 10.0.0.2/32 10.0.0.1 20 16 no +ipv4 10.0.0.2/32 10.0.0.4 20 22 no +ipv4 10.0.0.2/32 10.0.0.5 20 24 yes +ipv4 10.0.0.2/32 10.0.0.7 20 17 no +ipv4 10.0.0.2/32 10.0.0.8 20 17 no +ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no +ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no +ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no +ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no +ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no +ipv4 10.0.0.4/32 10.0.0.1 16 18 no +ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes +ipv4 10.0.0.4/32 10.0.0.5 16 19 no +ipv4 10.0.0.4/32 10.0.0.7 16 19 no +ipv4 10.0.0.4/32 10.0.0.8 16 19 no +ipv4 10.0.0.5/32 10.0.0.1 21 19 no +ipv4 10.0.0.5/32 10.0.0.4 21 17 no +ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes +ipv4 10.0.0.5/32 10.0.0.7 21 20 no +ipv4 10.0.0.5/32 10.0.0.8 21 20 no +ipv4 10.0.0.6/32 10.0.0.1 17 20 no +ipv4 10.0.0.6/32 10.0.0.4 17 23 yes +ipv4 10.0.0.6/32 10.0.0.5 17 21 yes +ipv4 10.0.0.6/32 10.0.0.7 17 21 no +ipv4 10.0.0.6/32 10.0.0.8 17 21 no +ipv4 10.0.0.7/32 10.0.0.1 22 21 no +ipv4 10.0.0.7/32 10.0.0.4 22 18 no +ipv4 10.0.0.7/32 10.0.0.5 22 20 no +ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes +ipv4 10.0.0.7/32 10.0.0.8 22 22 no +ipv4 10.0.0.8/32 10.0.0.1 24 22 no +ipv4 10.0.0.8/32 10.0.0.4 24 19 no +ipv4 10.0.0.8/32 10.0.0.5 24 16 no +ipv4 10.0.0.8/32 10.0.0.7 24 22 no +ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes +ipv4 10.0.0.9/32 10.0.0.1 18 23 no +ipv4 10.0.0.9/32 10.0.0.4 18 21 yes +ipv4 10.0.0.9/32 10.0.0.5 18 22 no +ipv4 10.0.0.9/32 10.0.0.7 18 23 no +ipv4 10.0.0.9/32 10.0.0.8 18 23 no +ipv4 10.0.0.10/32 10.0.0.1 19 24 no +ipv4 10.0.0.10/32 10.0.0.4 19 24 yes +ipv4 10.0.0.10/32 10.0.0.5 19 23 yes +ipv4 10.0.0.10/32 10.0.0.7 19 24 no +ipv4 10.0.0.10/32 10.0.0.8 19 24 no +``` + +Now we’re checking iBGP status and routes from route-reflector +nodes to other devices: + +- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors: + +```none +vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary +BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0 +BGP table version 0 +RIB entries 9, using 1728 bytes of memory +Peers 4, using 85 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 +10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 +10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 +10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + +Total number of neighbors 4 +``` + +- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information: + +```none +vyos@VyOS-RR1:~$ show bgp ipv4 vpn +BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 +Default local pref 100, local AS 65001 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path +Route Distinguisher: 10.50.50.1:1011 +*>i10.50.50.0/24 10.0.0.7 0 100 0 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 +*>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 +Route Distinguisher: 10.60.60.1:1011 +*>i10.60.60.0/24 10.0.0.10 0 100 0 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 +*>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 +Route Distinguisher: 10.80.80.1:1011 +*>i10.80.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 +*>i100.100.100.100/32 + 10.0.0.8 0 100 0 65035 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 +Route Distinguisher: 172.16.80.1:2011 +*>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 +*>i172.16.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 +Route Distinguisher: 172.16.100.1:2011 +*>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 +*>i172.16.100.0/24 10.0.0.9 0 100 0 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 +``` + +- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected + for specific VPNv4 destination + +```none +vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32 +BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 +not allocated +Paths: (1 available, best #1) + Advertised to non peer-group peers: + 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 + 65035, (Received from a RR-client) + 10.0.0.8 from 10.0.0.8 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:65035:1030 + Remote label: 80 + Last update: Tue Oct 19 13:45:32 202 +``` + +Also we can verify how PE devices receives VPNv4 networks from the RRs +and installing them to the specific customer VRFs: + +- “show bgp ipv4 vpn summary” for checking iBGP neighbors against + route-reflector devices: + +```none +vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary +BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0 +BGP table version 0 +RIB entries 9, using 1728 bytes of memory +Peers 2, using 43 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 +10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 +``` + +- “show bgp vrf all” for checking all the prefix learning on BGP + : within VRFs: + +```none +vyos@VyOS-PE1:~$ show bgp vrf all + +Instance default: +No BGP prefixes displayed, 0 exist + +Instance BLUE_SPOKE: +BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 +Default local pref 100, local AS 65001 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path +* 10.50.50.0/24 0.0.0.0 0 32768 ? +*> 0.0.0.0 0 32768 i +*> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i +* 10.0.0.8@0< 0 100 0 i +*> 10.0.0.80/32 10.50.50.2 0 0 65035 i +*> 10.0.0.100/32 + 10.0.0.8@0< 0 100 0 65035 ? +* 10.0.0.8@0< 0 100 0 65035 ? +``` + +- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor + : information between PE and CE: + +```none +vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary + + +IPv4 Unicast Summary: +BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6 +BGP table version 8 +RIB entries 7, using 1344 bytes of memory +Peers 1, using 21 KiB of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 + +Total number of neighbors 1 +``` + +- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. + : Using this command we are also able to check the transport and + customer label (inner/outer) for Hub network prefix (10.0.0.100/32): + +```none +vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE + +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + +VRF BLUE_SPOKE: +K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h +C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h +B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 +B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m +B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 +``` + +- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the + : specific VPNv4 destination including extended community and + remotelabel information. This procedure is the same on all Spoke nodes: + +```none +vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32 +BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 +not allocated +Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.8 from 10.0.0.1 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Tue Oct 19 13:45:26 2021 + 65035 + 10.0.0.8 from 10.0.0.2 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Wed Oct 13 12:39:34 202 +``` + +Now, let’s check routing information on out Hub PE: + +- “show bgp ipv4 vpn summary” for checking iBGP neighbors again + : VyOS-RR1/RR2 + +```none +vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary +BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0 +BGP table version 0 +RIB entries 9, using 1728 bytes of memory +Peers 2, using 43 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 +10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 + +Total number of neighbors +``` + +- “show bgp vrf all” for checking all the prefixes learning on BGP + +```none +vyos@VyOS-PE2:~$ show bgp vrf all + +Instance default: +No BGP prefixes displayed, 0 exist + +Instance BLUE_HUB: +BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 +Default local pref 100, local AS 65001 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path +*> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i +* 10.0.0.7@0< 0 100 0 i +*> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i +* 10.0.0.10@0< 0 100 0 i +* 10.80.80.0/24 10.80.80.2 0 0 65035 ? +* 0.0.0.0 0 32768 i +*> 0.0.0.0 0 32768 ? +*> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i +*> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i +* 10.0.0.9@0< 0 100 0 65050 i +*> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i +* 10.0.0.7@0< 0 100 0 65035 i +*> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i +* 10.0.0.10@0< 0 100 0 65035 i +*> 10.0.0.100/32 + 10.80.80.2 0 0 65035 ? +*> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? + 0.0.0.0@9< 0 32768 i +*> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i +* 10.0.0.9@0< 0 100 0 i +``` + +- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor + : CE Hub device + +```none +vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary + +IPv4 Unicast Summary: +BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8 +BGP table version 50 +RIB entries 19, using 3648 bytes of memory +Peers 1, using 21 KiB of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 +``` + +- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. + : With this command we are able to check the transport and + customer label (inner/outer) for network spokes prefixes + 10.0.0.80/32 - 10.0.0.90/32 + +```none +vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup +VRF BLUE_HUB: +K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h +B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 +B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 +C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h +B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h +B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 +B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 +B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 +B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h +B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h +B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 +``` + +- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, + : extended community and remote label of specific destination + +```none +vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32 +BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32 +not allocated +Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.7 from 10.0.0.1 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 10.0.0.7 from 10.0.0.2 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:39:37 2021 + +vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 +BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 +not allocated +Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.10 from 10.0.0.1 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 10.0.0.10 from 10.0.0.2 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:45:44 2021 +``` + +Finally, let’s check the reachability between CEs: + +- VyOS-CE1-SPOKE -----> VyOS-CE-HUB + +```none +# check rib +vyos@VyOS-CE1-SPOKE:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + +B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m +C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h +B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m +C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h +B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m + +# check icmp +vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80 +PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data. +64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms +64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms +64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms +64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms +^C +--- 10.0.0.100 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 8ms +rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms + +# check network path +vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100 +traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets + 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms + 2 * * * + 3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m +``` + +- VyOS-CE-HUB -------> VyOS-CE1-SPOKE +- VyOS-CE-HUB -------> VyOS-CE2-SPOKE + +```none +# check rib +vyos@VyOS-CE-HUB:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + +B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m +B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m +C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h +B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h +B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m +B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m +B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m +C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h +B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h +B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + +# check icmp +vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4 +PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data. +64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms +64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms +64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms +64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms + +--- 10.0.0.80 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 9ms +rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms + +vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4 +PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data. +64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms +64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms +64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms +^C +--- 10.0.0.90 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 6ms +rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms + +# check network path +vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80 +traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms + 2 * * * + 3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms + +vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90 +traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms + 2 * * * + 3 * * * + 4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms +``` + +- VyOS-CE2-SPOKE -------> VyOS-CE-HUB + +```none +# check rib +vyos@rt-ce2-SPOKE:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + +B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h +C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h +B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m +C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h +B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m + +# check icmp +vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4 +PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data. +64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms +64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms +64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms +64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms + +--- 10.0.0.100 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 9ms +rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms + +# check network path +vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100 +traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets + 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms + 2 * * * + 3 * * * + 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms +``` + +**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll see * * * for the transit routers of the mpls backbone. diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst deleted file mode 100644 index 8e1d0051..00000000 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ /dev/null @@ -1,1123 +0,0 @@ - -############################################## -L3VPN for Hub-and-Spoke connectivity with VyOS -############################################## - -IP/MPLS technology is widely used by various service providers and large -enterprises in order to achieve better network scalability, manageability -and flexibility. It also provides the possibility to deliver different -services for the customers in a seamless manner. -Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered -through OSI layer 3 networking technologies. Often the border gateway -protocol (BGP) is used to send and receive VPN-related data that is -responsible for the control plane. L3VPN utilizes virtual routing and -forwarding (VRF) techniques to receive and deliver user data as well as -separate data planes of the end-users. It is built using a combination of -IP- and MPLS-based information. Generally, L3VPNs are used to send data -on back-end VPN infrastructures, such as for VPN connections between data -centres, HQs and branches. - -An L3VPN consists of multiple access links, multiple VPN routing and -forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs. -An L3VPN can be configured to connect two or more customer sites. -In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have -unique Route Distinguishers (RDs). In order to use the hub site as a -transit point for connectivity in such an environment, the spoke sites -export their routes to the hub. Spokes can talk to hubs, but never have -direct paths to other spokes. All traffic between spokes is controlled -and delivered over the hub site. - - -To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple -requirements in order to properly implement the solution. -We'll use the following nodes in our LAB environment: - -* 2 x Route reflectors (VyOS-RRx) -* 4 x Provider routers (VyOS-Px) -* 3 x Provider Edge (VyOs-PEx) -* 3 x Customer Edge (VyOS-CEx) - -The following software was used in the creation of this document: - -* Operating system: VyOS -* Version: 1.4-rolling-202110310317 -* Image name: vyos-1.4-rolling-202110310317-amd64.iso - -**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) -– The configurations below are specifically for VyOS 1.4.x. - -General information can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter. - - - -******** -Topology -******** -.. image:: /_static/images/L3VPN_hub_and_spoke.png - :width: 80% - :align: center - :alt: Network Topology Diagram - - - -***************** -How does it work? -***************** - -As we know the main assumption of L3VPN “Hub and Spoke” is, that the traffic -between spokes have to pass via hub, in our scenario VyOS-PE2 is the Hub PE -and the VyOS-CE1-HUB is the central customer office device that is responsible -for controlling access between all spokes and announcing its network prefixes -(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its -own Route-Distinguisher(RD) and route-target import/export lists. -Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to -the nodes across network where PEs Spokes import the route-target 60535:1030 -(this is export route-target of vrf BLUE_HUB) and export its own route-target -60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the -Customer edge nodes can only learn the network prefixes of the HUB site -[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes -[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. -Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network -routes exchange and minimize iBGP peerings between devices. - -L3VPN configuration parameters table: - -+----------+-------+------------+-----------------+-------------+-------------+ -| Node | Role | VRF | RD | RT import | RT export | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE2 | Hub | BLUE_HUB | 10.80.80.1:1011 | 65035:1011 | 65035:1030 | -| | | | | 65035:1030 | | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030 | 65035:1011 | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030 | 65035:1011 | -+----------+-------+------------+-----------------+-------------+-------------+ - - - -************* -Configuration -************* - - - -Step-1: Configuring IGP and enabling MPLS LDP -============================================= - -At the first step we need to configure the IP/MPLS backbone network using OSPF -as IGP protocol and LDP as label-switching protocol for the base connectivity -between **P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R** -(eflector) nodes: - -- VyOS-P1: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.3/32' - set interfaces ethernet eth0 address '172.16.30.1/24' - set interfaces ethernet eth1 address '172.16.40.1/24' - set interfaces ethernet eth2 address '172.16.90.1/24' - set interfaces ethernet eth3 address '172.16.10.1/24' - set interfaces ethernet eth5 address '172.16.100.1/24' - - # protocols ospf+ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set protocols mpls interface 'eth5' - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp interface 'eth3' - set protocols mpls ldp interface 'eth5' - set protocols mpls ldp router-id '10.0.0.3' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.3 - - -- VyOS-P2: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.4/32' - set interfaces ethernet eth0 address '172.16.30.2/24' - set interfaces ethernet eth1 address '172.16.20.1/24' - set interfaces ethernet eth2 address '172.16.120.1/24' - set interfaces ethernet eth3 address '172.16.60.1/24' - - # protocols ospf+ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp interface 'eth3' - set protocols mpls ldp router-id '10.0.0.4' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.4' - -- VyOS-P3: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.5/32' - set interfaces ethernet eth0 address '172.16.110.1/24' - set interfaces ethernet eth1 address '172.16.40.2/24' - set interfaces ethernet eth2 address '172.16.50.1/24' - set interfaces ethernet eth3 address '172.16.70.1/24' - - # protocols ospf + ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp interface 'eth3' - set protocols mpls ldp router-id '10.0.0.5' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.5' - -- VyOS-P4: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.6/32' - set interfaces ethernet eth0 address '172.16.80.2/24' - set interfaces ethernet eth1 address '172.16.130.1/24' - set interfaces ethernet eth2 address '172.16.50.2/24' - set interfaces ethernet eth3 address '172.16.60.2/24' - set interfaces ethernet eth5 address '172.16.140.1/24' - - - # protocols ospf + ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set protocols mpls interface 'eth0' - set protocols mpls interface 'eth5' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp interface 'eth3' - set protocols mpls ldp interface 'eth5' - set protocols mpls ldp router-id '10.0.0.6' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.6' - -- VyOS-PE1: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.7/32' - set interfaces ethernet eth0 address '172.16.90.2/24' - - # protocols ospf + ldp - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp router-id '10.0.0.7' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.7' - -- VyOS-PE2: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.8/32' - set interfaces ethernet eth0 address '172.16.110.2/24' - set interfaces ethernet eth1 address '172.16.100.2/24' - set interfaces ethernet eth2 address '172.16.80.1/24' - - # protocols ospf + ldp - set protocols mpls interface 'eth0' - set protocols mpls interface 'eth1' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp router-id '10.0.0.8' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.8' - -- VyOS-PE3: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.10/32' - set interfaces ethernet eth0 address '172.16.140.2/24' - - # protocols ospf + ldp - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp router-id '10.0.0.10' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.10' - -- VyOS-RR1: - -.. code-block:: none - - # interfaces - set interfaces ethernet eth1 address '172.16.20.2/24' - set interfaces ethernet eth2 address '172.16.10.2/24' - set interfaces dummy dum10 address '10.0.0.1/32' - - # protocols ospf + ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp router-id '10.0.0.1' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.1' - -- VyOS-RR2: - -.. code-block:: none - - # interfaces - set interfaces ethernet eth0 address '172.16.80.1/24' - set interfaces ethernet eth1 address '172.16.70.2/24' - set interfaces dummy dum10 address '10.0.0.2/32' - - # protocols ospf + ldp - set protocols mpls interface 'eth0' - set protocols mpls interface 'eth1' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp router-id '10.0.0.2' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.2' - - - -Step-2: Configuring iBGP for L3VPN control-plane -================================================ - -At this step we are going to enable iBGP protocol on MPLS nodes and -Route Reflectors (two routers for redundancy) that will deliver IPv4 -VPN (L3VPN) routes between them: - -- VyOS-RR1: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' - set protocols bgp parameters cluster-id '10.0.0.1' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.1' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - -- VyOS-RR2: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' - set protocols bgp parameters cluster-id '10.0.0.1' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.2' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - -- VyOS-PE1: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.7' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - -- VyOS-PE2: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.8' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - -- VyOS-PE3: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.10' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - - - -Step-3: Configuring L3VPN VRFs on PE nodes -========================================== - -This section provides configuration steps for setting up VRFs on our -PE nodes including CE facing interfaces, BGP, rd and route-target -import/export based on the pre-defined parameters. - -- VyOS-PE1: - -.. code-block:: none - - # VRF settings - set vrf name BLUE_SPOKE table '200' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' - set vrf name BLUE_SPOKE protocols bgp system-as '65001' - set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override - set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035' - - # interfaces - set interfaces ethernet eth3 address '10.50.50.1/24' - set interfaces ethernet eth3 vrf 'BLUE_SPOKE' - -- VyOS-PE2: - -.. code-block:: none - - # VRF settings - set vrf name BLUE_HUB table '400' - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' - set vrf name BLUE_HUB protocols bgp system-as '65001' - set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override - set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035' - - # interfaces - set interfaces ethernet eth3 address '10.80.80.1/24' - set interfaces ethernet eth3 vrf 'BLUE_HUB' - -- VyOS-PE3: - -.. code-block:: none - - # VRF settings - set vrf name BLUE_SPOKE table '200' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' - set vrf name BLUE_SPOKE protocols bgp system-as '65001' - set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override - set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035' - - # interfaces - set interfaces ethernet eth3 address '10.60.60.1/24' - set interfaces ethernet eth3 vrf 'BLUE_SPOKE' - - - -Step-4: Configuring CE nodes -============================ - -Dynamic routing used between CE and PE nodes and eBGP peering -established for the route exchanging between them. All routes -received by PEs are then exported to L3VPN and delivered from -Spoke sites to Hub and vise-versa based on previously -configured L3VPN parameters. - -- VyOS-CE1-SPOKE: - -.. code-block:: none - - # interfaces - set interfaces dummy dum20 address '10.0.0.80/32' - set interfaces ethernet eth0 address '10.50.50.2/24' - - # BGP for peering with PE - set protocols bgp system-as 65035 - set protocols bgp address-family ipv4-unicast network 10.0.0.80/32 - set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2' - set protocols bgp neighbor 10.50.50.1 remote-as '65001' - set protocols bgp neighbor 10.50.50.1 update-source 'eth0' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.50.50.2' - -- VyOS-CE1-HUB: - -.. code-block:: none - - # interfaces - set interfaces dummy dum20 address '10.0.0.100/32' - set interfaces ethernet eth0 address '10.80.80.2/24' - - # BGP for peering with PE - set protocols bgp system-as 65035 - set protocols bgp address-family ipv4-unicast network 10.0.0.100/32 - set protocols bgp address-family ipv4-unicast redistribute connected - set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2' - set protocols bgp neighbor 10.80.80.1 remote-as '65001' - set protocols bgp neighbor 10.80.80.1 update-source 'eth0' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.80.80.2' - -- VyOS-CE2-SPOKE: - -.. code-block:: none - - # interfaces - set interfaces dummy dum20 address '10.0.0.90/32' - set interfaces ethernet eth0 address '10.60.60.2/24' - - # BGP for peering with PE - set protocols bgp system-as 65035 - set protocols bgp address-family ipv4-unicast network 10.0.0.90/32 - set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2' - set protocols bgp neighbor 10.60.60.1 remote-as '65001' - set protocols bgp neighbor 10.60.60.1 update-source 'eth0' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.60.60.2' - - - -Step-5: Verification -==================== - -This section describes verification commands for MPLS/BGP/LDP -protocols and L3VPN related routes as well as diagnosis and -reachability checks between CE nodes. - -Let’s check IPv4 routing and MPLS information on provider nodes -(same procedure for all P nodes): - -- “show ip ospf neighbor” for checking ospf relationship - -.. code-block:: none - - vyos@VyOS-P1:~$ show ip ospf neighbor - - Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL - 10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 - 10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 - 10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 - 10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 - 10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 - -- “show mpls ldp neighbor “ for checking ldp neighbors - -.. code-block:: none - - vyos@VyOS-P1:~$ show mpls ldp neighbor - AF ID State Remote Address Uptime - ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h - ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h - ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h - ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h - ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h - -- “show mpls ldp binding” for checking mpls label assignment - -.. code-block:: none - - vyos@VyOS-P1:~$ show mpls ldp discovery - AF Destination Nexthop Local Label Remote Label In Use - ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes - ipv4 10.0.0.1/32 10.0.0.4 23 20 no - ipv4 10.0.0.1/32 10.0.0.5 23 17 no - ipv4 10.0.0.1/32 10.0.0.7 23 16 no - ipv4 10.0.0.1/32 10.0.0.8 23 16 no - ipv4 10.0.0.2/32 10.0.0.1 20 16 no - ipv4 10.0.0.2/32 10.0.0.4 20 22 no - ipv4 10.0.0.2/32 10.0.0.5 20 24 yes - ipv4 10.0.0.2/32 10.0.0.7 20 17 no - ipv4 10.0.0.2/32 10.0.0.8 20 17 no - ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no - ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no - ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no - ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no - ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no - ipv4 10.0.0.4/32 10.0.0.1 16 18 no - ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes - ipv4 10.0.0.4/32 10.0.0.5 16 19 no - ipv4 10.0.0.4/32 10.0.0.7 16 19 no - ipv4 10.0.0.4/32 10.0.0.8 16 19 no - ipv4 10.0.0.5/32 10.0.0.1 21 19 no - ipv4 10.0.0.5/32 10.0.0.4 21 17 no - ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes - ipv4 10.0.0.5/32 10.0.0.7 21 20 no - ipv4 10.0.0.5/32 10.0.0.8 21 20 no - ipv4 10.0.0.6/32 10.0.0.1 17 20 no - ipv4 10.0.0.6/32 10.0.0.4 17 23 yes - ipv4 10.0.0.6/32 10.0.0.5 17 21 yes - ipv4 10.0.0.6/32 10.0.0.7 17 21 no - ipv4 10.0.0.6/32 10.0.0.8 17 21 no - ipv4 10.0.0.7/32 10.0.0.1 22 21 no - ipv4 10.0.0.7/32 10.0.0.4 22 18 no - ipv4 10.0.0.7/32 10.0.0.5 22 20 no - ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes - ipv4 10.0.0.7/32 10.0.0.8 22 22 no - ipv4 10.0.0.8/32 10.0.0.1 24 22 no - ipv4 10.0.0.8/32 10.0.0.4 24 19 no - ipv4 10.0.0.8/32 10.0.0.5 24 16 no - ipv4 10.0.0.8/32 10.0.0.7 24 22 no - ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes - ipv4 10.0.0.9/32 10.0.0.1 18 23 no - ipv4 10.0.0.9/32 10.0.0.4 18 21 yes - ipv4 10.0.0.9/32 10.0.0.5 18 22 no - ipv4 10.0.0.9/32 10.0.0.7 18 23 no - ipv4 10.0.0.9/32 10.0.0.8 18 23 no - ipv4 10.0.0.10/32 10.0.0.1 19 24 no - ipv4 10.0.0.10/32 10.0.0.4 19 24 yes - ipv4 10.0.0.10/32 10.0.0.5 19 23 yes - ipv4 10.0.0.10/32 10.0.0.7 19 24 no - ipv4 10.0.0.10/32 10.0.0.8 19 24 no - -Now we’re checking iBGP status and routes from route-reflector -nodes to other devices: - -- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors: - -.. code-block:: none - - vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary - BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0 - BGP table version 0 - RIB entries 9, using 1728 bytes of memory - Peers 4, using 85 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 - 10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 - 10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 - 10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 - - Total number of neighbors 4 - -- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information: - -.. code-block:: none - - vyos@VyOS-RR1:~$ show bgp ipv4 vpn - BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 - Default local pref 100, local AS 65001 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path - Route Distinguisher: 10.50.50.1:1011 - *>i10.50.50.0/24 10.0.0.7 0 100 0 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 - Route Distinguisher: 10.60.60.1:1011 - *>i10.60.60.0/24 10.0.0.10 0 100 0 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 - Route Distinguisher: 10.80.80.1:1011 - *>i10.80.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 - *>i100.100.100.100/32 - 10.0.0.8 0 100 0 65035 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 - Route Distinguisher: 172.16.80.1:2011 - *>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 - *>i172.16.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 - Route Distinguisher: 172.16.100.1:2011 - *>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 - *>i172.16.100.0/24 10.0.0.9 0 100 0 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 - -- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected - for specific VPNv4 destination - -.. code-block:: none - - vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32 - BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 - not allocated - Paths: (1 available, best #1) - Advertised to non peer-group peers: - 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 - 65035, (Received from a RR-client) - 10.0.0.8 from 10.0.0.8 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:65035:1030 - Remote label: 80 - Last update: Tue Oct 19 13:45:32 202 - -Also we can verify how PE devices receives VPNv4 networks from the RRs -and installing them to the specific customer VRFs: - -- “show bgp ipv4 vpn summary” for checking iBGP neighbors against - route-reflector devices: - -.. code-block:: none - - vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary - BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0 - BGP table version 0 - RIB entries 9, using 1728 bytes of memory - Peers 2, using 43 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 - 10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 - -- “show bgp vrf all” for checking all the prefix learning on BGP - within VRFs: - -.. code-block:: none - - vyos@VyOS-PE1:~$ show bgp vrf all - - Instance default: - No BGP prefixes displayed, 0 exist - - Instance BLUE_SPOKE: - BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 - Default local pref 100, local AS 65001 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path - * 10.50.50.0/24 0.0.0.0 0 32768 ? - *> 0.0.0.0 0 32768 i - *> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i - * 10.0.0.8@0< 0 100 0 i - *> 10.0.0.80/32 10.50.50.2 0 0 65035 i - *> 10.0.0.100/32 - 10.0.0.8@0< 0 100 0 65035 ? - * 10.0.0.8@0< 0 100 0 65035 ? - -- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor - information between PE and CE: - -.. code-block:: none - - vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary - - - IPv4 Unicast Summary: - BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6 - BGP table version 8 - RIB entries 7, using 1344 bytes of memory - Peers 1, using 21 KiB of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 - - Total number of neighbors 1 - -- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. - Using this command we are also able to check the transport and - customer label (inner/outer) for Hub network prefix (10.0.0.100/32): - -.. code-block:: none - - vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE - - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - - VRF BLUE_SPOKE: - K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h - C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h - B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 - B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m - B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 - -- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the - specific VPNv4 destination including extended community and - remotelabel information. This procedure is the same on all Spoke nodes: - -.. code-block:: none - - vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32 - BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 - not allocated - Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.8 from 10.0.0.1 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Tue Oct 19 13:45:26 2021 - 65035 - 10.0.0.8 from 10.0.0.2 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Wed Oct 13 12:39:34 202 - -Now, let’s check routing information on out Hub PE: - -- “show bgp ipv4 vpn summary” for checking iBGP neighbors again - VyOS-RR1/RR2 - -.. code-block:: none - - vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary - BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0 - BGP table version 0 - RIB entries 9, using 1728 bytes of memory - Peers 2, using 43 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 - 10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 - - Total number of neighbors - -- “show bgp vrf all” for checking all the prefixes learning on BGP - -.. code-block:: none - - vyos@VyOS-PE2:~$ show bgp vrf all - - Instance default: - No BGP prefixes displayed, 0 exist - - Instance BLUE_HUB: - BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 - Default local pref 100, local AS 65001 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path - *> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i - * 10.0.0.7@0< 0 100 0 i - *> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i - * 10.0.0.10@0< 0 100 0 i - * 10.80.80.0/24 10.80.80.2 0 0 65035 ? - * 0.0.0.0 0 32768 i - *> 0.0.0.0 0 32768 ? - *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i - *> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i - * 10.0.0.9@0< 0 100 0 65050 i - *> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i - * 10.0.0.7@0< 0 100 0 65035 i - *> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i - * 10.0.0.10@0< 0 100 0 65035 i - *> 10.0.0.100/32 - 10.80.80.2 0 0 65035 ? - *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? - 0.0.0.0@9< 0 32768 i - *> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i - * 10.0.0.9@0< 0 100 0 i - -- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor - CE Hub device - -.. code-block:: none - - vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary - - IPv4 Unicast Summary: - BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8 - BGP table version 50 - RIB entries 19, using 3648 bytes of memory - Peers 1, using 21 KiB of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 - -- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. - With this command we are able to check the transport and - customer label (inner/outer) for network spokes prefixes - 10.0.0.80/32 - 10.0.0.90/32 - -.. code-block:: none - - vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - VRF BLUE_HUB: - K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h - B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 - B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 - C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h - B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h - B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 - B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 - B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 - B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h - B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h - B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 - -- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, - extended community and remote label of specific destination - -.. code-block:: none - - vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32 - BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32 - not allocated - Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.7 from 10.0.0.1 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 - 65035 - 10.0.0.7 from 10.0.0.2 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:39:37 2021 - - vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 - BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 - not allocated - Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.10 from 10.0.0.1 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 - 65035 - 10.0.0.10 from 10.0.0.2 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:45:44 2021 - -Finally, let’s check the reachability between CEs: - -- VyOS-CE1-SPOKE -----> VyOS-CE-HUB - - -.. code-block:: none - - # check rib - vyos@VyOS-CE1-SPOKE:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - - B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m - C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h - B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m - C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h - B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m - - # check icmp - vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80 - PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data. - 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms - 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms - 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms - 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms - ^C - --- 10.0.0.100 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 8ms - rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms - - # check network path - vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100 - traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets - 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms - 2 * * * - 3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m - -- VyOS-CE-HUB -------> VyOS-CE1-SPOKE -- VyOS-CE-HUB -------> VyOS-CE2-SPOKE - -.. code-block:: none - - # check rib - vyos@VyOS-CE-HUB:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - - B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m - B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h - B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h - B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m - B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h - B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h - B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - - # check icmp - vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4 - PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data. - 64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms - 64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms - 64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms - 64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms - - --- 10.0.0.80 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 9ms - rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms - - vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4 - PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data. - 64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms - 64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms - 64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms - ^C - --- 10.0.0.90 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 6ms - rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms - - # check network path - vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80 - traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets - 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms - 2 * * * - 3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms - - vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90 - traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets - 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms - 2 * * * - 3 * * * - 4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms - -- VyOS-CE2-SPOKE -------> VyOS-CE-HUB - -.. code-block:: none - - # check rib - vyos@rt-ce2-SPOKE:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - - B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h - C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h - B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m - C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h - B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m - - # check icmp - vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4 - PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data. - 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms - 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms - 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms - 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms - - --- 10.0.0.100 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 9ms - rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms - - # check network path - vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100 - traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets - 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms - 2 * * * - 3 * * * - 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms - -**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll see * * * for the transit routers of the mpls backbone. diff --git a/docs/configexamples/lac-lns.md b/docs/configexamples/lac-lns.md new file mode 100644 index 00000000..5bf5edb2 --- /dev/null +++ b/docs/configexamples/lac-lns.md @@ -0,0 +1,174 @@ +--- +lastproofread: '2024-02-21' +--- + +(examples-lac-lns)= + +# PPPoE over L2TP + +This document is to describe a basic setup using PPPoE over L2TP. +LAC and LNS are components of the broadband topology. +LAC - L2TP access concentrator +LNS - L2TP Network Server +LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and +forward them to LNS. LNS is the termination point that comes from PPP packets +from the remote client. + +In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC. +All users with domain **vyos.io** will be tunneled to LNS via L2TP. + +## Network Topology + +```{image} /_static/images/lac-lns-diagram.jpg +:align: center +:alt: Network Topology Diagram +:width: 60% +``` + +## Configurations + +### LAC + +```none +aaa new-model +! +aaa authentication ppp default local +! +vpdn enable +vpdn aaa attribute nas-ip-address vpdn-nas +! +vpdn-group LAC + request-dialin + protocol l2tp + domain vyos.io + initiate-to ip 192.168.139.100 + source-ip 192.168.139.101 + local name LAC + l2tp tunnel password 0 test123 +! +bba-group pppoe MAIN-BBA + virtual-template 1 +! +interface GigabitEthernet0/0 + description To LNS + ip address 192.168.139.101 255.255.255.0 + duplex auto + speed auto + media-type rj45 +! +interface GigabitEthernet0/1 + description To PPPoE clients + no ip address + duplex auto + speed auto + media-type rj45 + pppoe enable group MAIN-BBA +! +interface Virtual-Template1 + description pppoe MAIN-BBA + no ip address + no peer default ip address + ppp mtu adaptive + ppp authentication chap +! +``` + +### LNS + +```none +set interfaces ethernet eth0 address '192.168.139.100/24' +set nat source rule 100 outbound-interface name 'eth0' +set nat source rule 100 source address '10.0.0.0/24' +set nat source rule 100 translation address 'masquerade' +set protocols static route 0.0.0.0/0 next-hop 192.168.139.2 +set vpn l2tp remote-access authentication mode 'radius' +set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest' +set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100' +set vpn l2tp remote-access default-pool 'TEST-POOL' +set vpn l2tp remote-access gateway-address '10.0.0.1' +set vpn l2tp remote-access lns host-name 'LAC' +set vpn l2tp remote-access lns shared-secret 'test123' +set vpn l2tp remote-access name-server '8.8.8.8' +set vpn l2tp remote-access ppp-options disable-ccp +``` + +:::{note} +This setup requires the Compression Control Protocol (CCP) +being disabled, the command `set vpn l2tp remote-access ppp-options disable-ccp` +accomplishes that. +::: + +### Client + +In this lab we use Windows PPPoE client. + +```{image} /_static/images/lac-lns-winclient.jpg +:align: center +:alt: Window PPPoE Client Configuration +:width: 100% +``` + +### Monitoring + +Monitoring on LNS side + +```none +vyos@vyos:~$ show l2tp-server sessions + ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes +--------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+---------- + l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB +``` + +Monitoring on LAC side + +```none +Router#show pppoe session + 1 session in FORWARDED (FWDED) State + 1 session total +Uniq ID PPPoE RemMAC Port VT VA State + SID LocMAC VA-st Type + 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED + 0c58.88ac.0001 + +Router#show l2tp +L2TP Tunnel and Session Information Total tunnels 1 sessions 1 + +LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ + Count VPDN Group +23238 2640 LAC est 192.168.139.100 1 LAC + +LocID RemID TunID Username, Intf/ State Last Chg Uniq ID + Vcid, Circuit +25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1 +``` + +Monitoring on RADIUS Server side + +```none +root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221 +Wed Feb 21 13:37:17 2024 + User-Name = "test@vyos.io" + NAS-Port = 0 + NAS-Port-Id = "l2tp0" + NAS-Port-Type = Virtual + Service-Type = Framed-User + Framed-Protocol = PPP + Calling-Station-Id = "192.168.139.101" + Called-Station-Id = "192.168.139.100" + Acct-Status-Type = Start + Acct-Authentic = RADIUS + Acct-Session-Id = "45c731e169d9a4f1" + Acct-Session-Time = 0 + Acct-Input-Octets = 0 + Acct-Output-Octets = 0 + Acct-Input-Packets = 0 + Acct-Output-Packets = 0 + Acct-Input-Gigawords = 0 + Acct-Output-Gigawords = 0 + Framed-IP-Address = 10.0.0.2 + NAS-IP-Address = 192.168.139.100 + Event-Timestamp = "Feb 21 2024 13:37:17 UTC" + Tmp-String-9 = "ai:" + Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318" + Timestamp = 1708522637 +``` diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst deleted file mode 100644 index 8443ddff..00000000 --- a/docs/configexamples/lac-lns.rst +++ /dev/null @@ -1,177 +0,0 @@ -:lastproofread: 2024-02-21 - -.. _examples-lac-lns: - -############### -PPPoE over L2TP -############### - -This document is to describe a basic setup using PPPoE over L2TP. -LAC and LNS are components of the broadband topology. -LAC - L2TP access concentrator -LNS - L2TP Network Server -LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and -forward them to LNS. LNS is the termination point that comes from PPP packets -from the remote client. - -In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC. -All users with domain **vyos.io** will be tunneled to LNS via L2TP. - -Network Topology -================ - -.. image:: /_static/images/lac-lns-diagram.jpg - :width: 60% - :align: center - :alt: Network Topology Diagram - -Configurations -============== - -LAC ---- - -.. code-block:: none - - aaa new-model - ! - aaa authentication ppp default local - ! - vpdn enable - vpdn aaa attribute nas-ip-address vpdn-nas - ! - vpdn-group LAC - request-dialin - protocol l2tp - domain vyos.io - initiate-to ip 192.168.139.100 - source-ip 192.168.139.101 - local name LAC - l2tp tunnel password 0 test123 - ! - bba-group pppoe MAIN-BBA - virtual-template 1 - ! - interface GigabitEthernet0/0 - description To LNS - ip address 192.168.139.101 255.255.255.0 - duplex auto - speed auto - media-type rj45 - ! - interface GigabitEthernet0/1 - description To PPPoE clients - no ip address - duplex auto - speed auto - media-type rj45 - pppoe enable group MAIN-BBA - ! - interface Virtual-Template1 - description pppoe MAIN-BBA - no ip address - no peer default ip address - ppp mtu adaptive - ppp authentication chap - ! - - -LNS ---- - -.. code-block:: none - - set interfaces ethernet eth0 address '192.168.139.100/24' - set nat source rule 100 outbound-interface name 'eth0' - set nat source rule 100 source address '10.0.0.0/24' - set nat source rule 100 translation address 'masquerade' - set protocols static route 0.0.0.0/0 next-hop 192.168.139.2 - set vpn l2tp remote-access authentication mode 'radius' - set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest' - set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100' - set vpn l2tp remote-access default-pool 'TEST-POOL' - set vpn l2tp remote-access gateway-address '10.0.0.1' - set vpn l2tp remote-access lns host-name 'LAC' - set vpn l2tp remote-access lns shared-secret 'test123' - set vpn l2tp remote-access name-server '8.8.8.8' - set vpn l2tp remote-access ppp-options disable-ccp - -.. note:: This setup requires the Compression Control Protocol (CCP) - being disabled, the command ``set vpn l2tp remote-access ppp-options disable-ccp`` - accomplishes that. - -Client ------- - -In this lab we use Windows PPPoE client. - -.. image:: /_static/images/lac-lns-winclient.jpg - :width: 100% - :align: center - :alt: Window PPPoE Client Configuration - -Monitoring ----------- - -Monitoring on LNS side - -.. code-block:: none - - vyos@vyos:~$ show l2tp-server sessions - ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes - --------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+---------- - l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB - -Monitoring on LAC side - -.. code-block:: none - - Router#show pppoe session - 1 session in FORWARDED (FWDED) State - 1 session total - Uniq ID PPPoE RemMAC Port VT VA State - SID LocMAC VA-st Type - 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED - 0c58.88ac.0001 - - Router#show l2tp - L2TP Tunnel and Session Information Total tunnels 1 sessions 1 - - LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ - Count VPDN Group - 23238 2640 LAC est 192.168.139.100 1 LAC - - LocID RemID TunID Username, Intf/ State Last Chg Uniq ID - Vcid, Circuit - 25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1 - -Monitoring on RADIUS Server side - -.. code-block:: none - - root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221 - Wed Feb 21 13:37:17 2024 - User-Name = "test@vyos.io" - NAS-Port = 0 - NAS-Port-Id = "l2tp0" - NAS-Port-Type = Virtual - Service-Type = Framed-User - Framed-Protocol = PPP - Calling-Station-Id = "192.168.139.101" - Called-Station-Id = "192.168.139.100" - Acct-Status-Type = Start - Acct-Authentic = RADIUS - Acct-Session-Id = "45c731e169d9a4f1" - Acct-Session-Time = 0 - Acct-Input-Octets = 0 - Acct-Output-Octets = 0 - Acct-Input-Packets = 0 - Acct-Output-Packets = 0 - Acct-Input-Gigawords = 0 - Acct-Output-Gigawords = 0 - Framed-IP-Address = 10.0.0.2 - NAS-IP-Address = 192.168.139.100 - Event-Timestamp = "Feb 21 2024 13:37:17 UTC" - Tmp-String-9 = "ai:" - Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318" - Timestamp = 1708522637 diff --git a/docs/configexamples/md-azure-vpn-bgp.md b/docs/configexamples/md-azure-vpn-bgp.md deleted file mode 100644 index 0b4132d8..00000000 --- a/docs/configexamples/md-azure-vpn-bgp.md +++ /dev/null @@ -1,134 +0,0 @@ ---- -lastproofread: '2021-06-28' ---- - -(examples-azure-vpn-bgp)= - -# Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) - -This guide shows an example of a route-based IKEv2 site-to-site VPN to -Azure using VTI and BGP for dynamic routing updates. - -For redundant / active-active configurations see -{ref}`examples-azure-vpn-dual-bgp` - -## Prerequisites - -- A pair of Azure VNet Gateways deployed in active-passive - configuration with BGP enabled. -- A local network gateway deployed in Azure representing - the Vyos device, matching the below Vyos settings except for - address space, which only requires the Vyos private IP, in - this example 10.10.0.5/32 -- A connection resource deployed in Azure linking the - Azure VNet gateway and the local network gateway representing - the Vyos device. - -## Example - -```{eval-rst} -+---------------------------------------+---------------------+ -| WAN Interface | eth0 | -+---------------------------------------+---------------------+ -| On-premises address space | 10.10.0.0/16 | -+---------------------------------------+---------------------+ -| Azure address space | 10.0.0.0/16 | -+---------------------------------------+---------------------+ -| Vyos public IP | 198.51.100.3 | -+---------------------------------------+---------------------+ -| Vyos private IP | 10.10.0.5 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway public IP | 203.0.113.2 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway BGP IP | 10.0.0.4 | -+---------------------------------------+---------------------+ -| Pre-shared key | ch00s3-4-s3cur3-psk | -+---------------------------------------+---------------------+ -| Vyos ASN | 64499 | -+---------------------------------------+---------------------+ -| Azure ASN | 65540 | -+---------------------------------------+---------------------+ -``` - -## Vyos configuration - -- Configure the IKE and ESP settings to match a subset - of those supported by Azure: - -```none -set vpn ipsec esp-group AZURE lifetime '3600' -set vpn ipsec esp-group AZURE mode 'tunnel' -set vpn ipsec esp-group AZURE pfs 'dh-group2' -set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' -set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' - -set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' -set vpn ipsec ike-group AZURE dead-peer-detection interval '15' -set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' -set vpn ipsec ike-group AZURE ikev2-reauth -set vpn ipsec ike-group AZURE key-exchange 'ikev2' -set vpn ipsec ike-group AZURE lifetime '28800' -set vpn ipsec ike-group AZURE proposal 1 dh-group '2' -set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' -set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' -``` - -- Enable IPsec on eth0 - -```none -set vpn ipsec interface 'eth0' -``` - -- Configure a VTI with a dummy IP address - -```none -set interfaces vti vti1 address '10.10.1.5/32' -set interfaces vti vti1 description 'Azure Tunnel' -``` - -- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. - -```none -set interfaces vti vti1 ip adjust-mss 1350 -``` - -- Configure the VPN tunnel - -```none -set vpn ipsec authentication psk azure id '198.51.100.3' -set vpn ipsec authentication psk azure id '203.0.113.2' -set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' -set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3' -set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' -set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond' -set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' -set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' -set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' -set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' -set vpn ipsec site-to-site peer azure remote-address '203.0.113.2' -set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' -set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' -``` - -- **Important**: Add an interface route to reach Azure's BGP listener - -```none -set protocols static route 10.0.0.4/32 interface vti1 -``` - -- Configure your BGP settings - -```none -set protocols bgp system-as 64499 -set protocols bgp neighbor 10.0.0.4 remote-as '65540' -set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' -set protocols bgp neighbor 10.0.0.4 timers holdtime '30' -set protocols bgp neighbor 10.0.0.4 timers keepalive '10' -``` - -- **Important**: Disable connected check - -```none -set protocols bgp neighbor 10.0.0.4 disable-connected-check -``` diff --git a/docs/configexamples/md-azure-vpn-dual-bgp.md b/docs/configexamples/md-azure-vpn-dual-bgp.md deleted file mode 100644 index e81b25f3..00000000 --- a/docs/configexamples/md-azure-vpn-dual-bgp.