ifconfig: backport ifconfig framework from 1.4 to support new tunnel options

It is easier to backport the entire vyos.ifconfig library from 1.4 instead of
backporting single pieces which are required to add new feature to the tunnel
interface section.

In addition that both libraries are now back in sync it will become much easier
to backport any other new feature introduced in VyOS 1.4!

23 files changed, 468 insertions, 591 deletions

diff --git a/interface-definitions/interfaces-l2tpv3.xml.in b/interface-definitions/interfaces-l2tpv3.xml.in
index db2a7d39d..2edf08070 100644
--- a/interface-definitions/interfaces-l2tpv3.xml.in
+++ b/interface-definitions/interfaces-l2tpv3.xml.in
@@ -55,22 +55,7 @@
           </leafNode>
           #include <include/interface/interface-ipv4-options.xml.i>
           #include <include/interface/interface-ipv6-options.xml.i>
-          <leafNode name="local-ip">
-            <properties>
-              <help>Local IP address for L2TPv3 tunnel</help>
-              <valueHelp>
-                <format>ipv4</format>
-                <description>Local IPv4 address of tunnel</description>
-              </valueHelp>
-              <valueHelp>
-                <format>ipv6</format>
-                <description>Local IPv6 address of tunnel</description>
-              </valueHelp>
-              <constraint>
-                <validator name="ip-address"/>
-              </constraint>
-            </properties>
-          </leafNode>
+          #include <include/source-address-ipv4-ipv6.xml.i>
           #include <include/interface/interface-mtu-68-16000.xml.i>
           <leafNode name="mtu">
             <defaultValue>1488</defaultValue>
@@ -99,22 +84,7 @@
               </constraint>
             </properties>
           </leafNode>
-          <leafNode name="remote-ip">
-            <properties>
-              <help>Remote IP address for L2TPv3 tunnel</help>
-              <valueHelp>
-                <format>ipv4</format>
-                <description>Remote IPv4 address of tunnel</description>
-              </valueHelp>
-              <valueHelp>
-                <format>ipv6</format>
-                <description>Remote IPv6 address of tunnel</description>
-              </valueHelp>
-              <constraint>
-                <validator name="ip-address"/>
-              </constraint>
-            </properties>
-          </leafNode>
+          #include <include/tunnel-remote.xml.i>
           <leafNode name="session-id">
             <properties>
               <help>Session identifier</help>
diff --git a/interface-definitions/interfaces-tunnel.xml.in b/interface-definitions/interfaces-tunnel.xml.in
index 2b425f865..3a9454e91 100644
--- a/interface-definitions/interfaces-tunnel.xml.in
+++ b/interface-definitions/interfaces-tunnel.xml.in
@@ -27,50 +27,9 @@
           </leafNode>
           #include <include/interface/interface-ipv4-options.xml.i>
           #include <include/interface/interface-ipv6-options.xml.i>
-          <leafNode name="local-ip">
-            <properties>
-              <help>Local IP address for this tunnel</help>
-              <valueHelp>
-                <format>ipv4</format>
-                <description>Local IPv4 address for this tunnel</description>
-              </valueHelp>
-              <valueHelp>
-                <format>ipv6</format>
-                <description>Local IPv6 address for this tunnel [NOTICE: unavailable for mGRE tunnels]</description>
-              </valueHelp>
-              <completionHelp>
-                <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
-              </completionHelp>
-              <constraint>
-                <validator name="ip-address"/>
-              </constraint>
-            </properties>
-          </leafNode>
-          <leafNode name="remote-ip">
-            <properties>
-              <help>Remote IP address for this tunnel</help>
-              <valueHelp>
-                <format>ipv4</format>
-                <description>Remote IPv4 address for this tunnel</description>
-              </valueHelp>
-              <valueHelp>
-                <format>ipv6</format>
-                <description>Remote IPv6 address for this tunnel</description>
-              </valueHelp>
-              <constraint>
-                <!-- does it need fixing/changing to be more restrictive ? -->
-                <validator name="ip-address"/>
-              </constraint>
-            </properties>
-          </leafNode>
-          <leafNode name="source-interface">
-            <properties>
-              <help>Physical Interface used for underlaying traffic</help>
-              <completionHelp>
-                <script>${vyos_completion_dir}/list_interfaces.py</script>
-              </completionHelp>
-            </properties>
-          </leafNode>
+          #include <include/source-address-ipv4-ipv6.xml.i>
+          #include <include/tunnel-remote.xml.i>
+          #include <include/source-interface.xml.i>
           <leafNode name="6rd-prefix">
             <properties>
               <help>6rd network prefix</help>
@@ -114,14 +73,14 @@
             <properties>
               <help>Encapsulation of this tunnel interface</help>
               <completionHelp>
-                <list>gre gre-bridge ip6gre ip6ip6 ipip ipip6 sit</list>
+                <list>gre gretap ip6gre ip6ip6 ipip ipip6 sit</list>
               </completionHelp>
               <valueHelp>
                 <format>gre</format>
                 <description>Generic Routing Encapsulation</description>
               </valueHelp>
               <valueHelp>
-                <format>gre-bridge</format>
+                <format>gretap</format>
                 <description>Generic Routing Encapsulation bridge interface</description>
               </valueHelp>
               <valueHelp>
@@ -145,9 +104,9 @@
                 <description>Simple Internet Transition encapsulation</description>
               </valueHelp>
               <constraint>
-                <regex>^(gre|gre-bridge|ip6gre|ip6ip6|ipip|ipip6|sit)$</regex>
+                <regex>^(gre|gretap|ip6gre|ip6ip6|ipip|ipip6|sit)$</regex>
               </constraint>
-              <constraintErrorMessage>Invalid encapsulation, must be one of: gre, gre-bridge, ipip, sit, ipip6, ip6ip6, ip6gre</constraintErrorMessage>
+              <constraintErrorMessage>Invalid encapsulation, must be one of: gre, gretap, ipip, sit, ipip6, ip6ip6, ip6gre</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="multicast">
diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py
index ee0fd94f7..0fb3501e8 100644
--- a/python/vyos/configverify.py
+++ b/python/vyos/configverify.py
@@ -84,6 +84,50 @@ def verify_mtu_ipv6(config):
             if tmp and 'eui64' in tmp:
                 raise ConfigError(error_msg)
 
+def verify_tunnel(config):
+    """
+    This helper is used to verify the common part of the tunnel
+    """
+    from vyos.template import is_ipv4
+    from vyos.template import is_ipv6
+
+    if 'encapsulation' not in config:
+        raise ConfigError('Must configure the tunnel encapsulation for '\
+                          '{ifname}!'.format(**config))
+
+    if 'source_address' not in config and 'dhcp_interface' not in config:
+        raise ConfigError('source-address is mandatory for tunnel')
+
+    if 'remote' not in config and config['encapsulation'] != 'gre':
+        raise ConfigError('remote-ip address is mandatory for tunnel')
+
+    if {'source_address', 'dhcp_interface'} <= set(config):
+        raise ConfigError('Can not use both source-address and dhcp-interface')
+
+    if config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
+        error_ipv6 = 'Encapsulation mode requires IPv6'
+        if 'source_address' in config and not is_ipv6(config['source_address']):
+            raise ConfigError(f'{error_ipv6} source-address')
+
+        if 'remote' in config and not is_ipv6(config['remote']):
+            raise ConfigError(f'{error_ipv6} remote-ip address')
+    else:
+        error_ipv4 = 'Encapsulation mode requires IPv4'
+        if 'source_address' in config and not is_ipv4(config['source_address']):
+            raise ConfigError(f'{error_ipv4} source-address')
+
+        if 'remote' in config and not is_ipv4(config['remote']):
+            raise ConfigError(f'{error_ipv4} remote address')
+
+    if config['encapsulation'] in ['sit', 'gretap']:
+        if 'source_interface' in config:
+            encapsulation = config['encapsulation']
+            raise ConfigError(f'Option source-interface can not be used with ' \
+                              f'encapsulation "{encapsulation}"!')
+    elif config['encapsulation'] == 'gre':
+        if 'source_address' in config and is_ipv6(config['source_address']):
+            raise ConfigError('Can not use local IPv6 address is for mGRE tunnels')
+
 def verify_vrf(config):
     """
     Common helper function used by interface implementations to perform
diff --git a/python/vyos/ifconfig/__init__.py b/python/vyos/ifconfig/__init__.py
index 1c77a9e55..cbde93c97 100644
--- a/python/vyos/ifconfig/__init__.py
+++ b/python/vyos/ifconfig/__init__.py
@@ -29,14 +29,7 @@ from vyos.ifconfig.macvlan import MACVLANIf
 from vyos.ifconfig.vxlan import VXLANIf
 from vyos.ifconfig.wireguard import WireGuardIf
 from vyos.ifconfig.vtun import VTunIf
-from vyos.ifconfig.tunnel import GREIf
-from vyos.ifconfig.tunnel import GRETapIf
-from vyos.ifconfig.tunnel import IP6GREIf
-from vyos.ifconfig.tunnel import IPIPIf
-from vyos.ifconfig.tunnel import IPIP6If
-from vyos.ifconfig.tunnel import IP6IP6If
-from vyos.ifconfig.tunnel import SitIf
-from vyos.ifconfig.tunnel import Sit6RDIf
+from vyos.ifconfig.tunnel import TunnelIf
 from vyos.ifconfig.wireless import WiFiIf
 from vyos.ifconfig.l2tpv3 import L2TPv3If
 from vyos.ifconfig.macsec import MACsecIf
diff --git a/python/vyos/ifconfig/bond.py b/python/vyos/ifconfig/bond.py
index 78ce27bba..27d0182e9 100644
--- a/python/vyos/ifconfig/bond.py
+++ b/python/vyos/ifconfig/bond.py
@@ -31,9 +31,7 @@ class BondIf(Interface):
     monitoring may be performed.
     """
 
