VyOS Can Loose Parts Of Its Config On Reboot - In Certain Situations
Open, HighPublic

Description

Create a very basic firewall config like this http://pastebin.com/biT3iNes then delete (or rename) the TrustedHosts address group ( The CLI will give you an error like: "Error: group [TrustedHosts] still in use" but it will remove the group anyway ), commit, save, reboot.

After it reboots the entire EXTERNAL-TO-SELF firewall will not exist because a single rule failed to evaluate. This problem is amplified when you consider other parts of the config tree, you will loose zones because the single firewall no longer exists. Same with ESP/IKE groups, you will loose peers definitions.

This partiuclar issue can be fixed by making the "still in use" error fatal, maybe their is a generic way to solve this for all portions of the config tree

Details

Difficulty level
Hard (possibly days)
Version
1.1.7
syncer assigned this task to dmbaturin.Jul 25 2016, 4:15 PM
syncer triaged this task as High priority.
syncer edited projects, added VyOS 1.1.x (1.1.8); removed VyOS 1.1.x.
syncer added subscribers: VyOS 1.1.x, VyOS 1.1.x (1.1.8).
syncer removed a subscriber: VyOS 1.1.x (1.1.8).
syncer edited subscribers, added: Maintainers; removed: VyOS 1.1.x.Aug 21 2017, 2:05 AM
syncer added a subscriber: syncer.

@jhendryUK is this also affects 1.2.x ?