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -lastproofread: '2021-06-28' ---- - -(examples-azure-vpn-dual-bgp)= - -# Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) - -This guide shows an example of a redundant (active-active) route-based IKEv2 -site-to-site VPN to Azure using VTI -and BGP for dynamic routing updates. - -## Prerequisites - -- A pair of Azure VNet Gateways deployed in active-active - configuration with BGP enabled. -- A local network gateway deployed in Azure representing - the Vyos device, matching the below Vyos settings except for - address space, which only requires the Vyos private IP, in - this example 10.10.0.5/32 -- A connection resource deployed in Azure linking the - Azure VNet gateway and the local network gateway representing - the Vyos device. - -## Example - -```{eval-rst} -+---------------------------------------+---------------------+ -| WAN Interface | eth0 | -+---------------------------------------+---------------------+ -| On-premises address space | 10.10.0.0/16 | -+---------------------------------------+---------------------+ -| Azure address space | 10.0.0.0/16 | -+---------------------------------------+---------------------+ -| Vyos public IP | 198.51.100.3 | -+---------------------------------------+---------------------+ -| Vyos private IP | 10.10.0.5 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway 1 public IP | 203.0.113.2 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway 2 public IP | 203.0.113.3 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway BGP IP | 10.0.0.4,10.0.0.5 | -+---------------------------------------+---------------------+ -| Pre-shared key | ch00s3-4-s3cur3-psk | -+---------------------------------------+---------------------+ -| Vyos ASN | 64499 | -+---------------------------------------+---------------------+ -| Azure ASN | 65540 | -+---------------------------------------+---------------------+ -``` - -## Vyos configuration - -- Configure the IKE and ESP settings to match a subset - of those supported by Azure: - -```none -set vpn ipsec esp-group AZURE lifetime '3600' -set vpn ipsec esp-group AZURE mode 'tunnel' -set vpn ipsec esp-group AZURE pfs 'dh-group2' -set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' -set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' - -set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' -set vpn ipsec ike-group AZURE dead-peer-detection interval '15' -set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' -set vpn ipsec ike-group AZURE ikev2-reauth -set vpn ipsec ike-group AZURE key-exchange 'ikev2' -set vpn ipsec ike-group AZURE lifetime '28800' -set vpn ipsec ike-group AZURE proposal 1 dh-group '2' -set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' -set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' -``` - -- Enable IPsec on eth0 - -```none -set vpn ipsec interface 'eth0' -``` - -- Configure two VTIs with a dummy IP address each - -```none -set interfaces vti vti1 address '10.10.1.5/32' -set interfaces vti vti1 description 'Azure Primary Tunnel' - -set interfaces vti vti2 address '10.10.1.6/32' -set interfaces vti vti2 description 'Azure Secondary Tunnel' -``` - -- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. - -```none -set interfaces vti vti1 ip adjust-mss 1350 -set interfaces vti vti2 ip adjust-mss 1350 -``` - -- Configure the VPN tunnels - -```none -set vpn ipsec authentication psk azure id '198.51.100.3' -set vpn ipsec authentication psk azure id '203.0.113.2' -set vpn ipsec authentication psk azure id '203.0.113.3' -set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' - -set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3' -set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2' -set vpn ipsec site-to-site peer azure-primary connection-type 'respond' -set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL' -set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE' -set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit' -set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5' -set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2' -set vpn ipsec site-to-site peer azure-primary vti bind 'vti1' -set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE' - -set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3' -set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3' -set vpn ipsec site-to-site peer azure-secondary connection-type 'respond' -set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL' -set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE' -set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit' -set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5' -set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3' -set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2' -set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE' -``` - -- **Important**: Add an interface route to reach both Azure's BGP listeners - -```none -set protocols static route 10.0.0.4/32 interface vti1 -set protocols static route 10.0.0.5/32 interface vti2 -``` - -- Configure your BGP settings - -```none -set protocols bgp system-as 64499 -set protocols bgp neighbor 10.0.0.4 remote-as '65540' -set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' -set protocols bgp neighbor 10.0.0.4 timers holdtime '30' -set protocols bgp neighbor 10.0.0.4 timers keepalive '10' - -set protocols bgp neighbor 10.0.0.5 remote-as '65540' -set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound' -set protocols bgp neighbor 10.0.0.5 timers holdtime '30' -set protocols bgp neighbor 10.0.0.5 timers keepalive '10' -``` - -- **Important**: Disable connected check, otherwise the routes learned - from Azure will not be imported into the routing table. - -```none -set protocols bgp neighbor 10.0.0.4 disable-connected-check -set protocols bgp neighbor 10.0.0.5 disable-connected-check -``` diff --git a/docs/configexamples/md-bgp-ipv6-unnumbered.md b/docs/configexamples/md-bgp-ipv6-unnumbered.md deleted file mode 100644 index 4fa29834..00000000 --- a/docs/configexamples/md-bgp-ipv6-unnumbered.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -lastproofread: '2021-06-28' ---- - -(examples-bgp-ipv6-unnumbered)= - -# BGP IPv6 unnumbered with extended nexthop - -General information can be found in the {ref}`routing-bgp` chapter. - -## Configuration - -- Router A: - -```none -set protocols bgp system-as 64496 -set protocols bgp address-family ipv4-unicast redistribute connected -set protocols bgp address-family ipv6-unicast redistribute connected -set protocols bgp neighbor eth1 interface v6only -set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' -set protocols bgp neighbor eth2 interface v6only -set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' -set protocols bgp parameters bestpath as-path multipath-relax -set protocols bgp parameters bestpath compare-routerid -set protocols bgp parameters default no-ipv4-unicast -set protocols bgp parameters router-id '192.168.0.1' -set protocols bgp peer-group fabric address-family ipv4-unicast -set protocols bgp peer-group fabric address-family ipv6-unicast -set protocols bgp peer-group fabric capability extended-nexthop -set protocols bgp peer-group fabric remote-as 'external' -``` - -- Router B: - -```none -set protocols bgp system-as 64499 -set protocols bgp address-family ipv4-unicast redistribute connected -set protocols bgp address-family ipv6-unicast redistribute connected -set protocols bgp neighbor eth1 interface v6only -set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' -set protocols bgp neighbor eth2 interface v6only -set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' -set protocols bgp parameters bestpath as-path multipath-relax -set protocols bgp parameters bestpath compare-routerid -set protocols bgp parameters default no-ipv4-unicast -set protocols bgp parameters router-id '192.168.0.2' -set protocols bgp peer-group fabric address-family ipv4-unicast -set protocols bgp peer-group fabric address-family ipv6-unicast -set protocols bgp peer-group fabric capability extended-nexthop -set protocols bgp peer-group fabric remote-as 'external' -``` - - -## Results - -- Router A: - -```none -vyos@vyos:~$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 198.51.100.34/24 u/u -eth1 - u/u -eth2 - u/u -lo 127.0.0.1/8 u/u - 192.168.0.1/32 - ::1/128 -``` - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route - -S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53 -C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53 -C>* 192.168.0.1/32 is directly connected, lo, 03:21:56 -B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07 - * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07 -``` - -```none -vyos@vyos:~$ ping 192.168.0.2 -PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data. -64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms -64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms -64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms -64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms -64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms - ---- 192.168.0.2 ping statistics --- -5 packets transmitted, 5 received, 0% packet loss, time 4086ms -rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms -``` - -```none -vyos@vyos:~$ show ip bgp summary - -IPv4 Unicast Summary: -BGP router identifier 192.168.0.1, local AS number 64496 vrf-id 0 -BGP table version 4 -RIB entries 5, using 800 bytes of memory -Peers 2, using 41 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd -eth1 4 64499 13 13 0 0 0 00:05:33 2 -eth2 4 64499 13 14 0 0 0 00:05:29 2 - -Total number of neighbors 2 -``` - -- Router B: - -```none -vyos@vyos:~$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 198.51.100.33/24 u/u -eth1 - u/u -eth2 - u/u -lo 127.0.0.1/8 u/u - 192.168.0.2/32 - ::1/128 -``` - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route - -S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08 -C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09 -B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18 - * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18 -C>* 192.168.0.2/32 is directly connected, lo, 00:44:11 -``` - -```none -vyos@vyos:~$ ping 192.168.0.1 -PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. -64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms -64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms -64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms -64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms - ---- 192.168.0.1 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3051ms -rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms -``` - -```none -vyos@vyos:~$ show ip bgp summary -IPv4 Unicast Summary: -BGP router identifier 192.168.0.2, local AS number 64499 vrf-id 0 -BGP table version 4 -RIB entries 5, using 800 bytes of memory -Peers 2, using 41 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd -eth1 4 64496 14 14 0 0 0 00:06:40 2 -eth2 4 64496 14 14 0 0 0 00:06:37 2 - -Total number of neighbors 2 -``` diff --git a/docs/configexamples/md-firewall.md b/docs/configexamples/md-firewall.md deleted file mode 100644 index 1f6f0b9a..00000000 --- a/docs/configexamples/md-firewall.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -lastproofread: '2024-06-14' ---- - -# Firewall Examples - -This section contains examples of firewall configurations for various deployments. - -```{eval-rst} -.. toctree:: - :maxdepth: 2 - - fwall-and-vrf - zone-policy -``` diff --git a/docs/configexamples/md-fwall-and-vrf.md b/docs/configexamples/md-fwall-and-vrf.md deleted file mode 100644 index f1be96a2..00000000 --- a/docs/configexamples/md-fwall-and-vrf.md +++ /dev/null @@ -1,119 +0,0 @@ -# VRF and firewall example - -## Scenario and requirements - -This example shows how to configure a VyOS router with VRFs and firewall rules. - -Diagram used in this example: - -```{image} /_static/images/firewall-and-vrf-blueprints.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -As exposed in the diagram, there are four VRFs. These VRFs are `MGMT`, -`WAN`, `LAN` and `PROD`, and their requirements are: - -- VRF MGMT: - : - Allow connections to LAN and PROD. - - Deny connections to internet(WAN). - - Allow connections to the router. -- VRF LAN: - : - Allow connections to PROD. - - Allow connections to internet(WAN). -- VRF PROD: - : - Only accepts connections. -- VRF WAN: - : - Allow connection to PROD. - -## Configuration - -First, we need to configure the interfaces and VRFs: - -```none -set interfaces ethernet eth1 address '10.100.100.1/24' -set interfaces ethernet eth1 vrf 'MGMT' -set interfaces ethernet eth2 vif 150 address '10.150.150.1/24' -set interfaces ethernet eth2 vif 150 vrf 'LAN' -set interfaces ethernet eth2 vif 160 address '10.160.160.1/24' -set interfaces ethernet eth2 vif 160 vrf 'LAN' -set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24' -set interfaces ethernet eth2 vif 3500 vrf 'PROD' -set interfaces loopback lo -set interfaces pppoe pppoe0 authentication password 'p4ssw0rd' -set interfaces pppoe pppoe0 authentication username 'vyos' -set interfaces pppoe pppoe0 source-interface 'eth0' -set interfaces pppoe pppoe0 vrf 'WAN' -set vrf bind-to-all -set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' -set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' -set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' -set vrf name LAN table '103' -set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' -set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' -set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' -set vrf name MGMT table '102' -set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' -set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' -set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' -set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' -set vrf name PROD table '104' -set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' -set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' -set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' -set vrf name WAN table '101' -``` - -And before firewall rules are shown, we need to pay attention how to configure -and match interfaces and VRFs. In case where an interface is assigned to a -non-default VRF, if we want to use inbound-interface or outbound-interface in -firewall rules, we need to: - -- For **inbound-interface**: use the interface name with the VRF name, like - `MGMT` or `LAN`. -- For **outbound-interface**: use the interface name, like `eth0`, `vtun0`, - `eth2*` or similar. - -Next, we need to configure the firewall rules. First we will define all rules -for transit traffic between VRFs. - -```none -set firewall ipv4 forward filter default-action 'drop' -set firewall ipv4 forward filter default-log -set firewall ipv4 forward filter rule 10 action 'accept' -set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD' -set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT' -set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*' -set firewall ipv4 forward filter rule 99 action 'drop' -set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt' -set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1' -set firewall ipv4 forward filter rule 120 action 'accept' -set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD' -set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN' -set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500' -set firewall ipv4 forward filter rule 130 action 'accept' -set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet' -set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN' -set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0' -``` - -Also, we are adding global state policies, in order to allow established and -related traffic, in order not to drop valid responses: - -```none -set firewall global-options state-policy established action 'accept' -set firewall global-options state-policy invalid action 'drop' -set firewall global-options state-policy related action 'accept' -``` - -And finally, we need to allow input connections to the router itself only from -vrf MGMT: - -```none -set firewall ipv4 input filter default-action 'drop' -set firewall ipv4 input filter default-log -set firewall ipv4 input filter rule 10 action 'accept' -set firewall ipv4 input filter rule 10 description 'MGMT - Allow input' -set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT' -``` diff --git a/docs/configexamples/md-ha.md b/docs/configexamples/md-ha.md deleted file mode 100644 index 83e3b65e..00000000 --- a/docs/configexamples/md-ha.md +++ /dev/null @@ -1,545 +0,0 @@ ---- -lastproofread: '2021-06-28' ---- - -(example-high-availability)= - -# High Availability Walkthrough - -This document walks you through a complete HA setup of two VyOS machines. This -design is based on a VM as the primary router and a physical machine as a -backup, using VRRP, BGP, OSPF, and conntrack sharing. - -This document aims to walk you through setting everything up, so -at a point where you can reboot any machine and not lose more than a few -seconds worth of connectivity. - -## Design - -This is based on a real-life production design. One of the complex issues -is ensuring you have redundant data INTO your network. We do this with a pair -of Cisco Nexus switches and using Virtual PortChannels that are spanned across -them. As a bonus, this also allows for complete switch failure without -an outage. How you achieve this yourself is left as an exercise to the reader. -But our setup is documented here. - -### Walkthrough suggestion - -The `commit` command is implied after every section. If you make an error, -`commit` will warn you and you can fix it before getting too far into things. -Please ensure you commit early and commit often. - -If you are following through this document, it is strongly suggested you -complete the entire document, ONLY doing the virtual router1 steps, and then -come back and walk through it AGAIN on the backup hardware router. - -This ensures you don't go too fast or miss a step. However, it will make your -life easier to configure the fixed IP address and default route now on the -hardware router. - -### Example Network - -In this document, we have been allocated 203.0.113.0/24 by our upstream -provider, which we are publishing on VLAN100. - -They want us to establish a BGP session to their routers on 192.0.2.11 and -192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and -we are AS 65551. - -Our routers are going to have a floating IP address of 203.0.113.1, and use -.2 and .3 as their fixed IPs. - -We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201. - -When traffic is originated from the 10.200.201.0/24 network, it will be -masqueraded to 203.0.113.1 - -For connection between sites, we are running a WireGuard link to two REMOTE -routers and using OSPF over those links to distribute routes. That remote -site is expected to send traffic from anything in 10.201.0.0/16 - -### VLANs - -These are the vlans we will be using: - -- 50: Upstream, using the 192.0.2.0/24 network allocated by them. -- 100: 'Public' network, using our 203.0.113.0/24 network. -- 201: 'Internal' network, using 10.200.201.0/24 - -### Hardware - -- switch1 (Nexus 10gb Switch) -- switch2 (Nexus 10gb Switch) -- compute1 (VMware ESXi 6.5) -- compute2 (VMware ESXi 6.5) -- compute3 (VMware ESXi 6.5) -- router2 (Random 1RU machine with 4 NICs) - -Note that router1 is a VM that runs on one of the compute nodes. - -### Network Cabling - -- From Datacenter - This connects into port 1 on both switches, and is tagged - as VLAN 50 -- Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch -- Hardware Router - Port 8 of each switch -- compute1 - Port 9 of each switch -- compute2 - Port 10 of each switch -- compute3 - Port 11 of each switch - -This is ignoring the extra Out-of-band management networking, which should be -on totally different switches, and a different feed into the rack, and is out -of scope of this. - -:::{note} -Our implementation uses VMware's Distributed Port Groups, which allows -VMware to use LACP. This is a part of the ENTERPRISE licence, and is not -available on a free licence. If you are implementing this and do not have -access to DPGs, you should not use VMware, and use some other virtualization -platform instead. -::: - -## Basic Setup (via console) - -Create your router1 VM. So it can withstand a VM Host failing or a -network link failing. Using VMware, this is achieved by enabling vSphere DRS, -vSphere Availability, and creating a Distributed Port Group that uses LACP. - -Many other Hypervisors do this, and I'm hoping that this document will be -expanded to document how to do this for others. - -Create an 'All VLANs' network group, that passes all trunked traffic through -to the VM. Attach this network group to router1 as eth0. - -:::{note} -VMware: You must DISABLE SECURITY on this Port group. Make sure that -`Promiscuous Mode`, `MAC address changes` and `Forged transmits` are -enabled. All of these will be done as part of failover. -::: - -### Bonding on Hardware Router - -Create a LACP bond on the hardware router. We are assuming that eth0 and eth1 -are connected to port 8 on both switches, and that those ports are configured -as a Port-Channel. - -```none -set interfaces bonding bond0 description 'Switch Port-Channel' -set interfaces bonding bond0 hash-policy 'layer2' -set interfaces bonding bond0 member interface 'eth0' -set interfaces bonding bond0 member interface 'eth1' -set interfaces bonding bond0 mode '802.3ad' -``` - -### Assign external IP addresses - -VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this -is talking directly to upstream. Create our IP address on vlan50. - -For the hardware router, replace `eth0` with `bond0`. As (almost) every -command is identical, this will not be specified unless different things need -to be performed on different hosts. - -```none -set interfaces ethernet eth0 vif 50 address '192.0.2.21/24' -``` - -In this case, the hardware router has a different IP, so it would be - -```none -set interfaces ethernet bond0 vif 50 address '192.0.2.22/24' -``` - -### Add (temporary) default route - -It is assumed that the routers provided by upstream are capable of acting as a -default router, add that as a static route. - -```none -set protocols static route 0.0.0.0/0 next-hop 192.0.2.11 -commit -save -``` - -### Enable SSH - -Enable SSH so you can now SSH into the routers, rather than using the console. - -```none -set service ssh -commit -save -``` - -At this point, you should be able to SSH into both of them, and will no longer -need access to the console (unless you break something!) - -## VRRP Configuration - -We are setting up VRRP so that it does NOT fail back when a machine returns into -service, and it prioritizes router1 over router2. - -### Internal Network - -This has a floating IP address of 10.200.201.1/24, using virtual router ID 201. -The difference between them is the interface name, hello-source-address, and -peer-address. - -**router1** - -```none -set interfaces ethernet eth0 vif 201 address 10.200.201.2/24 -set high-availability vrrp group int hello-source-address '10.200.201.2' -set high-availability vrrp group int interface 'eth0.201' -set high-availability vrrp group int peer-address '10.200.201.3' -set high-availability vrrp group int no-preempt -set high-availability vrrp group int priority '200' -set high-availability vrrp group int address '10.200.201.1/24' -set high-availability vrrp group int vrid '201' -``` - -**router2** - -```none -set interfaces ethernet bond0 vif 201 address 10.200.201.3/24 -set high-availability vrrp group int hello-source-address '10.200.201.3' -set high-availability vrrp group int interface 'bond0.201' -set high-availability vrrp group int peer-address '10.200.201.2' -set high-availability vrrp group int no-preempt -set high-availability vrrp group int priority '100' -set high-availability vrrp group int address '10.200.201.1/24' -set high-availability vrrp group int vrid '201' -``` - -### Public Network - -This has a floating IP address of 203.0.113.1/24, using virtual router ID 113. -The virtual router ID is just a random number between 1 and 254, and can be set -to whatever you want. Best practices suggest you try to keep them unique -enterprise-wide. - -**router1** - -```none -set interfaces ethernet eth0 vif 100 address 203.0.113.2/24 -set high-availability vrrp group public hello-source-address '203.0.113.2' -set high-availability vrrp group public interface 'eth0.100' -set high-availability vrrp group public peer-address '203.0.113.3' -set high-availability vrrp group public no-preempt -set high-availability vrrp group public priority '200' -set high-availability vrrp group public address '203.0.113.1/24' -set high-availability vrrp group public vrid '113' -``` - -**router2** - -```none -set interfaces ethernet bond0 vif 100 address 203.0.113.3/24 -set high-availability vrrp group public hello-source-address '203.0.113.3' -set high-availability vrrp group public interface 'bond0.100' -set high-availability vrrp group public peer-address '203.0.113.2' -set high-availability vrrp group public no-preempt -set high-availability vrrp group public priority '100' -set high-availability vrrp group public address '203.0.113.1/24' -set high-availability vrrp group public vrid '113' -``` - -### Create VRRP sync-group - -The sync group is used to replicate connection tracking. It needs to be assigned -to a random VRRP group, and we are creating a sync group called `sync` using -the vrrp group `int`. - -```none -set high-availability vrrp sync-group sync member 'int' -``` - -### Testing - -At this point, you should be able to see both IP addresses when you run -`show interfaces`, and `show vrrp` should show both interfaces in MASTER -state (and SLAVE state on router2). - -```none -vyos@router1:~$ show vrrp -Name Interface VRID State Last Transition --------- ----------- ------ ------- ----------------- -int eth0.201 201 MASTER 100s -public eth0.100 113 MASTER 200s -vyos@router1:~$ -``` - -You should be able to ping to and from all the IPs you have allocated. - -## NAT and conntrack-sync - -Masquerade Traffic originating from 10.200.201.0/24 that is heading out the -public interface. - -:::{note} -We explicitly exclude the primary upstream network so that BGP or -OSPF traffic doesn't accidentally get NAT'ed. -::: - -```none -set nat source rule 10 destination address '!192.0.2.0/24' -set nat source rule 10 outbound-interface 'eth0.50' -set nat source rule 10 source address '10.200.201.0/24' -set nat source rule 10 translation address '203.0.113.1' -``` - -### Configure conntrack-sync and enable helpers - -Conntrack helper modules are enabled by default, but they tend to cause more -problems than they're worth in complex networks. You can disable all of them -at one go. - -```none -delete system conntrack modules -``` - -Now enable replication between nodes. Replace eth0.201 with bond0.201 on the -hardware router. - -```none -set service conntrack-sync accept-protocol 'tcp,udp,icmp' -set service conntrack-sync event-listen-queue-size '8' -set service conntrack-sync failover-mechanism vrrp sync-group 'sync' -set service conntrack-sync interface eth0.201 -set service conntrack-sync mcast-group '224.0.0.50' -set service conntrack-sync sync-queue-size '8' -``` - -(ha-contracktesting)= - -### Testing - -The simplest way to test is to look at the connection tracking stats on the -standby hardware router with the command `show conntrack-sync statistics`. -The numbers should be very close to the numbers on the primary router. - -When you have both routers up, you should be able to establish a connection -from a NAT'ed machine out to the internet, reboot the active machine, and that -connection should be preserved, and will not drop out. - -## OSPF Over WireGuard - -Wireguard doesn't have the concept of an up or down link, due to its design. -This complicates AND simplifies using it for network transport, as for reliable -state detection you need to use SOMETHING to detect when the link is down. - -If you use a routing protocol itself, you solve two problems at once. This is -only a basic example, and is provided as a starting point. - -### Configure Wireguard - -There is plenty of instructions and documentation on setting up Wireguard. The -only important thing you need to remember is to only use one WireGuard -interface per OSPF connection. - -We use small /30's from 10.254.60/24 for the point-to-point links. - -**router1** - -Replace the 203.0.113.3 with whatever the other router's IP address is. - -```none -set interfaces wireguard wg01 address '10.254.60.1/30' -set interfaces wireguard wg01 description 'router1-to-offsite1' -set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' -set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001' -set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' -set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' -set interfaces wireguard wg01 port '50001' -set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' -set protocols ospf interface wg01 cost '11' -set protocols ospf interface wg01 dead-interval '5' -set protocols ospf interface wg01 hello-interval '1' -set protocols ospf interface wg01 network 'point-to-point' -set protocols ospf interface wg01 priority '1' -set protocols ospf interface wg01 retransmit-interval '5' -set protocols ospf interface wg01 transmit-delay '1' -``` - -**offsite1** - -This is connecting back to the STATIC IP of router1, not the floating. - -```none -set interfaces wireguard wg01 address '10.254.60.2/30' -set interfaces wireguard wg01 description 'offsite1-to-router1' -set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0' -set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001' -set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15' -set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=' -set interfaces wireguard wg01 port '50001' -set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' -set protocols ospf interface wg01 cost '11' -set protocols ospf interface wg01 dead-interval '5' -set protocols ospf interface wg01 hello-interval '1' -set protocols ospf interface wg01 network 'point-to-point' -set protocols ospf interface wg01 priority '1' -set protocols ospf interface wg01 retransmit-interval '5' -set protocols ospf interface wg01 transmit-delay '1' -``` - -### Test WireGuard - -Make sure you can ping 10.254.60.1 and .2 from both routers. - -### Create Export Filter - -We only want to export the networks we know. Always do a whitelist on your route -filters, both importing and exporting. A good rule of thumb is -**'If you are not the default router for a network, don't advertise -it'**. This means we explicitly do not want to advertise the 192.0.2.0/24 -network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE -the default route for). This filter is applied to `redistribute connected`. -If we WERE to advertise it, the remote machines would see 192.0.2.21 available -via their default route, establish the connection, and then OSPF would say -'192.0.2.0/24 is available via this tunnel', at which point the tunnel would -break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via -default again. This is called 'flapping'. - -```none -set policy access-list 150 description 'Outbound OSPF Redistribution' -set policy access-list 150 rule 10 action 'permit' -set policy access-list 150 rule 10 destination any -set policy access-list 150 rule 10 source inverse-mask '0.0.0.255' -set policy access-list 150 rule 10 source network '10.200.201.0' -set policy access-list 150 rule 20 action 'permit' -set policy access-list 150 rule 20 destination any -set policy access-list 150 rule 20 source inverse-mask '0.0.0.255' -set policy access-list 150 rule 20 source network '203.0.113.0' -set policy access-list 150 rule 100 action 'deny' -set policy access-list 150 rule 100 destination any -set policy access-list 150 rule 100 source any -``` - -### Create Import Filter - -We only want to import networks we know. Our OSPF peer should only be -advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE -MATCH. You deny in access-list 100 to accept the route. - -```none -set policy access-list 100 description 'Inbound OSPF Routes from Peers' -set policy access-list 100 rule 10 action 'deny' -set policy access-list 100 rule 10 destination any -set policy access-list 100 rule 10 source inverse-mask '0.0.255.255' -set policy access-list 100 rule 10 source network '10.201.0.0' -set policy access-list 100 rule 100 action 'permit' -set policy access-list 100 rule 100 destination any -set policy access-list 100 rule 100 source any -set policy route-map PUBOSPF rule 100 action 'deny' -set policy route-map PUBOSPF rule 100 match ip address access-list '100' -set policy route-map PUBOSPF rule 500 action 'permit' -``` - -### Enable OSPF - -Every router **must** have a unique router-id. -The 'reference-bandwidth' is used because when OSPF was originally designed, -the idea of a link faster than 1gbit was unheard of, and it does not scale -correctly. - -```none -set protocols ospf area 0.0.0.0 authentication 'md5' -set protocols ospf area 0.0.0.0 network '10.254.60.0/24' -set protocols ospf auto-cost reference-bandwidth '10000' -set protocols ospf log-adjacency-changes -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.254.60.2' -set protocols ospf route-map PUBOSPF -``` - -### Test OSPF - -When you have enabled OSPF on both routers, you should be able to see each -other with the command `show ip ospf neighbour`. The state must be 'Full' -or '2-Way'. If it is not, then there is a network connectivity issue between the -hosts. This is often caused by NAT or MTU issues. You should not see any new -routes (unless this is the second pass) in the output of `show ip route` - -## Advertise connected routes - -As a reminder, only advertise routes that you are the default router for. This -is why we are NOT announcing the 192.0.2.0/24 network, because if that was -announced into OSPF, the other routers would try to connect to that network -over a tunnel that connects to that network! - -```none -set protocols ospf access-list 150 export 'connected' -set protocols ospf redistribute connected -``` - -You should now be able to see the advertised network on the other host. - -### Duplicate configuration - -At this point, you now need to create the X link between all four routers. -Use amdifferent /30 for each link. - -### Priorities - -Set the cost on the secondary links to be 200. This means that they will not -be used unless the primary links are down. - -```none -set protocols ospf interface wg01 cost '10' -set protocols ospf interface wg01 cost '200' -``` - -This will be visible in 'show ip route'. - -## BGP - -BGP is an extremely complex network protocol. An example is provided here. - -:::{note} -Router id's must be unique. -::: - -**router1** - -The `redistribute ospf` command is there purely as an example of how this can -be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as -it is not 203.0.113.0/24. - -```none -set policy prefix-list BGPOUT description 'BGP Export List' -set policy prefix-list BGPOUT rule 10 action 'deny' -set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' -set policy prefix-list BGPOUT rule 10 ge '25' -set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' -set policy prefix-list BGPOUT rule 100 action 'permit' -set policy prefix-list BGPOUT rule 100 description 'Our network' -set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' -set policy prefix-list BGPOUT rule 10000 action 'deny' -set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' - -set policy route-map BGPOUT description 'BGP Export Filter' -set policy route-map BGPOUT rule 10 action 'permit' -set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT' -set policy route-map BGPOUT rule 10000 action 'deny' -set policy route-map BGPPREPENDOUT description 'BGP Export Filter' -set policy route-map BGPPREPENDOUT rule 10 action 'permit' -set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' -set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT' -set policy route-map BGPPREPENDOUT rule 10000 action 'deny' - -set protocols bgp system-as 65551 -set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 -set protocols bgp address-family ipv4-unicast redistribute connected metric '50' -set protocols bgp address-family ipv4-unicast redistribute ospf metric '50' -set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT' -set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound -set protocols bgp neighbor 192.0.2.11 remote-as '65550' -set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21' -set protocols bgp parameters router-id '192.0.2.21' -``` - -**router2** - -This is identical, but you use the BGPPREPENDOUT route-map to advertise the -route with a longer path. diff --git a/docs/configexamples/md-index.md b/docs/configexamples/md-index.md deleted file mode 100644 index 78490de4..00000000 --- a/docs/configexamples/md-index.md +++ /dev/null @@ -1,59 +0,0 @@ -(examples)= - -# Configuration Blueprints - -This chapter contains various configuration examples: - -```{eval-rst} -.. toctree:: - :maxdepth: 2 - - firewall - bgp-ipv6-unnumbered - ospf-unnumbered - azure-vpn-bgp - azure-vpn-dual-bgp - ha - wan-load-balancing - pppoe-ipv6-basic - l3vpn-hub-and-spoke - lac-lns - inter-vrf-routing-vrf-lite - qos - segment-routing-isis - nmp - ipsec-cisco-policy-based - ipsec-cisco-route-based - ipsec-pa-route-based - -``` - -# Configuration Blueprints (autotest) - -The next pages contains automatic full tested configuration examples. - -Each lab will build an test from an external script. -The page content will generate, so changes will not take an effect. - -A host `vyos-oobm` will use as a ssh proxy. This host is just -necessary for the Lab test. - -The process will do the following steps: - -1. create the lab on a eve-ng server -2. configure each host in the lab -3. do some defined tests -4. optional do an upgrade to a higher version and do step 3 again. -5. generate the documentation and include files -6. shutdown and destroy the lab, if there is no error - -```{eval-rst} -.. toctree:: - :maxdepth: 1 - - autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE - autotest/tunnelbroker/tunnelbroker - autotest/L3VPN_EVPN/L3VPN_EVPN - autotest/Wireguard/Wireguard - autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP -``` diff --git a/docs/configexamples/md-inter-vrf-routing-vrf-lite.md b/docs/configexamples/md-inter-vrf-routing-vrf-lite.md deleted file mode 100644 index 50e666a9..00000000 --- a/docs/configexamples/md-inter-vrf-routing-vrf-lite.md +++ /dev/null @@ -1,798 +0,0 @@ -# Inter-VRF Routing over VRF Lite - -**Virtual Routing and Forwarding** is a technology that allow multiple instance -of a routing table to exist within a single device. One of the key aspect of -**VRFs** is that do not share the same routes or interfaces, therefore packets -are forwarded between interfaces that belong to the same VRF only. - -Any information related to a VRF is not exchanged between devices -or in the -same device- by default, this is a technique called **VRF-Lite**. - -Keep networks isolated is -in general- a good principle, but there are cases -where you might need that some network can access other in a different VRF. - -The scope of this document is to cover such cases in a dynamic way without the -use of MPLS-LDP. - -General information about L3VPNs can be found in the {ref}`configuration/vrf/index:L3VPN VRFs` chapter. - -## Overview - -Let’s say we have a requirement to have multiple networks. - -- LAN 1 -- LAN 2 -- Management -- Internet - -Both LANs have to be able to route between each other, both will have managed -devices through a dedicated management network and both will need Internet -access yet the LAN2 will need access to some set of outside networks, not all. -The management network will need access to both LANs but cannot have access -to/from the outside. - -This scenario could be a nightmare applying regular routing and might need -filtering in multiple interfaces. - -A simple solution could be using different routing tables, or VRFs -for all the networks so we can keep the routing restrictions. -But for us to route between the different VRFs we would need a cable or a -logical connection between each other: - -- One cable/logical connection between LAN1 and LAN2 -- One cable/logical connection between LAN1 and Internet -- One cable/logical connection between LAN2 and Internet -- One cable/logical connection between LAN1 and Management -- One cable/logical connection between LAN2 and Management - -As we can see this is unpractical. - -To address this scenario we will use to our advantage an extension of the BGP -routing protocol that will help us in the “Export” between VRFs without the -need for MPLS. - -MP-BGP or MultiProtocol BGP introduces two main concepts to solve this -limitation: -\- Route Distinguisher (RD): Is used to distinguish between different VRFs -–called VPNs- inside the BGP Process. The RD is appended to each IPv4 Network -that is advertised into BGP for that VPN making it a unique VPNv4 route. -\- Route Target (RT): This is an extended BGP community append to the VPNv4 route -in the Import/Export process. When a route passes from the VRF routing table -into the BGP process it will add the configured export extended community(ies) -for that VPN. When that route needs to go from BGP into the VRF routing table -will only pass if that given VPN import policy matches any of the appended -community(ies) into that prefix. - -## Topology - -```{image} /_static/images/inter-vrf-routing-vrf-lite.png -:align: center -:alt: Network Topology Diagram -:width: 70% -``` - -### IP Schema - -```{eval-rst} -+----------+------------+----------------+------------------+ -| Device-A | Device-B | IPv4 Network | IPv6 Network | -+----------+------------+----------------+------------------+ -| Core | LAN1 | 10.1.1.0/30 | 2001:db8::/127 | -+----------+------------+----------------+------------------+ -| Core | LAN2 | 172.16.2.0/30 | 2001:db8::2/127 | -+----------+------------+----------------+------------------+ -| Core | Management | 192.168.3.0/30 | 2001:db8::4/127 | -+----------+------------+----------------+------------------+ -| Core | ISP | 10.2.2.0/30 | 2001:db8::6/127 | -+----------+------------+----------------+------------------+ -``` - -### RD & RT Schema - -```{eval-rst} -+------------+-----------+-----------+ -| VRF | RD | RT | -+------------+-----------+-----------+ -| LAN1 | 64496:1 | 64496:1 | -+------------+-----------+-----------+ -| LAN2 | 64496:2 | 64496:2 | -+------------+-----------+-----------+ -| Management | 64496:50 | 64496:50 | -+------------+-----------+-----------+ -| Internet | 64496:100 | 64496:100 | -+------------+-----------+-----------+ -``` - -## Configurations - -:::{note} -We use a static route configuration in between the Core and each -LAN and Management router, and BGP between the Core router and the ISP router -but any dynamic routing protocol can be used. -::: - -### Remote Networks - -The following template configuration can be used in each remote router based -in our topology. - -```none -# Interface Configuration -set interface eth eth address - -# Static default route back to Core -set procotols static route 0.0.0.0/0 next-hop -``` - -### Core Router - -#### Step 1: VRF and Configurations to remote networks - -- Configuration - -Set the VRF name and Table ID, set interface address and bind it to the VRF. -Last add the static route to the remote network. - -```none -# VRF name and table ID (MANDATORY) -set vrf name table - -# Interface Configuration -set interface eth eth address - -# Assign interface to VRF -set interface eth eth vrf - -# Static route to remote Network -set vrf name protocols static route next-hop -``` - -- Verification - -Checking the routing table of the VRF should reveal both static and connected -entries active. A PING test between the Core and remote router is a way to -validate connectivity within the VRF. - -```none -# show ip route vrf -# show ipv6 route vrf - -vyos@Core:~$ show ip route vrf LAN1 -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF LAN1: -S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41 -C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44 - -vyos@Core:~$ show ipv6 route vrf LAN1 -Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF LAN1: -C>* 2001:db8::/127 is directly connected, eth0, 00:18:43 -S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03 -C>* fe80::/64 is directly connected, eth0, 00:18:43 - -# ping vrf - -vyos@Core:~$ ping 10.1.1.2 vrf LAN1 -PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data. -64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms -64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms -^C ---- 10.1.1.2 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1002ms -rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms -vyos@Core:~$ ping 10.0.0.1 vrf LAN1 -PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. -64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms -64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms -^C ---- 10.0.0.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1002ms -rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms - -vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1 -PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes -64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms -64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms -64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms -^C ---- 2001:db8:0:1::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2004ms -rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms -``` - -#### Step 2: BGP Configuration for VRF-Lite - -- Configuration - -Setting BGP global local-as as well inside the VRF. Redistribute static routes -to inject configured networks into the BGP process but still inside the VRF. - -```none -# set BGP global local-as -set protocols bgp system-as - -# set BGP VRF local-as and redistribution -set vrf name protocols bgp system-as -set vrf name protocols bgp address-family redistribute static -``` - -- Verification - -Check the BGP VRF table and verify if the static routes are injected showing -the correct next-hop information. - -```none -# show ip bgp vrf -# show bgp vrf ipv6 - -vyos@Core:~$ show ip bgp vrf LAN1 -BGP table version is 3, local router ID is 10.1.1.1, vrf id 8 -Default local pref 100, local AS 64496 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete -RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path -*> 10.0.0.0/24 10.1.1.2 0 32768 ? - -vyos@Core# run show bgp vrf LAN1 ipv6 -BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 -Default local pref 100, local AS 64496 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete -RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path -*> 2001:db8:0:1::/64 - 2001:db8::1 0 32768 ? -``` - -#### Step 3: VPN Configuration - -- Configuration - -Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT), then -we enable the export/import VPN. - -```none -# set Route-distinguisher -set vrf name protocols bgp address-family rd vpn export '' - -# set route-target for import/export -# Note: RT are a list that can be more than one community between apostrophe -# and separated by blank space. Ex: ' ' -set vrf name protocols bgp address-family route-target vpn export '' -set vrf name protocols bgp address-family route-target vpn import '' - -# Enable VPN export/import under this VRF -set vrf name protocols bgp address-family export vpn -set vrf name protocols bgp address-family import vpn -``` - -A key point to understand is that if we need two VRFs to communicate between -each other EXPORT rt from VRF1 has to be in the IMPORT rt list from VRF2. But -this is only in ONE direction, to complete the communication the EXPORT rt from -VRF2 has to be in the IMPORT rt list from VRF1. - -There are some cases where this is not needed -for example, in some -DDoS appliance- but most inter-vrf routing designs use the above configurations. - -- Verification - -After configured all the VRFs involved in this topology we take a deeper look -at both BGP and Routing table for the VRF LAN1 - -```none -# show ip bgp vrf -# show bgp vrf ipv6 - -vyos@Core# run show ip bgp vrf LAN1 -BGP table version is 53, local router ID is 10.1.1.1, vrf id 8 -Default local pref 100, local AS 64496 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete -RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path -*> 0.0.0.0/0 10.2.2.2@7< 0 64497 i -*> 10.0.0.0/24 10.1.1.2 0 32768 ? -*> 10.2.2.0/30 10.2.2.2@7< 0 0 64497 ? -*> 192.0.2.0/24 10.2.2.2@7< 0 0 64497 ? -*> 192.168.0.0/24 192.168.3.2@11< 0 32768 ? -*> 198.51.100.0/24 10.2.2.2@7< 0 0 64497 ? -*> 203.0.113.0/24 10.2.2.2@7< 0 0 64497 ? - -vyos@Core# run show bgp vrf LAN1 ipv6 -BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 -Default local pref 100, local AS 64496 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete -RPKI validation codes: V valid, I invalid, N Not found - -Network Next Hop Metric LocPrf Weight Path -*> ::/0 fe80::5200:ff:fe02:3@7< - 0 64497 i -*> 2001:db8::6/127 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? -*> 2001:db8:0:1::/64 - 2001:db8::1 0 32768 ? -*> 2001:db8:0:3::/64 - 2001:db8::5@11< 0 32768 ? -*> 2001:db8:1::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? -*> 2001:db8:2::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? -*> 2001:db8:3::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - - -# show ip route vrf -# show ipv6 route vrf - -vyos@Core:~$ show ip route vrf LAN1 -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF LAN1: -B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 -S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57 -C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59 -B 10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38 -B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38 -B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 -B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 -B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - -vyos@Core# run show ipv6 route vrf LAN1 -Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF LAN1: -B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -C>* 2001:db8::/127 is directly connected, eth0, 05:33:43 -B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03 -B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50 -B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -C>* fe80::/64 is directly connected, eth0, 05:33:43 -``` - -As we can see in the BGP table any imported route has been injected with a "@" -followed by the VPN id; In the routing table of the VRF, if the route was -installed, we can see -between round brackets- the exported VRF table. - -#### Step 4: End to End verification - -Now we perform some end-to-end testing - -- From Management to LAN1/LAN2 - -```none -vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1 -PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data. -64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms -64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms -64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms -^C ---- 10.0.0.1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2005ms -rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms -vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1 -PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data. -64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms -64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms -^C ---- 172.16.0.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1001ms -rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms -vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1 -PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes -64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms -64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms -64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms -^C ---- 2001:db8:0:1::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2003ms -rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms -vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1 -PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes -64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms -^C ---- 2001:db8:0:2::1 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3005ms -rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms -``` - -- From Management to Outside (fails as intended) - -```none -vyos@Management:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58 -C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05 -C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03 -vyos@Management:~$ ping 192.0.2.1 -PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data. -From 192.168.3.1 icmp_seq=1 Destination Net Unreachable -From 192.168.3.1 icmp_seq=2 Destination Net Unreachable -^C ---- 192.0.2.1 ping statistics --- -2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - -vyos@Management:~$ ping 195.51.100.1 -PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data. -From 192.168.3.1 icmp_seq=1 Destination Net Unreachable -From 192.168.3.1 icmp_seq=2 Destination Net Unreachable -From 192.168.3.1 icmp_seq=3 Destination Net Unreachable -^C ---- 195.51.100.1 ping statistics --- -3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms - -vyos@Management:~$ ping 2001:db8:1::1 -PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes -From 2001:db8::4 icmp_seq=1 Destination unreachable: No route -From 2001:db8::4 icmp_seq=2 Destination unreachable: No route -^C ---- 2001:db8:1::1 ping statistics --- -2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - -vyos@Management:~$ ping 2001:db8:2::1 -PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes -From 2001:db8::4 icmp_seq=1 Destination unreachable: No route -From 2001:db8::4 icmp_seq=2 Destination unreachable: No route -^C ---- 2001:db8:2::1 ping statistics --- -2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms -``` - -- LAN1 to Outside - -```none -vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1 -PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data. -64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms -64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms -64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms -^C ---- 192.0.2.1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2004ms -rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms -vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1 -PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data. -64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms -64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms -^C ---- 198.51.100.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1002ms -rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms -vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1 -PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data. -64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms -64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms -^C ---- 203.0.113.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1003ms -rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms -vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1 -PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes -64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms -64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms -64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms -^C ---- 2001:db8:1::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2004ms -rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms -vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1 -PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes -64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms -64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms -64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms -^C ---- 2001:db8:2::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2003ms -rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms -``` - -:::{note} -we are using "source-address" option cause we are not redistributing -connected interfaces into BGP on the Core router hence there is no comeback -route and ping will fail. -::: - -- LAN1 to LAN2 - -```none -vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1 -PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data. -64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms -64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms -^C ---- 172.16.0.