-    default = {
-        'type': 'bond',
-    }
+    iftype = 'bond'
     definition = {
         **Interface.definition,
         ** {
diff --git a/python/vyos/ifconfig/bridge.py b/python/vyos/ifconfig/bridge.py
index 116ed22c0..65a4506c5 100644
--- a/python/vyos/ifconfig/bridge.py
+++ b/python/vyos/ifconfig/bridge.py
@@ -34,9 +34,7 @@ class BridgeIf(Interface):
     The Linux bridge code implements a subset of the ANSI/IEEE 802.1d standard.
     """
 
-    default = {
-        'type': 'bridge',
-    }
+    iftype = 'bridge'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/dummy.py b/python/vyos/ifconfig/dummy.py
index f2a4106e6..50a7a710b 100644
--- a/python/vyos/ifconfig/dummy.py
+++ b/python/vyos/ifconfig/dummy.py
@@ -23,9 +23,7 @@ class DummyIf(Interface):
     packets through without actually transmitting them.
     """
 
-    default = {
-        'type': 'dummy',
-    }
+    iftype = 'dummy'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/ethernet.py b/python/vyos/ifconfig/ethernet.py
index aa7da35d5..df6b96fbf 100644
--- a/python/vyos/ifconfig/ethernet.py
+++ b/python/vyos/ifconfig/ethernet.py
@@ -27,9 +27,7 @@ class EthernetIf(Interface):
     Abstraction of a Linux Ethernet Interface
     """
 
-    default = {
-        'type': 'ethernet',
-    }
+    iftype = 'ethernet'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/geneve.py b/python/vyos/ifconfig/geneve.py
index 0a3711dab..35b7680a1 100644
--- a/python/vyos/ifconfig/geneve.py
+++ b/python/vyos/ifconfig/geneve.py
@@ -27,11 +27,7 @@ class GeneveIf(Interface):
     https://lwn.net/Articles/644938/
     """
 
-    default = {
-        'type': 'geneve',
-        'vni': 0,
-        'remote': '',
-    }
+    iftype = 'geneve'
     options = Interface.options + \
         ['vni', 'remote']
     definition = {
diff --git a/python/vyos/ifconfig/interface.py b/python/vyos/ifconfig/interface.py
index fb658bd61..9c02af68f 100644
--- a/python/vyos/ifconfig/interface.py
+++ b/python/vyos/ifconfig/interface.py
@@ -1,4 +1,4 @@
-# Copyright 2019-2020 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -61,7 +61,6 @@ class Interface(Control):
     options = ['debug', 'create']
     required = []
     default = {
-        'type': '',
         'debug': True,
         'create': True,
     }
@@ -115,6 +114,10 @@ class Interface(Control):
             'convert': lambda name: name if name else '',
             'shellcmd': 'ip link set dev {ifname} alias "{value}"',
         },
+        'bridge_port_isolation': {
+            'validate': lambda v: assert_list(v, ['on', 'off']),
+            'shellcmd': 'bridge link set dev {ifname} isolated {value}',
+        },
         'mac': {
             'validate': assert_mac,
             'shellcmd': 'ip link set dev {ifname} address {value}',
@@ -233,26 +236,21 @@ class Interface(Control):
         >>> from vyos.ifconfig import Interface
         >>> i = Interface('eth0')
         """
+        self.config = deepcopy(kargs)
+        self.config['ifname'] = self.ifname = ifname
 
-        self.config = deepcopy(self.default)
-        for k in self.options:
-            if k in kargs:
-                self.config[k] = kargs[k]
-
-        # make sure the ifname is the first argument and not from the dict
-        self.config['ifname'] = ifname
         self._admin_state_down_cnt = 0
 
         # we must have updated config before initialising the Interface
         super().__init__(**kargs)
-        self.ifname = ifname
 
         if not self.exists(ifname):
-            # Any instance of Interface, such as Interface('eth0')
-            # can be used safely to access the generic function in this class
-            # as 'type' is unset, the class can not be created
-            if not self.config['type']:
+            # Any instance of Interface, such as Interface('eth0') can be used
+            # safely to access the generic function in this class as 'type' is
+            # unset, the class can not be created
+            if not self.iftype:
                 raise Exception(f'interface "{ifname}" not found')
+            self.config['type'] = self.iftype
 
             # Should an Instance of a child class (EthernetIf, DummyIf, ..)
             # be required, then create should be set to False to not accidentally create it.
@@ -696,6 +694,20 @@ class Interface(Control):
         """
         self.set_interface('path_priority', priority)
 
+    def set_port_isolation(self, on_or_off):
+        """
+        Controls whether a given port will be isolated, which means it will be
+        able to communicate with non-isolated ports only. By default this flag
+        is off.
+
+        Use enable=1 to enable or enable=0 to disable
+
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> Interface('eth1').set_port_isolation('on')
+        """
+        self.set_interface('bridge_port_isolation', on_or_off)
+
     def set_proxy_arp(self, enable):
         """
         Set per interface proxy ARP configuration
@@ -736,6 +748,7 @@ class Interface(Control):
         """
         Retrieve assigned IPv4 addresses from given interface.
         This is done using the netifaces and ipaddress python modules.
+
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_addr_v4()
@@ -750,28 +763,18 @@ class Interface(Control):
                 ipv4.append(v4_addr['addr'] + prefix)
         return ipv4
 
-    def get_addr(self):
+    def get_addr_v6(self):
         """
-        Retrieve assigned IPv4 and IPv6 addresses from given interface.
+        Retrieve assigned IPv6 addresses from given interface.
         This is done using the netifaces and ipaddress python modules.
 
