SSH listener on VRF interface will not work

Board,

While working with the new vrf build (which are amazing) I found that when configuring an ssh service on a VRF’d interface I am handed an error.

"Job for ssh.service failed because the control process exited with error code. See “systemctl status ssh.service” and “journalctl -xe” for details.

When this config is removed and ssh is enabled on an address or interface that is not configured vrf, error is cleared.

Thanks,

db

Hello, sorry to hear that you are hitting an issue ! Could you please share with us how you setup your machine (ie: the content of “show configuration commands”) so we can try to replicate and understand what is going on please ?

Hi,

have hit the same error with VRFs - basic concept of having a seperated “management plane” vrf with a seperate routing table and default route… In my case (not sure it’s the same as what dbenson experienced) steps to reproduce are:

  1. Start with a fresh vyos installation

  2. Add the below config in a configure session:
    set vrf name mgmt description ‘Management VRF’
    set vrf name mgmt table ‘100’
    set interfaces ethernet eth0 address ‘192.168.1.2/24’
    set interfaces ethernet eth0 description ‘Management Interface’
    set interfaces ethernet eth0 vrf ‘mgmt’
    set protocols vrf mgmt static route 0.0.0.0/0 next-hop 192.168.1.1
    set service ssh listen-address 192.168.1.2

  3. Tried to commit, errors with:
    [ service ssh ]
    Job for ssh.service failed because the control process exited with error code.
    See “systemctl status ssh.service” and “journalctl -xe” for details.

  4. Took a look at the journal for the ssh unit (journalctl -xe -u ssh.service) to see:
    May 03 21:14:19 vyosvpn02 sshd[9990]: error: Bind to port 22 on 192.168.1.2 failed: Cannot assign requested address.
    May 03 21:14:19 vyosvpn02 sshd[9990]: fatal: Cannot bind any address.
    May 03 21:14:19 vyosvpn02 systemd[1]: ssh.service: Main process exited, code=exited, status=255/EXCEPTION
    – Subject: Unit process exited
    – Defined-By: systemd
    – Support: https://www.debian.org/support

    – An ExecStart= process belonging to unit ssh.service has exited.

    – The process’ exit code is ‘exited’ and its exit status is 255.

adding the “set vrf bind-to-all” config doesn’t make a difference for the behavior with listen-address specified.

I’ve reverted to NOT specifying a listen address for ssh for now, but have the set vrf bind-to-all, otherwise can’t reach ssh on the management vrf (which is expected I assume?).

The above was tested on:
Version: VyOS 1.3-rolling-202004191932

Regards,
pptak