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1002ms -rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms -vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1 -PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes -64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms -^C ---- 2001:db8:0:2::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2003ms -rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms -``` - -## Conclusions - -Inter-VRF routing is a well-known solution to address complex routing scenarios -that enable -in a dynamic way- to leak routes between VRFs. Is recommended to -take special consideration while designing route-targets and its application as -it can minimize future interventions while creating a new VRF will automatically -take the desired effect in its propagation. - -## Appendix-A - -### Full configuration from all devices - -- Core - -```none -set interfaces ethernet eth0 address '10.1.1.1/30' -set interfaces ethernet eth0 address '2001:db8::/127' -set interfaces ethernet eth0 vrf 'LAN1' -set interfaces ethernet eth1 address '172.16.2.1/30' -set interfaces ethernet eth1 address '2001:db8::2/127' -set interfaces ethernet eth1 vrf 'LAN2' -set interfaces ethernet eth2 address '192.168.3.1/30' -set interfaces ethernet eth2 address '2001:db8::4/127' -set interfaces ethernet eth2 vrf 'Management' -set interfaces ethernet eth3 address '10.2.2.1/30' -set interfaces ethernet eth3 address '2001:db8::6/127' -set interfaces ethernet eth3 vrf 'Internet' -set protocols bgp address-family ipv4-unicast -set protocols bgp system-as '64496' -set vrf name Internet protocols bgp address-family ipv4-unicast export vpn -set vrf name Internet protocols bgp address-family ipv4-unicast import vpn -set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' -set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' -set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' -set vrf name Internet protocols bgp address-family ipv6-unicast export vpn -set vrf name Internet protocols bgp address-family ipv6-unicast import vpn -set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' -set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' -set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' -set vrf name Internet protocols bgp system-as '64496' -set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast -set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497' -set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast -set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497' -set vrf name Internet table '104' -set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn -set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn -set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' -set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static -set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' -set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' -set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn -set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn -set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' -set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static -set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' -set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' -set vrf name LAN1 protocols bgp system-as '64496' -set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2 -set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1 -set vrf name LAN1 table '101' -set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn -set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn -set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' -set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static -set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' -set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' -set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn -set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn -set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' -set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static -set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' -set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' -set vrf name LAN2 protocols bgp system-as '64496' -set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2 -set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3 -set vrf name LAN2 table '102' -set vrf name Management protocols bgp address-family ipv4-unicast export vpn -set vrf name Management protocols bgp address-family ipv4-unicast import vpn -set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' -set vrf name Management protocols bgp address-family ipv4-unicast redistribute static -set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' -set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' -set vrf name Management protocols bgp address-family ipv6-unicast export vpn -set vrf name Management protocols bgp address-family ipv6-unicast import vpn -set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' -set vrf name Management protocols bgp address-family ipv6-unicast redistribute static -set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' -set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' -set vrf name Management protocols bgp system-as '64496' -set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2 -set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5 -set vrf name Management table '103' -``` - -- LAN1 - -```none -set interfaces dummy dum0 address '10.0.0.1/24' -set interfaces dummy dum0 address '2001:db8:0:1::1/64' -set interfaces ethernet eth0 address '10.1.1.2/30' -set interfaces ethernet eth0 address '2001:db8::1/127' -set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 -set protocols static route6 ::/0 next-hop 2001:db8::* -``` - -- LAN2 - -```none -set interfaces dummy dum0 address '172.16.0.1/24' -set interfaces dummy dum0 address '2001:db8:0:2::1/64' -set interfaces ethernet eth0 hw-id '50:00:00:03:00:00' -set interfaces ethernet eth1 address '172.16.2.2/30' -set interfaces ethernet eth1 address '2001:db8::3/127' -set protocols static route 0.0.0.0/0 next-hop 172.16.2.1 -set protocols static route6 ::/0 next-hop 2001:db8::2 -``` - -- Management - -```none -set interfaces dummy dum0 address '192.168.0.1/24' -set interfaces dummy dum0 address '2001:db8:0:3::1/64' -set interfaces ethernet eth2 address '192.168.3.2/30' -set interfaces ethernet eth2 address '2001:db8::5/127' -set protocols static route 0.0.0.0/0 next-hop 192.168.3.1 -set protocols static route6 ::/0 next-hop 2001:db8::4 -``` - -- ISP - -```none -set interfaces dummy dum0 address '192.0.2.1/24' -set interfaces dummy dum0 address '2001:db8:1::1/48' -set interfaces dummy dum1 address '198.51.100.1/24' -set interfaces dummy dum1 address '2001:db8:2::1/48' -set interfaces dummy dum2 address '203.0.113.1/24' -set interfaces dummy dum2 address '2001:db8:3::1/48' -set interfaces ethernet eth3 address '10.2.2.2/30' -set interfaces ethernet eth3 address '2001:db8::7/127' -set protocols bgp address-family ipv4-unicast redistribute connected -set protocols bgp address-family ipv6-unicast redistribute connected -set protocols bgp system-as '64497' -set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate -set protocols bgp neighbor 10.2.2.1 remote-as '64496' -set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate -set protocols bgp neighbor 2001:db8::6 remote-as '64496' -set protocols static route 0.0.0.0/0 next-hop 10.2.2.1 -set protocols static route6 ::/0 next-hop 2001:db8::6 -``` - -## Appendix-B - -### Route-Filtering - -When importing routes using MP-BGP it is possible to filter a subset of them -before are injected in the BGP table. One of the most common case is to use a -route-map with an prefix-list. - -- Configuration - -We create a prefix-list first and add all the routes we need to. - -```none -# set both ipv4 and ipv6 policies - -set policy prefix-list LAN2-Internet rule 1 action 'permit' -set policy prefix-list LAN2-Internet rule 1 le '24' -set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16' -set policy prefix-list LAN2-Internet rule 2 action 'permit' -set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24' -set policy prefix-list LAN2-Internet rule 3 action 'permit' -set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24' -set policy prefix-list LAN2-Internet rule 4 action 'permit' -set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24' - -set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit' -set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48' -set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit' -set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48' -set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit' -set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64' -set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' -set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' -``` - -Then add a route-map and reference to above prefix. Consider that the actions -taken inside the prefix will MATCH the routes that will be affected by the -actions inside the rules of the route-map. - -```none -set policy route-map LAN2-Internet rule 1 action 'permit' -set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet' - -set policy route-map LAN2-Internet-v6 rule 1 action 'permit' -set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-Internet-v6' -``` - -We are using a "white list" approach by allowing only what is necessary. In case -that need to implement a "black list" approach then you will need to change the -action in the route-map for a deny BUT you need to add a rule that permits the -rest due to the implicit deny in the route-map. - -Then we need to attach the policy to the BGP process. This needs to be under -the import statement in the vrf we need to filter. - -```none -set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet' -set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6' -``` - -- Verification - -```none -# show ip route vrf LAN2 - -B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28 -S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32 -C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39 -B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 -B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Managment), weight 1, 00:45:27 -B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 - -# show ipv6 route vrf LAN2 - -C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26 -B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17 -S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21 -B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Managment), weight 1, 00:46:16 -B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 -B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 -C>* fe80::/64 is directly connected, eth1, 00:46:27 -``` - -As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able -to select which routes are effectively imported and installed. diff --git a/docs/configexamples/md-ipsec-cisco-policy-based.md b/docs/configexamples/md-ipsec-cisco-policy-based.md deleted file mode 100644 index 2a12a252..00000000 --- a/docs/configexamples/md-ipsec-cisco-policy-based.md +++ /dev/null @@ -1,357 +0,0 @@ ---- -lastproofread: '2025-06-26' ---- - -(examples-ipsec-cisco-policy-based)= - -# Policy-based Site-to-Site VPN IPsec between VyOS and Cisco - -This document is to describe a basic setup using policy-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -Cisco IOS. Cisco initiates IPsec connection only if interesting -traffic present. For stable work we recommend configuring an -initiator role on VyOS side. - -## Network Topology - -```{image} /_static/images/cisco-vpn-ipsec.png -:align: center -:alt: Network Topology Diagram -``` - -## Prerequirements - -**VyOS:** - -```{eval-rst} -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ -``` - -**Cisco:** - -```{eval-rst} -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ -``` - -**IKE parameters:** - -```{eval-rst} -+-------------------+---------+ -| Encryption | AES-256 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 2 | -+-------------------+---------+ -``` - -**IPsec parameters:** - -```{eval-rst} -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ -``` - -**Traffic Selectors** - -: 192.168.0.0/24 \<==> 192.168.10.0/24 - - 192.168.1.0/24 \<==> 192.168.11.0/24 - -**Hosts configuration** - -```{eval-rst} -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ -``` - -## Configuration - -:::{note} -Pfs is disabled in Cisco by default. -::: - -### VyOS - -```none -set interfaces ethernet eth0 address '10.0.1.2/30' -set interfaces ethernet eth1 address '192.168.0.1/24' -set interfaces ethernet eth2 address '192.168.1.1/24' -set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 -set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' -set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' -set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' -set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' -set vpn ipsec esp-group ESP-GROUP lifetime '3600' -set vpn ipsec esp-group ESP-GROUP pfs 'disable' -set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' -set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' -set vpn ipsec ike-group IKE-GROUP close-action 'start' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' -set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' -set vpn ipsec ike-group IKE-GROUP lifetime '28800' -set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' -set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes256' -set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' -set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' -set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' -set vpn ipsec site-to-site peer CISCO connection-type 'initiate' -set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' -set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' -set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' -set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' -set vpn ipsec site-to-site peer CISCO tunnel 1 local prefix '192.168.0.0/24' -set vpn ipsec site-to-site peer CISCO tunnel 1 remote prefix '192.168.10.0/24' -set vpn ipsec site-to-site peer CISCO tunnel 2 local prefix '192.168.1.0/24' -set vpn ipsec site-to-site peer CISCO tunnel 2 remote prefix '192.168.11.0/24' -``` - -### Cisco - -```none -crypto ikev2 proposal aes-cbc-256-proposal - encryption aes-cbc-256 - integrity sha1 - group 14 -! -crypto ikev2 policy policy1 - match address local 10.0.2.2 - proposal aes-cbc-256-proposal -! -crypto ikev2 keyring keys - peer VyOS - address 10.0.1.2 - pre-shared-key local test - pre-shared-key remote test -! -crypto ikev2 profile IKEv2-profile - match identity remote address 10.0.1.2 255.255.255.255 - authentication remote pre-share - authentication local pre-share - keyring local keys - lifetime 28800 -! -crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac - mode tunnel -! -crypto map IPSEC-map 10 ipsec-isakmp - set peer 10.0.1.2 - set security-association lifetime seconds 3600 - set transform-set TS - set ikev2-profile IKEv2-profile - match address cryptoacl -! -interface GigabitEthernet0/0 - ip address 10.0.2.2 255.255.255.252 - crypto map IPSEC-map -! -interface GigabitEthernet0/1 - ip address 192.168.10.1 255.255.255.0 -! -interface GigabitEthernet0/2 - ip address 192.168.11.1 255.255.255.0 -! -ip route 0.0.0.0 0.0.0.0 10.0.2.1 -! -ip access-list extended cryptoacl - permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255 - permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255 -``` - -## Monitoring - -### Monitoring on VyOS side - -IKE SAs: - -```none -vyos@vyos:~$ show vpn ike sa -Peer ID / IP Local ID / IP ------------- ------------- -10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv2 AES_CBC_256 HMAC_SHA1_96 MODP_2048 no 304 26528 -``` - -IPsec SAs: - -```none -vyos@vyos:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal --------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- -CISCO-tunnel-1 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 -CISCO-tunnel-2 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 -``` - -### Monitoring on Cisco side - -IKE SAs: - -```none -Cisco#show crypto ikev2 sa - IPv4 Crypto IKEv2 SA - -Tunnel-id Local Remote fvrf/ivrf Status -1 10.0.2.2/4500 10.0.1.2/4500 none/none READY - Encr: AES-CBC, keysize: 256, PRF: SHA1, Hash: SHA96, DH Grp:14, Auth sign: PSK, Auth verify: PSK - Life/Active Time: 28800/471 sec - - IPv6 Crypto IKEv2 SA -``` - -IPsec SAs: - -```none - Cisco#show crypto ipsec sa - -interface: GigabitEthernet0/0 - Crypto map tag: IPSEC-map, local addr 10.0.2.2 - - protected vrf: (none) - local ident (addr/mask/prot/port): (192.168.11.0/255.255.255.0/0/0) - remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) - current_peer 10.0.1.2 port 4500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 - #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC81F83DA(3357508570) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x8C63C51E(2355348766) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 23, flow_id: SW:23, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4231729/3585) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC81F83DA(3357508570) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 24, flow_id: SW:24, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4231729/3585) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: - - protected vrf: (none) - local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0) - remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0) - current_peer 10.0.1.2 port 4500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 - #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC40C7A20(3289152032) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x2948B6CB(692631243) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 21, flow_id: SW:21, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4194891/3581) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC40C7A20(3289152032) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 22, flow_id: SW:22, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4194891/3581) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: -``` - -### Checking Connectivity - -ICMP packets from PC1 to PC3. - -```none -PC1> ping 192.168.10.2 - -84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms -84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms -84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms -84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms -84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms -``` - -ICMP packets from PC2 to PC4. - -```none -PC2> ping 192.168.11.2 - -84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms -84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms -84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms -``` diff --git a/docs/configexamples/md-ipsec-cisco-route-based.md b/docs/configexamples/md-ipsec-cisco-route-based.md deleted file mode 100644 index abd4fb3e..00000000 --- a/docs/configexamples/md-ipsec-cisco-route-based.md +++ /dev/null @@ -1,402 +0,0 @@ ---- -lastproofread: '2025-06-26' ---- - -(examples-ipsec-cisco-route-based)= - -# Route-based Site-to-Site VPN IPsec between VyOS and Cisco - -This document is to describe a basic setup using route-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -Cisco IOS. Cisco initiates IPsec connection only if interesting -traffic present. For stable work we recommend configuring an -initiator role on VyOS side. OSPF is selected as routing protocol -inside the tunnel. - -## Network Topology - -```{image} /_static/images/cisco-vpn-ipsec.png -:align: center -:alt: Network Topology Diagram -``` - -## Prerequirements - -**VyOS:** - -```{eval-rst} -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ -``` - -**Cisco:** - -```{eval-rst} -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ -``` - -**IKE parameters:** - -```{eval-rst} -+-------------------+---------+ -| Encryption | AES-128 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 1 | -+-------------------+---------+ -``` - -**IPsec parameters:** - -```{eval-rst} -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ -``` - -**Hosts configuration** - -```{eval-rst} -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ -``` - -## Configuration - -:::{note} -Pfs is disabled in Cisco by default. -::: - -### VyOS - -```none -set interfaces ethernet eth0 address '10.0.1.2/30' -set interfaces ethernet eth1 address '192.168.0.1/24' -set interfaces ethernet eth2 address '192.168.1.1/24' -set interfaces vti vti1 address '10.100.100.1/30' -set interfaces vti vti1 mtu '1438' -set protocols ospf area 0 network '10.100.100.0/30' -set protocols ospf area 0 network '192.168.0.0/24' -set protocols ospf area 0 network '192.168.1.0/24' -set protocols ospf interface eth1 passive -set protocols ospf interface eth2 passive -set protocols ospf interface vti1 network 'point-to-point' -set protocols ospf parameters router-id '2.2.2.2' -set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 -set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' -set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' -set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' -set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' -set vpn ipsec esp-group ESP-GROUP lifetime '3600' -set vpn ipsec esp-group ESP-GROUP pfs 'disable' -set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' -set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' -set vpn ipsec ike-group IKE-GROUP close-action 'start' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' -set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' -set vpn ipsec ike-group IKE-GROUP lifetime '28800' -set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' -set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' -set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' -set vpn ipsec options disable-route-autoinstall -set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' -set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' -set vpn ipsec site-to-site peer CISCO connection-type 'initiate' -set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' -set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' -set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' -set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' -set vpn ipsec site-to-site peer CISCO vti bind 'vti1' -``` - -### Cisco - -```none -crypto isakmp policy 10 - encr aes - authentication pre-share - group 14 - lifetime 28800 -crypto isakmp key test address 10.0.1.2 -! -! -crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac - mode transport -! -crypto ipsec profile IPsec-profile - set transform-set TS -! -! -! -! -! -! -! -interface Loopback0 - ip address 1.1.1.1 255.255.255.255 -! -interface Tunnel10 - ip address 10.100.100.2 255.255.255.252 - ip ospf network point-to-point - tunnel source GigabitEthernet0/0 - tunnel mode ipsec ipv4 - tunnel destination 10.0.1.2 - tunnel protection ipsec profile IPsec-profile -! -interface GigabitEthernet0/0 - ip address 10.0.2.2 255.255.255.252 - duplex auto - speed auto - media-type rj45 -! -interface GigabitEthernet0/1 - ip address 192.168.10.1 255.255.255.0 - duplex auto - speed auto - media-type rj45 -! -interface GigabitEthernet0/2 - ip address 192.168.11.1 255.255.255.0 - duplex auto - speed auto - media-type rj45 -! -router ospf 1 - router-id 1.1.1.1 - passive-interface GigabitEthernet0/1 - passive-interface GigabitEthernet0/2 - network 10.100.100.0 0.0.0.3 area 0 - network 192.168.10.0 0.0.0.255 area 0 - network 192.168.11.0 0.0.0.255 area 0 -! -ip route 0.0.0.0 0.0.0.0 10.0.2.1 -``` - -## Monitoring - -### Monitoring on VyOS side - -IKE SAs: - -```none -vyos@vyos:~$ show vpn ike sa -Peer ID / IP Local ID / IP ------------- ------------- -10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 8175 18439 -``` - -IPsec SAs: - -```none -vyos@vyos:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- -CISCO-vti up 34m59s 17K/14K 224/213 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 -``` - -OSPF Neighbor Status: - -```none -vyos@vyos:~$ show ip ospf neighbor - -Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL -1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 -``` - -Routing Table: - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - -S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54 -C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59 -L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59 -O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50 -C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50 -L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50 -O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54 -C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59 -L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59 -O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54 -C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59 -L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59 -O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 -O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 -``` - -### Monitoring on Cisco side - -IKE SAs: - -```none -Cisco#show crypto isakmp sa -IPv4 Crypto ISAKMP SA -dst src state conn-id status -10.0.1.2 10.0.2.2 QM_IDLE 1002 ACTIVE - -IPv6 Crypto ISAKMP SA -``` - -IPsec SAs: - -```none -Cisco#show crypto ipsec sa - -interface: Tunnel10 - Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2 - - protected vrf: (none) - local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) - remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) - current_peer 10.0.1.2 port 500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295 - #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC3E9B307(3286872839) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x2740C328(658555688) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0 - sa timing: remaining key lifetime (k/sec): (4173824/1401) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC3E9B307(3286872839) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0 - sa timing: remaining key lifetime (k/sec): (4173819/1401) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: -``` - -OSPF Neighbor Status: - -```none -Cisco# show ip ospf neighbor - -Neighbor ID Pri State Dead Time Address Interface -2.2.2.2 0 FULL/ - 00:00:35 10.100.100.1 Tunnel10 -``` - -Routing Table: - -```none -Cisco#show ip route -Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP - D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area - N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 - E1 - OSPF external type 1, E2 - OSPF external type 2 - i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 - ia - IS-IS inter area, * - candidate default, U - per-user static route - o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP - a - application route - + - replicated route, % - next hop override, p - overrides from PfR - -Gateway of last resort is 10.0.2.1 to network 0.0.0.0 - -S* 0.0.0.0/0 [1/0] via 10.0.2.1 - 1.0.0.0/32 is subnetted, 1 subnets -C 1.1.1.1 is directly connected, Loopback0 - 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks -C 10.0.2.0/30 is directly connected, GigabitEthernet0/0 -L 10.0.2.2/32 is directly connected, GigabitEthernet0/0 -C 10.100.100.0/30 is directly connected, Tunnel10 -L 10.100.100.2/32 is directly connected, Tunnel10 -O 192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 -O 192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 - 192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks -C 192.168.10.0/24 is directly connected, GigabitEthernet0/1 -L 192.168.10.1/32 is directly connected, GigabitEthernet0/1 - 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks -C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 -L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 -``` - -### Checking Connectivity - -ICMP packets from PC1 to PC3. - -```none -PC1> ping 192.168.10.2 - -84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms -84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms -84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms -84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms -84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms -``` - -ICMP packets from PC2 to PC4. - -```none -PC2> ping 192.168.11.2 - -84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms -84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms -84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms -``` diff --git a/docs/configexamples/md-ipsec-pa-route-based.md b/docs/configexamples/md-ipsec-pa-route-based.md deleted file mode 100644 index ce21a9d3..00000000 --- a/docs/configexamples/md-ipsec-pa-route-based.md +++ /dev/null @@ -1,420 +0,0 @@ ---- -lastproofread: '2025-06-26' ---- - -(examples-ipsec-pa-route-based)= - -# Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto - -This document is to describe a basic setup using route-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -PA 11.0.0. OSPF is selected as routing protocol inside the -tunnel. - -Since this example focuses on IPsec configuration it does not -include firewall configuration. - -## Network Topology - -```{image} /_static/images/ipsec-vyos-pa.png -:align: center -:alt: Network Topology Diagram -``` - -## Prerequirements - -**VyOS:** - -```{eval-rst} -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ -``` - -**Cisco:** - -```{eval-rst} -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ -``` - -**IKE parameters:** - -```{eval-rst} -+-------------------+---------+ -| Encryption | AES-128 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 1 | -+-------------------+---------+ -``` - -**IPsec parameters:** - -```{eval-rst} -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ -``` - -**Hosts configuration** - -```{eval-rst} -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ -``` - -## Configuration - -### VyOS - -```none -set interfaces ethernet eth0 address '10.0.1.2/30' -set interfaces ethernet eth1 address '192.168.0.1/24' -set interfaces ethernet eth2 address '192.168.1.1/24' -set interfaces vti vti1 address '10.100.100.1/30' -set interfaces vti vti1 mtu '1438' -set protocols ospf area 0 network '10.100.100.0/30' -set protocols ospf area 0 network '192.168.0.0/24' -set protocols ospf area 0 network '192.168.1.0/24' -set protocols ospf interface eth1 passive -set protocols ospf interface eth2 passive -set protocols ospf interface vti1 network 'point-to-point' -set protocols ospf parameters router-id '2.2.2.2' -set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 -set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' -set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' -set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' -set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' -set vpn ipsec esp-group ESP-GROUP lifetime '3600' -set vpn ipsec esp-group ESP-GROUP pfs 'disable' -set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' -set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' -set vpn ipsec ike-group IKE-GROUP close-action 'start' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' -set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' -set vpn ipsec ike-group IKE-GROUP lifetime '28800' -set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' -set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' -set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' -set vpn ipsec options disable-route-autoinstall -set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' -set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' -set vpn ipsec site-to-site peer CISCO connection-type 'initiate' -set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' -set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' -set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' -set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' -set vpn ipsec site-to-site peer CISCO vti bind 'vti1' -``` - -### Palo Alto - -GUI Configuration: - -: Network -> Network Profiles -> IKE Crypto - - ```{image} /_static/images/PA-IKE-group.png - :align: center - ``` - - Network -> Network Profiles -> IKE Gateways - - ```{image} /_static/images/PA-IKE-GW-1.png - :align: center - ``` - - ```{image} /_static/images/PA-IKE-GW-2.png - :align: center - ``` - - Network -> Network Profiles -> IPSec Crypto - - ```{image} /_static/images/PA-ESP-group.png - :align: center - ``` - - Network -> Interfaces - - ```{image} /_static/images/PA-tunnel-1.png - :align: center - ``` - - ```{image} /_static/images/PA-tunnel-2.png - :align: center - ``` - - ```{image} /_static/images/PA-tunnel-3.png - :align: center - ``` - - Network -> IPSec Tunnels - - ```{image} /_static/images/PA-IPsec-tunnel.png - :align: center - ``` - -CLI configuration with OSPF: - -```none -set network interface ethernet ethernet1/1 layer3 ip 10.0.2.2/30 -set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow -set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24 -set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow -set network interface ethernet ethernet1/3 layer3 ip 192.168.11.1/24 -set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow -set network interface tunnel units tunnel.1 ip 10.100.100.2/30 -set network interface tunnel units tunnel.1 interface-management-profile Allow -set network interface tunnel units tunnel.1 mtu 1438 -set network profiles interface-management-profile Allow ping yes -set network ike crypto-profiles ike-crypto-profiles IKE-GROUP hash sha1 -set network ike crypto-profiles ike-crypto-profiles IKE-GROUP dh-group group14 -set network ike crypto-profiles ike-crypto-profiles IKE-GROUP encryption aes-128-cbc -set network ike crypto-profiles ike-crypto-profiles IKE-GROUP lifetime seconds 28800 -set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp authentication sha256 -set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp encryption aes-256-cbc -set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP lifetime seconds 3600 -set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP dh-group no-pfs -set network ike gateway VyOS authentication pre-shared-key key test -set network ike gateway VyOS protocol ikev1 dpd enable yes -set network ike gateway VyOS protocol ikev1 exchange-mode main -set network ike gateway VyOS protocol ikev1 ike-crypto-profile IKE-GROUP -set network ike gateway VyOS protocol ikev2 dpd enable yes -set network ike gateway VyOS protocol version ikev1 -set network ike gateway VyOS protocol-common nat-traversal enable yes -set network ike gateway VyOS protocol-common fragmentation enable no -set network ike gateway VyOS protocol-common passive-mode yes -set network ike gateway VyOS local-address interface ethernet1/1 -set network ike gateway VyOS peer-address ip 10.0.1.2 -set network ike gateway VyOS local-id id 10.0.2.2 -set network ike gateway VyOS local-id type ipaddr -set network ike gateway VyOS peer-id id 10.0.1.2 -set network ike gateway VyOS peer-id type ipaddr -set network tunnel ipsec VyOS-tunnel auto-key ike-gateway VyOS -set network tunnel ipsec VyOS-tunnel auto-key ipsec-crypto-profile ESP-GROUP -set network tunnel ipsec VyOS-tunnel tunnel-monitor enable no -set network tunnel ipsec VyOS-tunnel tunnel-interface tunnel.1 -set network tunnel ipsec VyOS-tunnel anti-replay no -set network virtual-router default protocol ospf enable yes -set network virtual-router default protocol ospf area 0.0.0.0 type normal -set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 enable yes -set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 passive no -set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 link-type p2p -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 enable yes -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 passive yes -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 link-type broadcast -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 enable yes -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 passive yes -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 link-type broadcast -set network virtual-router default protocol ospf router-id 1.1.1.1 -set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] -``` - -## Monitoring - -### Monitoring on VyOS side - -IKE SAs: - -```none -vyos@vyos:~$ show vpn ike sa -Peer ID / IP Local ID / IP ------------- ------------- -10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 1372 25802 -``` - -IPsec SAs: - -```none -vyos@vyos:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- -PA-vti up 23m27s 9K/10K 149/151 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 -``` - -OSPF Neighbor Status: - -```none -vyos@vyos:~$ show ip ospf neighbor - -Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL -1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 -``` - -Routing Table: - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:27:30 -C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:27:34 -L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:27:34 -O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:24:34 -C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:24:34 -L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:24:34 -O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:27:29 -C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:27:34 -L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:27:34 -O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:27:29 -C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:27:34 -L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:27:34 -O>* 192.168.10.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 -O>* 192.168.11.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 -``` - -### Monitoring on Cisco side - -IKE SAs: - -```none -admin@PA-VM> show vpn ike-sa - -IKEv1 phase-1 SAs -GwID/client IP Peer-Address Gateway Name Role Mode Algorithm Established Expiration V ST Xt Phase2 --------------- ------------ ------------ ---- ---- --------- ----------- ---------- - -- -- ------ -1 10.0.1.2 VyOS Resp Main PSK/DH14/A128/SHA1 Jul.31 01:35:00 Jul.31 09:35:00 v1 13 1 1 - -Show IKEv1 IKE SA: Total 1 gateways found. 1 ike sa found. - - -IKEv1 phase-2 SAs -Gateway Name TnID Tunnel GwID/IP Role Algorithm SPI(in) SPI(out) MsgID ST Xt ------------- ---- ------ ------- ---- --------- ------- -------- ----- -- -- -VyOS 1 VyOS-tunnel 1 Resp ESP/ /tunl/SHA2 8827A3D9 C204F4FA BD202829 9 1 - -Show IKEv1 phase2 SA: Total 1 gateways found. 1 ike sa found. - - -There is no IKEv2 SA found. -``` - -IPsec SAs: - -```none -admin@PA-VM> show vpn ipsec-sa - -GwID/client IP TnID Peer-Address Tunnel(Gateway) Algorithm SPI(in) SPI(out) life(Sec/KB) remain-time(Sec) --------------- ---- ------------ --------------- --------- ------- -------- ------------ ---------------- -1 1 10.0.1.2 VyOS-tunnel(VyOS) ESP/A256/SHA256 8827A3D9 C204F4FA 3600/Unlimited 2733 - -Show IPSec SA: Total 1 tunnels found. 1 ipsec sa found. -``` - -OSPF Neighbor Status: - -```none -admin@PA-VM> show routing protocol ospf neighbor - - Options: 0x80:reserved, O:Opaq-LSA capability, DC:demand circuits, EA:Ext-Attr LSA capability, - N/P:NSSA option, MC:multicase, E:AS external LSA capability, T:TOS capability - ========== - virtual router: default - neighbor address: 10.100.100.1 - local address binding: 0.0.0.0 - type: dynamic - status: full - neighbor router ID: 2.2.2.2 - area id: 0.0.0.0 - neighbor priority: 1 - lifetime remain: 32 - messages pending: 0 - LSA request pending: 0 - options: 0x02: E - hello suppressed: no - restart helper status: not helping - restart helper time remaining: 0 - restart helper exit reason: none -``` - -Routing Table: - -```none -admin@PA-VM> show routing route - -flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, - Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast - - -VIRTUAL ROUTER: default (id 1) - ========== -destination nexthop metric flags age interface next-AS -0.0.0.0/0 10.0.2.1 10 A S ethernet1/1 -10.0.2.0/30 10.0.2.2 0 A C ethernet1/1 -10.0.2.2/32 0.0.0.0 0 A H -10.100.100.0/30 0.0.0.0 10 Oi 1273 tunnel.1 -10.100.100.0/30 10.100.100.2 0 A C tunnel.1 -10.100.100.2/32 0.0.0.0 0 A H -192.168.0.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 -192.168.1.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 -192.168.10.0/24 0.0.0.0 10 Oi 1273 ethernet1/2 -192.168.10.0/24 192.168.10.1 0 A C ethernet1/2 -192.168.10.1/32 0.0.0.0 0 A H -192.168.11.0/24 0.0.0.0 10 Oi 1273 ethernet1/3 -192.168.11.0/24 192.168.11.1 0 A C ethernet1/3 -192.168.11.1/32 0.0.0.0 0 A H -total routes shown: 14 -``` - -### Checking Connectivity - -ICMP packets from PC1 to PC3. - -```none -PC1> ping 192.168.10.2 - -84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms -84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms -84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms -84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms -84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms -``` - -ICMP packets from PC2 to PC4. - -```none -PC2> ping 192.168.11.2 - -84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms -84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms -84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms -``` diff --git a/docs/configexamples/md-l3vpn-hub-and-spoke.md b/docs/configexamples/md-l3vpn-hub-and-spoke.md deleted file mode 100644 index bdd62ada..00000000 --- a/docs/configexamples/md-l3vpn-hub-and-spoke.md +++ /dev/null @@ -1,1094 +0,0 @@ -# L3VPN for Hub-and-Spoke connectivity with VyOS - -IP/MPLS technology is widely used by various service providers and large -enterprises in order to achieve better network scalability, manageability -and flexibility. It also provides the possibility to deliver different -services for the customers in a seamless manner. -Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered -through OSI layer 3 networking technologies. Often the border gateway -protocol (BGP) is used to send and receive VPN-related data that is -responsible for the control plane. L3VPN utilizes virtual routing and -forwarding (VRF) techniques to receive and deliver user data as well as -separate data planes of the end-users. It is built using a combination of -IP- and MPLS-based information. Generally, L3VPNs are used to send data -on back-end VPN infrastructures, such as for VPN connections between data -centres, HQs and branches. - -An L3VPN consists of multiple access links, multiple VPN routing and -forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs. -An L3VPN can be configured to connect two or more customer sites. -In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have -unique Route Distinguishers (RDs). In order to use the hub site as a -transit point for connectivity in such an environment, the spoke sites -export their routes to the hub. Spokes can talk to hubs, but never have -direct paths to other spokes. All traffic between spokes is controlled -and delivered over the hub site. - -To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple -requirements in order to properly implement the solution. -We'll use the following nodes in our LAB environment: - -- 2 x Route reflectors (VyOS-RRx) -- 4 x Provider routers (VyOS-Px) -- 3 x Provider Edge (VyOs-PEx) -- 3 x Customer Edge (VyOS-CEx) - -The following software was used in the creation of this document: - -- Operating system: VyOS -- Version: 1.4-rolling-202110310317 -- Image name: vyos-1.4-rolling-202110310317-amd64.iso - -**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) -– The configurations below are specifically for VyOS 1.4.x. - -General information can be found in the {ref}`configuration/vrf/index:L3VPN VRFs` chapter. - -## Topology - -```{image} /_static/images/L3VPN_hub_and_spoke.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -## How does it work? - -As we know the main assumption of L3VPN “Hub and Spoke” is, that the traffic -between spokes have to pass via hub, in our scenario VyOS-PE2 is the Hub PE -and the VyOS-CE1-HUB is the central customer office device that is responsible -for controlling access between all spokes and announcing its network prefixes -(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its -own Route-Distinguisher(RD) and route-target import/export lists. -Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to -the nodes across network where PEs Spokes import the route-target 60535:1030 -(this is export route-target of vrf BLUE_HUB) and export its own route-target -60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the -Customer edge nodes can only learn the network prefixes of the HUB site -[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes -[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. -Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network -routes exchange and minimize iBGP peerings between devices. - -L3VPN configuration parameters table: - -```{eval-rst} -+----------+-------+------------+-----------------+-------------+-------------+ -| Node | Role | VRF | RD | RT import | RT export | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE2 | Hub | BLUE_HUB | 10.80.80.1:1011 | 65035:1011 | 65035:1030 | -| | | | | 65035:1030 | | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030 | 65035:1011 | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030 | 65035:1011 | -+----------+-------+------------+-----------------+-------------+-------------+ -``` - -## Configuration - -### Step-1: Configuring IGP and enabling MPLS LDP - -At the first step we need to configure the IP/MPLS backbone network using OSPF -as IGP protocol and LDP as label-switching protocol for the base connectivity -between **P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R** -(eflector) nodes: - -- VyOS-P1: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.3/32' -set interfaces ethernet eth0 address '172.16.30.1/24' -set interfaces ethernet eth1 address '172.16.40.1/24' -set interfaces ethernet eth2 address '172.16.90.1/24' -set interfaces ethernet eth3 address '172.16.10.1/24' -set interfaces ethernet eth5 address '172.16.100.1/24' - -# protocols ospf+ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set protocols mpls interface 'eth5' -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp interface 'eth3' -set protocols mpls ldp interface 'eth5' -set protocols mpls ldp router-id '10.0.0.3' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.3 -``` - -- VyOS-P2: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.4/32' -set interfaces ethernet eth0 address '172.16.30.2/24' -set interfaces ethernet eth1 address '172.16.20.1/24' -set interfaces ethernet eth2 address '172.16.120.1/24' -set interfaces ethernet eth3 address '172.16.60.1/24' - -# protocols ospf+ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp interface 'eth3' -set protocols mpls ldp router-id '10.0.0.4' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.4' -``` - -- VyOS-P3: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.5/32' -set interfaces ethernet eth0 address '172.16.110.1/24' -set interfaces ethernet eth1 address '172.16.40.2/24' -set interfaces ethernet eth2 address '172.16.50.1/24' -set interfaces ethernet eth3 address '172.16.70.1/24' - -# protocols ospf + ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp interface 'eth3' -set protocols mpls ldp router-id '10.0.0.5' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.5' -``` - -- VyOS-P4: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.6/32' -set interfaces ethernet eth0 address '172.16.80.2/24' -set interfaces ethernet eth1 address '172.16.130.1/24' -set interfaces ethernet eth2 address '172.16.50.2/24' -set interfaces ethernet eth3 address '172.16.60.2/24' -set interfaces ethernet eth5 address '172.16.140.1/24' - - -# protocols ospf + ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set protocols mpls interface 'eth0' -set protocols mpls interface 'eth5' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp interface 'eth3' -set protocols mpls ldp interface 'eth5' -set protocols mpls ldp router-id '10.0.0.6' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.6' -``` - -- VyOS-PE1: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.7/32' -set interfaces ethernet eth0 address '172.16.90.2/24' - -# protocols ospf + ldp -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp router-id '10.0.0.7' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.7' -``` - -- VyOS-PE2: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.8/32' -set interfaces ethernet eth0 address '172.16.110.2/24' -set interfaces ethernet eth1 address '172.16.100.2/24' -set interfaces ethernet eth2 address '172.16.80.1/24' - -# protocols ospf + ldp -set protocols mpls interface 'eth0' -set protocols mpls interface 'eth1' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp router-id '10.0.0.8' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.8' -``` - -- VyOS-PE3: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.10/32' -set interfaces ethernet eth0 address '172.16.140.2/24' - -# protocols ospf + ldp -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp router-id '10.0.0.10' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.10' -``` - -- VyOS-RR1: - -```none -# interfaces -set interfaces ethernet eth1 address '172.16.20.2/24' -set interfaces ethernet eth2 address '172.16.10.2/24' -set interfaces dummy dum10 address '10.0.0.1/32' - -# protocols ospf + ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp router-id '10.0.0.1' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.1' -``` - -- VyOS-RR2: - -```none -# interfaces -set interfaces ethernet eth0 address '172.16.80.1/24' -set interfaces ethernet eth1 address '172.16.70.2/24' -set interfaces dummy dum10 address '10.0.0.2/32' - -# protocols ospf + ldp -set protocols mpls interface 'eth0' -set protocols mpls interface 'eth1' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp router-id '10.0.0.2' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.2' -``` - -### Step-2: Configuring iBGP for L3VPN control-plane - -At this step we are going to enable iBGP protocol on MPLS nodes and -Route Reflectors (two routers for redundancy) that will deliver IPv4 -VPN (L3VPN) routes between them: - -- VyOS-RR1: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' -set protocols bgp parameters cluster-id '10.0.0.1' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.1' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - -- VyOS-RR2: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' -set protocols bgp parameters cluster-id '10.0.0.1' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.2' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - -- VyOS-PE1: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.7' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - -- VyOS-PE2: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.8' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - -- VyOS-PE3: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.10' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - -### Step-3: Configuring L3VPN VRFs on PE nodes - -This section provides configuration steps for setting up VRFs on our -PE nodes including CE facing interfaces, BGP, rd and route-target -import/export based on the pre-defined parameters. - -- VyOS-PE1: - -```none -# VRF settings -set vrf name BLUE_SPOKE table '200' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' -set vrf name BLUE_SPOKE protocols bgp system-as '65001' -set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override -set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035' - -# interfaces -set interfaces ethernet eth3 address '10.50.50.1/24' -set interfaces ethernet eth3 vrf 'BLUE_SPOKE' -``` - -- VyOS-PE2: - -```none -# VRF settings -set vrf name BLUE_HUB table '400' -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' -set vrf name BLUE_HUB protocols bgp system-as '65001' -set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override -set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035' - -# interfaces -set interfaces ethernet eth3 address '10.80.80.1/24' -set interfaces ethernet eth3 vrf 'BLUE_HUB' -``` - -- VyOS-PE3: - -```none -# VRF settings -set vrf name BLUE_SPOKE table '200' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' -set vrf name BLUE_SPOKE protocols bgp system-as '65001' -set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override -set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035' - -# interfaces -set interfaces ethernet eth3 address '10.60.60.1/24' -set interfaces ethernet eth3 vrf 'BLUE_SPOKE' -``` - -### Step-4: Configuring CE nodes - -Dynamic routing used between CE and PE nodes and eBGP peering -established for the route exchanging between them. All routes -received by PEs are then exported to L3VPN and delivered from -Spoke sites to Hub and vise-versa based on previously -configured L3VPN parameters. - -- VyOS-CE1-SPOKE: - -```none -# interfaces -set interfaces dummy dum20 address '10.0.0.80/32' -set interfaces ethernet eth0 address '10.50.50.2/24' - -# BGP for peering with PE -set protocols bgp system-as 65035 -set protocols bgp address-family ipv4-unicast network 10.0.0.80/32 -set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2' -set protocols bgp neighbor 10.50.50.1 remote-as '65001' -set protocols bgp neighbor 10.50.50.1 update-source 'eth0' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.50.50.2' -``` - -- VyOS-CE1-HUB: - -```none -# interfaces -set interfaces dummy dum20 address '10.0.0.100/32' -set interfaces ethernet eth0 address '10.80.80.2/24' - -# BGP for peering with PE -set protocols bgp system-as 65035 -set protocols bgp address-family ipv4-unicast network 10.0.0.100/32 -set protocols bgp address-family ipv4-unicast redistribute connected -set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2' -set protocols bgp neighbor 10.80.80.1 remote-as '65001' -set protocols bgp neighbor 10.80.80.1 update-source 'eth0' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.80.80.2' -``` - -- VyOS-CE2-SPOKE: - -```none -# interfaces -set interfaces dummy dum20 address '10.0.0.90/32' -set interfaces ethernet eth0 address '10.60.60.2/24' - -# BGP for peering with PE -set protocols bgp system-as 65035 -set protocols bgp address-family ipv4-unicast network 10.0.0.90/32 -set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2' -set protocols bgp neighbor 10.60.60.1 remote-as '65001' -set protocols bgp neighbor 10.60.60.1 update-source 'eth0' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.60.60.2' -``` - -### Step-5: Verification - -This section describes verification commands for MPLS/BGP/LDP -protocols and L3VPN related routes as well as diagnosis and -reachability checks between CE nodes. - -Let’s check IPv4 routing and MPLS information on provider nodes -(same procedure for all P nodes): - -- “show ip ospf neighbor” for checking ospf relationship - -```none -vyos@VyOS-P1:~$ show ip ospf neighbor - -Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL -10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 -10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 -10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 -10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 -10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 -``` - -- “show mpls ldp neighbor “ for checking ldp neighbors - -```none -vyos@VyOS-P1:~$ show mpls ldp neighbor -AF ID State Remote Address Uptime -ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h -ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h -ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h -ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h -ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h -``` - -- “show mpls ldp binding” for checking mpls label assignment - -```none -vyos@VyOS-P1:~$ show mpls ldp discovery -AF Destination Nexthop Local Label Remote Label In Use -ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes -ipv4 10.0.0.1/32 10.0.0.4 23 20 no -ipv4 10.0.0.1/32 10.0.0.5 23 17 no -ipv4 10.0.0.1/32 10.0.0.7 23 16 no -ipv4 10.0.0.1/32 10.0.0.8 23 16 no -ipv4 10.0.0.2/32 10.0.0.1 20 16 no -ipv4 10.0.0.2/32 10.0.0.4 20 22 no -ipv4 10.0.0.2/32 10.0.0.5 20 24 yes -ipv4 10.0.0.2/32 10.0.0.7 20 17 no -ipv4 10.0.0.2/32 10.0.0.8 20 17 no -ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no -ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no -ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no -ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no -ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no -ipv4 10.0.0.4/32 10.0.0.1 16 18 no -ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes -ipv4 10.0.0.4/32 10.0.0.5 16 19 no -ipv4 10.0.0.4/32 10.0.0.7 16 19 no -ipv4 10.0.0.4/32 10.0.0.8 16 19 no -ipv4 10.0.0.5/32 10.0.0.1 21 19 no -ipv4 10.0.0.5/32 10.0.0.4 21 17 no -ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes -ipv4 10.0.0.5/32 10.0.0.7 21 20 no -ipv4 10.0.0.5/32 10.0.0.8 21 20 no -ipv4 10.0.0.6/32 10.0.0.1 17 20 no -ipv4 10.0.0.6/32 10.0.0.4 17 23 yes -ipv4 10.0.0.6/32 10.0.0.5 17 21 yes -ipv4 10.0.0.6/32 10.0.0.7 17 21 no -ipv4 10.0.0.6/32 10.0.0.8 17 21 no -ipv4 10.0.0.7/32 10.0.0.1 22 21 no -ipv4 10.0.0.7/32 10.0.0.4 22 18 no -ipv4 10.0.0.7/32 10.0.0.5 22 20 no -ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes -ipv4 10.0.0.7/32 10.0.0.8 22 22 no -ipv4 10.0.0.8/32 10.0.0.1 24 22 no -ipv4 10.0.0.8/32 10.0.0.4 24 19 no -ipv4 10.0.0.8/32 10.0.0.5 24 16 no -ipv4 10.0.0.8/32 10.0.0.7 24 22 no -ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes -ipv4 10.0.0.9/32 10.0.0.1 18 23 no -ipv4 10.0.0.9/32 10.0.0.4 18 21 yes -ipv4 10.0.0.9/32 10.0.0.5 18 22 no -ipv4 10.0.0.9/32 10.0.0.7 18 23 no -ipv4 10.0.0.9/32 10.0.0.8 18 23 no -ipv4 10.0.0.10/32 10.0.0.1 19 24 no -ipv4 10.0.0.10/32 10.0.0.4 19 24 yes -ipv4 10.0.0.10/32 10.0.0.5 19 23 yes -ipv4 10.0.0.10/32 10.0.0.7 19 24 no -ipv4 10.0.0.10/32 10.0.0.8 19 24 no -``` - -Now we’re checking iBGP status and routes from route-reflector -nodes to other devices: - -- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors: - -```none -vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary -BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0 -BGP table version 0 -RIB entries 9, using 1728 bytes of memory -Peers 4, using 85 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 -10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 -10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 -10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 - -Total number of neighbors 4 -``` - -- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information: - -```none -vyos@VyOS-RR1:~$ show bgp ipv4 vpn -BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 -Default local pref 100, local AS 65001 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path -Route Distinguisher: 10.50.50.1:1011 -*>i10.50.50.0/24 10.0.0.7 0 100 0 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 -*>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 -Route Distinguisher: 10.60.60.1:1011 -*>i10.60.60.0/24 10.0.0.10 0 100 0 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 -*>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 -Route Distinguisher: 10.80.80.1:1011 -*>i10.80.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 -*>i100.100.100.100/32 - 10.0.0.8 0 100 0 65035 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 -Route Distinguisher: 172.16.80.1:2011 -*>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 -*>i172.16.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 -Route Distinguisher: 172.16.100.1:2011 -*>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 -*>i172.16.100.0/24 10.0.0.9 0 100 0 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 -``` - -- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected - for specific VPNv4 destination - -```none -vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32 -BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 -not allocated -Paths: (1 available, best #1) - Advertised to non peer-group peers: - 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 - 65035, (Received from a RR-client) - 10.0.0.8 from 10.0.0.8 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:65035:1030 - Remote label: 80 - Last update: Tue Oct 19 13:45:32 202 -``` - -Also we can verify how PE devices receives VPNv4 networks from the RRs -and installing them to the specific customer VRFs: - -- “show bgp ipv4 vpn summary” for checking iBGP neighbors against - route-reflector devices: - -```none -vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary -BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0 -BGP table version 0 -RIB entries 9, using 1728 bytes of memory -Peers 2, using 43 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 -10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 -``` - -- “show bgp vrf all” for checking all the prefix learning on BGP - : within VRFs: - -```none -vyos@VyOS-PE1:~$ show bgp vrf all - -Instance default: -No BGP prefixes displayed, 0 exist - -Instance BLUE_SPOKE: -BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 -Default local pref 100, local AS 65001 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path -* 10.50.50.0/24 0.0.0.0 0 32768 ? -*> 0.0.0.0 0 32768 i -*> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i -* 10.0.0.8@0< 0 100 0 i -*> 10.0.0.80/32 10.50.50.2 0 0 65035 i -*> 10.0.0.100/32 - 10.0.0.8@0< 0 100 0 65035 ? -* 10.0.0.8@0< 0 100 0 65035 ? -``` - -- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor - : information between PE and CE: - -```none -vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary - - -IPv4 Unicast Summary: -BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6 -BGP table version 8 -RIB entries 7, using 1344 bytes of memory -Peers 1, using 21 KiB of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 - -Total number of neighbors 1 -``` - -- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. - : Using this command we are also able to check the transport and - customer label (inner/outer) for Hub network prefix (10.0.0.100/32): - -```none -vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE - -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - -VRF BLUE_SPOKE: -K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h -C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h -B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 -B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m -B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 -``` - -- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the - : specific VPNv4 destination including extended community and - remotelabel information. This procedure is the same on all Spoke nodes: - -```none -vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32 -BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 -not allocated -Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.8 from 10.0.0.1 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Tue Oct 19 13:45:26 2021 - 65035 - 10.0.0.8 from 10.0.0.2 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Wed Oct 13 12:39:34 202 -``` - -Now, let’s check routing information on out Hub PE: - -- “show bgp ipv4 vpn summary” for checking iBGP neighbors again - : VyOS-RR1/RR2 - -```none -vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary -BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0 -BGP table version 0 -RIB entries 9, using 1728 bytes of memory -Peers 2, using 43 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 -10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 - -Total number of neighbors -``` - -- “show bgp vrf all” for checking all the prefixes learning on BGP - -```none -vyos@VyOS-PE2:~$ show bgp vrf all - -Instance default: -No BGP prefixes displayed, 0 exist - -Instance BLUE_HUB: -BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 -Default local pref 100, local AS 65001 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path -*> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i -* 10.0.0.7@0< 0 100 0 i -*> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i -* 10.0.0.10@0< 0 100 0 i -* 10.80.80.0/24 10.80.80.2 0 0 65035 ? -* 0.0.0.0 0 32768 i -*> 0.0.0.0 0 32768 ? -*> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i -*> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i -* 10.0.0.9@0< 0 100 0 65050 i -*> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i -* 10.0.0.7@0< 0 100 0 65035 i -*> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i -* 10.0.0.10@0< 0 100 0 65035 i -*> 10.0.0.100/32 - 10.80.80.2 0 0 65035 ? -*> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? - 0.0.0.0@9< 0 32768 i -*> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i -* 10.0.0.9@0< 0 100 0 i -``` - -- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor - : CE Hub device - -```none -vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary - -IPv4 Unicast Summary: -BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8 -BGP table version 50 -RIB entries 19, using 3648 bytes of memory -Peers 1, using 21 KiB of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 -``` - -- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. - : With this command we are able to check the transport and - customer label (inner/outer) for network spokes prefixes - 10.0.0.80/32 - 10.0.0.90/32 - -```none -vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup -VRF BLUE_HUB: -K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h -B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 -B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 -C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h -B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h -B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 -B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 -B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 -B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h -B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h -B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 -``` - -- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, - : extended community and remote label of specific destination - -```none -vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32 -BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32 -not allocated -Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.7 from 10.0.0.1 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 - 65035 - 10.0.0.7 from 10.0.0.2 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:39:37 2021 - -vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 -BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 -not allocated -Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.10 from 10.0.0.1 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 - 65035 - 10.0.0.10 from 10.0.0.2 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:45:44 2021 -``` - -Finally, let’s check the reachability between CEs: - -- VyOS-CE1-SPOKE -----> VyOS-CE-HUB - -```none -# check rib -vyos@VyOS-CE1-SPOKE:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - -B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m -C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h -B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m -C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h -B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m - -# check icmp -vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80 -PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data. -64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms -64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms -64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms -64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms -^C ---- 10.0.0.100 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 8ms -rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms - -# check network path -vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100 -traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets - 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms - 2 * * * - 3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m -``` - -- VyOS-CE-HUB -------> VyOS-CE1-SPOKE -- VyOS-CE-HUB -------> VyOS-CE2-SPOKE - -```none -# check rib -vyos@VyOS-CE-HUB:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - -B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m -B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m -C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h -B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h -B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m -B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m -B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m -C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h -B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h -B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - -# check icmp -vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4 -PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data. -64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms -64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms -64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms -64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms - ---- 10.0.0.80 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 9ms -rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms - -vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4 -PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data. -64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms -64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms -64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms -^C ---- 10.0.0.90 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 6ms -rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms - -# check network path -vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80 -traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets - 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms - 2 * * * - 3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms - -vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90 -traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets - 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms - 2 * * * - 3 * * * - 4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms -``` - -- VyOS-CE2-SPOKE -------> VyOS-CE-HUB - -```none -# check rib -vyos@rt-ce2-SPOKE:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - -B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h -C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h -B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m -C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h -B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m - -# check icmp -vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4 -PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data. -64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms -64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms -64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms -64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms - ---- 10.0.0.100 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 9ms -rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms - -# check network path -vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100 -traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets - 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms - 2 * * * - 3 * * * - 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms -``` - -**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll see * * * for the transit routers of the mpls backbone. diff --git a/docs/configexamples/md-lac-lns.md b/docs/configexamples/md-lac-lns.md deleted file mode 100644 index 5bf5edb2..00000000 --- a/docs/configexamples/md-lac-lns.