         Example:
         >>> from vyos.ifconfig import Interface
-        >>> Interface('eth0').get_addrs()
-        ['172.16.33.30/24', 'fe80::20c:29ff:fe11:a174/64']
+        >>> Interface('eth0').get_addr_v6()
+        ['fe80::20c:29ff:fe11:a174/64']
         """
-
-        ipv4 = []
         ipv6 = []
-
-        if AF_INET in ifaddresses(self.config['ifname']).keys():
-            for v4_addr in ifaddresses(self.config['ifname'])[AF_INET]:
-                # we need to manually assemble a list of IPv4 address/prefix
-                prefix = '/' + \
-                    str(IPv4Network('0.0.0.0/' + v4_addr['netmask']).prefixlen)
-                ipv4.append(v4_addr['addr'] + prefix)
-
-        if AF_INET6 in ifaddresses(self.config['ifname']).keys():
+        if AF_INET6 in ifaddresses(self.config['ifname']):
             for v6_addr in ifaddresses(self.config['ifname'])[AF_INET6]:
                 # Note that currently expanded netmasks are not supported. That means
                 # 2001:db00::0/24 is a valid argument while 2001:db00::0/ffff:ff00:: not.
@@ -784,8 +787,18 @@ class Interface(Control):
                 # addresses
                 v6_addr['addr'] = v6_addr['addr'].split('%')[0]
                 ipv6.append(v6_addr['addr'] + prefix)
+        return ipv6
 
-        return ipv4 + ipv6
+    def get_addr(self):
+        """
+        Retrieve assigned IPv4 and IPv6 addresses from given interface.
+
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> Interface('eth0').get_addr()
+        ['172.16.33.30/24', 'fe80::20c:29ff:fe11:a174/64']
+        """
+        return self.get_addr_v4() + self.get_addr_v6()
 
     def add_addr(self, addr):
         """
@@ -919,49 +932,42 @@ class Interface(Control):
             if 'priority' in bridge_config:
                 self.set_path_cost(bridge_config['priority'])
 
-            vlan_filter = 0
-            vlan_add = set()
-
-            del_ifname_vlan_ids = get_vlan_ids(ifname)
             bridge_vlan_filter = Section.klass(bridge)(bridge, create=True).get_vlan_filter()
 
-            if bridge_vlan_filter:
-                if 1 in del_ifname_vlan_ids:
-                    del_ifname_vlan_ids.remove(1)
-                vlan_filter = 1
-
-            for vlan in del_ifname_vlan_ids:
-                cmd = f'bridge vlan del dev {ifname} vid {vlan}'
-                self._cmd(cmd)
-
-            if 'native_vlan' in bridge_config:
-                vlan_filter = 1
-                cmd = f'bridge vlan del dev {self.ifname} vid 1'
-                self._cmd(cmd)
-                vlan_id = bridge_config['native_vlan']
-                cmd = f'bridge vlan add dev {self.ifname} vid {vlan_id} pvid untagged master'
-                self._cmd(cmd)
-                vlan_add.add(vlan_id)
-
-            if 'allowed_vlan' in bridge_config:
-                vlan_filter = 1
-                if 'native_vlan' not in bridge_config:
-                    cmd = f'bridge vlan del dev {self.ifname} vid 1'
-                    self._cmd(cmd)
-                for vlan in bridge_config['allowed_vlan']:
-                    cmd = f'bridge vlan add dev {self.ifname} vid {vlan} master'
+            if int(bridge_vlan_filter):
+                cur_vlan_ids = get_vlan_ids(ifname)
+                add_vlan = []
+                native_vlan_id = None
+                allowed_vlan_ids= []
+
+                if 'native_vlan' in bridge_config:
+                    vlan_id = bridge_config['native_vlan']
+                    add_vlan.append(vlan_id)
+                    native_vlan_id = vlan_id
+
+                if 'allowed_vlan' in bridge_config:
+                    for vlan in bridge_config['allowed_vlan']:
+                        vlan_range = vlan.split('-')
+                        if len(vlan_range) == 2:
+                            for vlan_add in range(int(vlan_range[0]),int(vlan_range[1]) + 1):
+                                add_vlan.append(str(vlan_add))
+                                allowed_vlan_ids.append(str(vlan_add))
+                        else:
+                            add_vlan.append(vlan)
+                            allowed_vlan_ids.append(vlan)
+
+                # Remove redundant VLANs from the system
+                for vlan in list_diff(cur_vlan_ids, add_vlan):
+                    cmd = f'bridge vlan del dev {ifname} vid {vlan} master'
                     self._cmd(cmd)
-                    vlan_add.add(vlan)
 
-            if vlan_filter:
-                # Setting VLAN ID for the bridge
-                for vlan in vlan_add:
-                    cmd = f'bridge vlan add dev {bridge} vid {vlan} self'
+                for vlan in allowed_vlan_ids:
+                    cmd = f'bridge vlan add dev {ifname} vid {vlan} master'
+                    self._cmd(cmd)
+                # Setting native VLAN to system
+                if native_vlan_id:
+                    cmd = f'bridge vlan add dev {ifname} vid {native_vlan_id} pvid untagged master'
                     self._cmd(cmd)
-
-                # enable/disable Vlan Filter
-                # When the VLAN aware option is not detected, the setting of `bridge` should not be overwritten
-                Section.klass(bridge)(bridge, create=True).set_vlan_filter(vlan_filter)
 
     def set_dhcp(self, enable):
         """
@@ -1042,9 +1048,11 @@ class Interface(Control):
             source_if = next(iter(self._config['is_mirror_intf']))
             config = self._config['is_mirror_intf'][source_if].get('mirror', None)
 
+        # Please do not clear the 'set $? = 0 '. It's meant to force a return of 0
         # Remove existing mirroring rules
-        delete_tc_cmd  = f'tc qdisc del dev {source_if} handle ffff: ingress; '
-        delete_tc_cmd += f'tc qdisc del dev {source_if} handle 1: root prio'
+        delete_tc_cmd  = f'tc qdisc del dev {source_if} handle ffff: ingress 2> /dev/null;'
+        delete_tc_cmd += f'tc qdisc del dev {source_if} handle 1: root prio 2> /dev/null;'
+        delete_tc_cmd += 'set $?=0'
         self._popen(delete_tc_cmd)
 
         # Bail out early if nothing needs to be configured
@@ -1068,7 +1076,6 @@ class Interface(Control):
             mirror_cmd += f'tc filter add dev {source_if} parent {parent} protocol all prio 10 u32 match u32 0 0 flowid 1:1 action mirred egress mirror dev {mirror_if}'
             self._popen(mirror_cmd)
 
-
     def update(self, config):
         """ General helper function which works on a dictionary retrived by
         get_config_dict(). It's main intention is to consolidate the scattered
@@ -1306,29 +1313,62 @@ class Interface(Control):
 
         # create/update 802.1q VLAN interfaces
         for vif_id, vif_config in config.get('vif', {}).items():
+
+            vif_ifname = f'{ifname}.{vif_id}'
+            vif_config['ifname'] = vif_ifname
+
             tmp = deepcopy(VLANIf.get_config())
             tmp['source_interface'] = ifname
             tmp['vlan_id'] = vif_id
 
-            vif_ifname = f'{ifname}.{vif_id}'
-            vif_config['ifname'] = vif_ifname
+            # We need to ensure that the string format is consistent, and we need to exclude redundant spaces.
+            sep = ' '
+            if 'egress_qos' in vif_config:
+                # Unwrap strings into arrays
+                egress_qos_array = vif_config['egress_qos'].split()
+                # The split array is spliced according to the fixed format
+                tmp['egress_qos'] = sep.join(egress_qos_array)
+
+            if 'ingress_qos' in vif_config:
+                # Unwrap strings into arrays
+                ingress_qos_array = vif_config['ingress_qos'].split()
+                # The split array is spliced according to the fixed format
+                tmp['ingress_qos'] = sep.join(ingress_qos_array)
+
+            # Since setting the QoS control parameters in the later stage will
+            # not completely delete the old settings,
+            # we still need to delete the VLAN encapsulation interface in order to
+            # ensure that the changed settings are effective.
+            cur_cfg = get_interface_config(vif_ifname)
+            qos_str = ''
+            tmp2 = dict_search('linkinfo.info_data.ingress_qos', cur_cfg)
+            if 'ingress_qos' in tmp and tmp2:
+                for item in tmp2:
+                    from_key = item['from']
+                    to_key = item['to']
+                    qos_str += f'{from_key}:{to_key} '
+                if qos_str != tmp['ingress_qos']:
+                    if self.exists(vif_ifname):
+                        VLANIf(vif_ifname).remove()
+
+            qos_str = ''
+            tmp2 = dict_search('linkinfo.info_data.egress_qos', cur_cfg)
+            if 'egress_qos' in tmp and tmp2:
+                for item in tmp2:
+                    from_key = item['from']
+                    to_key = item['to']
+                    qos_str += f'{from_key}:{to_key} '
+                if qos_str != tmp['egress_qos']:
+                    if self.exists(vif_ifname):
+                        VLANIf(vif_ifname).remove()
+
             vlan = VLANIf(vif_ifname, **tmp)
             vlan.update(vif_config)
 
 
 class VLANIf(Interface):
     """ Specific class which abstracts 802.1q and 802.1ad (Q-in-Q) VLAN interfaces """
-    default = {
-        'type': 'vlan',
-        'source_interface': '',
-        'vlan_id': '',
-        'protocol': '',
-        'ingress_qos': '',
-        'egress_qos': '',
-    }
-
-    options = Interface.options + \
-        ['source_interface', 'vlan_id', 'protocol', 'ingress_qos', 'egress_qos']
+    iftype = 'vlan'
 
