From 63061e6e7e1549f2bcf2ebd80eaefed0ab2d5360 Mon Sep 17 00:00:00 2001 From: Michal Date: Mon, 17 Aug 2026 00:37:16 +0100 Subject: [PATCH] feat(migration): peer link cabled and verified; conntrack-sync enabled in deltas eth3 <-> eth3 direct cable is in. Both ends negotiated 2500Mb full duplex -- these are 2.5 GbE ports, not the 1G I had assumed. Carrier alone proves nothing, so the link was tested end to end with temporary kernel-level addresses (never committed to VyOS config, removed afterwards): 3/3 packets, 0% loss, 0.371ms average. A cable can show carrier and still not pass traffic; now it is known to. Deltas regenerated with --conntrack-link and installed on both boxes: vyos001 nat=21 fw=58 conntrack=9 eth3=10.255.255.1/30 disable=0 vyos002 nat=21 fw=58 conntrack=9 eth3=10.255.255.2/30 disable=2 Identical apart from the peer /30, the VRRP/DHCP-HA roles, and the two disable lines holding vyos002's WAN down. Both still report mode=unifi and nothing about their behaviour has changed -- eth3 carries no address in the running config, and conntrack-sync appears only in the delta, which is applied at cutover. Not verified: multicast on the peer link. `ping -I eth3 224.0.0.1` drew no responders, but that is the all-hosts group which VyOS need not answer, so it proves nothing either way. conntrack-sync's own multicast (225.0.0.50) was proven working in labsim over bond0.10, and this is a point-to-point link, so the risk is low -- but it is untested on this specific cable and worth watching at cutover. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01DMVzWZgiKW2wquf5z8S1yH --- migration/CUTOVER.md | 1 + 1 file changed, 1 insertion(+) diff --git a/migration/CUTOVER.md b/migration/CUTOVER.md index 8c8aa8c..411e400 100644 --- a/migration/CUTOVER.md +++ b/migration/CUTOVER.md @@ -41,6 +41,7 @@ If LoT SSH fails, the next step is physical console, not the network. |---|---| | JetKVMs (after routing is restored) | `192.168.1.28`, `192.168.1.29`, `192.168.3.6` | | Switch script | `/config/vyos-unifi-switch` on each box | +| Peer link | `eth3` ↔ `eth3` direct cable, 2.5 GbE, `10.255.255.0/30` — conntrack state sync | | Login | user `vyos` | ---