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -lastproofread: '2024-02-21' ---- - -(examples-lac-lns)= - -# PPPoE over L2TP - -This document is to describe a basic setup using PPPoE over L2TP. -LAC and LNS are components of the broadband topology. -LAC - L2TP access concentrator -LNS - L2TP Network Server -LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and -forward them to LNS. LNS is the termination point that comes from PPP packets -from the remote client. - -In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC. -All users with domain **vyos.io** will be tunneled to LNS via L2TP. - -## Network Topology - -```{image} /_static/images/lac-lns-diagram.jpg -:align: center -:alt: Network Topology Diagram -:width: 60% -``` - -## Configurations - -### LAC - -```none -aaa new-model -! -aaa authentication ppp default local -! -vpdn enable -vpdn aaa attribute nas-ip-address vpdn-nas -! -vpdn-group LAC - request-dialin - protocol l2tp - domain vyos.io - initiate-to ip 192.168.139.100 - source-ip 192.168.139.101 - local name LAC - l2tp tunnel password 0 test123 -! -bba-group pppoe MAIN-BBA - virtual-template 1 -! -interface GigabitEthernet0/0 - description To LNS - ip address 192.168.139.101 255.255.255.0 - duplex auto - speed auto - media-type rj45 -! -interface GigabitEthernet0/1 - description To PPPoE clients - no ip address - duplex auto - speed auto - media-type rj45 - pppoe enable group MAIN-BBA -! -interface Virtual-Template1 - description pppoe MAIN-BBA - no ip address - no peer default ip address - ppp mtu adaptive - ppp authentication chap -! -``` - -### LNS - -```none -set interfaces ethernet eth0 address '192.168.139.100/24' -set nat source rule 100 outbound-interface name 'eth0' -set nat source rule 100 source address '10.0.0.0/24' -set nat source rule 100 translation address 'masquerade' -set protocols static route 0.0.0.0/0 next-hop 192.168.139.2 -set vpn l2tp remote-access authentication mode 'radius' -set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest' -set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100' -set vpn l2tp remote-access default-pool 'TEST-POOL' -set vpn l2tp remote-access gateway-address '10.0.0.1' -set vpn l2tp remote-access lns host-name 'LAC' -set vpn l2tp remote-access lns shared-secret 'test123' -set vpn l2tp remote-access name-server '8.8.8.8' -set vpn l2tp remote-access ppp-options disable-ccp -``` - -:::{note} -This setup requires the Compression Control Protocol (CCP) -being disabled, the command `set vpn l2tp remote-access ppp-options disable-ccp` -accomplishes that. -::: - -### Client - -In this lab we use Windows PPPoE client. - -```{image} /_static/images/lac-lns-winclient.jpg -:align: center -:alt: Window PPPoE Client Configuration -:width: 100% -``` - -### Monitoring - -Monitoring on LNS side - -```none -vyos@vyos:~$ show l2tp-server sessions - ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes ---------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+---------- - l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB -``` - -Monitoring on LAC side - -```none -Router#show pppoe session - 1 session in FORWARDED (FWDED) State - 1 session total -Uniq ID PPPoE RemMAC Port VT VA State - SID LocMAC VA-st Type - 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED - 0c58.88ac.0001 - -Router#show l2tp -L2TP Tunnel and Session Information Total tunnels 1 sessions 1 - -LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ - Count VPDN Group -23238 2640 LAC est 192.168.139.100 1 LAC - -LocID RemID TunID Username, Intf/ State Last Chg Uniq ID - Vcid, Circuit -25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1 -``` - -Monitoring on RADIUS Server side - -```none -root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221 -Wed Feb 21 13:37:17 2024 - User-Name = "test@vyos.io" - NAS-Port = 0 - NAS-Port-Id = "l2tp0" - NAS-Port-Type = Virtual - Service-Type = Framed-User - Framed-Protocol = PPP - Calling-Station-Id = "192.168.139.101" - Called-Station-Id = "192.168.139.100" - Acct-Status-Type = Start - Acct-Authentic = RADIUS - Acct-Session-Id = "45c731e169d9a4f1" - Acct-Session-Time = 0 - Acct-Input-Octets = 0 - Acct-Output-Octets = 0 - Acct-Input-Packets = 0 - Acct-Output-Packets = 0 - Acct-Input-Gigawords = 0 - Acct-Output-Gigawords = 0 - Framed-IP-Address = 10.0.0.2 - NAS-IP-Address = 192.168.139.100 - Event-Timestamp = "Feb 21 2024 13:37:17 UTC" - Tmp-String-9 = "ai:" - Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318" - Timestamp = 1708522637 -``` diff --git a/docs/configexamples/md-nmp.md b/docs/configexamples/md-nmp.md deleted file mode 100644 index 71855f89..00000000 --- a/docs/configexamples/md-nmp.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -lastproofread: '2023-03-26' ---- - -(examples-nmp)= - -# NMP example - -Consider how to quickly set up NMP and VyOS for monitoring. -NMP is multi-vendor network monitoring from 'SolarWinds' built to scale and expand with the needs of your network. - -## Configuration 'VyOS' - -First prepare our VyOS router for connection to NMP. We have to set up the SNMP protocol and connectivity between the router and NMP. - -```none -set interfaces ethernet eth0 address 'dhcp' -set system name-server '8.8.8.8' -set service snmp community router authorization 'test' -set service snmp community router network '0.0.0.0/0' -``` - -## Configuration 'NMP' - -Next, you just should follow the pictures: - -```{image} /_static/images/nmp1.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp2.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp3.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp4.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp5.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp6.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp7.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -In the end, you'll get a powerful instrument for monitoring the VyOS systems. diff --git a/docs/configexamples/md-ospf-unnumbered.md b/docs/configexamples/md-ospf-unnumbered.md deleted file mode 100644 index 9174d1b4..00000000 --- a/docs/configexamples/md-ospf-unnumbered.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -lastproofread: '2021-06-29' ---- - -(examples-ospf-unnumbered)= - -# OSPF unnumbered with ECMP - -General information can be found in the {ref}`routing-ospf` chapter. - -## Configuration - -- Router A: - -```none -set interfaces ethernet eth0 address '10.0.0.1/24' -set interfaces ethernet eth1 address '192.168.0.1/32' -set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' -set interfaces ethernet eth1 ip ospf network 'point-to-point' -set interfaces ethernet eth2 address '192.168.0.1/32' -set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' -set interfaces ethernet eth2 ip ospf network 'point-to-point' -set interfaces loopback lo address '192.168.0.1/32' -set protocols ospf area 0.0.0.0 authentication 'md5' -set protocols ospf area 0.0.0.0 network '192.168.0.1/32' -set protocols ospf parameters router-id '192.168.0.1' -set protocols ospf redistribute connected -``` - -- Router B: - -```none -set interfaces ethernet eth0 address '10.0.0.2/24' -set interfaces ethernet eth1 address '192.168.0.2/32' -set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' -set interfaces ethernet eth1 ip ospf network 'point-to-point' -set interfaces ethernet eth2 address '192.168.0.2/32' -set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' -set interfaces ethernet eth2 ip ospf network 'point-to-point' -set interfaces loopback lo address '192.168.0.2/32' -set protocols ospf area 0.0.0.0 authentication 'md5' -set protocols ospf area 0.0.0.0 network '192.168.0.2/32' -set protocols ospf parameters router-id '192.168.0.2' -set protocols ospf redistribute connected -``` - - -## Results - -- Router A: - -```none -vyos@vyos:~$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 10.0.0.1/24 u/u -eth1 192.168.0.1/32 u/u -eth2 192.168.0.1/32 u/u -lo 127.0.0.1/8 u/u - 192.168.0.1/32 - ::1/128 -``` - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - -S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 -O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21 - via 192.168.0.2, eth2 onlink, 00:13:21 -C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 -O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53 -C * 192.168.0.1/32 is directly connected, eth2, 00:56:31 -C * 192.168.0.1/32 is directly connected, eth1, 00:56:31 -C>* 192.168.0.1/32 is directly connected, lo, 00:57:36 -O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03 - * via 192.168.0.2, eth2 onlink, 00:29:03 -``` - -- Router B: - -```none -vyos@vyos:~$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 10.0.0.2/24 u/u -eth1 192.168.0.2/32 u/u -eth2 192.168.0.2/32 u/u -lo 127.0.0.1/8 u/u - 192.168.0.2/32 - ::1/128 -``` - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - -S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 -O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21 - via 192.168.0.1, eth2 onlink, 00:13:21 -C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 -O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53 -C * 192.168.0.2/32 is directly connected, eth2, 00:56:31 -C * 192.168.0.2/32 is directly connected, eth1, 00:56:31 -C>* 192.168.0.2/32 is directly connected, lo, 00:57:36 -O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03 - * via 192.168.0.1, eth2 onlink, 00:29:03 -``` diff --git a/docs/configexamples/md-pppoe-ipv6-basic.md b/docs/configexamples/md-pppoe-ipv6-basic.md deleted file mode 100644 index 9b1503f3..00000000 --- a/docs/configexamples/md-pppoe-ipv6-basic.md +++ /dev/null @@ -1,111 +0,0 @@ ---- -lastproofread: '2021-06-29' ---- - -(examples-pppoe-ipv6-basic)= - -# PPPoE IPv6 Basic Setup for Home Network - -This document is to describe a basic setup using PPPoE with DHCPv6-PD + -SLAAC to construct a typical home network. The user can follow the steps -described here to quickly setup a working network and use this as a starting -point to further configure or fine-tune other settings. - -To achieve this, your ISP is required to support DHCPv6-PD. If you're not sure, -please contact your ISP for more information. - -## Network Topology - -```{image} /_static/images/pppoe-ipv6-pd-diagram.jpg -:align: center -:alt: Network Topology Diagram -:width: 60% -``` - -## Configurations - -### PPPoE Setup - -```none -set interfaces pppoe pppoe0 authentication password -set interfaces pppoe pppoe0 authentication user -set interfaces pppoe pppoe0 service-name -set interfaces pppoe pppoe0 source-interface 'eth0' -``` - -- Fill `password` and `user` with the credential provided by your ISP. -- `service-name` can be an arbitrary string. - -### DHCPv6-PD Setup - -During address configuration, in addition to assigning an address to the WAN -interface, ISP also provides a prefix to allow the router to configure addresses -of LAN interface and other nodes connecting to LAN, which is called prefix -delegation (PD). - -```none -set interfaces pppoe pppoe0 ipv6 address autoconf -set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' -``` - -- Here we use the prefix to configure the address of eth1 (LAN) to form - `::64`, where `64` is hexadecimal of address 100. -- For home network users, most of time ISP only provides /64 prefix, hence - there is no need to set SLA ID and prefix length. See {ref}`pppoe-interface` - for more information. - -### Router Advertisement - -We need to enable router advertisement for LAN network so that PC can receive -the prefix and use SLAAC to configure the address automatically. - -```none -set service router-advert interface eth1 link-mtu '1492' -set service router-advert interface eth1 name-server -set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800' -``` - -- Set MTU in advertisement to 1492 because of PPPoE header overhead. -- Set DNS server address in the advertisement so that clients can obtain it by - using RDNSS option. Most operating systems (Windows, Linux, Mac) should - already support it. -- Here we set the prefix to `::/64` to indicate advertising any /64 prefix - the LAN interface is assigned. -- Since some ISPs disconnects continuous connection for every 2~3 days, we set - `valid-lifetime` to 2 days to allow PC for phasing out old address. - -### Basic Firewall - -To have basic protection while keeping IPv6 network functional, we need to: - -- Allow all established and related traffic for router and LAN -- Allow all icmpv6 packets for router and LAN -- Allow DHCPv6 packets for router - -```none -set firewall ipv6 name WAN_IN default-action 'drop' -set firewall ipv6 name WAN_IN rule 10 action 'accept' -set firewall ipv6 name WAN_IN rule 10 state established 'enable' -set firewall ipv6 name WAN_IN rule 10 state related 'enable' -set firewall ipv6 name WAN_IN rule 20 action 'accept' -set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6' -set firewall ipv6 name WAN_LOCAL default-action 'drop' -set firewall ipv6 name WAN_LOCAL rule 10 action 'accept' -set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable' -set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable' -set firewall ipv6 name WAN_LOCAL rule 20 action 'accept' -set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6' -set firewall ipv6 name WAN_LOCAL rule 30 action 'accept' -set firewall ipv6 name WAN_LOCAL rule 30 destination port '546' -set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp' -set firewall ipv6 name WAN_LOCAL rule 30 source port '547' -set firewall ipv6 forward filter rule 10 action jump -set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN' -set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0' -set firewall ipv6 input filter rule 10 action jump -set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL' -set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0' -``` - -Note to allow the router to receive DHCPv6 response from ISP. We need to allow -packets with source port 547 (server) and destination port 546 (client). diff --git a/docs/configexamples/md-qos.md b/docs/configexamples/md-qos.md deleted file mode 100644 index c22a0a13..00000000 --- a/docs/configexamples/md-qos.md +++ /dev/null @@ -1,187 +0,0 @@ ---- -lastproofread: '2023-02-18' ---- - -(examples-qos)= - -# QoS example - -## Configuration 'dcsp' and shaper using QoS - -In this case, we'll try to make a simple lab using QoS and the general ability of the VyOS system. -We recommend you to go through the main article about [QoS](https://docs.vyos.io/en/latest/configuration/trafficpolicy/index.html) first. - -Using the general schema for example: - -```{image} /_static/images/qos1.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -We have four hosts on the local network 172.17.1.0/24. All hosts are labeled CS0 by default. We need to replace labels on all hosts except vpc8. -We will replace the labels on the nearest router “VyOS3” using the IP addresses of the sources. - -- 172.17.1.2 CS0 -> CS4 -- 172.17.1.3 CS0 -> CS5 -- 172.17.1.4 CS0 -> CS6 -- 172.17.1.40 CS0 by default - -Next, we will replace only all CS4 labels on the “VyOS2” router. - -- CS4 -> CS5 - -In the end, we will configure the traffic shaper using QoS mechanisms on the “VYOS2” router. - -## Configuration: - -Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll use in this case only static routes. -On the VyOS3 router, we need to change the 'dscp' labels for the VPCs. To do this, we use this configuration. - -```none -set interfaces ethernet eth0 address '10.1.1.100/24' -set interfaces ethernet eth1 address '172.17.1.1/24' -set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 -set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' -set qos policy shaper vyos3 class 10 set-dscp 'CS4' -set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' -set qos policy shaper vyos3 class 20 set-dscp 'CS5' -set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' -set qos policy shaper vyos3 class 30 set-dscp 'CS6' -set qos policy shaper vyos3 default bandwidth '10%' -set qos policy shaper vyos3 default ceiling '100%' -set qos policy shaper vyos3 default priority '7' -set qos policy shaper vyos3 default queue-type 'fair-queue' -set qos interface eth0 egress 'vyos3' -``` - -Main rules: - -- ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32 -- ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32 -- ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32 - -Check the result - -```{image} /_static/images/qos2.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -Before the interface eth0 on router VyOS3 - -```{image} /_static/images/qos3.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -After the interface eth0 on router VyOS3 - -```{image} /_static/images/qos4.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -On the router, VyOS4 set all traffic as CS4. We have to configure the default class and class for changing all labels from CS0 to CS4 - -```none -set interfaces ethernet eth0 address '10.2.1.100/24' -set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 -set qos policy shaper vyos4 class 10 bandwidth '100%' -set qos policy shaper vyos4 class 10 burst '15k' -set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' -set qos policy shaper vyos4 class 10 queue-type 'fair-queue' -set qos policy shaper vyos4 class 10 set-dscp 'CS4' -set qos policy shaper vyos4 default bandwidth '10%' -set qos policy shaper vyos4 default burst '15k' -set qos policy shaper vyos4 default ceiling '100%' -set qos policy shaper vyos4 default priority '7' -set qos policy shaper vyos4 default queue-type 'fair-queue' -set qos interface eth0 egress 'vyos4' -``` - -Next on the router VyOS2 we will change labels on all incoming traffic only from CS4-> CS6 - -```{image} /_static/images/qos5.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```none -set interfaces ethernet eth0 address '10.1.1.1/24' -set interfaces ethernet eth1 address '10.2.1.1/24' -set interfaces ethernet eth2 address '10.9.9.1/24' -set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 -set qos policy shaper vyos2 class 10 bandwidth '100%' -set qos policy shaper vyos2 class 10 burst '15k' -set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' -set qos policy shaper vyos2 class 10 queue-type 'fair-queue' -set qos policy shaper vyos2 class 10 set-dscp 'CS5' -set qos policy shaper vyos2 default bandwidth '100%' -set qos policy shaper vyos2 default burst '15k' -set qos policy shaper vyos2 default ceiling '100%' -set qos policy shaper vyos2 default priority '7' -set qos policy shaper vyos2 default queue-type 'fair-queue' -set qos interface eth2 egress 'vyos2' -``` - -```{image} /_static/images/qos6.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -- 172.17.1.2/24 CS0 - -```{image} /_static/images/qos7.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -- 172.17.1.2/24 CS0 - > CS4 - -```{image} /_static/images/qos8.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -- 172.17.1.2/24 CS4 - > CS5 - -```{image} /_static/images/qos9.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -In the end, on the router “VyOS2” we will set outgoing bandwidth limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work with the help of the “iPerf” utility. - -Set up bandwidth limits on the eth2 interface of the router “VyOS2”. - -```none -vyos@vyos2# show qos policy shaper vyos2 class 20 -bandwidth 5mbit -description "for VyOS3 eth0" -match VyOS3 { - ip { - source { - address 10.1.1.100/32 - } - } -} -``` - -Check the result. - -```{image} /_static/images/qos10.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -As we see shaper is working and the traffic will not work over 5 Mbit/s. diff --git a/docs/configexamples/md-segment-routing-isis.md b/docs/configexamples/md-segment-routing-isis.md deleted file mode 100644 index 76cb726c..00000000 --- a/docs/configexamples/md-segment-routing-isis.md +++ /dev/null @@ -1,277 +0,0 @@ ---- -lastproofread: '2023-04-10' ---- - -(examples-segment-routing-isis)= - -# Segment-routing IS-IS example - -When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this -blue print as an initial setup to get MPLS ISIS-SR working between those two -devices.The lab was build using {abbr}`EVE-NG (Emulated Virtual -Environment NG)`. - -:::{figure} /_static/images/vyos-sr-isis.png -:alt: ISIS-SR network - -ISIS-SR example network -::: - -The below configuration is used as example where we keep focus on -VyOS-P1/VyOS-P2/XRv-P3 which we share the settings. - -## Configuration - -- VyOS-P1: - -```none -set interfaces dummy dum0 address '192.0.2.1/32' -set interfaces ethernet eth1 address '192.0.2.5/30' -set interfaces ethernet eth1 mtu '8000' -set interfaces ethernet eth3 address '192.0.2.21/30' -set interfaces ethernet eth3 mtu '8000' -set protocols isis interface dum0 passive -set protocols isis interface eth1 network point-to-point -set protocols isis interface eth3 network point-to-point -set protocols isis level 'level-2' -set protocols isis log-adjacency-changes -set protocols isis metric-style 'wide' -set protocols isis net '49.0000.0000.0000.0001.00' -set protocols isis segment-routing maximum-label-depth '8' -set protocols isis segment-routing prefix 192.0.2.1/32 index value '1' -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth3' -set system host-name 'P1-VyOS' -``` - -- XRv-P3: - -```none -hostname P3-VyOS -interface Loopback0 - ipv4 address 192.0.2.3 255.255.255.255 -! -interface GigabitEthernet0/0/0/1 - mtu 8014 - ipv4 address 192.0.2.6 255.255.255.252 -! -interface GigabitEthernet0/0/0/2 - mtu 8014 - ipv4 address 192.0.2.18 255.255.255.252 -! -router isis VyOS - is-type level-2-only - net 49.0000.0000.0000.0003.00 - log adjacency changes - address-family ipv4 unicast - metric-style wide - segment-routing mpls - ! - interface Loopback0 - passive - address-family ipv4 unicast - prefix-sid index 3 - ! - ! - interface GigabitEthernet0/0/0/1 - point-to-point - address-family ipv4 unicast - ! - ! - interface GigabitEthernet0/0/0/2 - point-to-point - address-family ipv4 unicast - ! - ! -! -``` - -- VyOS-P2: - -```none -set interfaces dummy dum0 address '192.0.2.2/32' -set interfaces ethernet eth2 address '192.0.2.17/30' -set interfaces ethernet eth2 mtu '8000' -set interfaces ethernet eth3 address '192.0.2.26/30' -set interfaces ethernet eth3 mtu '8000' -set protocols isis interface dum0 passive -set protocols isis interface eth2 network point-to-point -set protocols isis interface eth3 network point-to-point -set protocols isis level 'level-2' -set protocols isis log-adjacency-changes -set protocols isis metric-style 'wide' -set protocols isis net '49.0000.0000.0000.0002.00' -set protocols isis segment-routing maximum-label-depth '8' -set protocols isis segment-routing prefix 192.0.2.2/32 index value '2' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set system host-name 'P2-VyOS' -``` - -This gives us MPLS segment routing enabled and labels forwarding : - -```none -vyos@P1-VyOS:~$ show mpls table -Inbound Label Type Nexthop Outbound Label ------------------------------------------------------------------ -15000 SR (IS-IS) 192.0.2.6 implicit-null -15001 SR (IS-IS) 192.0.2.22 implicit-null -15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null -16002 SR (IS-IS) 192.0.2.6 16002 -16003 SR (IS-IS) 192.0.2.6 implicit-null -16011 SR (IS-IS) 192.0.2.22 implicit-null - -vyos@P2-VyOS:~$ show mpls table -Inbound Label Type Nexthop Outbound Label -------------------------------------------------------- -15000 SR (IS-IS) 192.0.2.18 implicit-null -16001 SR (IS-IS) 192.0.2.18 16001 -16003 SR (IS-IS) 192.0.2.18 implicit-null -16011 SR (IS-IS) 192.0.2.18 16011 - -RP/0/0/CPU0:P3-VyOS#show mpls forwarding -Tue Mar 28 17:47:18.928 UTC -Local Outgoing Prefix Outgoing Next Hop Bytes -Label Label or ID Interface Switched ------- ----------- ------------------ ------------ --------------- ------------ -16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0 -16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0 -16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0 -24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0 -24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0 -24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0 -24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0 -``` - -VyOS is able to check MSD per devices: - -```none -vyos@P1-VyOS:~$ show isis segment-routing node -Area VyOS: -IS-IS L1 SR-Nodes: - -IS-IS L2 SR-Nodes: - -System ID SRGB SRLB Algorithm MSD ---------------------------------------------------------------- -0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 -0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 -0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 -0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 - -vyos@P2-VyOS:~$ show isis segment-routing node -Area VyOS: - IS-IS L1 SR-Nodes: - - IS-IS L2 SR-Nodes: - - System ID SRGB SRLB Algorithm MSD - --------------------------------------------------------------- - 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 - 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 -``` - -Here is the routing tables showing the MPLS segment routing label operations: - -```none -vyos@P1-VyOS:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m -I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m -I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m -I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m -I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m -I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m -I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m - - -vyos@P2-VyOS:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m -I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m -I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m -I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m -I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m -I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m - -RP/0/0/CPU0:P3-VyOS#show route isis -Tue Mar 28 18:19:16.417 UTC - -i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 -i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 -i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1 -i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 -i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 -``` - -Information about prefix-sid and label-operation from VyOS - -```none -vyos@P1-VyOS:~$ show isis route prefix-sid -Area VyOS: -IS-IS L2 IPv4 routing table: - - Prefix Metric Interface Nexthop SID Label Op. - ---------------------------------------------------------------------- - 192.0.2.1/32 0 - - - - - 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002) - 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003) - 192.0.2.4/30 20 eth1 192.0.2.6 - - - 192.0.2.16/30 20 eth1 192.0.2.6 - - - 192.0.2.20/30 0 - - - - - 192.0.2.24/30 30 eth1 192.0.2.6 - - - - vyos@P2-VyOS:~$ show isis route prefix-sid - Area VyOS: - IS-IS L2 IPv4 routing table: - - Prefix Metric Interface Nexthop SID Label Op. - ----------------------------------------------------------------------- - 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001) - 192.0.2.2/32 0 - - - - - 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003) - 192.0.2.4/30 20 eth2 192.0.2.18 - - - 192.0.2.16/30 20 eth2 192.0.2.18 - - - 192.0.2.20/30 30 eth2 192.0.2.18 - - - 192.0.2.24/30 0 - - - - -``` - -Ping between VyOS-P1 / VyOS-P2 to confirm reachability: - -```none -vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1 -PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data. -64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms -64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms -64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms -64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms -^C ---- 192.0.2.2 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3004ms -rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms - -vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2 -PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data. -64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms -64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms -64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms -64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms -^C ---- 192.0.2.1 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3005ms -rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms -``` diff --git a/docs/configexamples/md-wan-load-balancing.md b/docs/configexamples/md-wan-load-balancing.md deleted file mode 100644 index e35b9056..00000000 --- a/docs/configexamples/md-wan-load-balancing.md +++ /dev/null @@ -1,175 +0,0 @@ ---- -lastproofread: '2021-06-29' ---- - -(wan-load-balancing)= - - -# WAN Load Balancer examples - -## Example 1: Distributing load evenly - -The setup used in this example is shown in the following diagram: - -```{image} /_static/images/Wan_load_balancing1.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -### Overview - -> - All traffic coming in through eth2 is balanced between eth0 and eth1 -> on the router. -> - Pings will be sent to four targets for health testing (33.44.55.66, -> 44.55.66.77, 55.66.77.88 and 66.77.88.99). -> - All outgoing packets are assigned the source address of the assigned -> interface (SNAT). -> - eth0 is set to be removed from the load balancer's interface pool -> after 5 ping failures, eth1 will be removed after 4 ping failures. - -### Create static routes to ping targets - -Create static routes through the two ISPs towards the ping targets and -commit the changes: - -```none -set protocols static route 33.44.55.66/32 next-hop 11.22.33.1 -set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 -set protocols static route 55.66.77.88/32 next-hop 22.33.44.1 -set protocols static route 66.77.88.99/32 next-hop 22.33.44.1 -``` - -### Configure the load balancer - -Configure the WAN load balancer with the parameters described above: - -```none -set load-balancing wan interface-health eth0 failure-count 5 -set load-balancing wan interface-health eth0 nexthop 11.22.33.1 -set load-balancing wan interface-health eth0 test 10 type ping -set load-balancing wan interface-health eth0 test 10 target 33.44.55.66 -set load-balancing wan interface-health eth0 test 20 type ping -set load-balancing wan interface-health eth0 test 20 target 44.55.66.77 -set load-balancing wan interface-health eth1 failure-count 4 -set load-balancing wan interface-health eth1 nexthop 22.33.44.1 -set load-balancing wan interface-health eth1 test 10 type ping -set load-balancing wan interface-health eth1 test 10 target 55.66.77.88 -set load-balancing wan interface-health eth1 test 20 type ping -set load-balancing wan interface-health eth1 test 20 target 66.77.88.99 -set load-balancing wan rule 10 inbound-interface eth2 -set load-balancing wan rule 10 interface eth0 -set load-balancing wan rule 10 interface eth1 -``` - -## Example 2: Failover based on interface weights - -This example uses the failover mode. - -(wan-example2-overwiew)= - -### Overview - -In this example, eth0 is the primary interface and eth1 is the secondary -interface. To provide simple failover functionality. If eth0 fails, eth1 -takes over. - -### Create interface weight based configuration - -The configuration steps are the same as in the previous example, except -rule 10. So we keep the configuration, remove rule 10 and add a new rule -for the failover mode: - -```none -delete load-balancing wan rule 10 -set load-balancing wan rule 10 failover -set load-balancing wan rule 10 inbound-interface eth2 -set load-balancing wan rule 10 interface eth0 weight 10 -set load-balancing wan rule 10 interface eth1 weight 1 -``` - -## Example 3: Failover based on rule order - -The previous example used the failover command to send traffic through -eth1 if eth0 fails. In this example, failover functionality is provided -by rule order. - -(wan-example3-overwiew)= - -### Overview - -Two rules will be created, the first rule directs traffic coming in -from eth2 to eth0 and the second rule directs the traffic to eth1. If -eth0 fails the first rule is bypassed and the second rule matches, -directing traffic to eth1. - -### Create rule order based configuration - -We keep the configuration from the previous example, delete rule 10 -and create the two new rules as described: - -```none -delete load-balancing wan rule 10 -set load-balancing wan rule 10 inbound-interface eth2 -set load-balancing wan rule 10 interface eth0 -set load-balancing wan rule 20 inbound-interface eth2 -set load-balancing wan rule 20 interface eth1 -``` - -## Example 4: Failover based on rule order - priority traffic - -A rule order for prioritizing traffic is useful in scenarios where the -secondary link has a lower speed and should only carry high priority -traffic. It is assumed for this example that eth1 is connected to a -slower connection than eth0 and should prioritize VoIP traffic. - -(wan-example4-overwiew)= - -### Overview - -A rule order for prioritizing traffic is useful in scenarios where the -secondary link has a lower speed and should only carry high priority -traffic. It is assumed for this example that eth1 is connected to a -slower connection than eth0 and should prioritize VoIP traffic. - -### Create rule order based configuration with low speed secondary link - -We keep the configuration from the previous example, delete rule 20 and -create a new rule as described: - -```none -delete load-balancing wan rule 20 -set load-balancing wan rule 20 inbound-interface eth2 -set load-balancing wan rule 20 interface eth1 -set load-balancing wan rule 20 destination port sip -set load-balancing wan rule 20 protocol tcp -set protocols static route 0.0.0.0/0 next-hop 11.22.33.1 -``` - -## Example 5: Exclude traffic from load balancing - -In this example two LAN interfaces exist in different subnets instead -of one like in the previous examples: - -```{image} /_static/images/Wan_load_balancing_exclude1.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -### Adding a rule for the second interface - -Based on the previous example, another rule for traffic from the second -interface eth3 can be added to the load balancer. However, traffic meant -to flow between the LAN subnets will be sent to eth0 and eth1 as well. -To prevent this, another rule is required. This rule excludes traffic -between the local subnets from the load balancer. It also excludes -locally-sources packets (required for web caching with load balancing). -eth+ is used as an alias that refers to all ethernet interfaces: - -```none -set load-balancing wan rule 5 exclude -set load-balancing wan rule 5 inbound-interface eth+ -set load-balancing wan rule 5 destination address 10.0.0.0/8 -``` - diff --git a/docs/configexamples/md-zone-policy.md b/docs/configexamples/md-zone-policy.md deleted file mode 100644 index d9c22c09..00000000 --- a/docs/configexamples/md-zone-policy.md +++ /dev/null @@ -1,415 +0,0 @@ ---- -lastproofread: '2024-06-14' ---- - -(examples-zone-policy)= - -# Zone-Policy example - -:::{note} -In {vytask}`T2199` the syntax of the zone configuration was changed. -The zone configuration moved from `zone-policy zone ` to `firewall -zone `. -::: - -## Native IPv4 and IPv6 - -We have three networks. - -```none -WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64 -LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64 -DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64 -``` - -**This specific example is for a router on a stick, but is very easily -adapted for however many NICs you have**: - -- Internet - 192.168.200.100 - TCP/80 -- Internet - 192.168.200.100 - TCP/443 -- Internet - 192.168.200.100 - TCP/25 -- Internet - 192.168.200.100 - TCP/53 -- VyOS acts as DHCP, DNS forwarder, NAT, router and firewall. -- 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web - and mail (SMTP/IMAP) server. -- 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It - can SSH to VyOS. -- LAN and DMZ hosts have basic outbound access: Web, FTP, SSH. -- LAN can access DMZ resources. -- DMZ cannot access LAN resources. -- Inbound WAN connect to DMZ host. - -```{image} /_static/images/zone-policy-diagram.png -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -The VyOS interface is assigned the .1/:1 address of their respective -networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30. - -It will look something like this: - -```none -interfaces { - ethernet eth0 { - duplex auto - hw-id 00:53:ed:6e:2a:92 - smp_affinity auto - speed auto - vif 10 { - address 172.16.10.1/24 - address 2001:db8:0:9999::1/64 - } - vif 20 { - address 192.168.100.1/24 - address 2001:db8:0:AAAA::1/64 - } - vif 30 { - address 192.168.200.1/24 - address 2001:db8:0:BBBB::1/64 - } - } - loopback lo { - } -} -``` - -## Zones Basics - -Each interface is assigned to a zone. The interface can be physical or -virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly -the same. - -Traffic flows from zone A to zone B. That flow is what I refer to as a -zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations. - -Ruleset are created per zone-pair-direction. - -I name rule sets to indicate which zone-pair-direction they represent. -eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN. - -In VyOS, you have to have unique Ruleset names. In the event of overlap, -I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This -allows for each auto-completion and uniqueness. - -In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is -the firewall itself. - -If your computer is on the LAN and you need to SSH into your VyOS box, -you would need a rule to allow it in the LAN-Local ruleset. If you want -to access a webpage from your VyOS box, you need a rule to allow it in -the Local-LAN ruleset. - -In rules, it is good to keep them named consistently. As the number of -rules you have grows, the more consistency you have, the easier your -life will be. - -```none -Rule 1 - State Established, Related -Rule 2 - State Invalid -Rule 100 - ICMP -Rule 200 - Web -Rule 300 - FTP -Rule 400 - NTP -Rule 500 - SMTP -Rule 600 - DNS -Rule 700 - DHCP -Rule 800 - SSH -Rule 900 - IMAPS -``` - -The first two rules are to deal with the idiosyncrasies of VyOS and -iptables. - -Zones and Rulesets both have a default action statement. When using -Zone-Policies, the default action is set by the zone-policy statement -and is represented by rule 10000. - -It is good practice to log both accepted and denied traffic. It can save -you significant headaches when trying to troubleshoot a connectivity -issue. - -To add logging to the default rule, do: - -```none -set firewall name default-log -``` - -By default, iptables does not allow traffic for established sessions to -return, so you must explicitly allow this. I do this by adding two rules -to every ruleset. 1 allows established and related state packets through -and rule 2 drops and logs invalid state packets. We place the -established/related rule at the top because the vast majority of traffic -on a network is established and the invalid rule to prevent invalid -state packets from mistakenly being matched against other rules. Having -the most matched rule listed first reduces CPU load in high volume -environments. Note: I have filed a bug to have this added as a default -action as well. - -''It is important to note, that you do not want to add logging to the -established state rule as you will be logging both the inbound and -outbound packets for each session instead of just the initiation of the -session. Your logs will be massive in a very short period of time.'' - -In VyOS you must have the interfaces created before you can apply it to -the zone and the rulesets must be created prior to applying it to a -zone-policy. - -I create/configure the interfaces first. Build out the rulesets for each -zone-pair-direction which includes at least the three state rules. Then -I setup the zone-policies. - -Zones do not allow for a default action of accept; either drop or -reject. It is important to remember this because if you apply an -interface to a zone and commit, any active connections will be dropped. -Specifically, if you are SSH’d into VyOS and add local or the interface -you are connecting through to a zone and do not have rulesets in place -to allow SSH and established sessions, you will not be able to connect. - -The following are the rules that were created for this example (may not -be complete), both in IPv4 and IPv6. If there is no IP specified, then -the source/destination address is not explicit. - -```none -WAN - DMZ:192.168.200.200 - tcp/80 -WAN - DMZ:192.168.200.200 - tcp/443 -WAN - DMZ:192.168.200.200 - tcp/25 -WAN - DMZ:192.168.200.200 - tcp/53 -WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80 -WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443 -WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25 -WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53 - -DMZ - Local - tcp/53 -DMZ - Local - tcp/123 -DMZ - Local - tcp/67,68 - -LAN - Local - tcp/53 -LAN - Local - tcp/123 -LAN - Local - tcp/67,68 -LAN:192.168.100.10 - Local - tcp/22 -LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22 - -LAN - WAN - tcp/80 -LAN - WAN - tcp/443 -LAN - WAN - tcp/22 -LAN - WAN - tcp/20,21 - -DMZ - WAN - tcp/80 -DMZ - WAN - tcp/443 -DMZ - WAN - tcp/22 -DMZ - WAN - tcp/20,21 -DMZ - WAN - tcp/53 -DMZ - WAN - udp/53 - -Local - WAN - tcp/80 -Local - WAN - tcp/443 -Local - WAN - tcp/20,21 - -Local - DMZ - tcp/25 -Local - DMZ - tcp/67,68 -Local - DMZ - tcp/53 -Local - DMZ - udp/53 - -Local - LAN - tcp/67,68 - -LAN - DMZ - tcp/80 -LAN - DMZ - tcp/443 -LAN - DMZ - tcp/993 -LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22 -LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22 -``` - -Since we have 4 zones, we need to setup the following rulesets. - -```none -Lan-wan -Lan-local -Lan-dmz -Wan-lan -Wan-local -Wan-dmz -Local-lan -Local-wan -Local-dmz -Dmz-lan -Dmz-wan -Dmz-local -``` - -Even if the two zones will never communicate, it is a good idea to -create the zone-pair-direction rulesets and set default-log. This -will allow you to log attempts to access the networks. Without it, you -will never see the connection attempts. - -This is an example of the three base rules. - -```none -name wan-lan { - default-action drop - default-log - rule 1 { - action accept - state { - established enable - related enable - } - } - rule 2 { - action drop - log enable - state { - invalid enable - } - } -} -``` - -Here is an example of an IPv6 DMZ-WAN ruleset. - -```none -ipv6-name dmz-wan-6 { - default-action drop - default-log - rule 1 { - action accept - state { - established enable - related enable - } - } - rule 2 { - action drop - log enable - state { - invalid enable - } - rule 100 { - action accept - log enable - protocol ipv6-icmp - } - rule 200 { - action accept - destination { - port 80,443 - } - log enable - protocol tcp - } - rule 300 { - action accept - destination { - port 20,21 - } - log enable - protocol tcp - } - rule 500 { - action accept - destination { - port 25 - } - log enable - protocol tcp - source { - address 2001:db8:0:BBBB::200 - } - } - rule 600 { - action accept - destination { - port 53 - } - log enable - protocol tcp_udp - source { - address 2001:db8:0:BBBB::200 - } - } - rule 800 { - action accept - destination { - port 22 - } - log enable - protocol tcp - } -} -``` - -Once you have all of your rulesets built, then you need to create your -zone-policy. - -Start by setting the interface and default action for each zone. - -```none -set firewall zone dmz default-action drop -set firewall zone dmz interface eth0.30 -``` - -In this case, we are setting the v6 ruleset that represents traffic -sourced from the LAN, destined for the DMZ. Because the zone-policy -firewall syntax is a little awkward, I keep it straight by thinking of -it backwards. - -```none -set firewall zone dmz from lan firewall ipv6-name lan-dmz-6 -``` - -DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out -a bunch at one time. - -In the end, you will end up with something like this config. I took out -everything but the Firewall, Interfaces, and zone-policy sections. It is -long enough as is. - -## IPv6 Tunnel - -If you are using a IPv6 tunnel from HE.net or someone else, the basis is -the same except you have two WAN interfaces. One for v4 and one for v6. - -You would have 5 zones instead of just 4 and you would configure your v6 -ruleset between your tunnel interface and your LAN/DMZ zones instead of -to the WAN. - -LAN, WAN, DMZ, local and TUN (tunnel) - -v6 pairs would be: - -```none -lan-tun -lan-local -lan-dmz -tun-lan -tun-local -tun-dmz -local-lan -local-tun -local-dmz -dmz-lan -dmz-tun -dmz-local -``` - -Notice, none go to WAN since WAN wouldn't have a v6 address on it. - -You would have to add a couple of rules on your wan-local ruleset to -allow protocol 41 in. - -Something like: - -```none -rule 400 { - action accept - destination { - address 172.16.10.1 - } - log enable - protocol 41 - source { - address ip.of.tunnel.broker - } -} -``` diff --git a/docs/configexamples/nmp.md b/docs/configexamples/nmp.md new file mode 100644 index 00000000..71855f89 --- /dev/null +++ b/docs/configexamples/nmp.md @@ -0,0 +1,69 @@ +--- +lastproofread: '2023-03-26' +--- + +(examples-nmp)= + +# NMP example + +Consider how to quickly set up NMP and VyOS for monitoring. +NMP is multi-vendor network monitoring from 'SolarWinds' built to scale and expand with the needs of your network. + +## Configuration 'VyOS' + +First prepare our VyOS router for connection to NMP. We have to set up the SNMP protocol and connectivity between the router and NMP. + +```none +set interfaces ethernet eth0 address 'dhcp' +set system name-server '8.8.8.8' +set service snmp community router authorization 'test' +set service snmp community router network '0.0.0.0/0' +``` + +## Configuration 'NMP' + +Next, you just should follow the pictures: + +```{image} /_static/images/nmp1.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp2.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp3.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp4.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp5.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp6.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp7.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +In the end, you'll get a powerful instrument for monitoring the VyOS systems. diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/nmp.rst deleted file mode 100644 index 913e7107..00000000 --- a/docs/configexamples/nmp.rst +++ /dev/null @@ -1,66 +0,0 @@ -:lastproofread: 2023-03-26 - -.. _examples-nmp: - -########### -NMP example -########### - -Consider how to quickly set up NMP and VyOS for monitoring. -NMP is multi-vendor network monitoring from 'SolarWinds' built to scale and expand with the needs of your network. - -Configuration 'VyOS' -==================== - -First prepare our VyOS router for connection to NMP. We have to set up the SNMP protocol and connectivity between the router and NMP. - -.. code-block:: none - - set interfaces ethernet eth0 address 'dhcp' - set system name-server '8.8.8.8' - set service snmp community router authorization 'test' - set service snmp community router network '0.0.0.0/0' - - -Configuration 'NMP' -==================== - -Next, you just should follow the pictures: - -.. image:: /_static/images/nmp1.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp2.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp3.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp4.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp5.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp6.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp7.png - :width: 80% - :align: center - :alt: Network Topology Diagram - - -In the end, you'll get a powerful instrument for monitoring the VyOS systems. \ No newline at end of file diff --git a/docs/configexamples/ospf-unnumbered.md b/docs/configexamples/ospf-unnumbered.md new file mode 100644 index 00000000..9174d1b4 --- /dev/null +++ b/docs/configexamples/ospf-unnumbered.md @@ -0,0 +1,118 @@ +--- +lastproofread: '2021-06-29' +--- + +(examples-ospf-unnumbered)= + +# OSPF unnumbered with ECMP + +General information can be found in the {ref}`routing-ospf` chapter. + +## Configuration + +- Router A: + +```none +set interfaces ethernet eth0 address '10.0.0.1/24' +set interfaces ethernet eth1 address '192.168.0.1/32' +set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' +set interfaces ethernet eth1 ip ospf network 'point-to-point' +set interfaces ethernet eth2 address '192.168.0.1/32' +set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' +set interfaces ethernet eth2 ip ospf network 'point-to-point' +set interfaces loopback lo address '192.168.0.1/32' +set protocols ospf area 0.0.0.0 authentication 'md5' +set protocols ospf area 0.0.0.0 network '192.168.0.1/32' +set protocols ospf parameters router-id '192.168.0.1' +set protocols ospf redistribute connected +``` + +- Router B: + +```none +set interfaces ethernet eth0 address '10.0.0.2/24' +set interfaces ethernet eth1 address '192.168.0.2/32' +set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' +set interfaces ethernet eth1 ip ospf network 'point-to-point' +set interfaces ethernet eth2 address '192.168.0.2/32' +set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' +set interfaces ethernet eth2 ip ospf network 'point-to-point' +set interfaces loopback lo address '192.168.0.2/32' +set protocols ospf area 0.0.0.0 authentication 'md5' +set protocols ospf area 0.0.0.0 network '192.168.0.2/32' +set protocols ospf parameters router-id '192.168.0.2' +set protocols ospf redistribute connected +``` + + +## Results + +- Router A: + +```none +vyos@vyos:~$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 10.0.0.1/24 u/u +eth1 192.168.0.1/32 u/u +eth2 192.168.0.1/32 u/u +lo 127.0.0.1/8 u/u + 192.168.0.1/32 + ::1/128 +``` + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + +S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 +O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21 + via 192.168.0.2, eth2 onlink, 00:13:21 +C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 +O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53 +C * 192.168.0.1/32 is directly connected, eth2, 00:56:31 +C * 192.168.0.1/32 is directly connected, eth1, 00:56:31 +C>* 192.168.0.1/32 is directly connected, lo, 00:57:36 +O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03 + * via 192.168.0.2, eth2 onlink, 00:29:03 +``` + +- Router B: + +```none +vyos@vyos:~$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 10.0.0.2/24 u/u +eth1 192.168.0.2/32 u/u +eth2 192.168.0.2/32 u/u +lo 127.0.0.1/8 u/u + 192.168.0.2/32 + ::1/128 +``` + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + +S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 +O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21 + via 192.168.0.1, eth2 onlink, 00:13:21 +C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 +O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53 +C * 192.168.0.2/32 is directly connected, eth2, 00:56:31 +C * 192.168.0.2/32 is directly connected, eth1, 00:56:31 +C>* 192.168.0.2/32 is directly connected, lo, 00:57:36 +O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03 + * via 192.168.0.1, eth2 onlink, 00:29:03 +``` diff --git a/docs/configexamples/ospf-unnumbered.rst b/docs/configexamples/ospf-unnumbered.rst deleted file mode 100644 index 6a5a1bb4..00000000 --- a/docs/configexamples/ospf-unnumbered.rst +++ /dev/null @@ -1,120 +0,0 @@ -:lastproofread: 2021-06-29 - -.. _examples-ospf-unnumbered: - -######################### -OSPF unnumbered with ECMP -######################### - -General information can be found in the :ref:`routing-ospf` chapter. - -Configuration -============= - -- Router A: - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.0.1/24' - set interfaces ethernet eth1 address '192.168.0.1/32' - set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' - set interfaces ethernet eth1 ip ospf network 'point-to-point' - set interfaces ethernet eth2 address '192.168.0.1/32' - set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' - set interfaces ethernet eth2 ip ospf network 'point-to-point' - set interfaces loopback lo address '192.168.0.1/32' - set protocols ospf area 0.0.0.0 authentication 'md5' - set protocols ospf area 0.0.0.0 network '192.168.0.1/32' - set protocols ospf parameters router-id '192.168.0.1' - set protocols ospf redistribute connected - -- Router B: - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.0.2/24' - set interfaces ethernet eth1 address '192.168.0.2/32' - set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' - set interfaces ethernet eth1 ip ospf network 'point-to-point' - set interfaces ethernet eth2 address '192.168.0.2/32' - set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' - set interfaces ethernet eth2 ip ospf network 'point-to-point' - set interfaces loopback lo address '192.168.0.2/32' - set protocols ospf area 0.0.0.0 authentication 'md5' - set protocols ospf area 0.0.0.0 network '192.168.0.2/32' - set protocols ospf parameters router-id '192.168.0.2' - set protocols ospf redistribute connected - - -Results -======= - -- Router A: - -.. code-block:: none - - vyos@vyos:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 10.0.0.1/24 u/u - eth1 192.168.0.1/32 u/u - eth2 192.168.0.1/32 u/u - lo 127.0.0.1/8 u/u - 192.168.0.1/32 - ::1/128 - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - - S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 - O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21 - via 192.168.0.2, eth2 onlink, 00:13:21 - C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 - O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53 - C * 192.168.0.1/32 is directly connected, eth2, 00:56:31 - C * 192.168.0.1/32 is directly connected, eth1, 00:56:31 - C>* 192.168.0.1/32 is directly connected, lo, 00:57:36 - O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03 - * via 192.168.0.2, eth2 onlink, 00:29:03 - -- Router B: - -.. code-block:: none - - vyos@vyos:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 10.0.0.2/24 u/u - eth1 192.168.0.2/32 u/u - eth2 192.168.0.2/32 u/u - lo 127.0.0.1/8 u/u - 192.168.0.2/32 - ::1/128 - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - - S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 - O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21 - via 192.168.0.1, eth2 onlink, 00:13:21 - C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 - O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53 - C * 192.168.0.2/32 is directly connected, eth2, 00:56:31 - C * 192.168.0.2/32 is directly connected, eth1, 00:56:31 - C>* 192.168.0.2/32 is directly connected, lo, 00:57:36 - O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03 - * via 192.168.0.1, eth2 onlink, 00:29:03 diff --git a/docs/configexamples/pppoe-ipv6-basic.md b/docs/configexamples/pppoe-ipv6-basic.md new file mode 100644 index 00000000..9b1503f3 --- /dev/null +++ b/docs/configexamples/pppoe-ipv6-basic.md @@ -0,0 +1,111 @@ +--- +lastproofread: '2021-06-29' +--- + +(examples-pppoe-ipv6-basic)= + +# PPPoE IPv6 Basic Setup for Home Network + +This document is to describe a basic setup using PPPoE with DHCPv6-PD + +SLAAC to construct a typical home network. The user can follow the steps +described here to quickly setup a working network and use this as a starting +point to further configure or fine-tune other settings. + +To achieve this, your ISP is required to support DHCPv6-PD. If you're not sure, +please contact your ISP for more information. + +## Network Topology + +```{image} /_static/images/pppoe-ipv6-pd-diagram.jpg +:align: center +:alt: Network Topology Diagram +:width: 60% +``` + +## Configurations + +### PPPoE Setup + +```none +set interfaces pppoe pppoe0 authentication password +set interfaces pppoe pppoe0 authentication user +set interfaces pppoe pppoe0 service-name +set interfaces pppoe pppoe0 source-interface 'eth0' +``` + +- Fill `password` and `user` with the credential provided by your ISP. +- `service-name` can be an arbitrary string. + +### DHCPv6-PD Setup + +During address configuration, in addition to assigning an address to the WAN +interface, ISP also provides a prefix to allow the router to configure addresses +of LAN interface and other nodes connecting to LAN, which is called prefix +delegation (PD). + +```none +set interfaces pppoe pppoe0 ipv6 address autoconf +set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' +``` + +- Here we use the prefix to configure the address of eth1 (LAN) to form + `::64`, where `64` is hexadecimal of address 100. +- For home network users, most of time ISP only provides /64 prefix, hence + there is no need to set SLA ID and prefix length. See {ref}`pppoe-interface` + for more information. + +### Router Advertisement + +We need to enable router advertisement for LAN network so that PC can receive +the prefix and use SLAAC to configure the address automatically. + +```none +set service router-advert interface eth1 link-mtu '1492' +set service router-advert interface eth1 name-server +set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800' +``` + +- Set MTU in advertisement to 1492 because of PPPoE header overhead. +- Set DNS server address in the advertisement so that clients can obtain it by + using RDNSS option. Most operating systems (Windows, Linux, Mac) should + already support it. +- Here we set the prefix to `::/64` to indicate advertising any /64 prefix + the LAN interface is assigned. +- Since some ISPs disconnects continuous connection for every 2~3 days, we set + `valid-lifetime` to 2 days to allow PC for phasing out old address. + +### Basic Firewall + +To have basic protection while keeping IPv6 network functional, we need to: + +- Allow all established and related traffic for router and LAN +- Allow all icmpv6 packets for router and LAN +- Allow DHCPv6 packets for router + +```none +set firewall ipv6 name WAN_IN default-action 'drop' +set firewall ipv6 name WAN_IN rule 10 action 'accept' +set firewall ipv6 name WAN_IN rule 10 state established 'enable' +set firewall ipv6 name WAN_IN rule 10 state related 'enable' +set firewall ipv6 name WAN_IN rule 20 action 'accept' +set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6' +set firewall ipv6 name WAN_LOCAL default-action 'drop' +set firewall ipv6 name WAN_LOCAL rule 10 action 'accept' +set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable' +set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable' +set firewall ipv6 name WAN_LOCAL rule 20 action 'accept' +set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6' +set firewall ipv6 name WAN_LOCAL rule 30 action 'accept' +set firewall ipv6 name WAN_LOCAL rule 30 destination port '546' +set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp' +set firewall ipv6 name WAN_LOCAL rule 30 source port '547' +set firewall ipv6 forward filter rule 10 action jump +set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN' +set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0' +set firewall ipv6 input filter rule 10 action jump +set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL' +set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0' +``` + +Note to allow the router to receive DHCPv6 response from ISP. We need to allow +packets with source port 547 (server) and destination port 546 (client). diff --git a/docs/configexamples/pppoe-ipv6-basic.rst b/docs/configexamples/pppoe-ipv6-basic.rst deleted file mode 100644 index ad588def..00000000 --- a/docs/configexamples/pppoe-ipv6-basic.rst +++ /dev/null @@ -1,116 +0,0 @@ -:lastproofread: 2021-06-29 - -.. _examples-pppoe-ipv6-basic: - -####################################### -PPPoE IPv6 Basic Setup for Home Network -####################################### - -This document is to describe a basic setup using PPPoE with DHCPv6-PD + -SLAAC to construct a typical home network. The user can follow the steps -described here to quickly setup a working network and use this as a starting -point to further configure or fine-tune other settings. - -To achieve this, your ISP is required to support DHCPv6-PD. If you're not sure, -please contact your ISP for more information. - -Network Topology -================ - -.. image:: /_static/images/pppoe-ipv6-pd-diagram.jpg - :width: 60% - :align: center - :alt: Network Topology Diagram - -Configurations -============== - -PPPoE Setup ------------ - -.. code-block:: none - - set interfaces pppoe pppoe0 authentication password - set interfaces pppoe pppoe0 authentication user - set interfaces pppoe pppoe0 service-name - set interfaces pppoe pppoe0 source-interface 'eth0' - -* Fill ``password`` and ``user`` with the credential provided by your ISP. -* ``service-name`` can be an arbitrary string. - -DHCPv6-PD Setup ---------------- - -During address configuration, in addition to assigning an address to the WAN -interface, ISP also provides a prefix to allow the router to configure addresses -of LAN interface and other nodes connecting to LAN, which is called prefix -delegation (PD). - -.. code-block:: none - - set interfaces pppoe pppoe0 ipv6 address autoconf - set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' - -* Here we use the prefix to configure the address of eth1 (LAN) to form - ``::64``, where ``64`` is hexadecimal of address 100. -* For home network users, most of time ISP only provides /64 prefix, hence - there is no need to set SLA ID and prefix length. See :ref:`pppoe-interface` - for more information. - -Router Advertisement --------------------- - -We need to enable router advertisement for LAN network so that PC can receive -the prefix and use SLAAC to configure the address automatically. - -.. code-block:: none - - set service router-advert interface eth1 link-mtu '1492' - set service router-advert interface eth1 name-server - set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800' - -* Set MTU in advertisement to 1492 because of PPPoE header overhead. -* Set DNS server address in the advertisement so that clients can obtain it by - using RDNSS option. Most operating systems (Windows, Linux, Mac) should - already support it. -* Here we set the prefix to ``::/64`` to indicate advertising any /64 prefix - the LAN interface is assigned. -* Since some ISPs disconnects continuous connection for every 2~3 days, we set - ``valid-lifetime`` to 2 days to allow PC for phasing out old address. - -Basic Firewall --------------- - -To have basic protection while keeping IPv6 network functional, we need to: - -* Allow all established and related traffic for router and LAN -* Allow all icmpv6 packets for router and LAN -* Allow DHCPv6 packets for router - -.. code-block:: none - - set firewall ipv6 name WAN_IN default-action 'drop' - set firewall ipv6 name WAN_IN rule 10 action 'accept' - set firewall ipv6 name WAN_IN rule 10 state established 'enable' - set firewall ipv6 name WAN_IN rule 10 state related 'enable' - set firewall ipv6 name WAN_IN rule 20 action 'accept' - set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6' - set firewall ipv6 name WAN_LOCAL default-action 'drop' - set firewall ipv6 name WAN_LOCAL rule 10 action 'accept' - set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable' - set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable' - set firewall ipv6 name WAN_LOCAL rule 20 action 'accept' - set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6' - set firewall ipv6 name WAN_LOCAL rule 30 action 'accept' - set firewall ipv6 name WAN_LOCAL rule 30 destination port '546' - set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp' - set firewall ipv6 name WAN_LOCAL rule 30 source port '547' - set firewall ipv6 forward filter rule 10 action jump - set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN' - set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0' - set firewall ipv6 input filter rule 10 action jump - set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL' - set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0' - -Note to allow the router to receive DHCPv6 response from ISP. We need to allow -packets with source port 547 (server) and destination port 546 (client). diff --git a/docs/configexamples/qos.md b/docs/configexamples/qos.md new file mode 100644 index 00000000..c22a0a13 --- /dev/null +++ b/docs/configexamples/qos.md @@ -0,0 +1,187 @@ +--- +lastproofread: '2023-02-18' +--- + +(examples-qos)= + +# QoS example + +## Configuration 'dcsp' and shaper using QoS + +In this case, we'll try to make a simple lab using QoS and the general ability of the VyOS system. +We recommend you to go through the main article about [QoS](https://docs.vyos.io/en/latest/configuration/trafficpolicy/index.html) first. + +Using the general schema for example: + +```{image} /_static/images/qos1.