     def _create(self):
         # bail out early if interface already exists
@@ -1336,11 +1376,11 @@ class VLANIf(Interface):
             return
 
         cmd = 'ip link add link {source_interface} name {ifname} type vlan id {vlan_id}'
-        if self.config['protocol']:
+        if 'protocol' in self.config:
             cmd += ' protocol {protocol}'
-        if self.config['ingress_qos']:
+        if 'ingress_qos' in self.config:
             cmd += ' ingress-qos-map {ingress_qos}'
-        if self.config['egress_qos']:
+        if 'egress_qos' in self.config:
             cmd += ' egress-qos-map {egress_qos}'
 
         self._cmd(cmd.format(**self.config))
diff --git a/python/vyos/ifconfig/l2tpv3.py b/python/vyos/ifconfig/l2tpv3.py
index 76d6e6311..7ff0fdd0e 100644
--- a/python/vyos/ifconfig/l2tpv3.py
+++ b/python/vyos/ifconfig/l2tpv3.py
@@ -1,4 +1,4 @@
-# Copyright 2019 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -24,19 +24,7 @@ class L2TPv3If(Interface):
     either hot standby or load balancing services. Additionally, link integrity
     monitoring may be performed.
     """
-
-    default = {
-        'type': 'l2tp',
-        'peer_tunnel_id': '',
-        'local_port': 0,
-        'remote_port': 0,
-        'encapsulation': 'udp',
-        'local_address': '',
-        'remote_address': '',
-        'session_id': '',
-        'tunnel_id': '',
-        'peer_session_id': ''
-    }
+    iftype = 'l2tp'
     definition = {
         **Interface.definition,
         **{
@@ -45,20 +33,16 @@ class L2TPv3If(Interface):
             'bridgeable': True,
         }
     }
-    options = Interface.options + \
-        ['tunnel_id', 'peer_tunnel_id', 'local_port', 'remote_port',
-         'encapsulation', 'local_address', 'remote_address', 'session_id',
-         'peer_session_id']
 
     def _create(self):
         # create tunnel interface
         cmd = 'ip l2tp add tunnel tunnel_id {tunnel_id}'
         cmd += ' peer_tunnel_id {peer_tunnel_id}'
-        cmd += ' udp_sport {local_port}'
-        cmd += ' udp_dport {remote_port}'
+        cmd += ' udp_sport {source_port}'
+        cmd += ' udp_dport {destination_port}'
         cmd += ' encap {encapsulation}'
-        cmd += ' local {local_address}'
-        cmd += ' remote {remote_address}'
+        cmd += ' local {source_address}'
+        cmd += ' remote {remote}'
         self._cmd(cmd.format(**self.config))
 
         # setup session
@@ -82,15 +66,15 @@ class L2TPv3If(Interface):
         >>> i.remove()
         """
 
-        if self.exists(self.config['ifname']):
+        if self.exists(self.ifname):
             # interface is always A/D down. It needs to be enabled explicitly
             self.set_admin_state('down')
 
-            if self.config['tunnel_id'] and self.config['session_id']:
+            if {'tunnel_id', 'session_id'} <= set(self.config):
                 cmd = 'ip l2tp del session tunnel_id {tunnel_id}'
                 cmd += ' session_id {session_id}'
                 self._cmd(cmd.format(**self.config))
 
-            if self.config['tunnel_id']:
+            if 'tunnel_id' in self.config:
                 cmd = 'ip l2tp del tunnel tunnel_id {tunnel_id}'
                 self._cmd(cmd.format(**self.config))
diff --git a/python/vyos/ifconfig/loopback.py b/python/vyos/ifconfig/loopback.py
index e911ecbd9..768d1eaf0 100644
--- a/python/vyos/ifconfig/loopback.py
+++ b/python/vyos/ifconfig/loopback.py
@@ -22,9 +22,7 @@ class LoopbackIf(Interface):
     uses to communicate with itself.
     """
     _persistent_addresses = ['127.0.0.1/8', '::1/128']
-    default = {
-        'type': 'loopback',
-    }
+    iftype = 'loopback'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/macsec.py b/python/vyos/ifconfig/macsec.py
index a229eaed5..b805f7bf7 100644
--- a/python/vyos/ifconfig/macsec.py
+++ b/python/vyos/ifconfig/macsec.py
@@ -28,11 +28,7 @@ class MACsecIf(Interface):
     those solutions are used for their own specific use cases.
     """
 
-    default = {
-        'type': 'macsec',
-        'security_cipher': '',
-        'source_interface': ''
-    }
+    iftype = 'macsec'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/macvlan.py b/python/vyos/ifconfig/macvlan.py
index 894215539..8dca7c14e 100644
--- a/python/vyos/ifconfig/macvlan.py
+++ b/python/vyos/ifconfig/macvlan.py
@@ -21,12 +21,7 @@ class MACVLANIf(Interface):
     Abstraction of a Linux MACvlan interface
     """
 
-    default = {
-        'type': 'macvlan',
-        'address': '',
-        'source_interface': '',
-        'mode': '',
-    }
+    iftype = 'macvlan'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/tunnel.py b/python/vyos/ifconfig/tunnel.py
index 6f9d7abbf..e40756cc7 100644
--- a/python/vyos/ifconfig/tunnel.py
+++ b/python/vyos/ifconfig/tunnel.py
@@ -1,4 +1,4 @@
-# Copyright 2019-2020 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -16,13 +16,12 @@
 # https://developers.redhat.com/blog/2019/05/17/an-introduction-to-linux-virtual-interfaces-tunnels/
 # https://community.hetzner.com/tutorials/linux-setup-gre-tunnel
 
-from copy import deepcopy
-
 from netaddr import EUI
 from netaddr import mac_unix_expanded
 from random import getrandbits
 
 from vyos.ifconfig.interface import Interface
+from vyos.util import dict_search
 from vyos.validate import assert_list
 
 def enable_to_on(value):
@@ -32,11 +31,10 @@ def enable_to_on(value):
         return 'off'
     raise ValueError(f'expect enable or disable but got "{value}"')
 
-
 @Interface.register
-class _Tunnel(Interface):
+class TunnelIf(Interface):
     """
-    _Tunnel: private base class for tunnels
+    Tunnel: private base class for tunnels
     https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/tunnel.c
     https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/ip6tunnel.c
     """
@@ -49,54 +47,127 @@ class _Tunnel(Interface):
         },
     }
 
+    # This table represents a mapping from VyOS internal config dict to
+    # arguments used by iproute2. For more information please refer to:
+    # - https://man7.org/linux/man-pages/man8/ip-link.8.html
+    # - https://man7.org/linux/man-pages/man8/ip-tunnel.8.html
+    mapping = {
+        'source_address'                  : 'local',
+        'source_interface'                : 'dev',
+        'remote'                          : 'remote',
+        'parameters.ip.key'               : 'key',
+        'parameters.ip.tos'               : 'tos',
+        'parameters.ip.ttl'               : 'ttl',
+    }
+    mapping_ipv4 = {
+        'parameters.ip.key'               : 'key',
+        'parameters.ip.no_pmtu_discovery' : 'nopmtudisc',
+        'parameters.ip.ignore_df'         : 'ignore-df',
+        'parameters.ip.tos'               : 'tos',
+        'parameters.ip.ttl'               : 'ttl',
+        'parameters.erspan.direction'     : 'erspan_dir',
+        'parameters.erspan.hw_id'         : 'erspan_hwid',
+        'parameters.erspan.index'         : 'erspan',
+        'parameters.erspan.version'       : 'erspan_ver',
+    }
+    mapping_ipv6 = {
+        'parameters.ipv6.encaplimit'      : 'encaplimit',
+        'parameters.ipv6.flowlabel'       : 'flowlabel',
+        'parameters.ipv6.hoplimit'        : 'hoplimit',
+        'parameters.ipv6.tclass'          : 'tclass',
+    }
+
     # TODO: This is surely used for more than tunnels
     # TODO: could be refactored elsewhere
-    _command_set = {**Interface._command_set, **{
-        'multicast': {
-            'validate': lambda v: assert_list(v, ['enable', 'disable']),
-            'convert': enable_to_on,
-            'shellcmd': 'ip link set dev {ifname} multicast {value}',
-        },
-        'allmulticast': {
-            'validate': lambda v: assert_list(v, ['enable', 'disable']),
-            'convert': enable_to_on,
-            'shellcmd': 'ip link set dev {ifname} allmulticast {value}',
-        },
-    }}
-
-    _create_cmd = 'ip tunnel add {ifname} mode {type}'
+    _command_set = {
+        **Interface._command_set,
+        **{
+            'multicast': {
+                'validate': lambda v: assert_list(v, ['enable', 'disable']),
+                'convert': enable_to_on,
+                'shellcmd': 'ip link set dev {ifname} multicast {value}',
+            },
+            'allmulticast': {
+                'validate': lambda v: assert_list(v, ['enable', 'disable']),
+                'convert': enable_to_on,
+                'shellcmd': 'ip link set dev {ifname} allmulticast {value}',
+            },
+        }
+    }
 
