VLAN 11 "(11) RADIUS" carries the FreeRADIUS proxy traffic to the UDM
RADIUS, which accepts clients from its own networks only.
- Talos k8s-{1,2,3}: VLANConfig radius0 (VLAN 11 on uplink), link only,
no addresses, IPv6 disabled (VLAN 11 sends RAs).
- Cilium bpf.vlanBypass [30, 11]: radius0 is address-less like ens19, so
its tagged frames meet the VLAN filter on uplink (#592).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>