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +We have four hosts on the local network 172.17.1.0/24. All hosts are labeled CS0 by default. We need to replace labels on all hosts except vpc8. +We will replace the labels on the nearest router “VyOS3” using the IP addresses of the sources. + +- 172.17.1.2 CS0 -> CS4 +- 172.17.1.3 CS0 -> CS5 +- 172.17.1.4 CS0 -> CS6 +- 172.17.1.40 CS0 by default + +Next, we will replace only all CS4 labels on the “VyOS2” router. + +- CS4 -> CS5 + +In the end, we will configure the traffic shaper using QoS mechanisms on the “VYOS2” router. + +## Configuration: + +Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll use in this case only static routes. +On the VyOS3 router, we need to change the 'dscp' labels for the VPCs. To do this, we use this configuration. + +```none +set interfaces ethernet eth0 address '10.1.1.100/24' +set interfaces ethernet eth1 address '172.17.1.1/24' +set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 +set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' +set qos policy shaper vyos3 class 10 set-dscp 'CS4' +set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' +set qos policy shaper vyos3 class 20 set-dscp 'CS5' +set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' +set qos policy shaper vyos3 class 30 set-dscp 'CS6' +set qos policy shaper vyos3 default bandwidth '10%' +set qos policy shaper vyos3 default ceiling '100%' +set qos policy shaper vyos3 default priority '7' +set qos policy shaper vyos3 default queue-type 'fair-queue' +set qos interface eth0 egress 'vyos3' +``` + +Main rules: + +- ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32 +- ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32 +- ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32 + +Check the result + +```{image} /_static/images/qos2.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +Before the interface eth0 on router VyOS3 + +```{image} /_static/images/qos3.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +After the interface eth0 on router VyOS3 + +```{image} /_static/images/qos4.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +On the router, VyOS4 set all traffic as CS4. We have to configure the default class and class for changing all labels from CS0 to CS4 + +```none +set interfaces ethernet eth0 address '10.2.1.100/24' +set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 +set qos policy shaper vyos4 class 10 bandwidth '100%' +set qos policy shaper vyos4 class 10 burst '15k' +set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' +set qos policy shaper vyos4 class 10 queue-type 'fair-queue' +set qos policy shaper vyos4 class 10 set-dscp 'CS4' +set qos policy shaper vyos4 default bandwidth '10%' +set qos policy shaper vyos4 default burst '15k' +set qos policy shaper vyos4 default ceiling '100%' +set qos policy shaper vyos4 default priority '7' +set qos policy shaper vyos4 default queue-type 'fair-queue' +set qos interface eth0 egress 'vyos4' +``` + +Next on the router VyOS2 we will change labels on all incoming traffic only from CS4-> CS6 + +```{image} /_static/images/qos5.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```none +set interfaces ethernet eth0 address '10.1.1.1/24' +set interfaces ethernet eth1 address '10.2.1.1/24' +set interfaces ethernet eth2 address '10.9.9.1/24' +set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 +set qos policy shaper vyos2 class 10 bandwidth '100%' +set qos policy shaper vyos2 class 10 burst '15k' +set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' +set qos policy shaper vyos2 class 10 queue-type 'fair-queue' +set qos policy shaper vyos2 class 10 set-dscp 'CS5' +set qos policy shaper vyos2 default bandwidth '100%' +set qos policy shaper vyos2 default burst '15k' +set qos policy shaper vyos2 default ceiling '100%' +set qos policy shaper vyos2 default priority '7' +set qos policy shaper vyos2 default queue-type 'fair-queue' +set qos interface eth2 egress 'vyos2' +``` + +```{image} /_static/images/qos6.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +- 172.17.1.2/24 CS0 + +```{image} /_static/images/qos7.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +- 172.17.1.2/24 CS0 - > CS4 + +```{image} /_static/images/qos8.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +- 172.17.1.2/24 CS4 - > CS5 + +```{image} /_static/images/qos9.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +In the end, on the router “VyOS2” we will set outgoing bandwidth limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work with the help of the “iPerf” utility. + +Set up bandwidth limits on the eth2 interface of the router “VyOS2”. + +```none +vyos@vyos2# show qos policy shaper vyos2 class 20 +bandwidth 5mbit +description "for VyOS3 eth0" +match VyOS3 { + ip { + source { + address 10.1.1.100/32 + } + } +} +``` + +Check the result. + +```{image} /_static/images/qos10.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +As we see shaper is working and the traffic will not work over 5 Mbit/s. diff --git a/docs/configexamples/qos.rst b/docs/configexamples/qos.rst deleted file mode 100644 index 842719c5..00000000 --- a/docs/configexamples/qos.rst +++ /dev/null @@ -1,182 +0,0 @@ -:lastproofread: 2023-02-18 - -.. _examples-qos: - -########### -QoS example -########### - -Configuration 'dcsp' and shaper using QoS -========================================= - -In this case, we'll try to make a simple lab using QoS and the general ability of the VyOS system. -We recommend you to go through the main article about `QoS `_ first. - - -Using the general schema for example: - -.. image:: /_static/images/qos1.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -We have four hosts on the local network 172.17.1.0/24. All hosts are labeled CS0 by default. We need to replace labels on all hosts except vpc8. -We will replace the labels on the nearest router “VyOS3” using the IP addresses of the sources. - -* 172.17.1.2 CS0 -> CS4 -* 172.17.1.3 CS0 -> CS5 -* 172.17.1.4 CS0 -> CS6 -* 172.17.1.40 CS0 by default - -Next, we will replace only all CS4 labels on the “VyOS2” router. - -* CS4 -> CS5 - -In the end, we will configure the traffic shaper using QoS mechanisms on the “VYOS2” router. - -Configuration: -============== - -Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll use in this case only static routes. -On the VyOS3 router, we need to change the 'dscp' labels for the VPCs. To do this, we use this configuration. - -.. code-block:: none - - set interfaces ethernet eth0 address '10.1.1.100/24' - set interfaces ethernet eth1 address '172.17.1.1/24' - set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 - set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' - set qos policy shaper vyos3 class 10 set-dscp 'CS4' - set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' - set qos policy shaper vyos3 class 20 set-dscp 'CS5' - set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' - set qos policy shaper vyos3 class 30 set-dscp 'CS6' - set qos policy shaper vyos3 default bandwidth '10%' - set qos policy shaper vyos3 default ceiling '100%' - set qos policy shaper vyos3 default priority '7' - set qos policy shaper vyos3 default queue-type 'fair-queue' - set qos interface eth0 egress 'vyos3' - -Main rules: - -* ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32 -* ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32 -* ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32 - - -Check the result - -.. image:: /_static/images/qos2.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -Before the interface eth0 on router VyOS3 - -.. image:: /_static/images/qos3.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -After the interface eth0 on router VyOS3 - -.. image:: /_static/images/qos4.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -On the router, VyOS4 set all traffic as CS4. We have to configure the default class and class for changing all labels from CS0 to CS4 - -.. code-block:: none - - set interfaces ethernet eth0 address '10.2.1.100/24' - set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 - set qos policy shaper vyos4 class 10 bandwidth '100%' - set qos policy shaper vyos4 class 10 burst '15k' - set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' - set qos policy shaper vyos4 class 10 queue-type 'fair-queue' - set qos policy shaper vyos4 class 10 set-dscp 'CS4' - set qos policy shaper vyos4 default bandwidth '10%' - set qos policy shaper vyos4 default burst '15k' - set qos policy shaper vyos4 default ceiling '100%' - set qos policy shaper vyos4 default priority '7' - set qos policy shaper vyos4 default queue-type 'fair-queue' - set qos interface eth0 egress 'vyos4' - -Next on the router VyOS2 we will change labels on all incoming traffic only from CS4-> CS6 - -.. image:: /_static/images/qos5.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. code-block:: none - - set interfaces ethernet eth0 address '10.1.1.1/24' - set interfaces ethernet eth1 address '10.2.1.1/24' - set interfaces ethernet eth2 address '10.9.9.1/24' - set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 - set qos policy shaper vyos2 class 10 bandwidth '100%' - set qos policy shaper vyos2 class 10 burst '15k' - set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' - set qos policy shaper vyos2 class 10 queue-type 'fair-queue' - set qos policy shaper vyos2 class 10 set-dscp 'CS5' - set qos policy shaper vyos2 default bandwidth '100%' - set qos policy shaper vyos2 default burst '15k' - set qos policy shaper vyos2 default ceiling '100%' - set qos policy shaper vyos2 default priority '7' - set qos policy shaper vyos2 default queue-type 'fair-queue' - set qos interface eth2 egress 'vyos2' - -.. image:: /_static/images/qos6.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -* 172.17.1.2/24 CS0 - -.. image:: /_static/images/qos7.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -* 172.17.1.2/24 CS0 - > CS4 - -.. image:: /_static/images/qos8.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -* 172.17.1.2/24 CS4 - > CS5 - -.. image:: /_static/images/qos9.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -In the end, on the router “VyOS2” we will set outgoing bandwidth limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work with the help of the “iPerf” utility. - -Set up bandwidth limits on the eth2 interface of the router “VyOS2”. - -.. code-block:: none - - - vyos@vyos2# show qos policy shaper vyos2 class 20 - bandwidth 5mbit - description "for VyOS3 eth0" - match VyOS3 { - ip { - source { - address 10.1.1.100/32 - } - } - } - -Check the result. - -.. image:: /_static/images/qos10.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -As we see shaper is working and the traffic will not work over 5 Mbit/s. diff --git a/docs/configexamples/rst-azure-vpn-bgp.rst b/docs/configexamples/rst-azure-vpn-bgp.rst new file mode 100644 index 00000000..f272aafd --- /dev/null +++ b/docs/configexamples/rst-azure-vpn-bgp.rst @@ -0,0 +1,137 @@ +:lastproofread: 2021-06-28 + +.. _examples-azure-vpn-bgp: + +Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) +------------------------------------------------------------ + +This guide shows an example of a route-based IKEv2 site-to-site VPN to +Azure using VTI and BGP for dynamic routing updates. + +For redundant / active-active configurations see +:ref:`examples-azure-vpn-dual-bgp` + + +Prerequisites +^^^^^^^^^^^^^ + +- A pair of Azure VNet Gateways deployed in active-passive + configuration with BGP enabled. + +- A local network gateway deployed in Azure representing + the Vyos device, matching the below Vyos settings except for + address space, which only requires the Vyos private IP, in + this example 10.10.0.5/32 + +- A connection resource deployed in Azure linking the + Azure VNet gateway and the local network gateway representing + the Vyos device. + +Example +^^^^^^^ + ++---------------------------------------+---------------------+ +| WAN Interface | eth0 | ++---------------------------------------+---------------------+ +| On-premises address space | 10.10.0.0/16 | ++---------------------------------------+---------------------+ +| Azure address space | 10.0.0.0/16 | ++---------------------------------------+---------------------+ +| Vyos public IP | 198.51.100.3 | ++---------------------------------------+---------------------+ +| Vyos private IP | 10.10.0.5 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway public IP | 203.0.113.2 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway BGP IP | 10.0.0.4 | ++---------------------------------------+---------------------+ +| Pre-shared key | ch00s3-4-s3cur3-psk | ++---------------------------------------+---------------------+ +| Vyos ASN | 64499 | ++---------------------------------------+---------------------+ +| Azure ASN | 65540 | ++---------------------------------------+---------------------+ + +Vyos configuration +^^^^^^^^^^^^^^^^^^ + +- Configure the IKE and ESP settings to match a subset + of those supported by Azure: + +.. code-block:: none + + set vpn ipsec esp-group AZURE lifetime '3600' + set vpn ipsec esp-group AZURE mode 'tunnel' + set vpn ipsec esp-group AZURE pfs 'dh-group2' + set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' + set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' + + set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' + set vpn ipsec ike-group AZURE dead-peer-detection interval '15' + set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' + set vpn ipsec ike-group AZURE ikev2-reauth + set vpn ipsec ike-group AZURE key-exchange 'ikev2' + set vpn ipsec ike-group AZURE lifetime '28800' + set vpn ipsec ike-group AZURE proposal 1 dh-group '2' + set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' + set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' + +- Enable IPsec on eth0 + +.. code-block:: none + + set vpn ipsec interface 'eth0' + +- Configure a VTI with a dummy IP address + +.. code-block:: none + + set interfaces vti vti1 address '10.10.1.5/32' + set interfaces vti vti1 description 'Azure Tunnel' + +- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. + +.. code-block:: none + + set interfaces vti vti1 ip adjust-mss 1350 + +- Configure the VPN tunnel + +.. code-block:: none + + set vpn ipsec authentication psk azure id '198.51.100.3' + set vpn ipsec authentication psk azure id '203.0.113.2' + set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' + set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3' + set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' + set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond' + set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' + set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' + set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' + set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' + set vpn ipsec site-to-site peer azure remote-address '203.0.113.2' + set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' + set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' + +- **Important**: Add an interface route to reach Azure's BGP listener + +.. code-block:: none + + set protocols static route 10.0.0.4/32 interface vti1 + +- Configure your BGP settings + +.. code-block:: none + + set protocols bgp system-as 64499 + set protocols bgp neighbor 10.0.0.4 remote-as '65540' + set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' + set protocols bgp neighbor 10.0.0.4 timers holdtime '30' + set protocols bgp neighbor 10.0.0.4 timers keepalive '10' + +- **Important**: Disable connected check \ + +.. code-block:: none + + set protocols bgp neighbor 10.0.0.4 disable-connected-check diff --git a/docs/configexamples/rst-azure-vpn-dual-bgp.rst b/docs/configexamples/rst-azure-vpn-dual-bgp.rst new file mode 100644 index 00000000..d019092c --- /dev/null +++ b/docs/configexamples/rst-azure-vpn-dual-bgp.rst @@ -0,0 +1,162 @@ +:lastproofread: 2021-06-28 + +.. _examples-azure-vpn-dual-bgp: + +Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) +---------------------------------------------------------------------- + +This guide shows an example of a redundant (active-active) route-based IKEv2 +site-to-site VPN to Azure using VTI +and BGP for dynamic routing updates. + +Prerequisites +^^^^^^^^^^^^^ + +- A pair of Azure VNet Gateways deployed in active-active + configuration with BGP enabled. + +- A local network gateway deployed in Azure representing + the Vyos device, matching the below Vyos settings except for + address space, which only requires the Vyos private IP, in + this example 10.10.0.5/32 + +- A connection resource deployed in Azure linking the + Azure VNet gateway and the local network gateway representing + the Vyos device. + +Example +^^^^^^^ + ++---------------------------------------+---------------------+ +| WAN Interface | eth0 | ++---------------------------------------+---------------------+ +| On-premises address space | 10.10.0.0/16 | ++---------------------------------------+---------------------+ +| Azure address space | 10.0.0.0/16 | ++---------------------------------------+---------------------+ +| Vyos public IP | 198.51.100.3 | ++---------------------------------------+---------------------+ +| Vyos private IP | 10.10.0.5 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway 1 public IP | 203.0.113.2 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway 2 public IP | 203.0.113.3 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway BGP IP | 10.0.0.4,10.0.0.5 | ++---------------------------------------+---------------------+ +| Pre-shared key | ch00s3-4-s3cur3-psk | ++---------------------------------------+---------------------+ +| Vyos ASN | 64499 | ++---------------------------------------+---------------------+ +| Azure ASN | 65540 | ++---------------------------------------+---------------------+ + +Vyos configuration +^^^^^^^^^^^^^^^^^^ + +- Configure the IKE and ESP settings to match a subset + of those supported by Azure: + +.. code-block:: none + + set vpn ipsec esp-group AZURE lifetime '3600' + set vpn ipsec esp-group AZURE mode 'tunnel' + set vpn ipsec esp-group AZURE pfs 'dh-group2' + set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' + set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' + + set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' + set vpn ipsec ike-group AZURE dead-peer-detection interval '15' + set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' + set vpn ipsec ike-group AZURE ikev2-reauth + set vpn ipsec ike-group AZURE key-exchange 'ikev2' + set vpn ipsec ike-group AZURE lifetime '28800' + set vpn ipsec ike-group AZURE proposal 1 dh-group '2' + set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' + set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' + +- Enable IPsec on eth0 + +.. code-block:: none + + set vpn ipsec interface 'eth0' + +- Configure two VTIs with a dummy IP address each + +.. code-block:: none + + set interfaces vti vti1 address '10.10.1.5/32' + set interfaces vti vti1 description 'Azure Primary Tunnel' + + set interfaces vti vti2 address '10.10.1.6/32' + set interfaces vti vti2 description 'Azure Secondary Tunnel' + +- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. + +.. code-block:: none + + set interfaces vti vti1 ip adjust-mss 1350 + set interfaces vti vti2 ip adjust-mss 1350 + +- Configure the VPN tunnels + +.. code-block:: none + + set vpn ipsec authentication psk azure id '198.51.100.3' + set vpn ipsec authentication psk azure id '203.0.113.2' + set vpn ipsec authentication psk azure id '203.0.113.3' + set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' + + set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3' + set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2' + set vpn ipsec site-to-site peer azure-primary connection-type 'respond' + set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL' + set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE' + set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit' + set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5' + set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2' + set vpn ipsec site-to-site peer azure-primary vti bind 'vti1' + set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE' + + set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3' + set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3' + set vpn ipsec site-to-site peer azure-secondary connection-type 'respond' + set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL' + set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE' + set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit' + set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5' + set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3' + set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2' + set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE' + +- **Important**: Add an interface route to reach both Azure's BGP listeners + +.. code-block:: none + + set protocols static route 10.0.0.4/32 interface vti1 + set protocols static route 10.0.0.5/32 interface vti2 + +- Configure your BGP settings + +.. code-block:: none + + set protocols bgp system-as 64499 + set protocols bgp neighbor 10.0.0.4 remote-as '65540' + set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' + set protocols bgp neighbor 10.0.0.4 timers holdtime '30' + set protocols bgp neighbor 10.0.0.4 timers keepalive '10' + + set protocols bgp neighbor 10.0.0.5 remote-as '65540' + set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound' + set protocols bgp neighbor 10.0.0.5 timers holdtime '30' + set protocols bgp neighbor 10.0.0.5 timers keepalive '10' + +- **Important**: Disable connected check, otherwise the routes learned + from Azure will not be imported into the routing table. + +.. code-block:: none + + set protocols bgp neighbor 10.0.0.4 disable-connected-check + set protocols bgp neighbor 10.0.0.5 disable-connected-check diff --git a/docs/configexamples/rst-bgp-ipv6-unnumbered.rst b/docs/configexamples/rst-bgp-ipv6-unnumbered.rst new file mode 100644 index 00000000..f7a530d8 --- /dev/null +++ b/docs/configexamples/rst-bgp-ipv6-unnumbered.rst @@ -0,0 +1,176 @@ +:lastproofread: 2021-06-28 + +.. _examples-bgp-ipv6-unnumbered: + +######################################### +BGP IPv6 unnumbered with extended nexthop +######################################### + +General information can be found in the :ref:`routing-bgp` chapter. + +Configuration +============= + +- Router A: + +.. code-block:: none + + set protocols bgp system-as 64496 + set protocols bgp address-family ipv4-unicast redistribute connected + set protocols bgp address-family ipv6-unicast redistribute connected + set protocols bgp neighbor eth1 interface v6only + set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' + set protocols bgp neighbor eth2 interface v6only + set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' + set protocols bgp parameters bestpath as-path multipath-relax + set protocols bgp parameters bestpath compare-routerid + set protocols bgp parameters default no-ipv4-unicast + set protocols bgp parameters router-id '192.168.0.1' + set protocols bgp peer-group fabric address-family ipv4-unicast + set protocols bgp peer-group fabric address-family ipv6-unicast + set protocols bgp peer-group fabric capability extended-nexthop + set protocols bgp peer-group fabric remote-as 'external' + +- Router B: + +.. code-block:: none + + set protocols bgp system-as 64499 + set protocols bgp address-family ipv4-unicast redistribute connected + set protocols bgp address-family ipv6-unicast redistribute connected + set protocols bgp neighbor eth1 interface v6only + set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' + set protocols bgp neighbor eth2 interface v6only + set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' + set protocols bgp parameters bestpath as-path multipath-relax + set protocols bgp parameters bestpath compare-routerid + set protocols bgp parameters default no-ipv4-unicast + set protocols bgp parameters router-id '192.168.0.2' + set protocols bgp peer-group fabric address-family ipv4-unicast + set protocols bgp peer-group fabric address-family ipv6-unicast + set protocols bgp peer-group fabric capability extended-nexthop + set protocols bgp peer-group fabric remote-as 'external' + +Results +======= + +- Router A: + +.. code-block:: none + + vyos@vyos:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 198.51.100.34/24 u/u + eth1 - u/u + eth2 - u/u + lo 127.0.0.1/8 u/u + 192.168.0.1/32 + ::1/128 + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route + + S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53 + C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53 + C>* 192.168.0.1/32 is directly connected, lo, 03:21:56 + B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07 + * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07 + +.. code-block:: none + + vyos@vyos:~$ ping 192.168.0.2 + PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data. + 64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms + 64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms + 64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms + 64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms + 64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms + + --- 192.168.0.2 ping statistics --- + 5 packets transmitted, 5 received, 0% packet loss, time 4086ms + rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms + +.. code-block:: none + + vyos@vyos:~$ show ip bgp summary + + IPv4 Unicast Summary: + BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0 + BGP table version 4 + RIB entries 5, using 800 bytes of memory + Peers 2, using 41 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd + eth1 4 64499 13 13 0 0 0 00:05:33 2 + eth2 4 64499 13 14 0 0 0 00:05:29 2 + + Total number of neighbors 2 + +- Router B: + +.. code-block:: none + + vyos@vyos:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 198.51.100.33/24 u/u + eth1 - u/u + eth2 - u/u + lo 127.0.0.1/8 u/u + 192.168.0.2/32 + ::1/128 + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route + + S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08 + C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09 + B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18 + * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18 + C>* 192.168.0.2/32 is directly connected, lo, 00:44:11 + +.. code-block:: none + + vyos@vyos:~$ ping 192.168.0.1 + PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. + 64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms + 64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms + 64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms + 64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms + + --- 192.168.0.1 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3051ms + rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms + +.. code-block:: none + + vyos@vyos:~$ show ip bgp summary + IPv4 Unicast Summary: + BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0 + BGP table version 4 + RIB entries 5, using 800 bytes of memory + Peers 2, using 41 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd + eth1 4 64496 14 14 0 0 0 00:06:40 2 + eth2 4 64496 14 14 0 0 0 00:06:37 2 + + Total number of neighbors 2 + diff --git a/docs/configexamples/rst-firewall.rst b/docs/configexamples/rst-firewall.rst new file mode 100644 index 00000000..e0a4ca55 --- /dev/null +++ b/docs/configexamples/rst-firewall.rst @@ -0,0 +1,12 @@ +:lastproofread: 2024-06-14 + +Firewall Examples +================= + +This section contains examples of firewall configurations for various deployments. + +.. toctree:: + :maxdepth: 2 + + fwall-and-vrf + zone-policy diff --git a/docs/configexamples/rst-fwall-and-vrf.rst b/docs/configexamples/rst-fwall-and-vrf.rst new file mode 100644 index 00000000..38663a18 --- /dev/null +++ b/docs/configexamples/rst-fwall-and-vrf.rst @@ -0,0 +1,121 @@ +VRF and firewall example +------------------------ + +Scenario and requirements +^^^^^^^^^^^^^^^^^^^^^^^^^ + +This example shows how to configure a VyOS router with VRFs and firewall rules. + +Diagram used in this example: + +.. image:: /_static/images/firewall-and-vrf-blueprints.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +As exposed in the diagram, there are four VRFs. These VRFs are ``MGMT``, +``WAN``, ``LAN`` and ``PROD``, and their requirements are: + +* VRF MGMT: + * Allow connections to LAN and PROD. + * Deny connections to internet(WAN). + * Allow connections to the router. +* VRF LAN: + * Allow connections to PROD. + * Allow connections to internet(WAN). +* VRF PROD: + * Only accepts connections. +* VRF WAN: + * Allow connection to PROD. + +Configuration +^^^^^^^^^^^^^ + +First, we need to configure the interfaces and VRFs: + +.. code-block:: none + + set interfaces ethernet eth1 address '10.100.100.1/24' + set interfaces ethernet eth1 vrf 'MGMT' + set interfaces ethernet eth2 vif 150 address '10.150.150.1/24' + set interfaces ethernet eth2 vif 150 vrf 'LAN' + set interfaces ethernet eth2 vif 160 address '10.160.160.1/24' + set interfaces ethernet eth2 vif 160 vrf 'LAN' + set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24' + set interfaces ethernet eth2 vif 3500 vrf 'PROD' + set interfaces loopback lo + set interfaces pppoe pppoe0 authentication password 'p4ssw0rd' + set interfaces pppoe pppoe0 authentication username 'vyos' + set interfaces pppoe pppoe0 source-interface 'eth0' + set interfaces pppoe pppoe0 vrf 'WAN' + set vrf bind-to-all + set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' + set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' + set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' + set vrf name LAN table '103' + set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' + set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' + set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' + set vrf name MGMT table '102' + set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' + set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' + set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' + set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' + set vrf name PROD table '104' + set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' + set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' + set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' + set vrf name WAN table '101' + +And before firewall rules are shown, we need to pay attention how to configure +and match interfaces and VRFs. In case where an interface is assigned to a +non-default VRF, if we want to use inbound-interface or outbound-interface in +firewall rules, we need to: + +* For **inbound-interface**: use the interface name with the VRF name, like + ``MGMT`` or ``LAN``. +* For **outbound-interface**: use the interface name, like ``eth0``, ``vtun0``, + ``eth2*`` or similar. + +Next, we need to configure the firewall rules. First we will define all rules +for transit traffic between VRFs. + +.. code-block:: none + + set firewall ipv4 forward filter default-action 'drop' + set firewall ipv4 forward filter default-log + set firewall ipv4 forward filter rule 10 action 'accept' + set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD' + set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT' + set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*' + set firewall ipv4 forward filter rule 99 action 'drop' + set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt' + set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1' + set firewall ipv4 forward filter rule 120 action 'accept' + set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD' + set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN' + set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500' + set firewall ipv4 forward filter rule 130 action 'accept' + set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet' + set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN' + set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0' + +Also, we are adding global state policies, in order to allow established and +related traffic, in order not to drop valid responses: + +.. code-block:: none + + set firewall global-options state-policy established action 'accept' + set firewall global-options state-policy invalid action 'drop' + set firewall global-options state-policy related action 'accept' + +And finally, we need to allow input connections to the router itself only from +vrf MGMT: + +.. code-block:: none + + set firewall ipv4 input filter default-action 'drop' + set firewall ipv4 input filter default-log + set firewall ipv4 input filter rule 10 action 'accept' + set firewall ipv4 input filter rule 10 description 'MGMT - Allow input' + set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT' \ No newline at end of file diff --git a/docs/configexamples/rst-ha.rst b/docs/configexamples/rst-ha.rst new file mode 100644 index 00000000..1ceda8e9 --- /dev/null +++ b/docs/configexamples/rst-ha.rst @@ -0,0 +1,584 @@ +:lastproofread: 2021-06-28 + +.. _example-high-availability: + +############################# +High Availability Walkthrough +############################# + +This document walks you through a complete HA setup of two VyOS machines. This +design is based on a VM as the primary router and a physical machine as a +backup, using VRRP, BGP, OSPF, and conntrack sharing. + +This document aims to walk you through setting everything up, so +at a point where you can reboot any machine and not lose more than a few +seconds worth of connectivity. + +Design +====== + +This is based on a real-life production design. One of the complex issues +is ensuring you have redundant data INTO your network. We do this with a pair +of Cisco Nexus switches and using Virtual PortChannels that are spanned across +them. As a bonus, this also allows for complete switch failure without +an outage. How you achieve this yourself is left as an exercise to the reader. +But our setup is documented here. + +Walkthrough suggestion +---------------------- + +The ``commit`` command is implied after every section. If you make an error, +``commit`` will warn you and you can fix it before getting too far into things. +Please ensure you commit early and commit often. + +If you are following through this document, it is strongly suggested you +complete the entire document, ONLY doing the virtual router1 steps, and then +come back and walk through it AGAIN on the backup hardware router. + +This ensures you don't go too fast or miss a step. However, it will make your +life easier to configure the fixed IP address and default route now on the +hardware router. + +Example Network +--------------- + +In this document, we have been allocated 203.0.113.0/24 by our upstream +provider, which we are publishing on VLAN100. + +They want us to establish a BGP session to their routers on 192.0.2.11 and +192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and +we are AS 65551. + +Our routers are going to have a floating IP address of 203.0.113.1, and use +.2 and .3 as their fixed IPs. + +We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201. + +When traffic is originated from the 10.200.201.0/24 network, it will be +masqueraded to 203.0.113.1 + +For connection between sites, we are running a WireGuard link to two REMOTE +routers and using OSPF over those links to distribute routes. That remote +site is expected to send traffic from anything in 10.201.0.0/16 + +VLANs +----- + +These are the vlans we will be using: + +* 50: Upstream, using the 192.0.2.0/24 network allocated by them. +* 100: 'Public' network, using our 203.0.113.0/24 network. +* 201: 'Internal' network, using 10.200.201.0/24 + +Hardware +-------- + +* switch1 (Nexus 10gb Switch) +* switch2 (Nexus 10gb Switch) +* compute1 (VMware ESXi 6.5) +* compute2 (VMware ESXi 6.5) +* compute3 (VMware ESXi 6.5) +* router2 (Random 1RU machine with 4 NICs) + +Note that router1 is a VM that runs on one of the compute nodes. + +Network Cabling +--------------- + +* From Datacenter - This connects into port 1 on both switches, and is tagged + as VLAN 50 +* Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch +* Hardware Router - Port 8 of each switch +* compute1 - Port 9 of each switch +* compute2 - Port 10 of each switch +* compute3 - Port 11 of each switch + +This is ignoring the extra Out-of-band management networking, which should be +on totally different switches, and a different feed into the rack, and is out +of scope of this. + +.. note:: Our implementation uses VMware's Distributed Port Groups, which allows + VMware to use LACP. This is a part of the ENTERPRISE licence, and is not + available on a free licence. If you are implementing this and do not have + access to DPGs, you should not use VMware, and use some other virtualization + platform instead. + + +Basic Setup (via console) +========================= + +Create your router1 VM. So it can withstand a VM Host failing or a +network link failing. Using VMware, this is achieved by enabling vSphere DRS, +vSphere Availability, and creating a Distributed Port Group that uses LACP. + +Many other Hypervisors do this, and I'm hoping that this document will be +expanded to document how to do this for others. + +Create an 'All VLANs' network group, that passes all trunked traffic through +to the VM. Attach this network group to router1 as eth0. + +.. note:: VMware: You must DISABLE SECURITY on this Port group. Make sure that + ``Promiscuous Mode``\ , ``MAC address changes`` and ``Forged transmits`` are + enabled. All of these will be done as part of failover. + +Bonding on Hardware Router +-------------------------- + +Create a LACP bond on the hardware router. We are assuming that eth0 and eth1 +are connected to port 8 on both switches, and that those ports are configured +as a Port-Channel. + +.. code-block:: none + + set interfaces bonding bond0 description 'Switch Port-Channel' + set interfaces bonding bond0 hash-policy 'layer2' + set interfaces bonding bond0 member interface 'eth0' + set interfaces bonding bond0 member interface 'eth1' + set interfaces bonding bond0 mode '802.3ad' + + +Assign external IP addresses +---------------------------- + +VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this +is talking directly to upstream. Create our IP address on vlan50. + +For the hardware router, replace ``eth0`` with ``bond0``. As (almost) every +command is identical, this will not be specified unless different things need +to be performed on different hosts. + +.. code-block:: none + + set interfaces ethernet eth0 vif 50 address '192.0.2.21/24' + +In this case, the hardware router has a different IP, so it would be + +.. code-block:: none + + set interfaces ethernet bond0 vif 50 address '192.0.2.22/24' + +Add (temporary) default route +----------------------------- + +It is assumed that the routers provided by upstream are capable of acting as a +default router, add that as a static route. + +.. code-block:: none + + set protocols static route 0.0.0.0/0 next-hop 192.0.2.11 + commit + save + + +Enable SSH +---------- + +Enable SSH so you can now SSH into the routers, rather than using the console. + +.. code-block:: none + + set service ssh + commit + save + +At this point, you should be able to SSH into both of them, and will no longer +need access to the console (unless you break something!) + + +VRRP Configuration +================== + +We are setting up VRRP so that it does NOT fail back when a machine returns into +service, and it prioritizes router1 over router2. + +Internal Network +---------------- + +This has a floating IP address of 10.200.201.1/24, using virtual router ID 201. +The difference between them is the interface name, hello-source-address, and +peer-address. + +**router1** + +.. code-block:: none + + set interfaces ethernet eth0 vif 201 address 10.200.201.2/24 + set high-availability vrrp group int hello-source-address '10.200.201.2' + set high-availability vrrp group int interface 'eth0.201' + set high-availability vrrp group int peer-address '10.200.201.3' + set high-availability vrrp group int no-preempt + set high-availability vrrp group int priority '200' + set high-availability vrrp group int address '10.200.201.1/24' + set high-availability vrrp group int vrid '201' + + +**router2** + +.. code-block:: none + + set interfaces ethernet bond0 vif 201 address 10.200.201.3/24 + set high-availability vrrp group int hello-source-address '10.200.201.3' + set high-availability vrrp group int interface 'bond0.201' + set high-availability vrrp group int peer-address '10.200.201.2' + set high-availability vrrp group int no-preempt + set high-availability vrrp group int priority '100' + set high-availability vrrp group int address '10.200.201.1/24' + set high-availability vrrp group int vrid '201' + + +Public Network +-------------- + +This has a floating IP address of 203.0.113.1/24, using virtual router ID 113. +The virtual router ID is just a random number between 1 and 254, and can be set +to whatever you want. Best practices suggest you try to keep them unique +enterprise-wide. + +**router1** + +.. code-block:: none + + set interfaces ethernet eth0 vif 100 address 203.0.113.2/24 + set high-availability vrrp group public hello-source-address '203.0.113.2' + set high-availability vrrp group public interface 'eth0.100' + set high-availability vrrp group public peer-address '203.0.113.3' + set high-availability vrrp group public no-preempt + set high-availability vrrp group public priority '200' + set high-availability vrrp group public address '203.0.113.1/24' + set high-availability vrrp group public vrid '113' + +**router2** + +.. code-block:: none + + set interfaces ethernet bond0 vif 100 address 203.0.113.3/24 + set high-availability vrrp group public hello-source-address '203.0.113.3' + set high-availability vrrp group public interface 'bond0.100' + set high-availability vrrp group public peer-address '203.0.113.2' + set high-availability vrrp group public no-preempt + set high-availability vrrp group public priority '100' + set high-availability vrrp group public address '203.0.113.1/24' + set high-availability vrrp group public vrid '113' + + +Create VRRP sync-group +---------------------- + +The sync group is used to replicate connection tracking. It needs to be assigned +to a random VRRP group, and we are creating a sync group called ``sync`` using +the vrrp group ``int``. + +.. code-block:: none + + set high-availability vrrp sync-group sync member 'int' + +Testing +------- + +At this point, you should be able to see both IP addresses when you run +``show interfaces``\ , and ``show vrrp`` should show both interfaces in MASTER +state (and SLAVE state on router2). + +.. code-block:: none + + vyos@router1:~$ show vrrp + Name Interface VRID State Last Transition + -------- ----------- ------ ------- ----------------- + int eth0.201 201 MASTER 100s + public eth0.100 113 MASTER 200s + vyos@router1:~$ + + +You should be able to ping to and from all the IPs you have allocated. + +NAT and conntrack-sync +====================== + +Masquerade Traffic originating from 10.200.201.0/24 that is heading out the +public interface. + +.. note:: We explicitly exclude the primary upstream network so that BGP or + OSPF traffic doesn't accidentally get NAT'ed. + +.. code-block:: none + + set nat source rule 10 destination address '!192.0.2.0/24' + set nat source rule 10 outbound-interface 'eth0.50' + set nat source rule 10 source address '10.200.201.0/24' + set nat source rule 10 translation address '203.0.113.1' + + +Configure conntrack-sync and enable helpers +-------------------------------------------- + +Conntrack helper modules are enabled by default, but they tend to cause more +problems than they're worth in complex networks. You can disable all of them +at one go. + +.. code-block:: none + + delete system conntrack modules + +Now enable replication between nodes. Replace eth0.201 with bond0.201 on the +hardware router. + +.. code-block:: none + + set service conntrack-sync accept-protocol 'tcp,udp,icmp' + set service conntrack-sync event-listen-queue-size '8' + set service conntrack-sync failover-mechanism vrrp sync-group 'sync' + set service conntrack-sync interface eth0.201 + set service conntrack-sync mcast-group '224.0.0.50' + set service conntrack-sync sync-queue-size '8' + +.. _ha:contracktesting: + +Testing +------- + +The simplest way to test is to look at the connection tracking stats on the +standby hardware router with the command ``show conntrack-sync statistics``. +The numbers should be very close to the numbers on the primary router. + +When you have both routers up, you should be able to establish a connection +from a NAT'ed machine out to the internet, reboot the active machine, and that +connection should be preserved, and will not drop out. + +OSPF Over WireGuard +=================== + +Wireguard doesn't have the concept of an up or down link, due to its design. +This complicates AND simplifies using it for network transport, as for reliable +state detection you need to use SOMETHING to detect when the link is down. + +If you use a routing protocol itself, you solve two problems at once. This is +only a basic example, and is provided as a starting point. + +Configure Wireguard +------------------- + +There is plenty of instructions and documentation on setting up Wireguard. The +only important thing you need to remember is to only use one WireGuard +interface per OSPF connection. + +We use small /30's from 10.254.60/24 for the point-to-point links. + +**router1** + +Replace the 203.0.113.3 with whatever the other router's IP address is. + +.. code-block:: none + + set interfaces wireguard wg01 address '10.254.60.1/30' + set interfaces wireguard wg01 description 'router1-to-offsite1' + set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' + set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001' + set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' + set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' + set interfaces wireguard wg01 port '50001' + set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' + set protocols ospf interface wg01 cost '11' + set protocols ospf interface wg01 dead-interval '5' + set protocols ospf interface wg01 hello-interval '1' + set protocols ospf interface wg01 network 'point-to-point' + set protocols ospf interface wg01 priority '1' + set protocols ospf interface wg01 retransmit-interval '5' + set protocols ospf interface wg01 transmit-delay '1' + + +**offsite1** + +This is connecting back to the STATIC IP of router1, not the floating. + +.. code-block:: none + + set interfaces wireguard wg01 address '10.254.60.2/30' + set interfaces wireguard wg01 description 'offsite1-to-router1' + set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0' + set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001' + set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15' + set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=' + set interfaces wireguard wg01 port '50001' + set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' + set protocols ospf interface wg01 cost '11' + set protocols ospf interface wg01 dead-interval '5' + set protocols ospf interface wg01 hello-interval '1' + set protocols ospf interface wg01 network 'point-to-point' + set protocols ospf interface wg01 priority '1' + set protocols ospf interface wg01 retransmit-interval '5' + set protocols ospf interface wg01 transmit-delay '1' + +Test WireGuard +-------------- + +Make sure you can ping 10.254.60.1 and .2 from both routers. + +Create Export Filter +-------------------- + +We only want to export the networks we know. Always do a whitelist on your route +filters, both importing and exporting. A good rule of thumb is +**'If you are not the default router for a network, don't advertise +it'**. This means we explicitly do not want to advertise the 192.0.2.0/24 +network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE +the default route for). This filter is applied to ``redistribute connected``. +If we WERE to advertise it, the remote machines would see 192.0.2.21 available +via their default route, establish the connection, and then OSPF would say +'192.0.2.0/24 is available via this tunnel', at which point the tunnel would +break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via +default again. This is called 'flapping'. + +.. code-block:: none + + set policy access-list 150 description 'Outbound OSPF Redistribution' + set policy access-list 150 rule 10 action 'permit' + set policy access-list 150 rule 10 destination any + set policy access-list 150 rule 10 source inverse-mask '0.0.0.255' + set policy access-list 150 rule 10 source network '10.200.201.0' + set policy access-list 150 rule 20 action 'permit' + set policy access-list 150 rule 20 destination any + set policy access-list 150 rule 20 source inverse-mask '0.0.0.255' + set policy access-list 150 rule 20 source network '203.0.113.0' + set policy access-list 150 rule 100 action 'deny' + set policy access-list 150 rule 100 destination any + set policy access-list 150 rule 100 source any + + +Create Import Filter +-------------------- + +We only want to import networks we know. Our OSPF peer should only be +advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE +MATCH. You deny in access-list 100 to accept the route. + +.. code-block:: none + + set policy access-list 100 description 'Inbound OSPF Routes from Peers' + set policy access-list 100 rule 10 action 'deny' + set policy access-list 100 rule 10 destination any + set policy access-list 100 rule 10 source inverse-mask '0.0.255.255' + set policy access-list 100 rule 10 source network '10.201.0.0' + set policy access-list 100 rule 100 action 'permit' + set policy access-list 100 rule 100 destination any + set policy access-list 100 rule 100 source any + set policy route-map PUBOSPF rule 100 action 'deny' + set policy route-map PUBOSPF rule 100 match ip address access-list '100' + set policy route-map PUBOSPF rule 500 action 'permit' + + +Enable OSPF +----------- + +Every router **must** have a unique router-id. +The 'reference-bandwidth' is used because when OSPF was originally designed, +the idea of a link faster than 1gbit was unheard of, and it does not scale +correctly. + +.. code-block:: none + + set protocols ospf area 0.0.0.0 authentication 'md5' + set protocols ospf area 0.0.0.0 network '10.254.60.0/24' + set protocols ospf auto-cost reference-bandwidth '10000' + set protocols ospf log-adjacency-changes + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.254.60.2' + set protocols ospf route-map PUBOSPF + + +Test OSPF +--------- + +When you have enabled OSPF on both routers, you should be able to see each +other with the command ``show ip ospf neighbour``. The state must be 'Full' +or '2-Way'. If it is not, then there is a network connectivity issue between the +hosts. This is often caused by NAT or MTU issues. You should not see any new +routes (unless this is the second pass) in the output of ``show ip route`` + +Advertise connected routes +========================== + +As a reminder, only advertise routes that you are the default router for. This +is why we are NOT announcing the 192.0.2.0/24 network, because if that was +announced into OSPF, the other routers would try to connect to that network +over a tunnel that connects to that network! + +.. code-block:: none + + set protocols ospf access-list 150 export 'connected' + set protocols ospf redistribute connected + + +You should now be able to see the advertised network on the other host. + +Duplicate configuration +----------------------- + +At this point, you now need to create the X link between all four routers. +Use amdifferent /30 for each link. + +Priorities +---------- + +Set the cost on the secondary links to be 200. This means that they will not +be used unless the primary links are down. + +.. code-block:: none + + set protocols ospf interface wg01 cost '10' + set protocols ospf interface wg01 cost '200' + + +This will be visible in 'show ip route'. + +BGP +=== + +BGP is an extremely complex network protocol. An example is provided here. + +.. note:: Router id's must be unique. + +**router1** + + +The ``redistribute ospf`` command is there purely as an example of how this can +be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as +it is not 203.0.113.0/24. + +.. code-block:: none + + set policy prefix-list BGPOUT description 'BGP Export List' + set policy prefix-list BGPOUT rule 10 action 'deny' + set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' + set policy prefix-list BGPOUT rule 10 ge '25' + set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' + set policy prefix-list BGPOUT rule 100 action 'permit' + set policy prefix-list BGPOUT rule 100 description 'Our network' + set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' + set policy prefix-list BGPOUT rule 10000 action 'deny' + set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' + + set policy route-map BGPOUT description 'BGP Export Filter' + set policy route-map BGPOUT rule 10 action 'permit' + set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT' + set policy route-map BGPOUT rule 10000 action 'deny' + set policy route-map BGPPREPENDOUT description 'BGP Export Filter' + set policy route-map BGPPREPENDOUT rule 10 action 'permit' + set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' + set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT' + set policy route-map BGPPREPENDOUT rule 10000 action 'deny' + + set protocols bgp system-as 65551 + set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 + set protocols bgp address-family ipv4-unicast redistribute connected metric '50' + set protocols bgp address-family ipv4-unicast redistribute ospf metric '50' + set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT' + set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound + set protocols bgp neighbor 192.0.2.11 remote-as '65550' + set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21' + set protocols bgp parameters router-id '192.0.2.21' + + +**router2** + +This is identical, but you use the BGPPREPENDOUT route-map to advertise the +route with a longer path. diff --git a/docs/configexamples/rst-index.rst b/docs/configexamples/rst-index.rst new file mode 100644 index 00000000..0b585972 --- /dev/null +++ b/docs/configexamples/rst-index.rst @@ -0,0 +1,58 @@ +.. _examples: + +Configuration Blueprints +======================== + +This chapter contains various configuration examples: + +.. toctree:: + :maxdepth: 2 + + firewall + bgp-ipv6-unnumbered + ospf-unnumbered + azure-vpn-bgp + azure-vpn-dual-bgp + ha + wan-load-balancing + pppoe-ipv6-basic + l3vpn-hub-and-spoke + lac-lns + inter-vrf-routing-vrf-lite + qos + segment-routing-isis + nmp + ipsec-cisco-policy-based + ipsec-cisco-route-based + ipsec-pa-route-based + + +Configuration Blueprints (autotest) +=================================== + +The next pages contains automatic full tested configuration examples. + +Each lab will build an test from an external script. +The page content will generate, so changes will not take an effect. + +A host ``vyos-oobm`` will use as a ssh proxy. This host is just +necessary for the Lab test. + +The process will do the following steps: + +1. create the lab on a eve-ng server +2. configure each host in the lab +3. do some defined tests +4. optional do an upgrade to a higher version and do step 3 again. +5. generate the documentation and include files +6. shutdown and destroy the lab, if there is no error + + +.. toctree:: + :maxdepth: 1 + + autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE + autotest/tunnelbroker/tunnelbroker + autotest/L3VPN_EVPN/L3VPN_EVPN + autotest/Wireguard/Wireguard + autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP diff --git a/docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst b/docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst new file mode 100644 index 00000000..0e442ab3 --- /dev/null +++ b/docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst @@ -0,0 +1,855 @@ +################################ +Inter-VRF Routing over VRF Lite +################################ + +**Virtual Routing and Forwarding** is a technology that allow multiple instance +of a routing table to exist within a single device. One of the key aspect of +**VRFs** is that do not share the same routes or interfaces, therefore packets +are forwarded between interfaces that belong to the same VRF only. + +Any information related to a VRF is not exchanged between devices -or in the +same device- by default, this is a technique called **VRF-Lite**. + +Keep networks isolated is -in general- a good principle, but there are cases +where you might need that some network can access other in a different VRF. + +The scope of this document is to cover such cases in a dynamic way without the +use of MPLS-LDP. + +General information about L3VPNs can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter. + +******** +Overview +******** + +Let’s say we have a requirement to have multiple networks. + +* LAN 1 +* LAN 2 +* Management +* Internet + +Both LANs have to be able to route between each other, both will have managed +devices through a dedicated management network and both will need Internet +access yet the LAN2 will need access to some set of outside networks, not all. +The management network will need access to both LANs but cannot have access +to/from the outside. + +This scenario could be a nightmare applying regular routing and might need +filtering in multiple interfaces. + +A simple solution could be using different routing tables, or VRFs +for all the networks so we can keep the routing restrictions. +But for us to route between the different VRFs we would need a cable or a +logical connection between each other: + +* One cable/logical connection between LAN1 and LAN2 +* One cable/logical connection between LAN1 and Internet +* One cable/logical connection between LAN2 and Internet +* One cable/logical connection between LAN1 and Management +* One cable/logical connection between LAN2 and Management + +As we can see this is unpractical. + +To address this scenario we will use to our advantage an extension of the BGP +routing protocol that will help us in the “Export” between VRFs without the +need for MPLS. + +MP-BGP or MultiProtocol BGP introduces two main concepts to solve this +limitation: +- Route Distinguisher (RD): Is used to distinguish between different VRFs +–called VPNs- inside the BGP Process. The RD is appended to each IPv4 Network +that is advertised into BGP for that VPN making it a unique VPNv4 route. +- Route Target (RT): This is an extended BGP community append to the VPNv4 route +in the Import/Export process. When a route passes from the VRF routing table +into the BGP process it will add the configured export extended community(ies) +for that VPN. When that route needs to go from BGP into the VRF routing table +will only pass if that given VPN import policy matches any of the appended +community(ies) into that prefix. + +******** +Topology +******** +.. image:: /_static/images/inter-vrf-routing-vrf-lite.png + :width: 70% + :align: center + :alt: Network Topology Diagram + + + + +IP Schema +========= + ++----------+------------+----------------+------------------+ +| Device-A | Device-B | IPv4 Network | IPv6 Network | ++----------+------------+----------------+------------------+ +| Core | LAN1 | 10.1.1.0/30 | 2001:db8::/127 | ++----------+------------+----------------+------------------+ +| Core | LAN2 | 172.16.2.0/30 | 2001:db8::2/127 | ++----------+------------+----------------+------------------+ +| Core | Management | 192.168.3.0/30 | 2001:db8::4/127 | ++----------+------------+----------------+------------------+ +| Core | ISP | 10.2.2.0/30 | 2001:db8::6/127 | ++----------+------------+----------------+------------------+ + +RD & RT Schema +============== + ++------------+-----------+-----------+ +| VRF | RD | RT | ++------------+-----------+-----------+ +| LAN1 | 64496:1 | 64496:1 | ++------------+-----------+-----------+ +| LAN2 | 64496:2 | 64496:2 | ++------------+-----------+-----------+ +| Management | 64496:50 | 64496:50 | ++------------+-----------+-----------+ +| Internet | 64496:100 | 64496:100 | ++------------+-----------+-----------+ + +************** +Configurations +************** + +.. note:: We use a static route configuration in between the Core and each + LAN and Management router, and BGP between the Core router and the ISP router + but any dynamic routing protocol can be used. + +Remote Networks +=============== + +The following template configuration can be used in each remote router based +in our topology. + +.. code-block:: none + + # Interface Configuration + set interface eth eth address + + # Static default route back to Core + set procotols static route 0.0.0.0/0 next-hop + +Core Router +=========== + +Step 1: VRF and Configurations to remote networks +------------------------------------------------- + +- Configuration + + + +Set the VRF name and Table ID, set interface address and bind it to the VRF. +Last add the static route to the remote network. + +.. code-block:: none + + # VRF name and table ID (MANDATORY) + set vrf name table + + # Interface Configuration + set interface eth eth address + + # Assign interface to VRF + set interface eth eth vrf + + # Static route to remote Network + set vrf name protocols static route next-hop + +- Verification + + + +Checking the routing table of the VRF should reveal both static and connected +entries active. A PING test between the Core and remote router is a way to +validate connectivity within the VRF. + +.. code-block:: none + + # show ip route vrf + # show ipv6 route vrf + + vyos@Core:~$ show ip route vrf LAN1 + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF LAN1: + S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41 + C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44 + + vyos@Core:~$ show ipv6 route vrf LAN1 + Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF LAN1: + C>* 2001:db8::/127 is directly connected, eth0, 00:18:43 + S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03 + C>* fe80::/64 is directly connected, eth0, 00:18:43 + + # ping vrf + + vyos@Core:~$ ping 10.1.1.2 vrf LAN1 + PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data. + 64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms + 64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms + ^C + --- 10.1.1.2 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1002ms + rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms + vyos@Core:~$ ping 10.0.0.1 vrf LAN1 + PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. + 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms + 64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms + ^C + --- 10.0.0.