-    def __init__(self, ifname, **config):
-        self.config = deepcopy(config) if config else {}
-        super().__init__(ifname, **config)
+    def __init__(self, ifname, **kargs):
+        # T3357: we do not have the 'encapsulation' in kargs when calling this
+        # class from op-mode like "show interfaces tunnel"
+        if 'encapsulation' in kargs:
+            self.iftype = kargs['encapsulation']
+            # The gretap interface has the possibility to act as L2 bridge
+            if self.iftype in ['gretap', 'ip6gretap']:
+                # no multicast, ttl or tos for gretap
+                self.definition = {
+                    **TunnelIf.definition,
+                    **{
+                        'bridgeable': True,
+                    },
+                }
+
+        super().__init__(ifname, **kargs)
 
     def _create(self):
-        # add " option-name option-name-value ..." for all options set
-        options = " ".join(["{} {}".format(k, self.config[k])
-                            for k in self.options if k in self.config and self.config[k]])
-        self._cmd('{} {}'.format(self._create_cmd.format(**self.config), options))
-        self.set_admin_state('down')
+        if self.config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
+            mapping = { **self.mapping, **self.mapping_ipv6 }
+        else:
+            mapping = { **self.mapping, **self.mapping_ipv4 }
+
+        cmd = 'ip tunnel add {ifname} mode {encapsulation}'
+        if self.iftype in ['gretap', 'ip6gretap', 'erspan', 'ip6erspan']:
+            cmd = 'ip link add name {ifname} type {encapsulation}'
+            # ERSPAN requires the serialisation of packets
+            if self.iftype in ['erspan', 'ip6erspan']:
+                cmd += ' seq'
+
+        for vyos_key, iproute2_key in mapping.items():
+            # dict_search will return an empty dict "{}" for valueless nodes like
+            # "parameters.nolearning" - thus we need to test the nodes existence
+            # by using isinstance()
+            tmp = dict_search(vyos_key, self.config)
+            if isinstance(tmp, dict):
+                cmd += f' {iproute2_key}'
+            elif tmp != None:
+                cmd += f' {iproute2_key} {tmp}'
+
+        self._cmd(cmd.format(**self.config))
 
-    def change_options(self):
-        change = 'ip tunnel change {ifname} mode {type}'
-
-        # add " option-name option-name-value ..." for all options set
-        options = " ".join(["{} {}".format(k, self.config[k])
-                            for k in self.options if k in self.config and self.config[k]])
-        self._cmd('{} {}'.format(change.format(**self.config), options))
+        self.set_admin_state('down')
 
-    @classmethod
-    def get_config(cls):
-        return dict(zip(cls.options, ['']*len(cls.options)))
+    def _change_options(self):
+        # gretap interfaces do not support changing any parameter
+        if self.iftype in ['gretap', 'ip6gretap', 'erspan', 'ip6erspan']:
+            return
+
+        if self.config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
+            mapping = { **self.mapping, **self.mapping_ipv6 }
+        else:
+            mapping = { **self.mapping, **self.mapping_ipv4 }
+
+        cmd = 'ip tunnel change {ifname} mode {encapsulation}'
+        for vyos_key, iproute2_key in mapping.items():
+            # dict_search will return an empty dict "{}" for valueless nodes like
+            # "parameters.nolearning" - thus we need to test the nodes existence
+            # by using isinstance()
+            tmp = dict_search(vyos_key, self.config)
+            if isinstance(tmp, dict):
+                cmd += f' {iproute2_key}'
+            elif tmp != None:
+                cmd += f' {iproute2_key} {tmp}'
+
+        self._cmd(cmd.format(**self.config))
 
     def get_mac(self):
         """
         Get current interface MAC (Media Access Contrl) address used.
-
         NOTE: Tunnel interfaces have no "MAC" address by default. The content
               of the 'address' file in /sys/class/net/device contains the
               local-ip thus we generate a random MAC address instead
-
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_mac()
@@ -113,113 +184,13 @@ class _Tunnel(Interface):
         mac.dialect = mac_unix_expanded
         return str(mac)
 
-class GREIf(_Tunnel):
-    """
-    GRE: Generic Routing Encapsulation
-
-    For more information please refer to:
-    RFC1701, RFC1702, RFC2784
-    https://tools.ietf.org/html/rfc2784
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_gre.c
-    """
-
-    default = {'type': 'gre'}
-    options = ['local', 'remote', 'dev', 'ttl', 'tos', 'key']
-
-# GreTap also called GRE Bridge
-class GRETapIf(_Tunnel):
-    """
-    GRETapIF: GreIF using TAP instead of TUN
-
-    https://en.wikipedia.org/wiki/TUN/TAP
-    """
-
-    # no multicast, ttl or tos for gretap
-    default = {'type': 'gretap'}
-    options = ['local', 'remote', 'ttl', 'tos', 'key']
-
-    _create_cmd = 'ip link add name {ifname} type {type}'
-
-    def change_options(self):
-        pass
-
-class IP6GREIf(_Tunnel):
-    """
-    IP6Gre: IPv6 Support for Generic Routing Encapsulation (GRE)
-
-    For more information please refer to:
-    https://tools.ietf.org/html/rfc7676
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_gre6.c
-    """
-
-    default = {'type': 'ip6gre'}
-    options = ['local', 'remote', 'dev', 'encaplimit',
-               'hoplimit', 'tclass', 'flowlabel']
-
-class IPIPIf(_Tunnel):
-    """
-    IPIP: IP Encapsulation within IP
-
-    For more information please refer to:
-    https://tools.ietf.org/html/rfc2003
-    """
-
-    # IPIP does not allow to pass multicast, unlike GRE
-    # but the interface itself can be set with multicast
-
-    default = {'type': 'ipip'}
-    options = ['local', 'remote', 'dev', 'ttl', 'tos', 'key']
-
-class IPIP6If(_Tunnel):
-    """
-    IPIP6: IPv4 over IPv6 tunnel
-
-    For more information please refer to:
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_ip6tnl.c
-    """
-
-    default = {'type': 'ipip6'}
-    options = ['local', 'remote', 'dev', 'encaplimit',
-               'hoplimit', 'tclass', 'flowlabel']
-
-class IP6IP6If(IPIP6If):
-    """
-    IP6IP6: IPv6 over IPv6 tunnel
-
-    For more information please refer to:
-    https://tools.ietf.org/html/rfc2473
-    """
-    default = {'type': 'ip6ip6'}
-
-
-class SitIf(_Tunnel):
-    """
-    Sit: Simple Internet Transition
-
-    For more information please refer to:
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_iptnl.c
-    """
-
-    default = {'type': 'sit'}
-    options = ['local', 'remote', 'dev', 'ttl', 'tos', 'key']
-
-class Sit6RDIf(SitIf):
-    """
-    Sit6RDIf: Simple Internet Transition with 6RD
-
-    https://en.wikipedia.org/wiki/IPv6_rapid_deployment
-    """
-    # TODO: check if key can really be used with 6RD
-    options = ['remote', 'ttl', 'tos', 'key', '6rd-prefix', '6rd-relay-prefix']
-
-    def _create(self):
-        # do not call _Tunnel.create, building fully here
-
-        create = 'ip tunnel add {ifname} mode {type} remote {remote}'
-        self._cmd(create.format(**self.config))
-        self.set_interface('state','down')
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+        # Adjust iproute2 tunnel parameters if necessary
+        self._change_options()
 
