I wonder if this used to work in the past?

@maznu @Merijn Can you test the latest rolling 1.4 release?
It should be fixed.
You can kill ripd/ripng/ospfd/bgpd/isisd daemons or allow it for watchfrr.

Turns out this is not a VyOS limitation but is a Linux Kernel/iproute2 limitation.

Fixed via https://github.com/vyos/vyatta-cfg-firewall/pull/21

This bug also persists in VyOS 1.2.7

The same with "policy" /usr/libexec/vyos/tests/config/dialup-router-medium-vpn

To reproduce it add firewall and attach it to interface

Usually on delete, the firewall should be detached from the interface first as the logic should go from the highest priority to the lowest one.

It is a priority for configurations
When the system load, the firewall should have configuration, and after configuration is applied to the interface.
So I think we can't delete it in one commit, it tried to delete the firewall before detaching the firewall from the interface.

So I finally stopped being lazy and got VyOS in to GNS3. As with our production routers MPLS remains off after restarting with either 1.3-rolling-202104021041 or 1.4-rolling-202104022042 for VLAN sub interfaces. Ethernet parent interfaces have their mpls state managed correctly.

It seems fixed for rolling release 1.4 because soft has been moved to FRR7.5.1
Of course it is not fixed for rolling release 1.3 (and as I understand won't be) due to FRR7.3.1

@syncer
Sorry to dredge up an old bug, but I believe I've hit this today on 1.2.7-LTS myself. Per @zsdc's original description, It seems that when you configure:

Added minisign package https://github.com/vyos/vyos-build/tree/current/packages/minisign and also included this in vyos-1x dependency list for crux, equuleus and current

We can do some workaround for that level,

It seems that "call" doesn't react to env.

'VYATTA_EDIT_LEVEL': '/system/login'

https://github.com/vyos/vyos-1x/blob/810f4700acc9816178dc9a7f5f555bbde71a141d/src/conf_mode/system-login.py#L161

vyos@vyos:~$ show version
Version: VyOS 1.3-rolling-202005100117
Release Train: equuleus

PR https://github.com/vyos/vyatta-cfg/pull/34
PR https://github.com/vyos/vyos-1x/pull/798

This can be reproduced with the following config on 1.4

This looks very promising to me for VyOS 1.4-rolling-202104020417, can we please backport this @jestabro ?

show ipv6 route lists you the forwarding path - FIB
show ipv6 bgp or show ipv6 route bgp will show you the rib

I think the presence of the kernel default route may be the problem. It comes from RA through autoconf option on the interface. I will do some more testing.

Could you please try backporting this to 1.3 equuleus branch?

That one just bit me - and actually this is caused by loading the tunnel-broker config from https://github.com/vyos/vyos-1x/blob/b666f8ba97dc792aac90fad4c4c99e47caca7baf/smoketest/configs/tunnel-broker

https://github.com/vyos/vyatta-cfg-system/pull/144

There are two issues in this task (1) reordering of interfaces (2) redundant hw-id entries due to vyatta_net_name not parsing quoted values. A quick fix for (2) will be a PR for vyatta-cfg-system; the general issues the bug raises, regarding quoted values in configtree, will be addressed in the subtasks.

PR https://github.com/vyos/vyos-1x/pull/796

Chown for saved configuration file should be frr:frr

So my feeling tells me that the offender is here.

Hmm, where should the documentation for "gretap" be now? I checked the following and it's still missing:

Parent task: https://phabricator.vyos.net/T3356

Does anyone follow up on this?

Expect

vyos@r5-roll# set protocols ospf redistribute isis 
Possible completions:
   metric       OSPF default metric
   metric-type  OSPF metric type for default routes (default: 2)
   route-map    Route map reference

Update: It turns out the md5sum.txt files are put there by Debian's Live Build. Checksums are added on lb binary_checksums step of the build, which defaults to MD5 if no variable is provided to tell it otherwise. As Daniil suggested, we can put a second checksum step with SHA256 variable to produce both checksums, then check for sha256sum.txt files on new images. This way, old update scripts can still find an md5sum.txt in images.

@dtoux show ipv6 route vrf foo

I still see it in frr after the reboot but it is not showing in the output of show ipv6 route, so it seems like just a visualization problem.

To reproduce, on clean install 1.3.-rc3

set interfaces ethernet eth1 address '2620:18:6000:aa10::2/64'
set interfaces ethernet eth1 vrf 'foo'
set protocols vrf foo static route6 ::/0 next-hop 2620:18:6000:aa10::1
set vrf name foo table '1050'

@dtoux vtysh -c "show run"
Also, it doesn't show a directly connected ipv6 route.

What command do you use to get this?

The route present in the frr

!
vrf foo
 ipv6 route ::/0 2620:18:6000:aa10::1
 exit-vrf
!