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1002ms + rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms + + vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1 + PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes + 64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms + 64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms + 64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms + ^C + --- 2001:db8:0:1::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2004ms + rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms + +Step 2: BGP Configuration for VRF-Lite +-------------------------------------- + + +- Configuration + + + +Setting BGP global local-as as well inside the VRF. Redistribute static routes +to inject configured networks into the BGP process but still inside the VRF. + + +.. code-block:: none + + # set BGP global local-as + set protocols bgp system-as + + # set BGP VRF local-as and redistribution + set vrf name protocols bgp system-as + set vrf name protocols bgp address-family redistribute static + +- Verification + + + +Check the BGP VRF table and verify if the static routes are injected showing +the correct next-hop information. + +.. code-block:: none + + # show ip bgp vrf + # show bgp vrf ipv6 + + vyos@Core:~$ show ip bgp vrf LAN1 + BGP table version is 3, local router ID is 10.1.1.1, vrf id 8 + Default local pref 100, local AS 64496 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path + *> 10.0.0.0/24 10.1.1.2 0 32768 ? + + vyos@Core# run show bgp vrf LAN1 ipv6 + BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 + Default local pref 100, local AS 64496 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path + *> 2001:db8:0:1::/64 + 2001:db8::1 0 32768 ? + + +Step 3: VPN Configuration +------------------------- + + +- Configuration + + +Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT), then +we enable the export/import VPN. + + +.. code-block:: none + + # set Route-distinguisher + set vrf name protocols bgp address-family rd vpn export '' + + # set route-target for import/export + # Note: RT are a list that can be more than one community between apostrophe + # and separated by blank space. Ex: ' ' + set vrf name protocols bgp address-family route-target vpn export '' + set vrf name protocols bgp address-family route-target vpn import '' + + # Enable VPN export/import under this VRF + set vrf name protocols bgp address-family export vpn + set vrf name protocols bgp address-family import vpn + +A key point to understand is that if we need two VRFs to communicate between +each other EXPORT rt from VRF1 has to be in the IMPORT rt list from VRF2. But +this is only in ONE direction, to complete the communication the EXPORT rt from +VRF2 has to be in the IMPORT rt list from VRF1. + +There are some cases where this is not needed -for example, in some +DDoS appliance- but most inter-vrf routing designs use the above configurations. + +- Verification + + + +After configured all the VRFs involved in this topology we take a deeper look +at both BGP and Routing table for the VRF LAN1 + +.. code-block:: none + + # show ip bgp vrf + # show bgp vrf ipv6 + + vyos@Core# run show ip bgp vrf LAN1 + BGP table version is 53, local router ID is 10.1.1.1, vrf id 8 + Default local pref 100, local AS 64496 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path + *> 0.0.0.0/0 10.2.2.2@7< 0 64497 i + *> 10.0.0.0/24 10.1.1.2 0 32768 ? + *> 10.2.2.0/30 10.2.2.2@7< 0 0 64497 ? + *> 192.0.2.0/24 10.2.2.2@7< 0 0 64497 ? + *> 192.168.0.0/24 192.168.3.2@11< 0 32768 ? + *> 198.51.100.0/24 10.2.2.2@7< 0 0 64497 ? + *> 203.0.113.0/24 10.2.2.2@7< 0 0 64497 ? + + vyos@Core# run show bgp vrf LAN1 ipv6 + BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 + Default local pref 100, local AS 64496 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path + *> ::/0 fe80::5200:ff:fe02:3@7< + 0 64497 i + *> 2001:db8::6/127 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + *> 2001:db8:0:1::/64 + 2001:db8::1 0 32768 ? + *> 2001:db8:0:3::/64 + 2001:db8::5@11< 0 32768 ? + *> 2001:db8:1::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + *> 2001:db8:2::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + *> 2001:db8:3::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + + + # show ip route vrf + # show ipv6 route vrf + + vyos@Core:~$ show ip route vrf LAN1 + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF LAN1: + B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57 + C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59 + B 10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38 + B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38 + B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + + vyos@Core# run show ipv6 route vrf LAN1 + Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF LAN1: + B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + C>* 2001:db8::/127 is directly connected, eth0, 05:33:43 + B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03 + B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50 + B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + C>* fe80::/64 is directly connected, eth0, 05:33:43 + + +As we can see in the BGP table any imported route has been injected with a "@" +followed by the VPN id; In the routing table of the VRF, if the route was +installed, we can see -between round brackets- the exported VRF table. + +Step 4: End to End verification +------------------------------- + + +Now we perform some end-to-end testing + +- From Management to LAN1/LAN2 + + +.. code-block:: none + + vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1 + PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data. + 64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms + 64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms + 64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms + ^C + --- 10.0.0.1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2005ms + rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms + vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1 + PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data. + 64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms + 64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms + ^C + --- 172.16.0.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1001ms + rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms + vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1 + PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes + 64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms + 64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms + 64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms + ^C + --- 2001:db8:0:1::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2003ms + rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms + vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1 + PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes + 64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms + ^C + --- 2001:db8:0:2::1 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3005ms + rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms + +- From Management to Outside (fails as intended) + + + +.. code-block:: none + + vyos@Management:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58 + C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05 + C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03 + vyos@Management:~$ ping 192.0.2.1 + PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data. + From 192.168.3.1 icmp_seq=1 Destination Net Unreachable + From 192.168.3.1 icmp_seq=2 Destination Net Unreachable + ^C + --- 192.0.2.1 ping statistics --- + 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + + vyos@Management:~$ ping 195.51.100.1 + PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data. + From 192.168.3.1 icmp_seq=1 Destination Net Unreachable + From 192.168.3.1 icmp_seq=2 Destination Net Unreachable + From 192.168.3.1 icmp_seq=3 Destination Net Unreachable + ^C + --- 195.51.100.1 ping statistics --- + 3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms + + vyos@Management:~$ ping 2001:db8:1::1 + PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes + From 2001:db8::4 icmp_seq=1 Destination unreachable: No route + From 2001:db8::4 icmp_seq=2 Destination unreachable: No route + ^C + --- 2001:db8:1::1 ping statistics --- + 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + + vyos@Management:~$ ping 2001:db8:2::1 + PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes + From 2001:db8::4 icmp_seq=1 Destination unreachable: No route + From 2001:db8::4 icmp_seq=2 Destination unreachable: No route + ^C + --- 2001:db8:2::1 ping statistics --- + 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + + +- LAN1 to Outside + + + +.. code-block:: none + + vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1 + PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data. + 64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms + 64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms + 64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms + ^C + --- 192.0.2.1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2004ms + rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms + vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1 + PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data. + 64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms + 64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms + ^C + --- 198.51.100.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1002ms + rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms + vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1 + PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data. + 64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms + 64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms + ^C + --- 203.0.113.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1003ms + rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms + vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1 + PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes + 64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms + 64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms + 64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms + ^C + --- 2001:db8:1::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2004ms + rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms + vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1 + PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes + 64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms + 64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms + 64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms + ^C + --- 2001:db8:2::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2003ms + rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms + + +.. note:: we are using "source-address" option cause we are not redistributing + connected interfaces into BGP on the Core router hence there is no comeback + route and ping will fail. + +- LAN1 to LAN2 + + + +.. code-block:: none + + vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1 + PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data. + 64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms + 64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms + ^C + --- 172.16.0.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1002ms + rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms + vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1 + PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes + 64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms + ^C + --- 2001:db8:0:2::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2003ms + rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms + +*********** +Conclusions +*********** + +Inter-VRF routing is a well-known solution to address complex routing scenarios +that enable -in a dynamic way- to leak routes between VRFs. Is recommended to +take special consideration while designing route-targets and its application as +it can minimize future interventions while creating a new VRF will automatically +take the desired effect in its propagation. + +********** +Appendix-A +********** + +Full configuration from all devices +=================================== + +- Core + + +.. code-block:: none + + set interfaces ethernet eth0 address '10.1.1.1/30' + set interfaces ethernet eth0 address '2001:db8::/127' + set interfaces ethernet eth0 vrf 'LAN1' + set interfaces ethernet eth1 address '172.16.2.1/30' + set interfaces ethernet eth1 address '2001:db8::2/127' + set interfaces ethernet eth1 vrf 'LAN2' + set interfaces ethernet eth2 address '192.168.3.1/30' + set interfaces ethernet eth2 address '2001:db8::4/127' + set interfaces ethernet eth2 vrf 'Management' + set interfaces ethernet eth3 address '10.2.2.1/30' + set interfaces ethernet eth3 address '2001:db8::6/127' + set interfaces ethernet eth3 vrf 'Internet' + set protocols bgp address-family ipv4-unicast + set protocols bgp system-as '64496' + set vrf name Internet protocols bgp address-family ipv4-unicast export vpn + set vrf name Internet protocols bgp address-family ipv4-unicast import vpn + set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' + set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' + set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' + set vrf name Internet protocols bgp address-family ipv6-unicast export vpn + set vrf name Internet protocols bgp address-family ipv6-unicast import vpn + set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' + set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' + set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' + set vrf name Internet protocols bgp system-as '64496' + set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast + set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497' + set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast + set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497' + set vrf name Internet table '104' + set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn + set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn + set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' + set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static + set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' + set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' + set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn + set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn + set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' + set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static + set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' + set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' + set vrf name LAN1 protocols bgp system-as '64496' + set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2 + set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1 + set vrf name LAN1 table '101' + set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn + set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn + set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' + set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static + set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' + set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' + set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn + set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn + set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' + set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static + set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' + set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' + set vrf name LAN2 protocols bgp system-as '64496' + set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2 + set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3 + set vrf name LAN2 table '102' + set vrf name Management protocols bgp address-family ipv4-unicast export vpn + set vrf name Management protocols bgp address-family ipv4-unicast import vpn + set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' + set vrf name Management protocols bgp address-family ipv4-unicast redistribute static + set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' + set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' + set vrf name Management protocols bgp address-family ipv6-unicast export vpn + set vrf name Management protocols bgp address-family ipv6-unicast import vpn + set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' + set vrf name Management protocols bgp address-family ipv6-unicast redistribute static + set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' + set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' + set vrf name Management protocols bgp system-as '64496' + set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2 + set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5 + set vrf name Management table '103' + + +- LAN1 + + +.. code-block:: none + + set interfaces dummy dum0 address '10.0.0.1/24' + set interfaces dummy dum0 address '2001:db8:0:1::1/64' + set interfaces ethernet eth0 address '10.1.1.2/30' + set interfaces ethernet eth0 address '2001:db8::1/127' + set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 + set protocols static route6 ::/0 next-hop 2001:db8::* + +- LAN2 + + + +.. code-block:: none + + set interfaces dummy dum0 address '172.16.0.1/24' + set interfaces dummy dum0 address '2001:db8:0:2::1/64' + set interfaces ethernet eth0 hw-id '50:00:00:03:00:00' + set interfaces ethernet eth1 address '172.16.2.2/30' + set interfaces ethernet eth1 address '2001:db8::3/127' + set protocols static route 0.0.0.0/0 next-hop 172.16.2.1 + set protocols static route6 ::/0 next-hop 2001:db8::2 + +- Management + + +.. code-block:: none + + set interfaces dummy dum0 address '192.168.0.1/24' + set interfaces dummy dum0 address '2001:db8:0:3::1/64' + set interfaces ethernet eth2 address '192.168.3.2/30' + set interfaces ethernet eth2 address '2001:db8::5/127' + set protocols static route 0.0.0.0/0 next-hop 192.168.3.1 + set protocols static route6 ::/0 next-hop 2001:db8::4 + +- ISP + + +.. code-block:: none + + set interfaces dummy dum0 address '192.0.2.1/24' + set interfaces dummy dum0 address '2001:db8:1::1/48' + set interfaces dummy dum1 address '198.51.100.1/24' + set interfaces dummy dum1 address '2001:db8:2::1/48' + set interfaces dummy dum2 address '203.0.113.1/24' + set interfaces dummy dum2 address '2001:db8:3::1/48' + set interfaces ethernet eth3 address '10.2.2.2/30' + set interfaces ethernet eth3 address '2001:db8::7/127' + set protocols bgp address-family ipv4-unicast redistribute connected + set protocols bgp address-family ipv6-unicast redistribute connected + set protocols bgp system-as '64497' + set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate + set protocols bgp neighbor 10.2.2.1 remote-as '64496' + set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate + set protocols bgp neighbor 2001:db8::6 remote-as '64496' + set protocols static route 0.0.0.0/0 next-hop 10.2.2.1 + set protocols static route6 ::/0 next-hop 2001:db8::6 + +********** +Appendix-B +********** + +Route-Filtering +=============== + + +When importing routes using MP-BGP it is possible to filter a subset of them +before are injected in the BGP table. One of the most common case is to use a +route-map with an prefix-list. + +- Configuration + + + +We create a prefix-list first and add all the routes we need to. + +.. code-block:: none + + # set both ipv4 and ipv6 policies + + set policy prefix-list LAN2-Internet rule 1 action 'permit' + set policy prefix-list LAN2-Internet rule 1 le '24' + set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16' + set policy prefix-list LAN2-Internet rule 2 action 'permit' + set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24' + set policy prefix-list LAN2-Internet rule 3 action 'permit' + set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24' + set policy prefix-list LAN2-Internet rule 4 action 'permit' + set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24' + + set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit' + set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48' + set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit' + set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48' + set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit' + set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64' + set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' + set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' + +Then add a route-map and reference to above prefix. Consider that the actions +taken inside the prefix will MATCH the routes that will be affected by the +actions inside the rules of the route-map. + +.. code-block:: none + + set policy route-map LAN2-Internet rule 1 action 'permit' + set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet' + + set policy route-map LAN2-Internet-v6 rule 1 action 'permit' + set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-Internet-v6' + +We are using a "white list" approach by allowing only what is necessary. In case +that need to implement a "black list" approach then you will need to change the +action in the route-map for a deny BUT you need to add a rule that permits the +rest due to the implicit deny in the route-map. + +Then we need to attach the policy to the BGP process. This needs to be under +the import statement in the vrf we need to filter. + +.. code-block:: none + + set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet' + set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6' + + +- Verification + + +.. code-block:: none + + # show ip route vrf LAN2 + + B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28 + S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32 + C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39 + B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 + B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Managment), weight 1, 00:45:27 + B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 + + # show ipv6 route vrf LAN2 + + C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26 + B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17 + S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21 + B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Managment), weight 1, 00:46:16 + B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 + B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 + C>* fe80::/64 is directly connected, eth1, 00:46:27 + +As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able +to select which routes are effectively imported and installed. + diff --git a/docs/configexamples/rst-ipsec-cisco-policy-based.rst b/docs/configexamples/rst-ipsec-cisco-policy-based.rst new file mode 100644 index 00000000..787c1140 --- /dev/null +++ b/docs/configexamples/rst-ipsec-cisco-policy-based.rst @@ -0,0 +1,355 @@ +:lastproofread: 2025-06-26 + +.. _examples-ipsec-cisco-policy-based: + +########################################################## +Policy-based Site-to-Site VPN IPsec between VyOS and Cisco +########################################################## + +This document is to describe a basic setup using policy-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +Cisco IOS. Cisco initiates IPsec connection only if interesting +traffic present. For stable work we recommend configuring an +initiator role on VyOS side. + +Network Topology +================ + +.. image:: /_static/images/cisco-vpn-ipsec.png + :align: center + :alt: Network Topology Diagram + +Prerequirements +=============== + +**VyOS:** + ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ + +**Cisco:** + ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ + +**IKE parameters:** + ++-------------------+---------+ +| Encryption | AES-256 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 2 | ++-------------------+---------+ + +**IPsec parameters:** + ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ + +**Traffic Selectors** + 192.168.0.0/24 <==> 192.168.10.0/24 + + 192.168.1.0/24 <==> 192.168.11.0/24 + +**Hosts configuration** + ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ + +Configuration +============= + +.. note:: Pfs is disabled in Cisco by default. + +VyOS +---- + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.1.2/30' + set interfaces ethernet eth1 address '192.168.0.1/24' + set interfaces ethernet eth2 address '192.168.1.1/24' + set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 + set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' + set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' + set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' + set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' + set vpn ipsec esp-group ESP-GROUP lifetime '3600' + set vpn ipsec esp-group ESP-GROUP pfs 'disable' + set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' + set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' + set vpn ipsec ike-group IKE-GROUP close-action 'start' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' + set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' + set vpn ipsec ike-group IKE-GROUP lifetime '28800' + set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' + set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes256' + set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' + set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' + set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' + set vpn ipsec site-to-site peer CISCO connection-type 'initiate' + set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' + set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' + set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' + set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' + set vpn ipsec site-to-site peer CISCO tunnel 1 local prefix '192.168.0.0/24' + set vpn ipsec site-to-site peer CISCO tunnel 1 remote prefix '192.168.10.0/24' + set vpn ipsec site-to-site peer CISCO tunnel 2 local prefix '192.168.1.0/24' + set vpn ipsec site-to-site peer CISCO tunnel 2 remote prefix '192.168.11.0/24' + +Cisco +----- + +.. code-block:: none + + crypto ikev2 proposal aes-cbc-256-proposal + encryption aes-cbc-256 + integrity sha1 + group 14 + ! + crypto ikev2 policy policy1 + match address local 10.0.2.2 + proposal aes-cbc-256-proposal + ! + crypto ikev2 keyring keys + peer VyOS + address 10.0.1.2 + pre-shared-key local test + pre-shared-key remote test + ! + crypto ikev2 profile IKEv2-profile + match identity remote address 10.0.1.2 255.255.255.255 + authentication remote pre-share + authentication local pre-share + keyring local keys + lifetime 28800 + ! + crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac + mode tunnel + ! + crypto map IPSEC-map 10 ipsec-isakmp + set peer 10.0.1.2 + set security-association lifetime seconds 3600 + set transform-set TS + set ikev2-profile IKEv2-profile + match address cryptoacl + ! + interface GigabitEthernet0/0 + ip address 10.0.2.2 255.255.255.252 + crypto map IPSEC-map + ! + interface GigabitEthernet0/1 + ip address 192.168.10.1 255.255.255.0 + ! + interface GigabitEthernet0/2 + ip address 192.168.11.1 255.255.255.0 + ! + ip route 0.0.0.0 0.0.0.0 10.0.2.1 + ! + ip access-list extended cryptoacl + permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255 + permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255 + + + +Monitoring +========== + +Monitoring on VyOS side +----------------------- + +IKE SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ike sa + Peer ID / IP Local ID / IP + ------------ ------------- + 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv2 AES_CBC_256 HMAC_SHA1_96 MODP_2048 no 304 26528 + +IPsec SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + -------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- + CISCO-tunnel-1 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 + CISCO-tunnel-2 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 + +Monitoring on Cisco side +------------------------ + +IKE SAs: + +.. code-block:: none + + Cisco#show crypto ikev2 sa + IPv4 Crypto IKEv2 SA + + Tunnel-id Local Remote fvrf/ivrf Status + 1 10.0.2.2/4500 10.0.1.2/4500 none/none READY + Encr: AES-CBC, keysize: 256, PRF: SHA1, Hash: SHA96, DH Grp:14, Auth sign: PSK, Auth verify: PSK + Life/Active Time: 28800/471 sec + + IPv6 Crypto IKEv2 SA + + +IPsec SAs: + +.. code-block:: none + + Cisco#show crypto ipsec sa + + interface: GigabitEthernet0/0 + Crypto map tag: IPSEC-map, local addr 10.0.2.2 + + protected vrf: (none) + local ident (addr/mask/prot/port): (192.168.11.0/255.255.255.0/0/0) + remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) + current_peer 10.0.1.2 port 4500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 + #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC81F83DA(3357508570) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x8C63C51E(2355348766) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 23, flow_id: SW:23, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4231729/3585) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC81F83DA(3357508570) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 24, flow_id: SW:24, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4231729/3585) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: + + protected vrf: (none) + local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0) + remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0) + current_peer 10.0.1.2 port 4500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 + #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC40C7A20(3289152032) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x2948B6CB(692631243) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 21, flow_id: SW:21, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4194891/3581) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC40C7A20(3289152032) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 22, flow_id: SW:22, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4194891/3581) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: + +Checking Connectivity +--------------------- + +ICMP packets from PC1 to PC3. + +.. code-block:: none + + PC1> ping 192.168.10.2 + + 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms + 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms + 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms + 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms + 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms + +ICMP packets from PC2 to PC4. + +.. code-block:: none + + PC2> ping 192.168.11.2 + + 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms + 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms + 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/rst-ipsec-cisco-route-based.rst b/docs/configexamples/rst-ipsec-cisco-route-based.rst new file mode 100644 index 00000000..f7c3cb08 --- /dev/null +++ b/docs/configexamples/rst-ipsec-cisco-route-based.rst @@ -0,0 +1,405 @@ +:lastproofread: 2025-06-26 + +.. _examples-ipsec-cisco-route-based: + +######################################################### +Route-based Site-to-Site VPN IPsec between VyOS and Cisco +######################################################### + +This document is to describe a basic setup using route-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +Cisco IOS. Cisco initiates IPsec connection only if interesting +traffic present. For stable work we recommend configuring an +initiator role on VyOS side. OSPF is selected as routing protocol +inside the tunnel. + +Network Topology +================ + +.. image:: /_static/images/cisco-vpn-ipsec.png + :align: center + :alt: Network Topology Diagram + +Prerequirements +=============== + +**VyOS:** + ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ + +**Cisco:** + ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ + +**IKE parameters:** + ++-------------------+---------+ +| Encryption | AES-128 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 1 | ++-------------------+---------+ + +**IPsec parameters:** + ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ + +**Hosts configuration** + ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ + +Configuration +============= + +.. note:: Pfs is disabled in Cisco by default. + +VyOS +---- + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.1.2/30' + set interfaces ethernet eth1 address '192.168.0.1/24' + set interfaces ethernet eth2 address '192.168.1.1/24' + set interfaces vti vti1 address '10.100.100.1/30' + set interfaces vti vti1 mtu '1438' + set protocols ospf area 0 network '10.100.100.0/30' + set protocols ospf area 0 network '192.168.0.0/24' + set protocols ospf area 0 network '192.168.1.0/24' + set protocols ospf interface eth1 passive + set protocols ospf interface eth2 passive + set protocols ospf interface vti1 network 'point-to-point' + set protocols ospf parameters router-id '2.2.2.2' + set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 + set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' + set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' + set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' + set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' + set vpn ipsec esp-group ESP-GROUP lifetime '3600' + set vpn ipsec esp-group ESP-GROUP pfs 'disable' + set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' + set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' + set vpn ipsec ike-group IKE-GROUP close-action 'start' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' + set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' + set vpn ipsec ike-group IKE-GROUP lifetime '28800' + set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' + set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' + set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' + set vpn ipsec options disable-route-autoinstall + set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' + set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' + set vpn ipsec site-to-site peer CISCO connection-type 'initiate' + set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' + set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' + set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' + set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' + set vpn ipsec site-to-site peer CISCO vti bind 'vti1' + +Cisco +----- + +.. code-block:: none + + crypto isakmp policy 10 + encr aes + authentication pre-share + group 14 + lifetime 28800 + crypto isakmp key test address 10.0.1.2 + ! + ! + crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac + mode transport + ! + crypto ipsec profile IPsec-profile + set transform-set TS + ! + ! + ! + ! + ! + ! + ! + interface Loopback0 + ip address 1.1.1.1 255.255.255.255 + ! + interface Tunnel10 + ip address 10.100.100.2 255.255.255.252 + ip ospf network point-to-point + tunnel source GigabitEthernet0/0 + tunnel mode ipsec ipv4 + tunnel destination 10.0.1.2 + tunnel protection ipsec profile IPsec-profile + ! + interface GigabitEthernet0/0 + ip address 10.0.2.2 255.255.255.252 + duplex auto + speed auto + media-type rj45 + ! + interface GigabitEthernet0/1 + ip address 192.168.10.1 255.255.255.0 + duplex auto + speed auto + media-type rj45 + ! + interface GigabitEthernet0/2 + ip address 192.168.11.1 255.255.255.0 + duplex auto + speed auto + media-type rj45 + ! + router ospf 1 + router-id 1.1.1.1 + passive-interface GigabitEthernet0/1 + passive-interface GigabitEthernet0/2 + network 10.100.100.0 0.0.0.3 area 0 + network 192.168.10.0 0.0.0.255 area 0 + network 192.168.11.0 0.0.0.255 area 0 + ! + ip route 0.0.0.0 0.0.0.0 10.0.2.1 + + + +Monitoring +========== + +Monitoring on VyOS side +----------------------- + +IKE SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ike sa + Peer ID / IP Local ID / IP + ------------ ------------- + 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 8175 18439 + + + +IPsec SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + ------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- + CISCO-vti up 34m59s 17K/14K 224/213 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 + +OSPF Neighbor Status: + +.. code-block:: none + + vyos@vyos:~$ show ip ospf neighbor + + Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL + 1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 + +Routing Table: + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + + S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54 + C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59 + L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59 + O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50 + C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50 + L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50 + O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54 + C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59 + L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59 + O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54 + C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59 + L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59 + O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 + O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 + +Monitoring on Cisco side +------------------------ + +IKE SAs: + +.. code-block:: none + + Cisco#show crypto isakmp sa + IPv4 Crypto ISAKMP SA + dst src state conn-id status + 10.0.1.2 10.0.2.2 QM_IDLE 1002 ACTIVE + + IPv6 Crypto ISAKMP SA + + + +IPsec SAs: + +.. code-block:: none + + Cisco#show crypto ipsec sa + + interface: Tunnel10 + Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2 + + protected vrf: (none) + local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) + remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) + current_peer 10.0.1.2 port 500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295 + #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC3E9B307(3286872839) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x2740C328(658555688) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0 + sa timing: remaining key lifetime (k/sec): (4173824/1401) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC3E9B307(3286872839) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0 + sa timing: remaining key lifetime (k/sec): (4173819/1401) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: + +OSPF Neighbor Status: + +.. code-block:: none + + Cisco# show ip ospf neighbor + + Neighbor ID Pri State Dead Time Address Interface + 2.2.2.2 0 FULL/ - 00:00:35 10.100.100.1 Tunnel10 + +Routing Table: + +.. code-block:: none + + Cisco#show ip route + Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP + D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area + N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 + E1 - OSPF external type 1, E2 - OSPF external type 2 + i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 + ia - IS-IS inter area, * - candidate default, U - per-user static route + o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + a - application route + + - replicated route, % - next hop override, p - overrides from PfR + + Gateway of last resort is 10.0.2.1 to network 0.0.0.0 + + S* 0.0.0.0/0 [1/0] via 10.0.2.1 + 1.0.0.0/32 is subnetted, 1 subnets + C 1.1.1.1 is directly connected, Loopback0 + 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks + C 10.0.2.0/30 is directly connected, GigabitEthernet0/0 + L 10.0.2.2/32 is directly connected, GigabitEthernet0/0 + C 10.100.100.0/30 is directly connected, Tunnel10 + L 10.100.100.2/32 is directly connected, Tunnel10 + O 192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 + O 192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 + 192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks + C 192.168.10.0/24 is directly connected, GigabitEthernet0/1 + L 192.168.10.1/32 is directly connected, GigabitEthernet0/1 + 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks + C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 + L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 + + +Checking Connectivity +--------------------- + +ICMP packets from PC1 to PC3. + +.. code-block:: none + + PC1> ping 192.168.10.2 + + 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms + 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms + 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms + 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms + 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms + +ICMP packets from PC2 to PC4. + +.. code-block:: none + + PC2> ping 192.168.11.2 + + 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms + 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms + 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/rst-ipsec-pa-route-based.rst b/docs/configexamples/rst-ipsec-pa-route-based.rst new file mode 100644 index 00000000..b6f6f3a7 --- /dev/null +++ b/docs/configexamples/rst-ipsec-pa-route-based.rst @@ -0,0 +1,420 @@ +:lastproofread: 2025-06-26 + +.. _examples-ipsec-pa-route-based: + +############################################################# +Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto +############################################################# + +This document is to describe a basic setup using route-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +PA 11.0.0. OSPF is selected as routing protocol inside the +tunnel. + +Since this example focuses on IPsec configuration it does not +include firewall configuration. + +Network Topology +================ + +.. image:: /_static/images/ipsec-vyos-pa.png + :align: center + :alt: Network Topology Diagram + +Prerequirements +=============== + +**VyOS:** + ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ + +**Cisco:** + ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ + +**IKE parameters:** + ++-------------------+---------+ +| Encryption | AES-128 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 1 | ++-------------------+---------+ + +**IPsec parameters:** + ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ + +**Hosts configuration** + ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ + +Configuration +============= + +VyOS +---- + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.1.2/30' + set interfaces ethernet eth1 address '192.168.0.1/24' + set interfaces ethernet eth2 address '192.168.1.1/24' + set interfaces vti vti1 address '10.100.100.1/30' + set interfaces vti vti1 mtu '1438' + set protocols ospf area 0 network '10.100.100.0/30' + set protocols ospf area 0 network '192.168.0.0/24' + set protocols ospf area 0 network '192.168.1.0/24' + set protocols ospf interface eth1 passive + set protocols ospf interface eth2 passive + set protocols ospf interface vti1 network 'point-to-point' + set protocols ospf parameters router-id '2.2.2.2' + set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 + set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' + set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' + set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' + set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' + set vpn ipsec esp-group ESP-GROUP lifetime '3600' + set vpn ipsec esp-group ESP-GROUP pfs 'disable' + set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' + set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' + set vpn ipsec ike-group IKE-GROUP close-action 'start' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' + set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' + set vpn ipsec ike-group IKE-GROUP lifetime '28800' + set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' + set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' + set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' + set vpn ipsec options disable-route-autoinstall + set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' + set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' + set vpn ipsec site-to-site peer CISCO connection-type 'initiate' + set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' + set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' + set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' + set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' + set vpn ipsec site-to-site peer CISCO vti bind 'vti1' + +Palo Alto +--------- + +GUI Configuration: + Network -> Network Profiles -> IKE Crypto + + .. image:: /_static/images/PA-IKE-group.png + :align: center + + Network -> Network Profiles -> IKE Gateways + + .. image:: /_static/images/PA-IKE-GW-1.png + :align: center + + .. image:: /_static/images/PA-IKE-GW-2.png + :align: center + + Network -> Network Profiles -> IPSec Crypto + + .. image:: /_static/images/PA-ESP-group.png + :align: center + + Network -> Interfaces + + .. image:: /_static/images/PA-tunnel-1.png + :align: center + + .. image:: /_static/images/PA-tunnel-2.png + :align: center + + .. image:: /_static/images/PA-tunnel-3.png + :align: center + + Network -> IPSec Tunnels + + .. image:: /_static/images/PA-IPsec-tunnel.png + :align: center + +CLI configuration with OSPF: + +.. code-block:: none + + set network interface ethernet ethernet1/1 layer3 ip 10.0.2.2/30 + set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow + set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24 + set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow + set network interface ethernet ethernet1/3 layer3 ip 192.168.11.1/24 + set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow + set network interface tunnel units tunnel.1 ip 10.100.100.2/30 + set network interface tunnel units tunnel.1 interface-management-profile Allow + set network interface tunnel units tunnel.1 mtu 1438 + set network profiles interface-management-profile Allow ping yes + set network ike crypto-profiles ike-crypto-profiles IKE-GROUP hash sha1 + set network ike crypto-profiles ike-crypto-profiles IKE-GROUP dh-group group14 + set network ike crypto-profiles ike-crypto-profiles IKE-GROUP encryption aes-128-cbc + set network ike crypto-profiles ike-crypto-profiles IKE-GROUP lifetime seconds 28800 + set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp authentication sha256 + set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp encryption aes-256-cbc + set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP lifetime seconds 3600 + set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP dh-group no-pfs + set network ike gateway VyOS authentication pre-shared-key key test + set network ike gateway VyOS protocol ikev1 dpd enable yes + set network ike gateway VyOS protocol ikev1 exchange-mode main + set network ike gateway VyOS protocol ikev1 ike-crypto-profile IKE-GROUP + set network ike gateway VyOS protocol ikev2 dpd enable yes + set network ike gateway VyOS protocol version ikev1 + set network ike gateway VyOS protocol-common nat-traversal enable yes + set network ike gateway VyOS protocol-common fragmentation enable no + set network ike gateway VyOS protocol-common passive-mode yes + set network ike gateway VyOS local-address interface ethernet1/1 + set network ike gateway VyOS peer-address ip 10.0.1.2 + set network ike gateway VyOS local-id id 10.0.2.2 + set network ike gateway VyOS local-id type ipaddr + set network ike gateway VyOS peer-id id 10.0.1.2 + set network ike gateway VyOS peer-id type ipaddr + set network tunnel ipsec VyOS-tunnel auto-key ike-gateway VyOS + set network tunnel ipsec VyOS-tunnel auto-key ipsec-crypto-profile ESP-GROUP + set network tunnel ipsec VyOS-tunnel tunnel-monitor enable no + set network tunnel ipsec VyOS-tunnel tunnel-interface tunnel.1 + set network tunnel ipsec VyOS-tunnel anti-replay no + set network virtual-router default protocol ospf enable yes + set network virtual-router default protocol ospf area 0.0.0.0 type normal + set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 enable yes + set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 passive no + set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 link-type p2p + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 enable yes + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 passive yes + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 link-type broadcast + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 enable yes + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 passive yes + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 link-type broadcast + set network virtual-router default protocol ospf router-id 1.1.1.1 + set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] + + +Monitoring +========== + +Monitoring on VyOS side +----------------------- + +IKE SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ike sa + Peer ID / IP Local ID / IP + ------------ ------------- + 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 1372 25802 + + + + +IPsec SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + ------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- + PA-vti up 23m27s 9K/10K 149/151 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 + + +OSPF Neighbor Status: + +.. code-block:: none + + vyos@vyos:~$ show ip ospf neighbor + + Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL + 1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 + + +Routing Table: + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:27:30 + C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:27:34 + L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:27:34 + O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:24:34 + C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:24:34 + L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:24:34 + O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:27:29 + C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:27:34 + L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:27:34 + O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:27:29 + C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:27:34 + L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:27:34 + O>* 192.168.10.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 + O>* 192.168.11.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 + + +Monitoring on Cisco side +------------------------ + +IKE SAs: + +.. code-block:: none + + admin@PA-VM> show vpn ike-sa + + IKEv1 phase-1 SAs + GwID/client IP Peer-Address Gateway Name Role Mode Algorithm Established Expiration V ST Xt Phase2 + -------------- ------------ ------------ ---- ---- --------- ----------- ---------- - -- -- ------ + 1 10.0.1.2 VyOS Resp Main PSK/DH14/A128/SHA1 Jul.31 01:35:00 Jul.31 09:35:00 v1 13 1 1 + + Show IKEv1 IKE SA: Total 1 gateways found. 1 ike sa found. + + + IKEv1 phase-2 SAs + Gateway Name TnID Tunnel GwID/IP Role Algorithm SPI(in) SPI(out) MsgID ST Xt + ------------ ---- ------ ------- ---- --------- ------- -------- ----- -- -- + VyOS 1 VyOS-tunnel 1 Resp ESP/ /tunl/SHA2 8827A3D9 C204F4FA BD202829 9 1 + + Show IKEv1 phase2 SA: Total 1 gateways found. 1 ike sa found. + + + There is no IKEv2 SA found. + +IPsec SAs: + +.. code-block:: none + + admin@PA-VM> show vpn ipsec-sa + + GwID/client IP TnID Peer-Address Tunnel(Gateway) Algorithm SPI(in) SPI(out) life(Sec/KB) remain-time(Sec) + -------------- ---- ------------ --------------- --------- ------- -------- ------------ ---------------- + 1 1 10.0.1.2 VyOS-tunnel(VyOS) ESP/A256/SHA256 8827A3D9 C204F4FA 3600/Unlimited 2733 + + Show IPSec SA: Total 1 tunnels found. 1 ipsec sa found. + +OSPF Neighbor Status: + +.. code-block:: none + + admin@PA-VM> show routing protocol ospf neighbor + + Options: 0x80:reserved, O:Opaq-LSA capability, DC:demand circuits, EA:Ext-Attr LSA capability, + N/P:NSSA option, MC:multicase, E:AS external LSA capability, T:TOS capability + ========== + virtual router: default + neighbor address: 10.100.100.1 + local address binding: 0.0.0.0 + type: dynamic + status: full + neighbor router ID: 2.2.2.2 + area id: 0.0.0.0 + neighbor priority: 1 + lifetime remain: 32 + messages pending: 0 + LSA request pending: 0 + options: 0x02: E + hello suppressed: no + restart helper status: not helping + restart helper time remaining: 0 + restart helper exit reason: none + + + +Routing Table: + +.. code-block:: none + + admin@PA-VM> show routing route + + flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, + Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast + + + VIRTUAL ROUTER: default (id 1) + ========== + destination nexthop metric flags age interface next-AS + 0.0.0.0/0 10.0.2.1 10 A S ethernet1/1 + 10.0.2.0/30 10.0.2.2 0 A C ethernet1/1 + 10.0.2.2/32 0.0.0.0 0 A H + 10.100.100.0/30 0.0.0.0 10 Oi 1273 tunnel.1 + 10.100.100.0/30 10.100.100.2 0 A C tunnel.1 + 10.100.100.2/32 0.0.0.0 0 A H + 192.168.0.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 + 192.168.1.