-        set6rd = 'ip tunnel 6rd dev {ifname} 6rd-prefix {6rd-prefix}'
-        if '6rd-relay-prefix' in self.config:
-            set6rd += ' 6rd-relay-prefix {6rd-relay-prefix}'
-        self._cmd(set6rd.format(**self.config))
+        # call base class first
+        super().update(config)
diff --git a/python/vyos/ifconfig/vtun.py b/python/vyos/ifconfig/vtun.py
index 2c6e126d5..ab32ef656 100644
--- a/python/vyos/ifconfig/vtun.py
+++ b/python/vyos/ifconfig/vtun.py
@@ -17,10 +17,7 @@ from vyos.ifconfig.interface import Interface
 
 @Interface.register
 class VTunIf(Interface):
-    default = {
-        'type': 'vtun',
-        'device_type': 'tun',
-    }
+    iftype = 'vtun'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/vxlan.py b/python/vyos/ifconfig/vxlan.py
index 2cff21f02..d73fb47b8 100644
--- a/python/vyos/ifconfig/vxlan.py
+++ b/python/vyos/ifconfig/vxlan.py
@@ -1,4 +1,4 @@
-# Copyright 2019 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -14,7 +14,8 @@
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from vyos import ConfigError
-from vyos.ifconfig.interface import Interface
+from vyos.ifconfig import Interface
+from vyos.util import dict_search
 
 @Interface.register
 class VXLANIf(Interface):
@@ -38,17 +39,7 @@ class VXLANIf(Interface):
     https://www.kernel.org/doc/Documentation/networking/vxlan.txt
     """
 
-    default = {
-        'type': 'vxlan',
-        'group': '',
-        'port': 8472,   # The Linux implementation of VXLAN pre-dates
-                        # the IANA's selection of a standard destination port
-        'remote': '',
-        'source_address': '',
-        'source_interface': '',
-        'vni': 0,
-        'ttl': '16',
-    }
+    iftype = 'vxlan'
     definition = {
         **Interface.definition,
         **{
@@ -57,43 +48,34 @@ class VXLANIf(Interface):
             'bridgeable': True,
         }
     }
-    options = Interface.options + ['group', 'remote', 'source_interface',
-                                   'port', 'vni', 'source_address', 'ttl']
-
-    mapping = {
-        'ifname': 'add',
-        'vni':    'id',
-        'port':   'dstport',
-        'source_address': 'local',
-        'source_interface': 'dev',
-        'ttl': 'ttl',
-    }
 
     def _create(self):
-        cmdline = ['ifname', 'type', 'vni', 'port', 'ttl']
-
-        if self.config['source_address']:
-            cmdline.append('source_address')
-
-        if self.config['remote']:
-            cmdline.append('remote')
-
-        if self.config['group'] or self.config['source_interface']:
-            if self.config['group']:
-                cmdline.append('group')
-            if self.config['source_interface']:
-                cmdline.append('source_interface')
-            else:
-                ifname = self.config['ifname']
-                raise ConfigError(
-                    f'VXLAN "{ifname}" is missing mandatory underlay multicast'
-                     'group or source interface for a multicast network.')
+        # This table represents a mapping from VyOS internal config dict to
+        # arguments used by iproute2. For more information please refer to:
+        # - https://man7.org/linux/man-pages/man8/ip-link.8.html
+        mapping = {
+            'source_address'             : 'local',
+            'source_interface'           : 'dev',
+            'remote'                     : 'remote',
+            'group'                      : 'group',
+            'parameters.ip.dont_fragment': 'df set',
+            'parameters.ip.tos'          : 'tos',
+            'parameters.ip.ttl'          : 'ttl',
+            'parameters.ipv6.flowlabel'  : 'flowlabel',
+            'parameters.nolearning'      : 'nolearning',
+        }
 
-        cmd = 'ip link'
-        for key in cmdline:
-            value = self.config.get(key, '')
-            if not value:
-                continue
-            cmd += ' {} {}'.format(self.mapping.get(key, key), value)
+        cmd = 'ip link add {ifname} type {type} id {vni} dstport {port}'
+        for vyos_key, iproute2_key in mapping.items():
+            # dict_search will return an empty dict "{}" for valueless nodes like
+            # "parameters.nolearning" - thus we need to test the nodes existence
+            # by using isinstance()
+            tmp = dict_search(vyos_key, self.config)
+            if isinstance(tmp, dict):
+                cmd += f' {iproute2_key}'
+            elif tmp != None:
+                cmd += f' {iproute2_key} {tmp}'
 
-        self._cmd(cmd)
+        self._cmd(cmd.format(**self.config))
+        # interface is always A/D down. It needs to be enabled explicitly
+        self.set_admin_state('down')
diff --git a/python/vyos/ifconfig/wireguard.py b/python/vyos/ifconfig/wireguard.py
index 33f59b57e..2d2243b84 100644
--- a/python/vyos/ifconfig/wireguard.py
+++ b/python/vyos/ifconfig/wireguard.py
@@ -149,17 +149,7 @@ class WireGuardOperational(Operational):
 class WireGuardIf(Interface):
     OperationalClass = WireGuardOperational
 
-    default = {
-        'type': 'wireguard',
-        'port': 0,
-        'private_key': None,
-        'pubkey': None,
-        'psk': '',
-        'allowed_ips': [],
-        'fwmark': 0x00,
-        'endpoint': None,
-        'keepalive': 0
-    }
+    iftype = 'wireguard'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/wireless.py b/python/vyos/ifconfig/wireless.py
index 0efe38d59..d897715db 100644
--- a/python/vyos/ifconfig/wireless.py
+++ b/python/vyos/ifconfig/wireless.py
@@ -21,10 +21,7 @@ class WiFiIf(Interface):
     Handle WIFI/WLAN interfaces.
     """
 
-    default = {
-        'type': 'wifi',
-        'phy': 'phy0'
-    }
+    iftype = 'wifi'
     definition = {
         **Interface.definition,
         **{
diff --git a/smoketest/scripts/cli/test_interfaces_tunnel.py b/smoketest/scripts/cli/test_interfaces_tunnel.py
index bbdfc2f0e..e65d83840 100755
--- a/smoketest/scripts/cli/test_interfaces_tunnel.py
+++ b/smoketest/scripts/cli/test_interfaces_tunnel.py
@@ -39,8 +39,8 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
         cls.local_v4 = '192.0.2.1'
         cls.local_v6 = '2001:db8::1'
         cls._options = {
-            'tun10': ['encapsulation ipip', 'remote-ip 192.0.2.10', 'local-ip ' + cls.local_v4],
-            'tun20': ['encapsulation gre',  'remote-ip 192.0.2.20', 'local-ip ' + cls.local_v4],
+            'tun10': ['encapsulation ipip', 'remote 192.0.2.10', 'source-address ' + cls.local_v4],
+            'tun20': ['encapsulation gre',  'remote 192.0.2.20', 'source-address ' + cls.local_v4],
         }
         cls._interfaces = list(cls._options)
 
@@ -60,26 +60,26 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
 
         interface = f'tun1000'
         local_if_addr = f'10.10.200.1/24'
-        for encapsulation in ['ipip', 'sit', 'gre', 'gre-bridge']:
+        for encapsulation in ['ipip', 'sit', 'gre', 'gretap']:
             self.session.set(self._base_path + [interface, 'address', local_if_addr])
             self.session.set(self._base_path + [interface, 'encapsulation', encapsulation])
-            self.session.set(self._base_path + [interface, 'local-ip', self.local_v6])
-            self.session.set(self._base_path + [interface, 'remote-ip', remote_ip6])
+            self.session.set(self._base_path + [interface, 'source-address', self.local_v6])
+            self.session.set(self._base_path + [interface, 'remote', remote_ip6])
 
-            # Encapsulation mode requires IPv4 local-ip
+            # Encapsulation mode requires IPv4 source-address
             with self.assertRaises(ConfigSessionError):
                 self.session.commit()
-            self.session.set(self._base_path + [interface, 'local-ip', self.local_v4])
+            self.session.set(self._base_path + [interface, 'source-address', self.local_v4])
 
-            # Encapsulation mode requires IPv4 local-ip
+            # Encapsulation mode requires IPv4 remote address
             with self.assertRaises(ConfigSessionError):
                 self.session.commit()
-            self.session.set(self._base_path + [interface, 'remote-ip', remote_ip4])
+            self.session.set(self._base_path + [interface, 'remote', remote_ip4])
 
             self.session.set(self._base_path + [interface, 'source-interface', source_if])
 
