Need to check with the latest rolling release, as we have more flexibility in the bridge firewall. But command set interfaces bridge br0 ip adjust-mss '1377', with no extra config, most probably won't have desired effect.

Engineid cli is not ok:

Can you share logs for those entries?

Can you check manually adding next rule?

This is not valid for 1.4 and 1.5
Only valid for 1.3 and older images.

This was supposed to be fixed in https://vyos.dev/T5794
We may need to double check once again

No. It's not applicable for 1.4/1.5

PR: https://github.com/vyos/vyos-1x/pull/4180

No constraints for Equuleus: https://github.com/vyos/vyos-1x/blob/equuleus/interface-definitions/system-login.xml.in#L110-L114

Can you check adding the next command?

Can you check if changing this line https://github.com/vyos/vyos-1x/blob/current/data/templates/login/tacplus_nss.conf.j2#L33 and adding those user helps?
This file can be changed locally in the router: /usr/share/vyos/templates/login/tacplus_nss.conf.j2
Change line:

exclude_users=root,telegraf,radvd,strongswan,tftp,conservr,frr,ocserv,pdns,_chrony,_lldpd,sshd,openvpn,radius_user,radius_priv_user,*{{ ',' + user | join(',') if user is vyos_defined }}

And change it to something like:

PR: https://github.com/vyos/vyos-1x/pull/4123

PR: https://github.com/vyos/vyos-1x/pull/4120

PR: https://github.com/vyos/vyos-1x/pull/4084

PR: https://github.com/vyos/vyos-1x/pull/4024

Showing all logs for interface might print more information than it's needed. Maybe a different approach:

PR for docuemntation: https://github.com/vyos/vyos-documentation/pull/1531

PR: https://github.com/vyos/vyos-1x/pull/4018

I think we can close this one

PR: https://github.com/vyos/vyos-1x/pull/3988

PR: https://github.com/vyos/vyos-1x/pull/3981

Config to reproduce the issue:

https://github.com/vyos/vyos-1x/pull/3964

PR https://github.com/vyos/vyos-1x/pull/3901

PR: https://github.com/vyos/vyos-1x/pull/3901

PR: https://github.com/vyos/vyos-1x/pull/3901

PR: https://github.com/vyos/vyos-1x/pull/3781