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 + 192.168.10.0/24 0.0.0.0 10 Oi 1273 ethernet1/2 + 192.168.10.0/24 192.168.10.1 0 A C ethernet1/2 + 192.168.10.1/32 0.0.0.0 0 A H + 192.168.11.0/24 0.0.0.0 10 Oi 1273 ethernet1/3 + 192.168.11.0/24 192.168.11.1 0 A C ethernet1/3 + 192.168.11.1/32 0.0.0.0 0 A H + total routes shown: 14 + + + +Checking Connectivity +--------------------- + +ICMP packets from PC1 to PC3. + +.. code-block:: none + + PC1> ping 192.168.10.2 + + 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms + 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms + 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms + 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms + 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms + +ICMP packets from PC2 to PC4. + +.. code-block:: none + + PC2> ping 192.168.11.2 + + 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms + 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms + 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/rst-l3vpn-hub-and-spoke.rst b/docs/configexamples/rst-l3vpn-hub-and-spoke.rst new file mode 100644 index 00000000..8e1d0051 --- /dev/null +++ b/docs/configexamples/rst-l3vpn-hub-and-spoke.rst @@ -0,0 +1,1123 @@ + +############################################## +L3VPN for Hub-and-Spoke connectivity with VyOS +############################################## + +IP/MPLS technology is widely used by various service providers and large +enterprises in order to achieve better network scalability, manageability +and flexibility. It also provides the possibility to deliver different +services for the customers in a seamless manner. +Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered +through OSI layer 3 networking technologies. Often the border gateway +protocol (BGP) is used to send and receive VPN-related data that is +responsible for the control plane. L3VPN utilizes virtual routing and +forwarding (VRF) techniques to receive and deliver user data as well as +separate data planes of the end-users. It is built using a combination of +IP- and MPLS-based information. Generally, L3VPNs are used to send data +on back-end VPN infrastructures, such as for VPN connections between data +centres, HQs and branches. + +An L3VPN consists of multiple access links, multiple VPN routing and +forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs. +An L3VPN can be configured to connect two or more customer sites. +In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have +unique Route Distinguishers (RDs). In order to use the hub site as a +transit point for connectivity in such an environment, the spoke sites +export their routes to the hub. Spokes can talk to hubs, but never have +direct paths to other spokes. All traffic between spokes is controlled +and delivered over the hub site. + + +To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple +requirements in order to properly implement the solution. +We'll use the following nodes in our LAB environment: + +* 2 x Route reflectors (VyOS-RRx) +* 4 x Provider routers (VyOS-Px) +* 3 x Provider Edge (VyOs-PEx) +* 3 x Customer Edge (VyOS-CEx) + +The following software was used in the creation of this document: + +* Operating system: VyOS +* Version: 1.4-rolling-202110310317 +* Image name: vyos-1.4-rolling-202110310317-amd64.iso + +**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) +– The configurations below are specifically for VyOS 1.4.x. + +General information can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter. + + + +******** +Topology +******** +.. image:: /_static/images/L3VPN_hub_and_spoke.png + :width: 80% + :align: center + :alt: Network Topology Diagram + + + +***************** +How does it work? +***************** + +As we know the main assumption of L3VPN “Hub and Spoke” is, that the traffic +between spokes have to pass via hub, in our scenario VyOS-PE2 is the Hub PE +and the VyOS-CE1-HUB is the central customer office device that is responsible +for controlling access between all spokes and announcing its network prefixes +(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its +own Route-Distinguisher(RD) and route-target import/export lists. +Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to +the nodes across network where PEs Spokes import the route-target 60535:1030 +(this is export route-target of vrf BLUE_HUB) and export its own route-target +60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the +Customer edge nodes can only learn the network prefixes of the HUB site +[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes +[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. +Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network +routes exchange and minimize iBGP peerings between devices. + +L3VPN configuration parameters table: + ++----------+-------+------------+-----------------+-------------+-------------+ +| Node | Role | VRF | RD | RT import | RT export | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE2 | Hub | BLUE_HUB | 10.80.80.1:1011 | 65035:1011 | 65035:1030 | +| | | | | 65035:1030 | | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ + + + +************* +Configuration +************* + + + +Step-1: Configuring IGP and enabling MPLS LDP +============================================= + +At the first step we need to configure the IP/MPLS backbone network using OSPF +as IGP protocol and LDP as label-switching protocol for the base connectivity +between **P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R** +(eflector) nodes: + +- VyOS-P1: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.3/32' + set interfaces ethernet eth0 address '172.16.30.1/24' + set interfaces ethernet eth1 address '172.16.40.1/24' + set interfaces ethernet eth2 address '172.16.90.1/24' + set interfaces ethernet eth3 address '172.16.10.1/24' + set interfaces ethernet eth5 address '172.16.100.1/24' + + # protocols ospf+ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth5' + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp interface 'eth5' + set protocols mpls ldp router-id '10.0.0.3' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.3 + + +- VyOS-P2: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.4/32' + set interfaces ethernet eth0 address '172.16.30.2/24' + set interfaces ethernet eth1 address '172.16.20.1/24' + set interfaces ethernet eth2 address '172.16.120.1/24' + set interfaces ethernet eth3 address '172.16.60.1/24' + + # protocols ospf+ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp router-id '10.0.0.4' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.4' + +- VyOS-P3: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.5/32' + set interfaces ethernet eth0 address '172.16.110.1/24' + set interfaces ethernet eth1 address '172.16.40.2/24' + set interfaces ethernet eth2 address '172.16.50.1/24' + set interfaces ethernet eth3 address '172.16.70.1/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp router-id '10.0.0.5' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.5' + +- VyOS-P4: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.6/32' + set interfaces ethernet eth0 address '172.16.80.2/24' + set interfaces ethernet eth1 address '172.16.130.1/24' + set interfaces ethernet eth2 address '172.16.50.2/24' + set interfaces ethernet eth3 address '172.16.60.2/24' + set interfaces ethernet eth5 address '172.16.140.1/24' + + + # protocols ospf + ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth0' + set protocols mpls interface 'eth5' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp interface 'eth5' + set protocols mpls ldp router-id '10.0.0.6' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.6' + +- VyOS-PE1: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.7/32' + set interfaces ethernet eth0 address '172.16.90.2/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp router-id '10.0.0.7' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.7' + +- VyOS-PE2: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.8/32' + set interfaces ethernet eth0 address '172.16.110.2/24' + set interfaces ethernet eth1 address '172.16.100.2/24' + set interfaces ethernet eth2 address '172.16.80.1/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls interface 'eth1' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp router-id '10.0.0.8' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.8' + +- VyOS-PE3: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.10/32' + set interfaces ethernet eth0 address '172.16.140.2/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp router-id '10.0.0.10' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.10' + +- VyOS-RR1: + +.. code-block:: none + + # interfaces + set interfaces ethernet eth1 address '172.16.20.2/24' + set interfaces ethernet eth2 address '172.16.10.2/24' + set interfaces dummy dum10 address '10.0.0.1/32' + + # protocols ospf + ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp router-id '10.0.0.1' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.1' + +- VyOS-RR2: + +.. code-block:: none + + # interfaces + set interfaces ethernet eth0 address '172.16.80.1/24' + set interfaces ethernet eth1 address '172.16.70.2/24' + set interfaces dummy dum10 address '10.0.0.2/32' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls interface 'eth1' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp router-id '10.0.0.2' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.2' + + + +Step-2: Configuring iBGP for L3VPN control-plane +================================================ + +At this step we are going to enable iBGP protocol on MPLS nodes and +Route Reflectors (two routers for redundancy) that will deliver IPv4 +VPN (L3VPN) routes between them: + +- VyOS-RR1: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' + set protocols bgp parameters cluster-id '10.0.0.1' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.1' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-RR2: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' + set protocols bgp parameters cluster-id '10.0.0.1' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.2' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-PE1: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.7' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-PE2: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.8' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-PE3: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.10' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + + + +Step-3: Configuring L3VPN VRFs on PE nodes +========================================== + +This section provides configuration steps for setting up VRFs on our +PE nodes including CE facing interfaces, BGP, rd and route-target +import/export based on the pre-defined parameters. + +- VyOS-PE1: + +.. code-block:: none + + # VRF settings + set vrf name BLUE_SPOKE table '200' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' + set vrf name BLUE_SPOKE protocols bgp system-as '65001' + set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override + set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035' + + # interfaces + set interfaces ethernet eth3 address '10.50.50.1/24' + set interfaces ethernet eth3 vrf 'BLUE_SPOKE' + +- VyOS-PE2: + +.. code-block:: none + + # VRF settings + set vrf name BLUE_HUB table '400' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' + set vrf name BLUE_HUB protocols bgp system-as '65001' + set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override + set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035' + + # interfaces + set interfaces ethernet eth3 address '10.80.80.1/24' + set interfaces ethernet eth3 vrf 'BLUE_HUB' + +- VyOS-PE3: + +.. code-block:: none + + # VRF settings + set vrf name BLUE_SPOKE table '200' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' + set vrf name BLUE_SPOKE protocols bgp system-as '65001' + set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override + set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035' + + # interfaces + set interfaces ethernet eth3 address '10.60.60.1/24' + set interfaces ethernet eth3 vrf 'BLUE_SPOKE' + + + +Step-4: Configuring CE nodes +============================ + +Dynamic routing used between CE and PE nodes and eBGP peering +established for the route exchanging between them. All routes +received by PEs are then exported to L3VPN and delivered from +Spoke sites to Hub and vise-versa based on previously +configured L3VPN parameters. + +- VyOS-CE1-SPOKE: + +.. code-block:: none + + # interfaces + set interfaces dummy dum20 address '10.0.0.80/32' + set interfaces ethernet eth0 address '10.50.50.2/24' + + # BGP for peering with PE + set protocols bgp system-as 65035 + set protocols bgp address-family ipv4-unicast network 10.0.0.80/32 + set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2' + set protocols bgp neighbor 10.50.50.1 remote-as '65001' + set protocols bgp neighbor 10.50.50.1 update-source 'eth0' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.50.50.2' + +- VyOS-CE1-HUB: + +.. code-block:: none + + # interfaces + set interfaces dummy dum20 address '10.0.0.100/32' + set interfaces ethernet eth0 address '10.80.80.2/24' + + # BGP for peering with PE + set protocols bgp system-as 65035 + set protocols bgp address-family ipv4-unicast network 10.0.0.100/32 + set protocols bgp address-family ipv4-unicast redistribute connected + set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2' + set protocols bgp neighbor 10.80.80.1 remote-as '65001' + set protocols bgp neighbor 10.80.80.1 update-source 'eth0' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.80.80.2' + +- VyOS-CE2-SPOKE: + +.. code-block:: none + + # interfaces + set interfaces dummy dum20 address '10.0.0.90/32' + set interfaces ethernet eth0 address '10.60.60.2/24' + + # BGP for peering with PE + set protocols bgp system-as 65035 + set protocols bgp address-family ipv4-unicast network 10.0.0.90/32 + set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2' + set protocols bgp neighbor 10.60.60.1 remote-as '65001' + set protocols bgp neighbor 10.60.60.1 update-source 'eth0' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.60.60.2' + + + +Step-5: Verification +==================== + +This section describes verification commands for MPLS/BGP/LDP +protocols and L3VPN related routes as well as diagnosis and +reachability checks between CE nodes. + +Let’s check IPv4 routing and MPLS information on provider nodes +(same procedure for all P nodes): + +- “show ip ospf neighbor” for checking ospf relationship + +.. code-block:: none + + vyos@VyOS-P1:~$ show ip ospf neighbor + + Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL + 10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 + 10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 + 10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 + 10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 + 10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 + +- “show mpls ldp neighbor “ for checking ldp neighbors + +.. code-block:: none + + vyos@VyOS-P1:~$ show mpls ldp neighbor + AF ID State Remote Address Uptime + ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h + ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h + ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h + ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h + ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h + +- “show mpls ldp binding” for checking mpls label assignment + +.. code-block:: none + + vyos@VyOS-P1:~$ show mpls ldp discovery + AF Destination Nexthop Local Label Remote Label In Use + ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes + ipv4 10.0.0.1/32 10.0.0.4 23 20 no + ipv4 10.0.0.1/32 10.0.0.5 23 17 no + ipv4 10.0.0.1/32 10.0.0.7 23 16 no + ipv4 10.0.0.1/32 10.0.0.8 23 16 no + ipv4 10.0.0.2/32 10.0.0.1 20 16 no + ipv4 10.0.0.2/32 10.0.0.4 20 22 no + ipv4 10.0.0.2/32 10.0.0.5 20 24 yes + ipv4 10.0.0.2/32 10.0.0.7 20 17 no + ipv4 10.0.0.2/32 10.0.0.8 20 17 no + ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no + ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no + ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no + ipv4 10.0.0.4/32 10.0.0.1 16 18 no + ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes + ipv4 10.0.0.4/32 10.0.0.5 16 19 no + ipv4 10.0.0.4/32 10.0.0.7 16 19 no + ipv4 10.0.0.4/32 10.0.0.8 16 19 no + ipv4 10.0.0.5/32 10.0.0.1 21 19 no + ipv4 10.0.0.5/32 10.0.0.4 21 17 no + ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes + ipv4 10.0.0.5/32 10.0.0.7 21 20 no + ipv4 10.0.0.5/32 10.0.0.8 21 20 no + ipv4 10.0.0.6/32 10.0.0.1 17 20 no + ipv4 10.0.0.6/32 10.0.0.4 17 23 yes + ipv4 10.0.0.6/32 10.0.0.5 17 21 yes + ipv4 10.0.0.6/32 10.0.0.7 17 21 no + ipv4 10.0.0.6/32 10.0.0.8 17 21 no + ipv4 10.0.0.7/32 10.0.0.1 22 21 no + ipv4 10.0.0.7/32 10.0.0.4 22 18 no + ipv4 10.0.0.7/32 10.0.0.5 22 20 no + ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes + ipv4 10.0.0.7/32 10.0.0.8 22 22 no + ipv4 10.0.0.8/32 10.0.0.1 24 22 no + ipv4 10.0.0.8/32 10.0.0.4 24 19 no + ipv4 10.0.0.8/32 10.0.0.5 24 16 no + ipv4 10.0.0.8/32 10.0.0.7 24 22 no + ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes + ipv4 10.0.0.9/32 10.0.0.1 18 23 no + ipv4 10.0.0.9/32 10.0.0.4 18 21 yes + ipv4 10.0.0.9/32 10.0.0.5 18 22 no + ipv4 10.0.0.9/32 10.0.0.7 18 23 no + ipv4 10.0.0.9/32 10.0.0.8 18 23 no + ipv4 10.0.0.10/32 10.0.0.1 19 24 no + ipv4 10.0.0.10/32 10.0.0.4 19 24 yes + ipv4 10.0.0.10/32 10.0.0.5 19 23 yes + ipv4 10.0.0.10/32 10.0.0.7 19 24 no + ipv4 10.0.0.10/32 10.0.0.8 19 24 no + +Now we’re checking iBGP status and routes from route-reflector +nodes to other devices: + +- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors: + +.. code-block:: none + + vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary + BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0 + BGP table version 0 + RIB entries 9, using 1728 bytes of memory + Peers 4, using 85 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 + 10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 + 10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + 10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + + Total number of neighbors 4 + +- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information: + +.. code-block:: none + + vyos@VyOS-RR1:~$ show bgp ipv4 vpn + BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 + Default local pref 100, local AS 65001 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + Route Distinguisher: 10.50.50.1:1011 + *>i10.50.50.0/24 10.0.0.7 0 100 0 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 + Route Distinguisher: 10.60.60.1:1011 + *>i10.60.60.0/24 10.0.0.10 0 100 0 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 + Route Distinguisher: 10.80.80.1:1011 + *>i10.80.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 + *>i100.100.100.100/32 + 10.0.0.8 0 100 0 65035 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 + Route Distinguisher: 172.16.80.1:2011 + *>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 + *>i172.16.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 + Route Distinguisher: 172.16.100.1:2011 + *>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 + *>i172.16.100.0/24 10.0.0.9 0 100 0 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 + +- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected + for specific VPNv4 destination + +.. code-block:: none + + vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32 + BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 + not allocated + Paths: (1 available, best #1) + Advertised to non peer-group peers: + 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 + 65035, (Received from a RR-client) + 10.0.0.8 from 10.0.0.8 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:65035:1030 + Remote label: 80 + Last update: Tue Oct 19 13:45:32 202 + +Also we can verify how PE devices receives VPNv4 networks from the RRs +and installing them to the specific customer VRFs: + +- “show bgp ipv4 vpn summary” for checking iBGP neighbors against + route-reflector devices: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary + BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0 + BGP table version 0 + RIB entries 9, using 1728 bytes of memory + Peers 2, using 43 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 + 10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 + +- “show bgp vrf all” for checking all the prefix learning on BGP + within VRFs: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp vrf all + + Instance default: + No BGP prefixes displayed, 0 exist + + Instance BLUE_SPOKE: + BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 + Default local pref 100, local AS 65001 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + * 10.50.50.0/24 0.0.0.0 0 32768 ? + *> 0.0.0.0 0 32768 i + *> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i + * 10.0.0.8@0< 0 100 0 i + *> 10.0.0.80/32 10.50.50.2 0 0 65035 i + *> 10.0.0.100/32 + 10.0.0.8@0< 0 100 0 65035 ? + * 10.0.0.8@0< 0 100 0 65035 ? + +- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor + information between PE and CE: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary + + + IPv4 Unicast Summary: + BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6 + BGP table version 8 + RIB entries 7, using 1344 bytes of memory + Peers 1, using 21 KiB of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 + + Total number of neighbors 1 + +- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. + Using this command we are also able to check the transport and + customer label (inner/outer) for Hub network prefix (10.0.0.100/32): + +.. code-block:: none + + vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE + + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + VRF BLUE_SPOKE: + K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h + C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h + B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m + B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + +- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the + specific VPNv4 destination including extended community and + remotelabel information. This procedure is the same on all Spoke nodes: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32 + BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 + not allocated + Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.8 from 10.0.0.1 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Tue Oct 19 13:45:26 2021 + 65035 + 10.0.0.8 from 10.0.0.2 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Wed Oct 13 12:39:34 202 + +Now, let’s check routing information on out Hub PE: + +- “show bgp ipv4 vpn summary” for checking iBGP neighbors again + VyOS-RR1/RR2 + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary + BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0 + BGP table version 0 + RIB entries 9, using 1728 bytes of memory + Peers 2, using 43 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 + 10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 + + Total number of neighbors + +- “show bgp vrf all” for checking all the prefixes learning on BGP + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp vrf all + + Instance default: + No BGP prefixes displayed, 0 exist + + Instance BLUE_HUB: + BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 + Default local pref 100, local AS 65001 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + *> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i + * 10.0.0.7@0< 0 100 0 i + *> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i + * 10.0.0.10@0< 0 100 0 i + * 10.80.80.0/24 10.80.80.2 0 0 65035 ? + * 0.0.0.0 0 32768 i + *> 0.0.0.0 0 32768 ? + *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i + *> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i + * 10.0.0.9@0< 0 100 0 65050 i + *> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i + * 10.0.0.7@0< 0 100 0 65035 i + *> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i + * 10.0.0.10@0< 0 100 0 65035 i + *> 10.0.0.100/32 + 10.80.80.2 0 0 65035 ? + *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? + 0.0.0.0@9< 0 32768 i + *> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i + * 10.0.0.9@0< 0 100 0 i + +- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor + CE Hub device + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary + + IPv4 Unicast Summary: + BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8 + BGP table version 50 + RIB entries 19, using 3648 bytes of memory + Peers 1, using 21 KiB of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 + +- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. + With this command we are able to check the transport and + customer label (inner/outer) for network spokes prefixes + 10.0.0.80/32 - 10.0.0.90/32 + +.. code-block:: none + + vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + VRF BLUE_HUB: + K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h + B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h + B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h + B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h + B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h + B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + +- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, + extended community and remote label of specific destination + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32 + BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32 + not allocated + Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.7 from 10.0.0.1 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 10.0.0.7 from 10.0.0.2 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:39:37 2021 + + vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 + BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 + not allocated + Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.10 from 10.0.0.1 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 10.0.0.10 from 10.0.0.2 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:45:44 2021 + +Finally, let’s check the reachability between CEs: + +- VyOS-CE1-SPOKE -----> VyOS-CE-HUB + + +.. code-block:: none + + # check rib + vyos@VyOS-CE1-SPOKE:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m + C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h + B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m + C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h + B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m + + # check icmp + vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80 + PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data. + 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms + 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms + 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms + 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms + ^C + --- 10.0.0.100 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 8ms + rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms + + # check network path + vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100 + traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets + 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms + 2 * * * + 3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m + +- VyOS-CE-HUB -------> VyOS-CE1-SPOKE +- VyOS-CE-HUB -------> VyOS-CE2-SPOKE + +.. code-block:: none + + # check rib + vyos@VyOS-CE-HUB:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m + B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h + B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h + B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m + B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h + B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h + B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + + # check icmp + vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4 + PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data. + 64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms + 64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms + 64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms + 64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms + + --- 10.0.0.80 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 9ms + rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms + + vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4 + PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data. + 64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms + 64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms + 64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms + ^C + --- 10.0.0.90 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 6ms + rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms + + # check network path + vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80 + traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms + 2 * * * + 3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms + + vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90 + traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms + 2 * * * + 3 * * * + 4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms + +- VyOS-CE2-SPOKE -------> VyOS-CE-HUB + +.. code-block:: none + + # check rib + vyos@rt-ce2-SPOKE:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h + C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h + B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m + C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h + B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m + + # check icmp + vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4 + PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data. + 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms + 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms + 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms + 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms + + --- 10.0.0.100 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 9ms + rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms + + # check network path + vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100 + traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets + 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms + 2 * * * + 3 * * * + 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms + +**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll see * * * for the transit routers of the mpls backbone. diff --git a/docs/configexamples/rst-lac-lns.rst b/docs/configexamples/rst-lac-lns.rst new file mode 100644 index 00000000..8443ddff --- /dev/null +++ b/docs/configexamples/rst-lac-lns.rst @@ -0,0 +1,177 @@ +:lastproofread: 2024-02-21 + +.. _examples-lac-lns: + +############### +PPPoE over L2TP +############### + +This document is to describe a basic setup using PPPoE over L2TP. +LAC and LNS are components of the broadband topology. +LAC - L2TP access concentrator +LNS - L2TP Network Server +LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and +forward them to LNS. LNS is the termination point that comes from PPP packets +from the remote client. + +In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC. +All users with domain **vyos.io** will be tunneled to LNS via L2TP. + +Network Topology +================ + +.. image:: /_static/images/lac-lns-diagram.jpg + :width: 60% + :align: center + :alt: Network Topology Diagram + +Configurations +============== + +LAC +--- + +.. code-block:: none + + aaa new-model + ! + aaa authentication ppp default local + ! + vpdn enable + vpdn aaa attribute nas-ip-address vpdn-nas + ! + vpdn-group LAC + request-dialin + protocol l2tp + domain vyos.io + initiate-to ip 192.168.139.100 + source-ip 192.168.139.101 + local name LAC + l2tp tunnel password 0 test123 + ! + bba-group pppoe MAIN-BBA + virtual-template 1 + ! + interface GigabitEthernet0/0 + description To LNS + ip address 192.168.139.101 255.255.255.0 + duplex auto + speed auto + media-type rj45 + ! + interface GigabitEthernet0/1 + description To PPPoE clients + no ip address + duplex auto + speed auto + media-type rj45 + pppoe enable group MAIN-BBA + ! + interface Virtual-Template1 + description pppoe MAIN-BBA + no ip address + no peer default ip address + ppp mtu adaptive + ppp authentication chap + ! + + +LNS +--- + +.. code-block:: none + + set interfaces ethernet eth0 address '192.168.139.100/24' + set nat source rule 100 outbound-interface name 'eth0' + set nat source rule 100 source address '10.0.0.0/24' + set nat source rule 100 translation address 'masquerade' + set protocols static route 0.0.0.0/0 next-hop 192.168.139.2 + set vpn l2tp remote-access authentication mode 'radius' + set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest' + set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100' + set vpn l2tp remote-access default-pool 'TEST-POOL' + set vpn l2tp remote-access gateway-address '10.0.0.1' + set vpn l2tp remote-access lns host-name 'LAC' + set vpn l2tp remote-access lns shared-secret 'test123' + set vpn l2tp remote-access name-server '8.8.8.8' + set vpn l2tp remote-access ppp-options disable-ccp + +.. note:: This setup requires the Compression Control Protocol (CCP) + being disabled, the command ``set vpn l2tp remote-access ppp-options disable-ccp`` + accomplishes that. + +Client +------ + +In this lab we use Windows PPPoE client. + +.. image:: /_static/images/lac-lns-winclient.jpg + :width: 100% + :align: center + :alt: Window PPPoE Client Configuration + +Monitoring +---------- + +Monitoring on LNS side + +.. code-block:: none + + vyos@vyos:~$ show l2tp-server sessions + ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes + --------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+---------- + l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB + +Monitoring on LAC side + +.. code-block:: none + + Router#show pppoe session + 1 session in FORWARDED (FWDED) State + 1 session total + Uniq ID PPPoE RemMAC Port VT VA State + SID LocMAC VA-st Type + 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED + 0c58.88ac.0001 + + Router#show l2tp + L2TP Tunnel and Session Information Total tunnels 1 sessions 1 + + LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ + Count VPDN Group + 23238 2640 LAC est 192.168.139.100 1 LAC + + LocID RemID TunID Username, Intf/ State Last Chg Uniq ID + Vcid, Circuit + 25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1 + +Monitoring on RADIUS Server side + +.. code-block:: none + + root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221 + Wed Feb 21 13:37:17 2024 + User-Name = "test@vyos.io" + NAS-Port = 0 + NAS-Port-Id = "l2tp0" + NAS-Port-Type = Virtual + Service-Type = Framed-User + Framed-Protocol = PPP + Calling-Station-Id = "192.168.139.101" + Called-Station-Id = "192.168.139.100" + Acct-Status-Type = Start + Acct-Authentic = RADIUS + Acct-Session-Id = "45c731e169d9a4f1" + Acct-Session-Time = 0 + Acct-Input-Octets = 0 + Acct-Output-Octets = 0 + Acct-Input-Packets = 0 + Acct-Output-Packets = 0 + Acct-Input-Gigawords = 0 + Acct-Output-Gigawords = 0 + Framed-IP-Address = 10.0.0.2 + NAS-IP-Address = 192.168.139.100 + Event-Timestamp = "Feb 21 2024 13:37:17 UTC" + Tmp-String-9 = "ai:" + Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318" + Timestamp = 1708522637 diff --git a/docs/configexamples/rst-nmp.rst b/docs/configexamples/rst-nmp.rst new file mode 100644 index 00000000..913e7107 --- /dev/null +++ b/docs/configexamples/rst-nmp.rst @@ -0,0 +1,66 @@ +:lastproofread: 2023-03-26 + +.. _examples-nmp: + +########### +NMP example +########### + +Consider how to quickly set up NMP and VyOS for monitoring. +NMP is multi-vendor network monitoring from 'SolarWinds' built to scale and expand with the needs of your network. + +Configuration 'VyOS' +==================== + +First prepare our VyOS router for connection to NMP. We have to set up the SNMP protocol and connectivity between the router and NMP. + +.. code-block:: none + + set interfaces ethernet eth0 address 'dhcp' + set system name-server '8.8.8.8' + set service snmp community router authorization 'test' + set service snmp community router network '0.0.0.0/0' + + +Configuration 'NMP' +==================== + +Next, you just should follow the pictures: + +.. image:: /_static/images/nmp1.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp2.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp3.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp4.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp5.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp6.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp7.png + :width: 80% + :align: center + :alt: Network Topology Diagram + + +In the end, you'll get a powerful instrument for monitoring the VyOS systems. \ No newline at end of file diff --git a/docs/configexamples/rst-ospf-unnumbered.rst b/docs/configexamples/rst-ospf-unnumbered.rst new file mode 100644 index 00000000..6a5a1bb4 --- /dev/null +++ b/docs/configexamples/rst-ospf-unnumbered.rst @@ -0,0 +1,120 @@ +:lastproofread: 2021-06-29 + +.. _examples-ospf-unnumbered: + +######################### +OSPF unnumbered with ECMP +######################### + +General information can be found in the :ref:`routing-ospf` chapter. + +Configuration +============= + +- Router A: + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.0.1/24' + set interfaces ethernet eth1 address '192.168.0.1/32' + set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' + set interfaces ethernet eth1 ip ospf network 'point-to-point' + set interfaces ethernet eth2 address '192.168.0.1/32' + set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' + set interfaces ethernet eth2 ip ospf network 'point-to-point' + set interfaces loopback lo address '192.168.0.1/32' + set protocols ospf area 0.0.0.0 authentication 'md5' + set protocols ospf area 0.0.0.0 network '192.168.0.1/32' + set protocols ospf parameters router-id '192.168.0.1' + set protocols ospf redistribute connected + +- Router B: + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.0.2/24' + set interfaces ethernet eth1 address '192.168.0.2/32' + set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' + set interfaces ethernet eth1 ip ospf network 'point-to-point' + set interfaces ethernet eth2 address '192.168.0.2/32' + set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' + set interfaces ethernet eth2 ip ospf network 'point-to-point' + set interfaces loopback lo address '192.168.0.2/32' + set protocols ospf area 0.0.0.0 authentication 'md5' + set protocols ospf area 0.0.0.0 network '192.168.0.2/32' + set protocols ospf parameters router-id '192.168.0.2' + set protocols ospf redistribute connected + + +Results +======= + +- Router A: + +.. code-block:: none + + vyos@vyos:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 10.0.0.1/24 u/u + eth1 192.168.0.1/32 u/u + eth2 192.168.0.1/32 u/u + lo 127.0.0.1/8 u/u + 192.168.0.1/32 + ::1/128 + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + + S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 + O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21 + via 192.168.0.2, eth2 onlink, 00:13:21 + C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 + O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53 + C * 192.168.0.1/32 is directly connected, eth2, 00:56:31 + C * 192.168.0.1/32 is directly connected, eth1, 00:56:31 + C>* 192.168.0.1/32 is directly connected, lo, 00:57:36 + O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03 + * via 192.168.0.2, eth2 onlink, 00:29:03 + +- Router B: + +.. code-block:: none + + vyos@vyos:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 10.0.0.2/24 u/u + eth1 192.168.0.2/32 u/u + eth2 192.168.0.2/32 u/u + lo 127.0.0.1/8 u/u + 192.168.0.2/32 + ::1/128 + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + + S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 + O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21 + via 192.168.0.1, eth2 onlink, 00:13:21 + C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 + O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53 + C * 192.168.0.2/32 is directly connected, eth2, 00:56:31 + C * 192.168.0.2/32 is directly connected, eth1, 00:56:31 + C>* 192.168.0.2/32 is directly connected, lo, 00:57:36 + O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03 + * via 192.168.0.1, eth2 onlink, 00:29:03 diff --git a/docs/configexamples/rst-pppoe-ipv6-basic.rst b/docs/configexamples/rst-pppoe-ipv6-basic.rst new file mode 100644 index 00000000..ad588def --- /dev/null +++ b/docs/configexamples/rst-pppoe-ipv6-basic.rst @@ -0,0 +1,116 @@ +:lastproofread: 2021-06-29 + +.. _examples-pppoe-ipv6-basic: + +####################################### +PPPoE IPv6 Basic Setup for Home Network +####################################### + +This document is to describe a basic setup using PPPoE with DHCPv6-PD + +SLAAC to construct a typical home network. The user can follow the steps +described here to quickly setup a working network and use this as a starting +point to further configure or fine-tune other settings. + +To achieve this, your ISP is required to support DHCPv6-PD. If you're not sure, +please contact your ISP for more information. + +Network Topology +================ + +.. image:: /_static/images/pppoe-ipv6-pd-diagram.jpg + :width: 60% + :align: center + :alt: Network Topology Diagram + +Configurations +============== + +PPPoE Setup +----------- + +.. code-block:: none + + set interfaces pppoe pppoe0 authentication password + set interfaces pppoe pppoe0 authentication user + set interfaces pppoe pppoe0 service-name + set interfaces pppoe pppoe0 source-interface 'eth0' + +* Fill ``password`` and ``user`` with the credential provided by your ISP. +* ``service-name`` can be an arbitrary string. + +DHCPv6-PD Setup +--------------- + +During address configuration, in addition to assigning an address to the WAN +interface, ISP also provides a prefix to allow the router to configure addresses +of LAN interface and other nodes connecting to LAN, which is called prefix +delegation (PD). + +.. code-block:: none + + set interfaces pppoe pppoe0 ipv6 address autoconf + set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' + +* Here we use the prefix to configure the address of eth1 (LAN) to form + ``::64``, where ``64`` is hexadecimal of address 100. +* For home network users, most of time ISP only provides /64 prefix, hence + there is no need to set SLA ID and prefix length. See :ref:`pppoe-interface` + for more information. + +Router Advertisement +-------------------- + +We need to enable router advertisement for LAN network so that PC can receive +the prefix and use SLAAC to configure the address automatically. + +.. code-block:: none + + set service router-advert interface eth1 link-mtu '1492' + set service router-advert interface eth1 name-server + set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800' + +* Set MTU in advertisement to 1492 because of PPPoE header overhead. +* Set DNS server address in the advertisement so that clients can obtain it by + using RDNSS option. Most operating systems (Windows, Linux, Mac) should + already support it. +* Here we set the prefix to ``::/64`` to indicate advertising any /64 prefix + the LAN interface is assigned. +* Since some ISPs disconnects continuous connection for every 2~3 days, we set + ``valid-lifetime`` to 2 days to allow PC for phasing out old address. + +Basic Firewall +-------------- + +To have basic protection while keeping IPv6 network functional, we need to: + +* Allow all established and related traffic for router and LAN +* Allow all icmpv6 packets for router and LAN +* Allow DHCPv6 packets for router + +.. code-block:: none + + set firewall ipv6 name WAN_IN default-action 'drop' + set firewall ipv6 name WAN_IN rule 10 action 'accept' + set firewall ipv6 name WAN_IN rule 10 state established 'enable' + set firewall ipv6 name WAN_IN rule 10 state related 'enable' + set firewall ipv6 name WAN_IN rule 20 action 'accept' + set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6' + set firewall ipv6 name WAN_LOCAL default-action 'drop' + set firewall ipv6 name WAN_LOCAL rule 10 action 'accept' + set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable' + set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable' + set firewall ipv6 name WAN_LOCAL rule 20 action 'accept' + set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6' + set firewall ipv6 name WAN_LOCAL rule 30 action 'accept' + set firewall ipv6 name WAN_LOCAL rule 30 destination port '546' + set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp' + set firewall ipv6 name WAN_LOCAL rule 30 source port '547' + set firewall ipv6 forward filter rule 10 action jump + set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN' + set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0' + set firewall ipv6 input filter rule 10 action jump + set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL' + set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0' + +Note to allow the router to receive DHCPv6 response from ISP. We need to allow +packets with source port 547 (server) and destination port 546 (client). diff --git a/docs/configexamples/rst-qos.rst b/docs/configexamples/rst-qos.rst new file mode 100644 index 00000000..842719c5 --- /dev/null +++ b/docs/configexamples/rst-qos.rst @@ -0,0 +1,182 @@ +:lastproofread: 2023-02-18 + +.. _examples-qos: + +########### +QoS example +########### + +Configuration 'dcsp' and shaper using QoS +========================================= + +In this case, we'll try to make a simple lab using QoS and the general ability of the VyOS system. +We recommend you to go through the main article about `QoS `_ first. + + +Using the general schema for example: + +.. image:: /_static/images/qos1.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +We have four hosts on the local network 172.17.1.0/24. All hosts are labeled CS0 by default. We need to replace labels on all hosts except vpc8. +We will replace the labels on the nearest router “VyOS3” using the IP addresses of the sources. + +* 172.17.1.2 CS0 -> CS4 +* 172.17.1.3 CS0 -> CS5 +* 172.17.1.4 CS0 -> CS6 +* 172.17.1.40 CS0 by default + +Next, we will replace only all CS4 labels on the “VyOS2” router. + +* CS4 -> CS5 + +In the end, we will configure the traffic shaper using QoS mechanisms on the “VYOS2” router. + +Configuration: +============== + +Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll use in this case only static routes. +On the VyOS3 router, we need to change the 'dscp' labels for the VPCs. To do this, we use this configuration. + +.. code-block:: none + + set interfaces ethernet eth0 address '10.1.1.100/24' + set interfaces ethernet eth1 address '172.17.1.1/24' + set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 + set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' + set qos policy shaper vyos3 class 10 set-dscp 'CS4' + set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' + set qos policy shaper vyos3 class 20 set-dscp 'CS5' + set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' + set qos policy shaper vyos3 class 30 set-dscp 'CS6' + set qos policy shaper vyos3 default bandwidth '10%' + set qos policy shaper vyos3 default ceiling '100%' + set qos policy shaper vyos3 default priority '7' + set qos policy shaper vyos3 default queue-type 'fair-queue' + set qos interface eth0 egress 'vyos3' + +Main rules: + +* ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32 +* ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32 +* ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32 + + +Check the result + +.. image:: /_static/images/qos2.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +Before the interface eth0 on router VyOS3 + +.. image:: /_static/images/qos3.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +After the interface eth0 on router VyOS3 + +.. image:: /_static/images/qos4.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +On the router, VyOS4 set all traffic as CS4. We have to configure the default class and class for changing all labels from CS0 to CS4 + +.. code-block:: none + + set interfaces ethernet eth0 address '10.2.1.100/24' + set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 + set qos policy shaper vyos4 class 10 bandwidth '100%' + set qos policy shaper vyos4 class 10 burst '15k' + set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' + set qos policy shaper vyos4 class 10 queue-type 'fair-queue' + set qos policy shaper vyos4 class 10 set-dscp 'CS4' + set qos policy shaper vyos4 default bandwidth '10%' + set qos policy shaper vyos4 default burst '15k' + set qos policy shaper vyos4 default ceiling '100%' + set qos policy shaper vyos4 default priority '7' + set qos policy shaper vyos4 default queue-type 'fair-queue' + set qos interface eth0 egress 'vyos4' + +Next on the router VyOS2 we will change labels on all incoming traffic only from CS4-> CS6 + +.. image:: /_static/images/qos5.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. code-block:: none + + set interfaces ethernet eth0 address '10.1.1.1/24' + set interfaces ethernet eth1 address '10.2.1.1/24' + set interfaces ethernet eth2 address '10.9.9.1/24' + set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 + set qos policy shaper vyos2 class 10 bandwidth '100%' + set qos policy shaper vyos2 class 10 burst '15k' + set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' + set qos policy shaper vyos2 class 10 queue-type 'fair-queue' + set qos policy shaper vyos2 class 10 set-dscp 'CS5' + set qos policy shaper vyos2 default bandwidth '100%' + set qos policy shaper vyos2 default burst '15k' + set qos policy shaper vyos2 default ceiling '100%' + set qos policy shaper vyos2 default priority '7' + set qos policy shaper vyos2 default queue-type 'fair-queue' + set qos interface eth2 egress 'vyos2' + +.. image:: /_static/images/qos6.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +* 172.17.1.2/24 CS0 + +.. image:: /_static/images/qos7.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +* 172.17.1.2/24 CS0 - > CS4 + +.. image:: /_static/images/qos8.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +* 172.17.1.2/24 CS4 - > CS5 + +.. image:: /_static/images/qos9.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +In the end, on the router “VyOS2” we will set outgoing bandwidth limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work with the help of the “iPerf” utility. + +Set up bandwidth limits on the eth2 interface of the router “VyOS2”. + +.. code-block:: none + + + vyos@vyos2# show qos policy shaper vyos2 class 20 + bandwidth 5mbit + description "for VyOS3 eth0" + match VyOS3 { + ip { + source { + address 10.1.1.100/32 + } + } + } + +Check the result. + +.. image:: /_static/images/qos10.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +As we see shaper is working and the traffic will not work over 5 Mbit/s. diff --git a/docs/configexamples/rst-segment-routing-isis.rst b/docs/configexamples/rst-segment-routing-isis.rst new file mode 100644 index 00000000..d9bc439b --- /dev/null +++ b/docs/configexamples/rst-segment-routing-isis.rst @@ -0,0 +1,279 @@ +:lastproofread: 2023-04-10 + +.. _examples-segment-routing-isis: + +############################# +Segment-routing IS-IS example +############################# + +When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this +blue print as an initial setup to get MPLS ISIS-SR working between those two +devices.The lab was build using :abbr:`EVE-NG (Emulated Virtual +Environment NG)`. + +.. figure:: /_static/images/vyos-sr-isis.png + :alt: ISIS-SR network + + ISIS-SR example network + +The below configuration is used as example where we keep focus on +VyOS-P1/VyOS-P2/XRv-P3 which we share the settings. + + +Configuration +============= + +- VyOS-P1: + +.. code-block:: none + + set interfaces dummy dum0 address '192.0.2.1/32' + set interfaces ethernet eth1 address '192.0.2.5/30' + set interfaces ethernet eth1 mtu '8000' + set interfaces ethernet eth3 address '192.0.2.21/30' + set interfaces ethernet eth3 mtu '8000' + set protocols isis interface dum0 passive + set protocols isis interface eth1 network point-to-point + set protocols isis interface eth3 network point-to-point + set protocols isis level 'level-2' + set protocols isis log-adjacency-changes + set protocols isis metric-style 'wide' + set protocols isis net '49.0000.0000.0000.0001.00' + set protocols isis segment-routing maximum-label-depth '8' + set protocols isis segment-routing prefix 192.0.2.1/32 index value '1' + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth3' + set system host-name 'P1-VyOS' + +- XRv-P3: + +.. code-block:: none + + hostname P3-VyOS + interface Loopback0 + ipv4 address 192.0.2.3 255.255.255.255 + ! + interface GigabitEthernet0/0/0/1 + mtu 8014 + ipv4 address 192.0.2.6 255.255.255.252 + ! + interface GigabitEthernet0/0/0/2 + mtu 8014 + ipv4 address 192.0.2.18 255.255.255.252 + ! + router isis VyOS + is-type level-2-only + net 49.0000.0000.0000.0003.00 + log adjacency changes + address-family ipv4 unicast + metric-style wide + segment-routing mpls + ! + interface Loopback0 + passive + address-family ipv4 unicast + prefix-sid index 3 + ! + ! + interface GigabitEthernet0/0/0/1 + point-to-point + address-family ipv4 unicast + ! + ! + interface GigabitEthernet0/0/0/2 + point-to-point + address-family ipv4 unicast + ! + ! + ! + +- VyOS-P2: + +.. code-block:: none + + set interfaces dummy dum0 address '192.0.2.2/32' + set interfaces ethernet eth2 address '192.0.2.17/30' + set interfaces ethernet eth2 mtu '8000' + set interfaces ethernet eth3 address '192.0.2.26/30' + set interfaces ethernet eth3 mtu '8000' + set protocols isis interface dum0 passive + set protocols isis interface eth2 network point-to-point + set protocols isis interface eth3 network point-to-point + set protocols isis level 'level-2' + set protocols isis log-adjacency-changes + set protocols isis metric-style 'wide' + set protocols isis net '49.0000.0000.0000.0002.00' + set protocols isis segment-routing maximum-label-depth '8' + set protocols isis segment-routing prefix 192.0.2.2/32 index value '2' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set system host-name 'P2-VyOS' + +This gives us MPLS segment routing enabled and labels forwarding : + +.. code-block:: none + + vyos@P1-VyOS:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------------- + 15000 SR (IS-IS) 192.0.2.6 implicit-null + 15001 SR (IS-IS) 192.0.2.22 implicit-null + 15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null + 16002 SR (IS-IS) 192.0.2.6 16002 + 16003 SR (IS-IS) 192.0.2.6 implicit-null + 16011 SR (IS-IS) 192.0.2.22 implicit-null + + vyos@P2-VyOS:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ------------------------------------------------------- + 15000 SR (IS-IS) 192.0.2.18 implicit-null + 16001 SR (IS-IS) 192.0.2.18 16001 + 16003 SR (IS-IS) 192.0.2.18 implicit-null + 16011 SR (IS-IS) 192.0.2.18 16011 + + RP/0/0/CPU0:P3-VyOS#show mpls forwarding + Tue Mar 28 17:47:18.928 UTC + Local Outgoing Prefix Outgoing Next Hop Bytes + Label Label or ID Interface Switched + ------ ----------- ------------------ ------------ --------------- ------------ + 16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0 + 16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0 + 16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0 + 24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0 + 24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0 + 24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0 + 24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0 + + +VyOS is able to check MSD per devices: + +.. code-block:: none + + vyos@P1-VyOS:~$ show isis segment-routing node + Area VyOS: + IS-IS L1 SR-Nodes: + + IS-IS L2 SR-Nodes: + + System ID SRGB SRLB Algorithm MSD + --------------------------------------------------------------- + 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 + 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 + + vyos@P2-VyOS:~$ show isis segment-routing node + Area VyOS: + IS-IS L1 SR-Nodes: + + IS-IS L2 SR-Nodes: + + System ID SRGB SRLB Algorithm MSD + --------------------------------------------------------------- + 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 + 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 + +Here is the routing tables showing the MPLS segment routing label operations: + +.. code-block:: none + + vyos@P1-VyOS:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m + I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m + I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m + I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m + I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m + I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m + I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m + + + vyos@P2-VyOS:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m + I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m + I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m + I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m + I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m + I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m + + RP/0/0/CPU0:P3-VyOS#show route isis + Tue Mar 28 18:19:16.417 UTC + + i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 + i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 + i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1 + i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 + i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 + +Information about prefix-sid and label-operation from VyOS + +.. code-block:: none + + vyos@P1-VyOS:~$ show isis route prefix-sid + Area VyOS: + IS-IS L2 IPv4 routing table: + + Prefix Metric Interface Nexthop SID Label Op. + ---------------------------------------------------------------------- + 192.0.2.1/32 0 - - - - + 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002) + 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003) + 192.0.2.4/30 20 eth1 192.0.2.6 - - + 192.0.2.16/30 20 eth1 192.0.2.6 - - + 192.0.2.20/30 0 - - - - + 192.0.2.24/30 30 eth1 192.0.2.6 - - + + vyos@P2-VyOS:~$ show isis route prefix-sid + Area VyOS: + IS-IS L2 IPv4 routing table: + + Prefix Metric Interface Nexthop SID Label Op. + ----------------------------------------------------------------------- + 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001) + 192.0.2.2/32 0 - - - - + 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003) + 192.0.2.4/30 20 eth2 192.0.2.18 - - + 192.0.2.16/30 20 eth2 192.0.2.18 - - + 192.0.2.20/30 30 eth2 192.0.2.18 - - + 192.0.2.24/30 0 - - - - + +Ping between VyOS-P1 / VyOS-P2 to confirm reachability: + +.. code-block:: none + + vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1 + PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data. + 64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms + 64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms + 64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms + 64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms + ^C + --- 192.0.2.2 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3004ms + rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms + + vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2 + PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data. + 64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms + 64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms + 64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms + 64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms + ^C + --- 192.0.2.1 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3005ms + rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms \ No newline at end of file diff --git a/docs/configexamples/rst-wan-load-balancing.rst b/docs/configexamples/rst-wan-load-balancing.rst new file mode 100644 index 00000000..ace9a981 --- /dev/null +++ b/docs/configexamples/rst-wan-load-balancing.rst @@ -0,0 +1,183 @@ +:lastproofread: 2021-06-29 + +.. _wan-load-balancing: + +.. stop_vyoslinter # pictures and text have to change + +WAN Load Balancer examples +========================== + + +Example 1: Distributing load evenly +----------------------------------- + +The setup used in this example is shown in the following diagram: + +.. image:: /_static/images/Wan_load_balancing1.png + :width: 80% + :align: center + :alt: Network Topology Diagram + + +Overview +^^^^^^^^ + * All traffic coming in through eth2 is balanced between eth0 and eth1 + on the router. + * Pings will be sent to four targets for health testing (33.44.55.66, + 44.55.66.77, 55.66.77.88 and 66.77.88.99). + * All outgoing packets are assigned the source address of the assigned + interface (SNAT). + * eth0 is set to be removed from the load balancer's interface pool + after 5 ping failures, eth1 will be removed after 4 ping failures. + +Create static routes to ping targets +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Create static routes through the two ISPs towards the ping targets and +commit the changes: + +.. code-block:: none + + set protocols static route 33.44.55.66/32 next-hop 11.22.33.1 + set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 + set protocols static route 55.66.77.88/32 next-hop 22.33.44.1 + set protocols static route 66.77.88.99/32 next-hop 22.33.44.1 + +Configure the load balancer +^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Configure the WAN load balancer with the parameters described above: + +.. code-block:: none + + set load-balancing wan interface-health eth0 failure-count 5 + set load-balancing wan interface-health eth0 nexthop 11.22.33.1 + set load-balancing wan interface-health eth0 test 10 type ping + set load-balancing wan interface-health eth0 test 10 target 33.44.55.66 + set load-balancing wan interface-health eth0 test 20 type ping + set load-balancing wan interface-health eth0 test 20 target 44.55.66.77 + set load-balancing wan interface-health eth1 failure-count 4 + set load-balancing wan interface-health eth1 nexthop 22.33.44.1 + set load-balancing wan interface-health eth1 test 10 type ping + set load-balancing wan interface-health eth1 test 10 target 55.66.77.88 + set load-balancing wan interface-health eth1 test 20 type ping + set load-balancing wan interface-health eth1 test 20 target 66.77.88.99 + set load-balancing wan rule 10 inbound-interface eth2 + set load-balancing wan rule 10 interface eth0 + set load-balancing wan rule 10 interface eth1 + +Example 2: Failover based on interface weights +---------------------------------------------- + +This example uses the failover mode. + +.. _wan:example2_overwiew: + +Overview +^^^^^^^^ +In this example, eth0 is the primary interface and eth1 is the secondary +interface. To provide simple failover functionality. If eth0 fails, eth1 +takes over. + +Create interface weight based configuration +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +The configuration steps are the same as in the previous example, except +rule 10. So we keep the configuration, remove rule 10 and add a new rule +for the failover mode: + +.. code-block:: none + + delete load-balancing wan rule 10 + set load-balancing wan rule 10 failover + set load-balancing wan rule 10 inbound-interface eth2 + set load-balancing wan rule 10 interface eth0 weight 10 + set load-balancing wan rule 10 interface eth1 weight 1 + +Example 3: Failover based on rule order +--------------------------------------- + +The previous example used the failover command to send traffic through +eth1 if eth0 fails. In this example, failover functionality is provided +by rule order. + +.. _wan:example3_overwiew: + +Overview +^^^^^^^^ +Two rules will be created, the first rule directs traffic coming in +from eth2 to eth0 and the second rule directs the traffic to eth1. If +eth0 fails the first rule is bypassed and the second rule matches, +directing traffic to eth1. + +Create rule order based configuration +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +We keep the configuration from the previous example, delete rule 10 +and create the two new rules as described: + +.. code-block:: none + + delete load-balancing wan rule 10 + set load-balancing wan rule 10 inbound-interface eth2 + set load-balancing wan rule 10 interface eth0 + set load-balancing wan rule 20 inbound-interface eth2 + set load-balancing wan rule 20 interface eth1 + +Example 4: Failover based on rule order - priority traffic +---------------------------------------------------------- + +A rule order for prioritizing traffic is useful in scenarios where the +secondary link has a lower speed and should only carry high priority +traffic. It is assumed for this example that eth1 is connected to a +slower connection than eth0 and should prioritize VoIP traffic. + + +.. _wan:example4_overwiew: + +Overview +^^^^^^^^ +A rule order for prioritizing traffic is useful in scenarios where the +secondary link has a lower speed and should only carry high priority +traffic. It is assumed for this example that eth1 is connected to a +slower connection than eth0 and should prioritize VoIP traffic. + +Create rule order based configuration with low speed secondary link +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +We keep the configuration from the previous example, delete rule 20 and +create a new rule as described: + +.. code-block:: none + + delete load-balancing wan rule 20 + set load-balancing wan rule 20 inbound-interface eth2 + set load-balancing wan rule 20 interface eth1 + set load-balancing wan rule 20 destination port sip + set load-balancing wan rule 20 protocol tcp + set protocols static route 0.0.0.0/0 next-hop 11.22.33.1 + +Example 5: Exclude traffic from load balancing +---------------------------------------------- + +In this example two LAN interfaces exist in different subnets instead +of one like in the previous examples: + +.. image:: /_static/images/Wan_load_balancing_exclude1.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +Adding a rule for the second interface +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Based on the previous example, another rule for traffic from the second +interface eth3 can be added to the load balancer. However, traffic meant +to flow between the LAN subnets will be sent to eth0 and eth1 as well. +To prevent this, another rule is required. This rule excludes traffic +between the local subnets from the load balancer. It also excludes +locally-sources packets (required for web caching with load balancing). +eth+ is used as an alias that refers to all ethernet interfaces: + +.. code-block:: none + + set load-balancing wan rule 5 exclude + set load-balancing wan rule 5 inbound-interface eth+ + set load-balancing wan rule 5 destination address 10.0.0.0/8 + +.. start_vyoslinter diff --git a/docs/configexamples/rst-zone-policy.rst b/docs/configexamples/rst-zone-policy.rst new file mode 100644 index 00000000..d0101ebf --- /dev/null +++ b/docs/configexamples/rst-zone-policy.rst @@ -0,0 +1,420 @@ +:lastproofread: 2024-06-14 + +.. _examples-zone-policy: + +Zone-Policy example +------------------- + +.. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. + The zone configuration moved from ``zone-policy zone `` to ``firewall + zone ``. + +Native IPv4 and IPv6 +^^^^^^^^^^^^^^^^^^^^ + +We have three networks. + +.. code-block:: none + + WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64 + LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64 + DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64 + + +**This specific example is for a router on a stick, but is very easily +adapted for however many NICs you have**: + + +* Internet - 192.168.200.100 - TCP/80 +* Internet - 192.168.200.100 - TCP/443 +* Internet - 192.168.200.100 - TCP/25 +* Internet - 192.168.200.100 - TCP/53 +* VyOS acts as DHCP, DNS forwarder, NAT, router and firewall. +* 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web + and mail (SMTP/IMAP) server. +* 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It + can SSH to VyOS. +* LAN and DMZ hosts have basic outbound access: Web, FTP, SSH. +* LAN can access DMZ resources. +* DMZ cannot access LAN resources. +* Inbound WAN connect to DMZ host. + +.. image:: /_static/images/zone-policy-diagram.png + :width: 80% + :align: center + :alt: Network Topology Diagram + +The VyOS interface is assigned the .1/:1 address of their respective +networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30. + +It will look something like this: + +.. code-block:: none + + interfaces { + ethernet eth0 { + duplex auto + hw-id 00:53:ed:6e:2a:92 + smp_affinity auto + speed auto + vif 10 { + address 172.16.10.1/24 + address 2001:db8:0:9999::1/64 + } + vif 20 { + address 192.168.100.1/24 + address 2001:db8:0:AAAA::1/64 + } + vif 30 { + address 192.168.200.1/24 + address 2001:db8:0:BBBB::1/64 + } + } + loopback lo { + } + } + + +Zones Basics +^^^^^^^^^^^^ + +Each interface is assigned to a zone. The interface can be physical or +virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly +the same. + +Traffic flows from zone A to zone B. That flow is what I refer to as a +zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations. + +Ruleset are created per zone-pair-direction. + +I name rule sets to indicate which zone-pair-direction they represent. +eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN. + +In VyOS, you have to have unique Ruleset names. In the event of overlap, +I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This +allows for each auto-completion and uniqueness. + +In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is +the firewall itself. + +If your computer is on the LAN and you need to SSH into your VyOS box, +you would need a rule to allow it in the LAN-Local ruleset. If you want +to access a webpage from your VyOS box, you need a rule to allow it in +the Local-LAN ruleset. + +In rules, it is good to keep them named consistently. As the number of +rules you have grows, the more consistency you have, the easier your +life will be. + +.. code-block:: none + + Rule 1 - State Established, Related + Rule 2 - State Invalid + Rule 100 - ICMP + Rule 200 - Web + Rule 300 - FTP + Rule 400 - NTP + Rule 500 - SMTP + Rule 600 - DNS + Rule 700 - DHCP + Rule 800 - SSH + Rule 900 - IMAPS + +The first two rules are to deal with the idiosyncrasies of VyOS and +iptables. + +Zones and Rulesets both have a default action statement. When using +Zone-Policies, the default action is set by the zone-policy statement +and is represented by rule 10000. + +It is good practice to log both accepted and denied traffic. It can save +you significant headaches when trying to troubleshoot a connectivity +issue. + +To add logging to the default rule, do: + +.. code-block:: none + + set firewall name default-log + + +By default, iptables does not allow traffic for established sessions to +return, so you must explicitly allow this. I do this by adding two rules +to every ruleset. 