-            # Source interface can not be used with sit and gre-bridge
-            if encapsulation in ['sit', 'gre-bridge']:
+            # Source interface can not be used with sit and gretap
+            if encapsulation in ['sit', 'gretap']:
                 with self.assertRaises(ConfigSessionError):
                     self.session.commit()
                 self.session.delete(self._base_path + [interface, 'source-interface'])
@@ -88,7 +88,7 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
             self.session.commit()
 
             conf = get_interface_config(interface)
-            if encapsulation not in ['sit', 'gre-bridge']:
+            if encapsulation not in ['sit', 'gretap']:
                 self.assertEqual(source_if, conf['link'])
 
             self.assertEqual(interface, conf['ifname'])
@@ -109,18 +109,18 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
         for encapsulation in ['ipip6', 'ip6ip6', 'ip6gre']:
             self.session.set(self._base_path + [interface, 'address', local_if_addr])
             self.session.set(self._base_path + [interface, 'encapsulation', encapsulation])
-            self.session.set(self._base_path + [interface, 'local-ip', self.local_v4])
-            self.session.set(self._base_path + [interface, 'remote-ip', remote_ip4])
+            self.session.set(self._base_path + [interface, 'source-address', self.local_v4])
+            self.session.set(self._base_path + [interface, 'remote', remote_ip4])
 
-            # Encapsulation mode requires IPv6 local-ip
+            # Encapsulation mode requires IPv6 source-address
             with self.assertRaises(ConfigSessionError):
                 self.session.commit()
-            self.session.set(self._base_path + [interface, 'local-ip', self.local_v6])
+            self.session.set(self._base_path + [interface, 'source-address', self.local_v6])
 
-            # Encapsulation mode requires IPv6 local-ip
+            # Encapsulation mode requires IPv6 remote address
             with self.assertRaises(ConfigSessionError):
                 self.session.commit()
-            self.session.set(self._base_path + [interface, 'remote-ip', remote_ip6])
+            self.session.set(self._base_path + [interface, 'remote', remote_ip6])
 
             # Configure Tunnel Source interface
             self.session.set(self._base_path + [interface, 'source-interface', source_if])
@@ -157,11 +157,11 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
 
         self.session.set(self._base_path + [interface, 'address', local_if_addr])
         self.session.set(self._base_path + [interface, 'encapsulation', 'gre'])
-        self.session.set(self._base_path + [interface, 'local-ip', self.local_v4])
-        self.session.set(self._base_path + [interface, 'remote-ip', remote_ip4])
+        self.session.set(self._base_path + [interface, 'source-address', self.local_v4])
+        self.session.set(self._base_path + [interface, 'remote', remote_ip4])
         self.session.set(self._base_path + [interface, 'dhcp-interface', 'eth0'])
 
-        # local-ip and dhcp-interface can not be used at the same time
+        # source-address and dhcp-interface can not be used at the same time
         with self.assertRaises(ConfigSessionError):
             self.session.commit()
         self.session.delete(self._base_path + [interface, 'dhcp-interface'])
@@ -177,8 +177,8 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
         ttl = 0
 
         self.session.set(self._base_path + [interface, 'encapsulation', encapsulation])
-        self.session.set(self._base_path + [interface, 'local-ip', self.local_v4])
-        self.session.set(self._base_path + [interface, 'remote-ip', remote_ip4])
+        self.session.set(self._base_path + [interface, 'source-address', self.local_v4])
+        self.session.set(self._base_path + [interface, 'remote', remote_ip4])
 
         self.session.set(self._base_path + [interface, 'parameters', 'ip', 'key', gre_key])
         self.session.set(self._base_path + [interface, 'parameters', 'ip', 'tos', tos])
@@ -198,12 +198,12 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
     def test_gretap_parameters_change(self):
         interface = f'tun1040'
         gre_key = '10'
-        encapsulation = 'gre-bridge'
+        encapsulation = 'gretap'
         tos = '20'
 
         self.session.set(self._base_path + [interface, 'encapsulation', encapsulation])
-        self.session.set(self._base_path + [interface, 'local-ip', self.local_v4])
-        self.session.set(self._base_path + [interface, 'remote-ip', remote_ip4])
+        self.session.set(self._base_path + [interface, 'source-address', self.local_v4])
+        self.session.set(self._base_path + [interface, 'remote', remote_ip4])
 
         # Check if commit is ok
         self.session.commit()
@@ -219,7 +219,7 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
 
         # Change remote ip address (inc host by 2
         new_remote = inc_ip(remote_ip4, 2)
-        self.session.set(self._base_path + [interface, 'remote-ip', new_remote])
+        self.session.set(self._base_path + [interface, 'remote', new_remote])
 
         # Check if commit is ok
         self.session.commit()
@@ -228,4 +228,4 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
         self.assertEqual(new_remote,    conf['linkinfo']['info_data']['remote'])
 
 if __name__ == '__main__':
-    unittest.main(verbosity=2)
+    unittest.main(verbosity=2, failfast=True)
diff --git a/src/conf_mode/interfaces-l2tpv3.py b/src/conf_mode/interfaces-l2tpv3.py
index 7b3afa058..9b6ddd5aa 100755
--- a/src/conf_mode/interfaces-l2tpv3.py
+++ b/src/conf_mode/interfaces-l2tpv3.py
@@ -34,7 +34,6 @@ airbag.enable()
 
 k_mod = ['l2tp_eth', 'l2tp_netlink', 'l2tp_ip', 'l2tp_ip6']
 
-
 def get_config(config=None):
     """
     Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
@@ -65,15 +64,15 @@ def verify(l2tpv3):
 
     interface = l2tpv3['ifname']
 
-    for key in ['local_ip', 'remote_ip', 'tunnel_id', 'peer_tunnel_id',
+    for key in ['source_address', 'remote', 'tunnel_id', 'peer_tunnel_id',
                 'session_id', 'peer_session_id']:
         if key not in l2tpv3:
             tmp = key.replace('_', '-')
-            raise ConfigError(f'L2TPv3 {tmp} must be configured!')
+            raise ConfigError(f'Missing mandatory L2TPv3 option: "{tmp}"!')
 
-    if not is_addr_assigned(l2tpv3['local_ip']):
-        raise ConfigError('L2TPv3 local-ip address '
-                          '"{local_ip}" is not configured!'.format(**l2tpv3))
+    if not is_addr_assigned(l2tpv3['source_address']):
+        raise ConfigError('L2TPv3 source-address address "{source_address}" '
+                          'not configured on any interface!'.format(**l2tpv3))
 
     verify_mtu_ipv6(l2tpv3)
     verify_address(l2tpv3)
@@ -83,34 +82,16 @@ def generate(l2tpv3):
     return None
 
 def apply(l2tpv3):
-    # This is a special type of interface which needs additional parameters
-    # when created using iproute2. Instead of passing a ton of arguments,
-    # use a dictionary provided by the interface class which holds all the
-    # options necessary.
-    conf = L2TPv3If.get_config()
-
     # Check if L2TPv3 interface already exists
     if l2tpv3['ifname'] in interfaces():
         # L2TPv3 is picky when changing tunnels/sessions, thus we can simply
         # always delete it first.
-        conf['session_id'] = l2tpv3['session_id']
-        conf['tunnel_id'] = l2tpv3['tunnel_id']
-        l = L2TPv3If(l2tpv3['ifname'], **conf)
+        l = L2TPv3If(**l2tpv3)
         l.remove()
 
     if 'deleted' not in l2tpv3:
-        conf['peer_tunnel_id'] = l2tpv3['peer_tunnel_id']
-        conf['local_port'] = l2tpv3['source_port']
-        conf['remote_port'] = l2tpv3['destination_port']
-        conf['encapsulation'] = l2tpv3['encapsulation']
-        conf['local_address'] = l2tpv3['local_ip']
-        conf['remote_address'] = l2tpv3['remote_ip']
-        conf['session_id'] = l2tpv3['session_id']
-        conf['tunnel_id'] = l2tpv3['tunnel_id']
-        conf['peer_session_id'] = l2tpv3['peer_session_id']
-
         # Finally create the new interface
-        l = L2TPv3If(l2tpv3['ifname'], **conf)
+        l = L2TPv3If(**l2tpv3)
         l.update(l2tpv3)
 
     return None
diff --git a/src/conf_mode/interfaces-tunnel.py b/src/conf_mode/interfaces-tunnel.py
index 3a497bade..e5958e9ae 100755
--- a/src/conf_mode/interfaces-tunnel.py
+++ b/src/conf_mode/interfaces-tunnel.py
@@ -29,15 +29,9 @@ from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_interface_exists
 from vyos.configverify import verify_mtu_ipv6
 from vyos.configverify import verify_vrf
+from vyos.configverify import verify_tunnel
 from vyos.ifconfig import Interface
-from vyos.ifconfig import GREIf
-from vyos.ifconfig import GRETapIf
-from vyos.ifconfig import IPIPIf
-from vyos.ifconfig import IP6GREIf
-from vyos.ifconfig import IPIP6If
-from vyos.ifconfig import IP6IP6If
-from vyos.ifconfig import SitIf
-from vyos.ifconfig import Sit6RDIf
+from vyos.ifconfig import TunnelIf
 from vyos.template import is_ipv4
 from vyos.template import is_ipv6
 from vyos.util import get_interface_config
@@ -78,48 +72,30 @@ def verify(tunnel):
 
         return None
 
-    if 'encapsulation' not in tunnel:
-        raise ConfigError('Must configure the tunnel encapsulation for '\
-                          '{ifname}!'.format(**tunnel))
+    verify_tunnel(tunnel)
 
     verify_mtu_ipv6(tunnel)
     verify_address(tunnel)
     verify_vrf(tunnel)
 
-    if 'local_ip' not in tunnel and 'dhcp_interface' not in tunnel:
-        raise ConfigError('local-ip is mandatory for tunnel')
-
-    if 'remote_ip' not in tunnel and tunnel['encapsulation'] != 'gre':
-        raise ConfigError('remote-ip is mandatory for tunnel')
-
-    if {'local_ip', 'dhcp_interface'} <= set(tunnel):
-        raise ConfigError('Can not use both local-ip and dhcp-interface')
-
-    if tunnel['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
-        error_ipv6 = 'Encapsulation mode requires IPv6'
-        if 'local_ip' in tunnel and not is_ipv6(tunnel['local_ip']):
-            raise ConfigError(f'{error_ipv6} local-ip')
+    if 'source_interface' in tunnel:
+        verify_interface_exists(tunnel['source_interface'])
 
-        if 'remote_ip' in tunnel and not is_ipv6(tunnel['remote_ip']):
-            raise ConfigError(f'{error_ipv6} remote-ip')
-    else:
-        error_ipv4 = 'Encapsulation mode requires IPv4'
-        if 'local_ip' in tunnel and not is_ipv4(tunnel['local_ip']):
-            raise ConfigError(f'{error_ipv4} local-ip')
+    # TTL != 0 and nopmtudisc are incompatible, parameters and ip use default
+    # values, thus the keys are always present.
+    if dict_search('parameters.ip.no_pmtu_discovery', tunnel) != None:
+        if dict_search('parameters.ip.ttl', tunnel) != '0':
+            raise ConfigError('Disabled PMTU requires TTL set to "0"!')
+        if tunnel['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
+            raise ConfigError('Can not disable PMTU discovery for given encapsulation')
 
-        if 'remote_ip' in tunnel and not is_ipv4(tunnel['remote_ip']):
-            raise ConfigError(f'{error_ipv4} remote-ip')
+    if dict_search('parameters.ip.ignore_df', tunnel) != None:
+        if tunnel['encapsulation'] not in ['gretap']:
+            raise ConfigError('Option ignore-df can only be used on GRETAP tunnels!')
 
-    if tunnel['encapsulation'] in ['sit', 'gre-bridge']:
-        if 'source_interface' in tunnel:
-            raise ConfigError('Option source-interface can not be used with ' \
-                              'encapsulation "sit" or "gre-bridge"')
-    elif tunnel['encapsulation'] == 'gre':
-        if 'local_ip' in tunnel and is_ipv6(tunnel['local_ip']):
-            raise ConfigError('Can not use local IPv6 address is for mGRE tunnels')
+        if dict_search('parameters.ip.no_pmtu_discovery', tunnel) == None:
+            raise ConfigError('Option ignore-df requires path MTU discovery to be disabled!')
 
-    if 'source_interface' in tunnel:
-        verify_interface_exists(tunnel['source_interface'])
 
 def generate(tunnel):
     return None
@@ -136,60 +112,15 @@ def apply(tunnel):
         encap = dict_search('linkinfo.info_kind', tmp)
         remote = dict_search('linkinfo.info_data.remote', tmp)
 
-    if ('deleted' in tunnel or 'encapsulation_changed' in tunnel or
-        encap in ['gretap', 'ip6gretap'] or remote in ['any']):
+    if ('deleted' in tunnel or 'encapsulation_changed' in tunnel or encap in
+        ['gretap', 'ip6gretap'] or remote in ['any']):
         if interface in interfaces():
             tmp = Interface(interface)
             tmp.remove()
         if 'deleted' in tunnel:
             return None
 
-    dispatch = {
-        'gre': GREIf,
-        'gre-bridge': GRETapIf,
-        'ipip': IPIPIf,
-        'ipip6': IPIP6If,
-        'ip6ip6': IP6IP6If,
-        'ip6gre': IP6GREIf,
-        'sit': SitIf,
-    }
-
-    # We need to re-map the tunnel encapsulation proto to a valid interface class
-    encap = tunnel['encapsulation']
-    klass = dispatch[encap]
-
-    # This is a special type of interface which needs additional parameters
-    # when created using iproute2. Instead of passing a ton of arguments,
-    # use a dictionary provided by the interface class which holds all the
-    # options necessary.
-    conf = klass.get_config()
-
-    # Copy/re-assign our dictionary values to values understood by the
-    # derived _Tunnel classes
-    mapping = {
-        # this                       :  get_config()
-        'local_ip'                   : 'local',
-        'remote_ip'                  : 'remote',
-        'source_interface'           : 'dev',
-        'parameters.ip.ttl'          : 'ttl',
-        'parameters.ip.tos'          : 'tos',
-        'parameters.ip.key'          : 'key',
-    }
-
-    # Add additional IPv6 options if tunnel is IPv6 aware
-    if tunnel['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
-        mappingv6 = {
-            # this                       :  get_config()
-            'parameters.ipv6.encaplimit' : 'encaplimit'
-        }
-        mapping.update(mappingv6)
-
-    for our_key, their_key in mapping.items():
-        if dict_search(our_key, tunnel) and their_key in conf:
-            conf[their_key] = dict_search(our_key, tunnel)
-
-    tun = klass(interface, **conf)
-    tun.change_options()
+    tun = TunnelIf(**tunnel)
     tun.update(tunnel)
 
     return None
diff --git a/src/migration-scripts/interfaces/19-to-20 b/src/migration-scripts/interfaces/19-to-20
new file mode 100755
index 000000000..e96663e54
--- /dev/null
+++ b/src/migration-scripts/interfaces/19-to-20
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import argv
+from sys import exit
+from vyos.configtree import ConfigTree
+
+if __name__ == '__main__':
+    if (len(argv) < 1):
+        print("Must specify file name!")
+        exit(1)
+
+    file_name = argv[1]
+    with open(file_name, 'r') as f:
+        config_file = f.read()
+
+    config = ConfigTree(config_file)
+
+    for type in ['tunnel', 'l2tpv3']:
+        base = ['interfaces', type]
+        if not config.exists(base):
+            # Nothing to do
+            continue
+
+        for interface in config.list_nodes(base):
+            # Migrate "interface tunnel <tunX> encapsulation gre-bridge" to gretap
+            encap_path = base + [interface, 'encapsulation']
+            if type == 'tunnel' and config.exists(encap_path):
+                tmp = config.return_value(encap_path)
+                if tmp == 'gre-bridge':
+                    config.set(encap_path, value='gretap')
+
+            # Migrate "interface tunnel|l2tpv3 <interface> local-ip" to source-address
+            # Migrate "interface tunnel|l2tpv3 <interface> remote-ip" to remote
+            local_ip_path = base + [interface, 'local-ip']
+            if config.exists(local_ip_path):
+                config.rename(local_ip_path, 'source-address')
+
+            remote_ip_path = base + [interface, 'remote-ip']
+            if config.exists(remote_ip_path):
+                config.rename(remote_ip_path, 'remote')
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        exit(1)