1 allows established and related state packets through +and rule 2 drops and logs invalid state packets. We place the +established/related rule at the top because the vast majority of traffic +on a network is established and the invalid rule to prevent invalid +state packets from mistakenly being matched against other rules. Having +the most matched rule listed first reduces CPU load in high volume +environments. Note: I have filed a bug to have this added as a default +action as well. + +''It is important to note, that you do not want to add logging to the +established state rule as you will be logging both the inbound and +outbound packets for each session instead of just the initiation of the +session. Your logs will be massive in a very short period of time.'' + +In VyOS you must have the interfaces created before you can apply it to +the zone and the rulesets must be created prior to applying it to a +zone-policy. + +I create/configure the interfaces first. Build out the rulesets for each +zone-pair-direction which includes at least the three state rules. Then +I setup the zone-policies. + +Zones do not allow for a default action of accept; either drop or +reject. It is important to remember this because if you apply an +interface to a zone and commit, any active connections will be dropped. +Specifically, if you are SSH’d into VyOS and add local or the interface +you are connecting through to a zone and do not have rulesets in place +to allow SSH and established sessions, you will not be able to connect. + +The following are the rules that were created for this example (may not +be complete), both in IPv4 and IPv6. If there is no IP specified, then +the source/destination address is not explicit. + +.. code-block:: none + + WAN - DMZ:192.168.200.200 - tcp/80 + WAN - DMZ:192.168.200.200 - tcp/443 + WAN - DMZ:192.168.200.200 - tcp/25 + WAN - DMZ:192.168.200.200 - tcp/53 + WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80 + WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443 + WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25 + WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53 + + DMZ - Local - tcp/53 + DMZ - Local - tcp/123 + DMZ - Local - tcp/67,68 + + LAN - Local - tcp/53 + LAN - Local - tcp/123 + LAN - Local - tcp/67,68 + LAN:192.168.100.10 - Local - tcp/22 + LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22 + + LAN - WAN - tcp/80 + LAN - WAN - tcp/443 + LAN - WAN - tcp/22 + LAN - WAN - tcp/20,21 + + DMZ - WAN - tcp/80 + DMZ - WAN - tcp/443 + DMZ - WAN - tcp/22 + DMZ - WAN - tcp/20,21 + DMZ - WAN - tcp/53 + DMZ - WAN - udp/53 + + Local - WAN - tcp/80 + Local - WAN - tcp/443 + Local - WAN - tcp/20,21 + + Local - DMZ - tcp/25 + Local - DMZ - tcp/67,68 + Local - DMZ - tcp/53 + Local - DMZ - udp/53 + + Local - LAN - tcp/67,68 + + LAN - DMZ - tcp/80 + LAN - DMZ - tcp/443 + LAN - DMZ - tcp/993 + LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22 + LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22 + +Since we have 4 zones, we need to setup the following rulesets. + +.. code-block:: none + + Lan-wan + Lan-local + Lan-dmz + Wan-lan + Wan-local + Wan-dmz + Local-lan + Local-wan + Local-dmz + Dmz-lan + Dmz-wan + Dmz-local + +Even if the two zones will never communicate, it is a good idea to +create the zone-pair-direction rulesets and set default-log. This +will allow you to log attempts to access the networks. Without it, you +will never see the connection attempts. + +This is an example of the three base rules. + +.. code-block:: none + + name wan-lan { + default-action drop + default-log + rule 1 { + action accept + state { + established enable + related enable + } + } + rule 2 { + action drop + log enable + state { + invalid enable + } + } + } + + +Here is an example of an IPv6 DMZ-WAN ruleset. + +.. code-block:: none + + ipv6-name dmz-wan-6 { + default-action drop + default-log + rule 1 { + action accept + state { + established enable + related enable + } + } + rule 2 { + action drop + log enable + state { + invalid enable + } + rule 100 { + action accept + log enable + protocol ipv6-icmp + } + rule 200 { + action accept + destination { + port 80,443 + } + log enable + protocol tcp + } + rule 300 { + action accept + destination { + port 20,21 + } + log enable + protocol tcp + } + rule 500 { + action accept + destination { + port 25 + } + log enable + protocol tcp + source { + address 2001:db8:0:BBBB::200 + } + } + rule 600 { + action accept + destination { + port 53 + } + log enable + protocol tcp_udp + source { + address 2001:db8:0:BBBB::200 + } + } + rule 800 { + action accept + destination { + port 22 + } + log enable + protocol tcp + } + } + +Once you have all of your rulesets built, then you need to create your +zone-policy. + +Start by setting the interface and default action for each zone. + +.. code-block:: none + + set firewall zone dmz default-action drop + set firewall zone dmz interface eth0.30 + +In this case, we are setting the v6 ruleset that represents traffic +sourced from the LAN, destined for the DMZ. Because the zone-policy +firewall syntax is a little awkward, I keep it straight by thinking of +it backwards. + +.. code-block:: none + + set firewall zone dmz from lan firewall ipv6-name lan-dmz-6 + +DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out +a bunch at one time. + +In the end, you will end up with something like this config. I took out +everything but the Firewall, Interfaces, and zone-policy sections. It is +long enough as is. + + +IPv6 Tunnel +^^^^^^^^^^^ + +If you are using a IPv6 tunnel from HE.net or someone else, the basis is +the same except you have two WAN interfaces. One for v4 and one for v6. + +You would have 5 zones instead of just 4 and you would configure your v6 +ruleset between your tunnel interface and your LAN/DMZ zones instead of +to the WAN. + +LAN, WAN, DMZ, local and TUN (tunnel) + +v6 pairs would be: + +.. code-block:: none + + lan-tun + lan-local + lan-dmz + tun-lan + tun-local + tun-dmz + local-lan + local-tun + local-dmz + dmz-lan + dmz-tun + dmz-local + +Notice, none go to WAN since WAN wouldn't have a v6 address on it. + +You would have to add a couple of rules on your wan-local ruleset to +allow protocol 41 in. + +Something like: + +.. code-block:: none + + rule 400 { + action accept + destination { + address 172.16.10.1 + } + log enable + protocol 41 + source { + address ip.of.tunnel.broker + } + } diff --git a/docs/configexamples/segment-routing-isis.md b/docs/configexamples/segment-routing-isis.md new file mode 100644 index 00000000..76cb726c --- /dev/null +++ b/docs/configexamples/segment-routing-isis.md @@ -0,0 +1,277 @@ +--- +lastproofread: '2023-04-10' +--- + +(examples-segment-routing-isis)= + +# Segment-routing IS-IS example + +When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this +blue print as an initial setup to get MPLS ISIS-SR working between those two +devices.The lab was build using {abbr}`EVE-NG (Emulated Virtual +Environment NG)`. + +:::{figure} /_static/images/vyos-sr-isis.png +:alt: ISIS-SR network + +ISIS-SR example network +::: + +The below configuration is used as example where we keep focus on +VyOS-P1/VyOS-P2/XRv-P3 which we share the settings. + +## Configuration + +- VyOS-P1: + +```none +set interfaces dummy dum0 address '192.0.2.1/32' +set interfaces ethernet eth1 address '192.0.2.5/30' +set interfaces ethernet eth1 mtu '8000' +set interfaces ethernet eth3 address '192.0.2.21/30' +set interfaces ethernet eth3 mtu '8000' +set protocols isis interface dum0 passive +set protocols isis interface eth1 network point-to-point +set protocols isis interface eth3 network point-to-point +set protocols isis level 'level-2' +set protocols isis log-adjacency-changes +set protocols isis metric-style 'wide' +set protocols isis net '49.0000.0000.0000.0001.00' +set protocols isis segment-routing maximum-label-depth '8' +set protocols isis segment-routing prefix 192.0.2.1/32 index value '1' +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth3' +set system host-name 'P1-VyOS' +``` + +- XRv-P3: + +```none +hostname P3-VyOS +interface Loopback0 + ipv4 address 192.0.2.3 255.255.255.255 +! +interface GigabitEthernet0/0/0/1 + mtu 8014 + ipv4 address 192.0.2.6 255.255.255.252 +! +interface GigabitEthernet0/0/0/2 + mtu 8014 + ipv4 address 192.0.2.18 255.255.255.252 +! +router isis VyOS + is-type level-2-only + net 49.0000.0000.0000.0003.00 + log adjacency changes + address-family ipv4 unicast + metric-style wide + segment-routing mpls + ! + interface Loopback0 + passive + address-family ipv4 unicast + prefix-sid index 3 + ! + ! + interface GigabitEthernet0/0/0/1 + point-to-point + address-family ipv4 unicast + ! + ! + interface GigabitEthernet0/0/0/2 + point-to-point + address-family ipv4 unicast + ! + ! +! +``` + +- VyOS-P2: + +```none +set interfaces dummy dum0 address '192.0.2.2/32' +set interfaces ethernet eth2 address '192.0.2.17/30' +set interfaces ethernet eth2 mtu '8000' +set interfaces ethernet eth3 address '192.0.2.26/30' +set interfaces ethernet eth3 mtu '8000' +set protocols isis interface dum0 passive +set protocols isis interface eth2 network point-to-point +set protocols isis interface eth3 network point-to-point +set protocols isis level 'level-2' +set protocols isis log-adjacency-changes +set protocols isis metric-style 'wide' +set protocols isis net '49.0000.0000.0000.0002.00' +set protocols isis segment-routing maximum-label-depth '8' +set protocols isis segment-routing prefix 192.0.2.2/32 index value '2' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set system host-name 'P2-VyOS' +``` + +This gives us MPLS segment routing enabled and labels forwarding : + +```none +vyos@P1-VyOS:~$ show mpls table +Inbound Label Type Nexthop Outbound Label +----------------------------------------------------------------- +15000 SR (IS-IS) 192.0.2.6 implicit-null +15001 SR (IS-IS) 192.0.2.22 implicit-null +15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null +16002 SR (IS-IS) 192.0.2.6 16002 +16003 SR (IS-IS) 192.0.2.6 implicit-null +16011 SR (IS-IS) 192.0.2.22 implicit-null + +vyos@P2-VyOS:~$ show mpls table +Inbound Label Type Nexthop Outbound Label +------------------------------------------------------- +15000 SR (IS-IS) 192.0.2.18 implicit-null +16001 SR (IS-IS) 192.0.2.18 16001 +16003 SR (IS-IS) 192.0.2.18 implicit-null +16011 SR (IS-IS) 192.0.2.18 16011 + +RP/0/0/CPU0:P3-VyOS#show mpls forwarding +Tue Mar 28 17:47:18.928 UTC +Local Outgoing Prefix Outgoing Next Hop Bytes +Label Label or ID Interface Switched +------ ----------- ------------------ ------------ --------------- ------------ +16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0 +16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0 +16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0 +24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0 +24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0 +24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0 +24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0 +``` + +VyOS is able to check MSD per devices: + +```none +vyos@P1-VyOS:~$ show isis segment-routing node +Area VyOS: +IS-IS L1 SR-Nodes: + +IS-IS L2 SR-Nodes: + +System ID SRGB SRLB Algorithm MSD +--------------------------------------------------------------- +0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 +0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 +0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 +0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 + +vyos@P2-VyOS:~$ show isis segment-routing node +Area VyOS: + IS-IS L1 SR-Nodes: + + IS-IS L2 SR-Nodes: + + System ID SRGB SRLB Algorithm MSD + --------------------------------------------------------------- + 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 + 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +```none +vyos@P1-VyOS:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m +I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m +I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m +I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m +I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m +I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m +I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m + + +vyos@P2-VyOS:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m +I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m +I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m +I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m +I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m +I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m + +RP/0/0/CPU0:P3-VyOS#show route isis +Tue Mar 28 18:19:16.417 UTC + +i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 +i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 +i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1 +i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 +i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 +``` + +Information about prefix-sid and label-operation from VyOS + +```none +vyos@P1-VyOS:~$ show isis route prefix-sid +Area VyOS: +IS-IS L2 IPv4 routing table: + + Prefix Metric Interface Nexthop SID Label Op. + ---------------------------------------------------------------------- + 192.0.2.1/32 0 - - - - + 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002) + 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003) + 192.0.2.4/30 20 eth1 192.0.2.6 - - + 192.0.2.16/30 20 eth1 192.0.2.6 - - + 192.0.2.20/30 0 - - - - + 192.0.2.24/30 30 eth1 192.0.2.6 - - + + vyos@P2-VyOS:~$ show isis route prefix-sid + Area VyOS: + IS-IS L2 IPv4 routing table: + + Prefix Metric Interface Nexthop SID Label Op. + ----------------------------------------------------------------------- + 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001) + 192.0.2.2/32 0 - - - - + 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003) + 192.0.2.4/30 20 eth2 192.0.2.18 - - + 192.0.2.16/30 20 eth2 192.0.2.18 - - + 192.0.2.20/30 30 eth2 192.0.2.18 - - + 192.0.2.24/30 0 - - - - +``` + +Ping between VyOS-P1 / VyOS-P2 to confirm reachability: + +```none +vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1 +PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data. +64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms +64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms +64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms +64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms +^C +--- 192.0.2.2 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3004ms +rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms + +vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2 +PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data. +64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms +64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms +64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms +64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms +^C +--- 192.0.2.1 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3005ms +rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms +``` diff --git a/docs/configexamples/segment-routing-isis.rst b/docs/configexamples/segment-routing-isis.rst deleted file mode 100644 index d9bc439b..00000000 --- a/docs/configexamples/segment-routing-isis.rst +++ /dev/null @@ -1,279 +0,0 @@ -:lastproofread: 2023-04-10 - -.. _examples-segment-routing-isis: - -############################# -Segment-routing IS-IS example -############################# - -When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this -blue print as an initial setup to get MPLS ISIS-SR working between those two -devices.The lab was build using :abbr:`EVE-NG (Emulated Virtual -Environment NG)`. - -.. figure:: /_static/images/vyos-sr-isis.png - :alt: ISIS-SR network - - ISIS-SR example network - -The below configuration is used as example where we keep focus on -VyOS-P1/VyOS-P2/XRv-P3 which we share the settings. - - -Configuration -============= - -- VyOS-P1: - -.. code-block:: none - - set interfaces dummy dum0 address '192.0.2.1/32' - set interfaces ethernet eth1 address '192.0.2.5/30' - set interfaces ethernet eth1 mtu '8000' - set interfaces ethernet eth3 address '192.0.2.21/30' - set interfaces ethernet eth3 mtu '8000' - set protocols isis interface dum0 passive - set protocols isis interface eth1 network point-to-point - set protocols isis interface eth3 network point-to-point - set protocols isis level 'level-2' - set protocols isis log-adjacency-changes - set protocols isis metric-style 'wide' - set protocols isis net '49.0000.0000.0000.0001.00' - set protocols isis segment-routing maximum-label-depth '8' - set protocols isis segment-routing prefix 192.0.2.1/32 index value '1' - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth3' - set system host-name 'P1-VyOS' - -- XRv-P3: - -.. code-block:: none - - hostname P3-VyOS - interface Loopback0 - ipv4 address 192.0.2.3 255.255.255.255 - ! - interface GigabitEthernet0/0/0/1 - mtu 8014 - ipv4 address 192.0.2.6 255.255.255.252 - ! - interface GigabitEthernet0/0/0/2 - mtu 8014 - ipv4 address 192.0.2.18 255.255.255.252 - ! - router isis VyOS - is-type level-2-only - net 49.0000.0000.0000.0003.00 - log adjacency changes - address-family ipv4 unicast - metric-style wide - segment-routing mpls - ! - interface Loopback0 - passive - address-family ipv4 unicast - prefix-sid index 3 - ! - ! - interface GigabitEthernet0/0/0/1 - point-to-point - address-family ipv4 unicast - ! - ! - interface GigabitEthernet0/0/0/2 - point-to-point - address-family ipv4 unicast - ! - ! - ! - -- VyOS-P2: - -.. code-block:: none - - set interfaces dummy dum0 address '192.0.2.2/32' - set interfaces ethernet eth2 address '192.0.2.17/30' - set interfaces ethernet eth2 mtu '8000' - set interfaces ethernet eth3 address '192.0.2.26/30' - set interfaces ethernet eth3 mtu '8000' - set protocols isis interface dum0 passive - set protocols isis interface eth2 network point-to-point - set protocols isis interface eth3 network point-to-point - set protocols isis level 'level-2' - set protocols isis log-adjacency-changes - set protocols isis metric-style 'wide' - set protocols isis net '49.0000.0000.0000.0002.00' - set protocols isis segment-routing maximum-label-depth '8' - set protocols isis segment-routing prefix 192.0.2.2/32 index value '2' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set system host-name 'P2-VyOS' - -This gives us MPLS segment routing enabled and labels forwarding : - -.. code-block:: none - - vyos@P1-VyOS:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------------- - 15000 SR (IS-IS) 192.0.2.6 implicit-null - 15001 SR (IS-IS) 192.0.2.22 implicit-null - 15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null - 16002 SR (IS-IS) 192.0.2.6 16002 - 16003 SR (IS-IS) 192.0.2.6 implicit-null - 16011 SR (IS-IS) 192.0.2.22 implicit-null - - vyos@P2-VyOS:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ------------------------------------------------------- - 15000 SR (IS-IS) 192.0.2.18 implicit-null - 16001 SR (IS-IS) 192.0.2.18 16001 - 16003 SR (IS-IS) 192.0.2.18 implicit-null - 16011 SR (IS-IS) 192.0.2.18 16011 - - RP/0/0/CPU0:P3-VyOS#show mpls forwarding - Tue Mar 28 17:47:18.928 UTC - Local Outgoing Prefix Outgoing Next Hop Bytes - Label Label or ID Interface Switched - ------ ----------- ------------------ ------------ --------------- ------------ - 16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0 - 16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0 - 16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0 - 24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0 - 24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0 - 24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0 - 24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0 - - -VyOS is able to check MSD per devices: - -.. code-block:: none - - vyos@P1-VyOS:~$ show isis segment-routing node - Area VyOS: - IS-IS L1 SR-Nodes: - - IS-IS L2 SR-Nodes: - - System ID SRGB SRLB Algorithm MSD - --------------------------------------------------------------- - 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 - 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 - - vyos@P2-VyOS:~$ show isis segment-routing node - Area VyOS: - IS-IS L1 SR-Nodes: - - IS-IS L2 SR-Nodes: - - System ID SRGB SRLB Algorithm MSD - --------------------------------------------------------------- - 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 - 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 - -Here is the routing tables showing the MPLS segment routing label operations: - -.. code-block:: none - - vyos@P1-VyOS:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m - I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m - I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m - I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m - I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m - I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m - I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m - - - vyos@P2-VyOS:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m - I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m - I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m - I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m - I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m - I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m - - RP/0/0/CPU0:P3-VyOS#show route isis - Tue Mar 28 18:19:16.417 UTC - - i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 - i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 - i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1 - i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 - i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 - -Information about prefix-sid and label-operation from VyOS - -.. code-block:: none - - vyos@P1-VyOS:~$ show isis route prefix-sid - Area VyOS: - IS-IS L2 IPv4 routing table: - - Prefix Metric Interface Nexthop SID Label Op. - ---------------------------------------------------------------------- - 192.0.2.1/32 0 - - - - - 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002) - 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003) - 192.0.2.4/30 20 eth1 192.0.2.6 - - - 192.0.2.16/30 20 eth1 192.0.2.6 - - - 192.0.2.20/30 0 - - - - - 192.0.2.24/30 30 eth1 192.0.2.6 - - - - vyos@P2-VyOS:~$ show isis route prefix-sid - Area VyOS: - IS-IS L2 IPv4 routing table: - - Prefix Metric Interface Nexthop SID Label Op. - ----------------------------------------------------------------------- - 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001) - 192.0.2.2/32 0 - - - - - 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003) - 192.0.2.4/30 20 eth2 192.0.2.18 - - - 192.0.2.16/30 20 eth2 192.0.2.18 - - - 192.0.2.20/30 30 eth2 192.0.2.18 - - - 192.0.2.24/30 0 - - - - - -Ping between VyOS-P1 / VyOS-P2 to confirm reachability: - -.. code-block:: none - - vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1 - PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data. - 64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms - 64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms - 64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms - 64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms - ^C - --- 192.0.2.2 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3004ms - rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms - - vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2 - PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data. - 64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms - 64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms - 64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms - 64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms - ^C - --- 192.0.2.1 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3005ms - rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms \ No newline at end of file diff --git a/docs/configexamples/wan-load-balancing.md b/docs/configexamples/wan-load-balancing.md new file mode 100644 index 00000000..e35b9056 --- /dev/null +++ b/docs/configexamples/wan-load-balancing.md @@ -0,0 +1,175 @@ +--- +lastproofread: '2021-06-29' +--- + +(wan-load-balancing)= + + +# WAN Load Balancer examples + +## Example 1: Distributing load evenly + +The setup used in this example is shown in the following diagram: + +```{image} /_static/images/Wan_load_balancing1.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +### Overview + +> - All traffic coming in through eth2 is balanced between eth0 and eth1 +> on the router. +> - Pings will be sent to four targets for health testing (33.44.55.66, +> 44.55.66.77, 55.66.77.88 and 66.77.88.99). +> - All outgoing packets are assigned the source address of the assigned +> interface (SNAT). +> - eth0 is set to be removed from the load balancer's interface pool +> after 5 ping failures, eth1 will be removed after 4 ping failures. + +### Create static routes to ping targets + +Create static routes through the two ISPs towards the ping targets and +commit the changes: + +```none +set protocols static route 33.44.55.66/32 next-hop 11.22.33.1 +set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 +set protocols static route 55.66.77.88/32 next-hop 22.33.44.1 +set protocols static route 66.77.88.99/32 next-hop 22.33.44.1 +``` + +### Configure the load balancer + +Configure the WAN load balancer with the parameters described above: + +```none +set load-balancing wan interface-health eth0 failure-count 5 +set load-balancing wan interface-health eth0 nexthop 11.22.33.1 +set load-balancing wan interface-health eth0 test 10 type ping +set load-balancing wan interface-health eth0 test 10 target 33.44.55.66 +set load-balancing wan interface-health eth0 test 20 type ping +set load-balancing wan interface-health eth0 test 20 target 44.55.66.77 +set load-balancing wan interface-health eth1 failure-count 4 +set load-balancing wan interface-health eth1 nexthop 22.33.44.1 +set load-balancing wan interface-health eth1 test 10 type ping +set load-balancing wan interface-health eth1 test 10 target 55.66.77.88 +set load-balancing wan interface-health eth1 test 20 type ping +set load-balancing wan interface-health eth1 test 20 target 66.77.88.99 +set load-balancing wan rule 10 inbound-interface eth2 +set load-balancing wan rule 10 interface eth0 +set load-balancing wan rule 10 interface eth1 +``` + +## Example 2: Failover based on interface weights + +This example uses the failover mode. + +(wan-example2-overwiew)= + +### Overview + +In this example, eth0 is the primary interface and eth1 is the secondary +interface. To provide simple failover functionality. If eth0 fails, eth1 +takes over. + +### Create interface weight based configuration + +The configuration steps are the same as in the previous example, except +rule 10. So we keep the configuration, remove rule 10 and add a new rule +for the failover mode: + +```none +delete load-balancing wan rule 10 +set load-balancing wan rule 10 failover +set load-balancing wan rule 10 inbound-interface eth2 +set load-balancing wan rule 10 interface eth0 weight 10 +set load-balancing wan rule 10 interface eth1 weight 1 +``` + +## Example 3: Failover based on rule order + +The previous example used the failover command to send traffic through +eth1 if eth0 fails. In this example, failover functionality is provided +by rule order. + +(wan-example3-overwiew)= + +### Overview + +Two rules will be created, the first rule directs traffic coming in +from eth2 to eth0 and the second rule directs the traffic to eth1. If +eth0 fails the first rule is bypassed and the second rule matches, +directing traffic to eth1. + +### Create rule order based configuration + +We keep the configuration from the previous example, delete rule 10 +and create the two new rules as described: + +```none +delete load-balancing wan rule 10 +set load-balancing wan rule 10 inbound-interface eth2 +set load-balancing wan rule 10 interface eth0 +set load-balancing wan rule 20 inbound-interface eth2 +set load-balancing wan rule 20 interface eth1 +``` + +## Example 4: Failover based on rule order - priority traffic + +A rule order for prioritizing traffic is useful in scenarios where the +secondary link has a lower speed and should only carry high priority +traffic. It is assumed for this example that eth1 is connected to a +slower connection than eth0 and should prioritize VoIP traffic. + +(wan-example4-overwiew)= + +### Overview + +A rule order for prioritizing traffic is useful in scenarios where the +secondary link has a lower speed and should only carry high priority +traffic. It is assumed for this example that eth1 is connected to a +slower connection than eth0 and should prioritize VoIP traffic. + +### Create rule order based configuration with low speed secondary link + +We keep the configuration from the previous example, delete rule 20 and +create a new rule as described: + +```none +delete load-balancing wan rule 20 +set load-balancing wan rule 20 inbound-interface eth2 +set load-balancing wan rule 20 interface eth1 +set load-balancing wan rule 20 destination port sip +set load-balancing wan rule 20 protocol tcp +set protocols static route 0.0.0.0/0 next-hop 11.22.33.1 +``` + +## Example 5: Exclude traffic from load balancing + +In this example two LAN interfaces exist in different subnets instead +of one like in the previous examples: + +```{image} /_static/images/Wan_load_balancing_exclude1.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +### Adding a rule for the second interface + +Based on the previous example, another rule for traffic from the second +interface eth3 can be added to the load balancer. However, traffic meant +to flow between the LAN subnets will be sent to eth0 and eth1 as well. +To prevent this, another rule is required. This rule excludes traffic +between the local subnets from the load balancer. It also excludes +locally-sources packets (required for web caching with load balancing). +eth+ is used as an alias that refers to all ethernet interfaces: + +```none +set load-balancing wan rule 5 exclude +set load-balancing wan rule 5 inbound-interface eth+ +set load-balancing wan rule 5 destination address 10.0.0.0/8 +``` + diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst deleted file mode 100644 index ace9a981..00000000 --- a/docs/configexamples/wan-load-balancing.rst +++ /dev/null @@ -1,183 +0,0 @@ -:lastproofread: 2021-06-29 - -.. _wan-load-balancing: - -.. stop_vyoslinter # pictures and text have to change - -WAN Load Balancer examples -========================== - - -Example 1: Distributing load evenly ------------------------------------ - -The setup used in this example is shown in the following diagram: - -.. image:: /_static/images/Wan_load_balancing1.png - :width: 80% - :align: center - :alt: Network Topology Diagram - - -Overview -^^^^^^^^ - * All traffic coming in through eth2 is balanced between eth0 and eth1 - on the router. - * Pings will be sent to four targets for health testing (33.44.55.66, - 44.55.66.77, 55.66.77.88 and 66.77.88.99). - * All outgoing packets are assigned the source address of the assigned - interface (SNAT). - * eth0 is set to be removed from the load balancer's interface pool - after 5 ping failures, eth1 will be removed after 4 ping failures. - -Create static routes to ping targets -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Create static routes through the two ISPs towards the ping targets and -commit the changes: - -.. code-block:: none - - set protocols static route 33.44.55.66/32 next-hop 11.22.33.1 - set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 - set protocols static route 55.66.77.88/32 next-hop 22.33.44.1 - set protocols static route 66.77.88.99/32 next-hop 22.33.44.1 - -Configure the load balancer -^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Configure the WAN load balancer with the parameters described above: - -.. code-block:: none - - set load-balancing wan interface-health eth0 failure-count 5 - set load-balancing wan interface-health eth0 nexthop 11.22.33.1 - set load-balancing wan interface-health eth0 test 10 type ping - set load-balancing wan interface-health eth0 test 10 target 33.44.55.66 - set load-balancing wan interface-health eth0 test 20 type ping - set load-balancing wan interface-health eth0 test 20 target 44.55.66.77 - set load-balancing wan interface-health eth1 failure-count 4 - set load-balancing wan interface-health eth1 nexthop 22.33.44.1 - set load-balancing wan interface-health eth1 test 10 type ping - set load-balancing wan interface-health eth1 test 10 target 55.66.77.88 - set load-balancing wan interface-health eth1 test 20 type ping - set load-balancing wan interface-health eth1 test 20 target 66.77.88.99 - set load-balancing wan rule 10 inbound-interface eth2 - set load-balancing wan rule 10 interface eth0 - set load-balancing wan rule 10 interface eth1 - -Example 2: Failover based on interface weights ----------------------------------------------- - -This example uses the failover mode. - -.. _wan:example2_overwiew: - -Overview -^^^^^^^^ -In this example, eth0 is the primary interface and eth1 is the secondary -interface. To provide simple failover functionality. If eth0 fails, eth1 -takes over. - -Create interface weight based configuration -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -The configuration steps are the same as in the previous example, except -rule 10. So we keep the configuration, remove rule 10 and add a new rule -for the failover mode: - -.. code-block:: none - - delete load-balancing wan rule 10 - set load-balancing wan rule 10 failover - set load-balancing wan rule 10 inbound-interface eth2 - set load-balancing wan rule 10 interface eth0 weight 10 - set load-balancing wan rule 10 interface eth1 weight 1 - -Example 3: Failover based on rule order ---------------------------------------- - -The previous example used the failover command to send traffic through -eth1 if eth0 fails. In this example, failover functionality is provided -by rule order. - -.. _wan:example3_overwiew: - -Overview -^^^^^^^^ -Two rules will be created, the first rule directs traffic coming in -from eth2 to eth0 and the second rule directs the traffic to eth1. If -eth0 fails the first rule is bypassed and the second rule matches, -directing traffic to eth1. - -Create rule order based configuration -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -We keep the configuration from the previous example, delete rule 10 -and create the two new rules as described: - -.. code-block:: none - - delete load-balancing wan rule 10 - set load-balancing wan rule 10 inbound-interface eth2 - set load-balancing wan rule 10 interface eth0 - set load-balancing wan rule 20 inbound-interface eth2 - set load-balancing wan rule 20 interface eth1 - -Example 4: Failover based on rule order - priority traffic ----------------------------------------------------------- - -A rule order for prioritizing traffic is useful in scenarios where the -secondary link has a lower speed and should only carry high priority -traffic. It is assumed for this example that eth1 is connected to a -slower connection than eth0 and should prioritize VoIP traffic. - - -.. _wan:example4_overwiew: - -Overview -^^^^^^^^ -A rule order for prioritizing traffic is useful in scenarios where the -secondary link has a lower speed and should only carry high priority -traffic. It is assumed for this example that eth1 is connected to a -slower connection than eth0 and should prioritize VoIP traffic. - -Create rule order based configuration with low speed secondary link -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -We keep the configuration from the previous example, delete rule 20 and -create a new rule as described: - -.. code-block:: none - - delete load-balancing wan rule 20 - set load-balancing wan rule 20 inbound-interface eth2 - set load-balancing wan rule 20 interface eth1 - set load-balancing wan rule 20 destination port sip - set load-balancing wan rule 20 protocol tcp - set protocols static route 0.0.0.0/0 next-hop 11.22.33.1 - -Example 5: Exclude traffic from load balancing ----------------------------------------------- - -In this example two LAN interfaces exist in different subnets instead -of one like in the previous examples: - -.. image:: /_static/images/Wan_load_balancing_exclude1.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -Adding a rule for the second interface -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Based on the previous example, another rule for traffic from the second -interface eth3 can be added to the load balancer. However, traffic meant -to flow between the LAN subnets will be sent to eth0 and eth1 as well. -To prevent this, another rule is required. This rule excludes traffic -between the local subnets from the load balancer. It also excludes -locally-sources packets (required for web caching with load balancing). -eth+ is used as an alias that refers to all ethernet interfaces: - -.. code-block:: none - - set load-balancing wan rule 5 exclude - set load-balancing wan rule 5 inbound-interface eth+ - set load-balancing wan rule 5 destination address 10.0.0.0/8 - -.. start_vyoslinter diff --git a/docs/configexamples/zone-policy.md b/docs/configexamples/zone-policy.md new file mode 100644 index 00000000..d9c22c09 --- /dev/null +++ b/docs/configexamples/zone-policy.md @@ -0,0 +1,415 @@ +--- +lastproofread: '2024-06-14' +--- + +(examples-zone-policy)= + +# Zone-Policy example + +:::{note} +In {vytask}`T2199` the syntax of the zone configuration was changed. +The zone configuration moved from `zone-policy zone ` to `firewall +zone `. +::: + +## Native IPv4 and IPv6 + +We have three networks. + +```none +WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64 +LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64 +DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64 +``` + +**This specific example is for a router on a stick, but is very easily +adapted for however many NICs you have**: + +- Internet - 192.168.200.100 - TCP/80 +- Internet - 192.168.200.100 - TCP/443 +- Internet - 192.168.200.100 - TCP/25 +- Internet - 192.168.200.100 - TCP/53 +- VyOS acts as DHCP, DNS forwarder, NAT, router and firewall. +- 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web + and mail (SMTP/IMAP) server. +- 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It + can SSH to VyOS. +- LAN and DMZ hosts have basic outbound access: Web, FTP, SSH. +- LAN can access DMZ resources. +- DMZ cannot access LAN resources. +- Inbound WAN connect to DMZ host. + +```{image} /_static/images/zone-policy-diagram.png +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +The VyOS interface is assigned the .1/:1 address of their respective +networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30. + +It will look something like this: + +```none +interfaces { + ethernet eth0 { + duplex auto + hw-id 00:53:ed:6e:2a:92 + smp_affinity auto + speed auto + vif 10 { + address 172.16.10.1/24 + address 2001:db8:0:9999::1/64 + } + vif 20 { + address 192.168.100.1/24 + address 2001:db8:0:AAAA::1/64 + } + vif 30 { + address 192.168.200.1/24 + address 2001:db8:0:BBBB::1/64 + } + } + loopback lo { + } +} +``` + +## Zones Basics + +Each interface is assigned to a zone. The interface can be physical or +virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly +the same. + +Traffic flows from zone A to zone B. That flow is what I refer to as a +zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations. + +Ruleset are created per zone-pair-direction. + +I name rule sets to indicate which zone-pair-direction they represent. +eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN. + +In VyOS, you have to have unique Ruleset names. In the event of overlap, +I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This +allows for each auto-completion and uniqueness. + +In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is +the firewall itself. + +If your computer is on the LAN and you need to SSH into your VyOS box, +you would need a rule to allow it in the LAN-Local ruleset. If you want +to access a webpage from your VyOS box, you need a rule to allow it in +the Local-LAN ruleset. + +In rules, it is good to keep them named consistently. As the number of +rules you have grows, the more consistency you have, the easier your +life will be. + +```none +Rule 1 - State Established, Related +Rule 2 - State Invalid +Rule 100 - ICMP +Rule 200 - Web +Rule 300 - FTP +Rule 400 - NTP +Rule 500 - SMTP +Rule 600 - DNS +Rule 700 - DHCP +Rule 800 - SSH +Rule 900 - IMAPS +``` + +The first two rules are to deal with the idiosyncrasies of VyOS and +iptables. + +Zones and Rulesets both have a default action statement. When using +Zone-Policies, the default action is set by the zone-policy statement +and is represented by rule 10000. + +It is good practice to log both accepted and denied traffic. It can save +you significant headaches when trying to troubleshoot a connectivity +issue. + +To add logging to the default rule, do: + +```none +set firewall name default-log +``` + +By default, iptables does not allow traffic for established sessions to +return, so you must explicitly allow this. I do this by adding two rules +to every ruleset. 1 allows established and related state packets through +and rule 2 drops and logs invalid state packets. We place the +established/related rule at the top because the vast majority of traffic +on a network is established and the invalid rule to prevent invalid +state packets from mistakenly being matched against other rules. Having +the most matched rule listed first reduces CPU load in high volume +environments. Note: I have filed a bug to have this added as a default +action as well. + +''It is important to note, that you do not want to add logging to the +established state rule as you will be logging both the inbound and +outbound packets for each session instead of just the initiation of the +session. Your logs will be massive in a very short period of time.'' + +In VyOS you must have the interfaces created before you can apply it to +the zone and the rulesets must be created prior to applying it to a +zone-policy. + +I create/configure the interfaces first. Build out the rulesets for each +zone-pair-direction which includes at least the three state rules. Then +I setup the zone-policies. + +Zones do not allow for a default action of accept; either drop or +reject. It is important to remember this because if you apply an +interface to a zone and commit, any active connections will be dropped. +Specifically, if you are SSH’d into VyOS and add local or the interface +you are connecting through to a zone and do not have rulesets in place +to allow SSH and established sessions, you will not be able to connect. + +The following are the rules that were created for this example (may not +be complete), both in IPv4 and IPv6. If there is no IP specified, then +the source/destination address is not explicit. + +```none +WAN - DMZ:192.168.200.200 - tcp/80 +WAN - DMZ:192.168.200.200 - tcp/443 +WAN - DMZ:192.168.200.200 - tcp/25 +WAN - DMZ:192.168.200.200 - tcp/53 +WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80 +WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443 +WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25 +WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53 + +DMZ - Local - tcp/53 +DMZ - Local - tcp/123 +DMZ - Local - tcp/67,68 + +LAN - Local - tcp/53 +LAN - Local - tcp/123 +LAN - Local - tcp/67,68 +LAN:192.168.100.10 - Local - tcp/22 +LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22 + +LAN - WAN - tcp/80 +LAN - WAN - tcp/443 +LAN - WAN - tcp/22 +LAN - WAN - tcp/20,21 + +DMZ - WAN - tcp/80 +DMZ - WAN - tcp/443 +DMZ - WAN - tcp/22 +DMZ - WAN - tcp/20,21 +DMZ - WAN - tcp/53 +DMZ - WAN - udp/53 + +Local - WAN - tcp/80 +Local - WAN - tcp/443 +Local - WAN - tcp/20,21 + +Local - DMZ - tcp/25 +Local - DMZ - tcp/67,68 +Local - DMZ - tcp/53 +Local - DMZ - udp/53 + +Local - LAN - tcp/67,68 + +LAN - DMZ - tcp/80 +LAN - DMZ - tcp/443 +LAN - DMZ - tcp/993 +LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22 +LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22 +``` + +Since we have 4 zones, we need to setup the following rulesets. + +```none +Lan-wan +Lan-local +Lan-dmz +Wan-lan +Wan-local +Wan-dmz +Local-lan +Local-wan +Local-dmz +Dmz-lan +Dmz-wan +Dmz-local +``` + +Even if the two zones will never communicate, it is a good idea to +create the zone-pair-direction rulesets and set default-log. This +will allow you to log attempts to access the networks. Without it, you +will never see the connection attempts. + +This is an example of the three base rules. + +```none +name wan-lan { + default-action drop + default-log + rule 1 { + action accept + state { + established enable + related enable + } + } + rule 2 { + action drop + log enable + state { + invalid enable + } + } +} +``` + +Here is an example of an IPv6 DMZ-WAN ruleset. + +```none +ipv6-name dmz-wan-6 { + default-action drop + default-log + rule 1 { + action accept + state { + established enable + related enable + } + } + rule 2 { + action drop + log enable + state { + invalid enable + } + rule 100 { + action accept + log enable + protocol ipv6-icmp + } + rule 200 { + action accept + destination { + port 80,443 + } + log enable + protocol tcp + } + rule 300 { + action accept + destination { + port 20,21 + } + log enable + protocol tcp + } + rule 500 { + action accept + destination { + port 25 + } + log enable + protocol tcp + source { + address 2001:db8:0:BBBB::200 + } + } + rule 600 { + action accept + destination { + port 53 + } + log enable + protocol tcp_udp + source { + address 2001:db8:0:BBBB::200 + } + } + rule 800 { + action accept + destination { + port 22 + } + log enable + protocol tcp + } +} +``` + +Once you have all of your rulesets built, then you need to create your +zone-policy. + +Start by setting the interface and default action for each zone. + +```none +set firewall zone dmz default-action drop +set firewall zone dmz interface eth0.30 +``` + +In this case, we are setting the v6 ruleset that represents traffic +sourced from the LAN, destined for the DMZ. Because the zone-policy +firewall syntax is a little awkward, I keep it straight by thinking of +it backwards. + +```none +set firewall zone dmz from lan firewall ipv6-name lan-dmz-6 +``` + +DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out +a bunch at one time. + +In the end, you will end up with something like this config. I took out +everything but the Firewall, Interfaces, and zone-policy sections. It is +long enough as is. + +## IPv6 Tunnel + +If you are using a IPv6 tunnel from HE.net or someone else, the basis is +the same except you have two WAN interfaces. One for v4 and one for v6. + +You would have 5 zones instead of just 4 and you would configure your v6 +ruleset between your tunnel interface and your LAN/DMZ zones instead of +to the WAN. + +LAN, WAN, DMZ, local and TUN (tunnel) + +v6 pairs would be: + +```none +lan-tun +lan-local +lan-dmz +tun-lan +tun-local +tun-dmz +local-lan +local-tun +local-dmz +dmz-lan +dmz-tun +dmz-local +``` + +Notice, none go to WAN since WAN wouldn't have a v6 address on it. + +You would have to add a couple of rules on your wan-local ruleset to +allow protocol 41 in. + +Something like: + +```none +rule 400 { + action accept + destination { + address 172.16.10.1 + } + log enable + protocol 41 + source { + address ip.of.tunnel.broker + } +} +``` diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst deleted file mode 100644 index d0101ebf..00000000 --- a/docs/configexamples/zone-policy.rst +++ /dev/null @@ -1,420 +0,0 @@ -:lastproofread: 2024-06-14 - -.. _examples-zone-policy: - -Zone-Policy example -------------------- - -.. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. - The zone configuration moved from ``zone-policy zone `` to ``firewall - zone ``. - -Native IPv4 and IPv6 -^^^^^^^^^^^^^^^^^^^^ - -We have three networks. - -.. code-block:: none - - WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64 - LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64 - DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64 - - -**This specific example is for a router on a stick, but is very easily -adapted for however many NICs you have**: - - -* Internet - 192.168.200.100 - TCP/80 -* Internet - 192.168.200.100 - TCP/443 -* Internet - 192.168.200.100 - TCP/25 -* Internet - 192.168.200.100 - TCP/53 -* VyOS acts as DHCP, DNS forwarder, NAT, router and firewall. -* 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web - and mail (SMTP/IMAP) server. -* 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It - can SSH to VyOS. -* LAN and DMZ hosts have basic outbound access: Web, FTP, SSH. -* LAN can access DMZ resources. -* DMZ cannot access LAN resources. -* Inbound WAN connect to DMZ host. - -.. image:: /_static/images/zone-policy-diagram.png - :width: 80% - :align: center - :alt: Network Topology Diagram - -The VyOS interface is assigned the .1/:1 address of their respective -networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30. - -It will look something like this: - -.. code-block:: none - - interfaces { - ethernet eth0 { - duplex auto - hw-id 00:53:ed:6e:2a:92 - smp_affinity auto - speed auto - vif 10 { - address 172.16.10.1/24 - address 2001:db8:0:9999::1/64 - } - vif 20 { - address 192.168.100.1/24 - address 2001:db8:0:AAAA::1/64 - } - vif 30 { - address 192.168.200.1/24 - address 2001:db8:0:BBBB::1/64 - } - } - loopback lo { - } - } - - -Zones Basics -^^^^^^^^^^^^ - -Each interface is assigned to a zone. The interface can be physical or -virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly -the same. - -Traffic flows from zone A to zone B. That flow is what I refer to as a -zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations. - -Ruleset are created per zone-pair-direction. - -I name rule sets to indicate which zone-pair-direction they represent. -eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN. - -In VyOS, you have to have unique Ruleset names. In the event of overlap, -I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This -allows for each auto-completion and uniqueness. - -In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is -the firewall itself. - -If your computer is on the LAN and you need to SSH into your VyOS box, -you would need a rule to allow it in the LAN-Local ruleset. If you want -to access a webpage from your VyOS box, you need a rule to allow it in -the Local-LAN ruleset. - -In rules, it is good to keep them named consistently. As the number of -rules you have grows, the more consistency you have, the easier your -life will be. - -.. code-block:: none - - Rule 1 - State Established, Related - Rule 2 - State Invalid - Rule 100 - ICMP - Rule 200 - Web - Rule 300 - FTP - Rule 400 - NTP - Rule 500 - SMTP - Rule 600 - DNS - Rule 700 - DHCP - Rule 800 - SSH - Rule 900 - IMAPS - -The first two rules are to deal with the idiosyncrasies of VyOS and -iptables. - -Zones and Rulesets both have a default action statement. When using -Zone-Policies, the default action is set by the zone-policy statement -and is represented by rule 10000. - -It is good practice to log both accepted and denied traffic. It can save -you significant headaches when trying to troubleshoot a connectivity -issue. - -To add logging to the default rule, do: - -.. code-block:: none - - set firewall name default-log - - -By default, iptables does not allow traffic for established sessions to -return, so you must explicitly allow this. I do this by adding two rules -to every ruleset. 1 allows established and related state packets through -and rule 2 drops and logs invalid state packets. We place the -established/related rule at the top because the vast majority of traffic -on a network is established and the invalid rule to prevent invalid -state packets from mistakenly being matched against other rules. Having -the most matched rule listed first reduces CPU load in high volume -environments. Note: I have filed a bug to have this added as a default -action as well. - -''It is important to note, that you do not want to add logging to the -established state rule as you will be logging both the inbound and -outbound packets for each session instead of just the initiation of the -session. Your logs will be massive in a very short period of time.'' - -In VyOS you must have the interfaces created before you can apply it to -the zone and the rulesets must be created prior to applying it to a -zone-policy. - -I create/configure the interfaces first. Build out the rulesets for each -zone-pair-direction which includes at least the three state rules. Then -I setup the zone-policies. - -Zones do not allow for a default action of accept; either drop or -reject. It is important to remember this because if you apply an -interface to a zone and commit, any active connections will be dropped. -Specifically, if you are SSH’d into VyOS and add local or the interface -you are connecting through to a zone and do not have rulesets in place -to allow SSH and established sessions, you will not be able to connect. - -The following are the rules that were created for this example (may not -be complete), both in IPv4 and IPv6. If there is no IP specified, then -the source/destination address is not explicit. - -.. code-block:: none - - WAN - DMZ:192.168.200.200 - tcp/80 - WAN - DMZ:192.168.200.200 - tcp/443 - WAN - DMZ:192.168.200.200 - tcp/25 - WAN - DMZ:192.168.200.200 - tcp/53 - WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80 - WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443 - WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25 - WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53 - - DMZ - Local - tcp/53 - DMZ - Local - tcp/123 - DMZ - Local - tcp/67,68 - - LAN - Local - tcp/53 - LAN - Local - tcp/123 - LAN - Local - tcp/67,68 - LAN:192.168.100.10 - Local - tcp/22 - LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22 - - LAN - WAN - tcp/80 - LAN - WAN - tcp/443 - LAN - WAN - tcp/22 - LAN - WAN - tcp/20,21 - - DMZ - WAN - tcp/80 - DMZ - WAN - tcp/443 - DMZ - WAN - tcp/22 - DMZ - WAN - tcp/20,21 - DMZ - WAN - tcp/53 - DMZ - WAN - udp/53 - - Local - WAN - tcp/80 - Local - WAN - tcp/443 - Local - WAN - tcp/20,21 - - Local - DMZ - tcp/25 - Local - DMZ - tcp/67,68 - Local - DMZ - tcp/53 - Local - DMZ - udp/53 - - Local - LAN - tcp/67,68 - - LAN - DMZ - tcp/80 - LAN - DMZ - tcp/443 - LAN - DMZ - tcp/993 - LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22 - LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22 - -Since we have 4 zones, we need to setup the following rulesets. - -.. code-block:: none - - Lan-wan - Lan-local - Lan-dmz - Wan-lan - Wan-local - Wan-dmz - Local-lan - Local-wan - Local-dmz - Dmz-lan - Dmz-wan - Dmz-local - -Even if the two zones will never communicate, it is a good idea to -create the zone-pair-direction rulesets and set default-log. This -will allow you to log attempts to access the networks. Without it, you -will never see the connection attempts. - -This is an example of the three base rules. - -.. code-block:: none - - name wan-lan { - default-action drop - default-log - rule 1 { - action accept - state { - established enable - related enable - } - } - rule 2 { - action drop - log enable - state { - invalid enable - } - } - } - - -Here is an example of an IPv6 DMZ-WAN ruleset. - -.. code-block:: none - - ipv6-name dmz-wan-6 { - default-action drop - default-log - rule 1 { - action accept - state { - established enable - related enable - } - } - rule 2 { - action drop - log enable - state { - invalid enable - } - rule 100 { - action accept - log enable - protocol ipv6-icmp - } - rule 200 { - action accept - destination { - port 80,443 - } - log enable - protocol tcp - } - rule 300 { - action accept - destination { - port 20,21 - } - log enable - protocol tcp - } - rule 500 { - action accept - destination { - port 25 - } - log enable - protocol tcp - source { - address 2001:db8:0:BBBB::200 - } - } - rule 600 { - action accept - destination { - port 53 - } - log enable - protocol tcp_udp - source { - address 2001:db8:0:BBBB::200 - } - } - rule 800 { - action accept - destination { - port 22 - } - log enable - protocol tcp - } - } - -Once you have all of your rulesets built, then you need to create your -zone-policy. - -Start by setting the interface and default action for each zone. - -.. code-block:: none - - set firewall zone dmz default-action drop - set firewall zone dmz interface eth0.30 - -In this case, we are setting the v6 ruleset that represents traffic -sourced from the LAN, destined for the DMZ. Because the zone-policy -firewall syntax is a little awkward, I keep it straight by thinking of -it backwards. - -.. code-block:: none - - set firewall zone dmz from lan firewall ipv6-name lan-dmz-6 - -DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out -a bunch at one time. - -In the end, you will end up with something like this config. I took out -everything but the Firewall, Interfaces, and zone-policy sections. It is -long enough as is. - - -IPv6 Tunnel -^^^^^^^^^^^ - -If you are using a IPv6 tunnel from HE.net or someone else, the basis is -the same except you have two WAN interfaces. One for v4 and one for v6. - -You would have 5 zones instead of just 4 and you would configure your v6 -ruleset between your tunnel interface and your LAN/DMZ zones instead of -to the WAN. - -LAN, WAN, DMZ, local and TUN (tunnel) - -v6 pairs would be: - -.. code-block:: none - - lan-tun - lan-local - lan-dmz - tun-lan - tun-local - tun-dmz - local-lan - local-tun - local-dmz - dmz-lan - dmz-tun - dmz-local - -Notice, none go to WAN since WAN wouldn't have a v6 address on it. - -You would have to add a couple of rules on your wan-local ruleset to -allow protocol 41 in. - -Something like: - -.. code-block:: none - - rule 400 { - action accept - destination { - address 172.16.10.1 - } - log enable - protocol 41 - source { - address ip.of.tunnel.broker - } - } diff --git a/docs/configuration/container/index.md b/docs/configuration/container/index.md new file mode 100644 index 00000000..c5163a99 --- /dev/null +++ b/docs/configuration/container/index.md @@ -0,0 +1,406 @@ +--- +lastproofread: '2022-06-10' +--- + +# Container + +The VyOS container implementation is based on `Podman` as +a deamonless container engine. + +## Configuration + +```{eval-rst} +.. cfgcmd:: set container name image + + Sets the image name in the hub registry + + .. code-block:: none + + set container name mysql-server image mysql:8.0 + + If a registry is not specified, Docker.io will be used as the container + registry unless an alternative registry is specified using + **set container registry ** or the registry is included + in the image name + + .. code-block:: none + + set container name mysql-server image quay.io/mysql:8.0 +``` + +```{eval-rst} +.. cfgcmd:: set container name entrypoint + + Override the default entrypoint from the image for a container. +``` + +```{eval-rst} +.. cfgcmd:: set container name command + + Override the default command from the image for a container. +``` + +```{eval-rst} +.. cfgcmd:: set container name arguments + + Set the command arguments for a container. +``` + +```{eval-rst} +.. cfgcmd:: set container name host-name + + Set the host name for a container. +``` + +```{eval-rst} +.. cfgcmd:: set container name allow-host-pid + + The container and the host share the same process namespace. + This means that processes running on the host are visible inside the + container, and processes inside the container are visible on the host. + + The command translates to "--pid host" when the container is created. +``` + +```{eval-rst} +.. cfgcmd:: set container name allow-host-networks + + Allow host networking in a container. The network stack of the container is + not isolated from the host and will use the host IP. + + The command translates to "--net host" when the container is created. + + .. note:: **allow-host-networks** cannot be used with **network** +``` + +```{eval-rst} +.. cfgcmd:: set container name network + + Attaches user-defined network to a container. + Only one network must be specified and must already exist. +``` + +```{eval-rst} +.. cfgcmd:: set container name network address
+ + Optionally set a specific static IPv4 or IPv6 address for the container. + This address must be within the named network prefix. + + .. note:: The first IP in the container network is reserved by the + engine and cannot be used +``` + +```{eval-rst} +.. cfgcmd:: set container name description + + Set a container description +``` + +```{eval-rst} +.. cfgcmd:: set container name environment value + + Add custom environment variables. + Multiple environment variables are allowed. + The following commands translate to "-e key=value" when the container + is created. + + .. code-block:: none + + set container name mysql-server environment MYSQL_DATABASE value 'zabbix' + set container name mysql-server environment MYSQL_USER value 'zabbix' + set container name mysql-server environment MYSQL_PASSWORD value 'zabbix_pwd' + set container name mysql-server environment MYSQL_ROOT_PASSWORD value 'root_pwd' +``` + +```{eval-rst} +.. cfgcmd:: set container name port source +``` + +```{eval-rst} +.. cfgcmd:: set container name port destination +``` + +```{eval-rst} +.. cfgcmd:: set container name port protocol + + Publish a port for the container. + + .. code-block:: none + + set container name zabbix-web-nginx-mysql port http source 80 + set container name zabbix-web-nginx-mysql port http destination 8080 + set container name zabbix-web-nginx-mysql port http protocol tcp +``` + +```{eval-rst} +.. cfgcmd:: set container name volume source +``` + +```{eval-rst} +.. cfgcmd:: set container name volume destination + + Mount a volume into the container + + .. code-block:: none + + set container name coredns volume 'corefile' source /config/coredns/Corefile + set container name coredns volume 'corefile' destination /etc/Corefile +``` + +```{eval-rst} +.. cfgcmd:: set container name volume mode + + Volume is either mounted as rw (read-write - default) or ro (read-only) +``` + +```{eval-rst} +.. cfgcmd:: set container name uid +``` + +```{eval-rst} +.. cfgcmd:: set container name gid + + Set the User ID or Group ID of the container +``` + +```{eval-rst} +.. cfgcmd:: set container name restart [no | on-failure | always] + + Set the restart behavior of the container. + + - **no**: Do not restart containers on exit + - **on-failure**: Restart containers when they exit with a non-zero + exit code, retrying indefinitely (default) + - **always**: Restart containers when they exit, regardless of status, + retrying indefinitely +``` + +```{eval-rst} +.. cfgcmd:: set container name cpu-quota + + This specifies the number of CPU resources the container can use. + + Default is 0 for unlimited. + For example, 1.25 limits the container to use up to 1.25 cores + worth of CPU time. + This can be a decimal number with up to three decimal places. + + The command translates to "--cpus=" when the container is created. +``` + +```{eval-rst} +.. cfgcmd:: set container name memory + + Constrain the memory available to the container. + + Default is 512 MB. Use 0 MB for unlimited memory. +``` + +```{eval-rst} +.. cfgcmd:: set container name device source +``` + +```{eval-rst} +.. cfgcmd:: set container name device destination + + Add a host device to the container. +``` + +```{eval-rst} +.. cfgcmd:: set container name capability + + Set container capabilities or permissions. + + - **net-admin**: Network operations (interface, firewall, routing tables) + - **net-bind-service**: Bind a socket to privileged ports + (port numbers less than 1024) + - **net-raw**: Permission to create raw network sockets + - **setpcap**: Capability sets (from bounded or inherited set) + - **sys-admin**: Administration operations (quotactl, mount, sethostname, + setdomainame) + - **sys-time**: Permission to set system clock +``` + +```{eval-rst} +.. cfgcmd:: set container name sysctl parameter value + + Set container sysctl values. + + The subset of possible parameters are: + + - Kernel Parameters: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem, + kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced + - Parameters beginning with fs.mqueue.* + - Parameters beginning with net.* (only if user-defined network is used) +``` + +```{eval-rst} +.. cfgcmd:: set container name label