Merge branch 'current' into 2fa

10 files changed, 498 insertions, 251 deletions

diff --git a/python/vyos/ifconfig/bridge.py b/python/vyos/ifconfig/bridge.py
index 14f64a8de..27073b266 100644
--- a/python/vyos/ifconfig/bridge.py
+++ b/python/vyos/ifconfig/bridge.py
@@ -366,5 +366,4 @@ class BridgeIf(Interface):
                         cmd = f'bridge vlan add dev {interface} vid {native_vlan_id} pvid untagged master'
                         self._cmd(cmd)
 
-        # call base class first
         super().update(config)
diff --git a/python/vyos/ifconfig/control.py b/python/vyos/ifconfig/control.py
index d41dfef47..7a6b36e7c 100644
--- a/python/vyos/ifconfig/control.py
+++ b/python/vyos/ifconfig/control.py
@@ -18,11 +18,12 @@ import os
 from inspect import signature
 from inspect import _empty
 
-from vyos import debug
+from vyos.ifconfig.section import Section
 from vyos.util import popen
 from vyos.util import cmd
-from vyos.ifconfig.section import Section
-
+from vyos.util import read_file
+from vyos.util import write_file
+from vyos import debug
 
 class Control(Section):
     _command_get = {}
@@ -116,20 +117,18 @@ class Control(Section):
         Provide a single primitive w/ error checking for reading from sysfs.
         """
         value = None
-        with open(filename, 'r') as f:
-            value = f.read().rstrip('\n')
-
-        self._debug_msg("read '{}' < '{}'".format(value, filename))
+        if os.path.exists(filename):
+            value = read_file(filename)
+            self._debug_msg("read '{}' < '{}'".format(value, filename))
         return value
 
     def _write_sysfs(self, filename, value):
         """
         Provide a single primitive w/ error checking for writing to sysfs.
         """
-        self._debug_msg("write '{}' > '{}'".format(value, filename))
         if os.path.isfile(filename):
-            with open(filename, 'w') as f:
-                f.write(str(value))
+            write_file(filename, str(value))
+            self._debug_msg("write '{}' > '{}'".format(value, filename))
             return True
         return False
 
diff --git a/python/vyos/ifconfig/ethernet.py b/python/vyos/ifconfig/ethernet.py
index 07b31a12a..2e59a7afc 100644
--- a/python/vyos/ifconfig/ethernet.py
+++ b/python/vyos/ifconfig/ethernet.py
@@ -16,9 +16,11 @@
 import os
 import re
 
+from vyos.ethtool import Ethtool
 from vyos.ifconfig.interface import Interface
 from vyos.util import run
 from vyos.util import dict_search
+from vyos.util import read_file
 from vyos.validate import assert_list
 
 @Interface.register
@@ -41,39 +43,29 @@ class EthernetIf(Interface):
 
     @staticmethod
     def feature(ifname, option, value):
-        run(f'ethtool -K {ifname} {option} {value}','ifconfig')
+        run(f'ethtool --features {ifname} {option} {value}')
         return False
 
     _command_set = {**Interface._command_set, **{
         'gro': {
             'validate': lambda v: assert_list(v, ['on', 'off']),
             'possible': lambda i, v: EthernetIf.feature(i, 'gro', v),
-            # 'shellcmd': 'ethtool -K {ifname} gro {value}',
         },
         'gso': {
             'validate': lambda v: assert_list(v, ['on', 'off']),
             'possible': lambda i, v: EthernetIf.feature(i, 'gso', v),
-            # 'shellcmd': 'ethtool -K {ifname} gso {value}',
         },
         'lro': {
             'validate': lambda v: assert_list(v, ['on', 'off']),
             'possible': lambda i, v: EthernetIf.feature(i, 'lro', v),
-            # 'shellcmd': 'ethtool -K {ifname} lro {value}',
         },
         'sg': {
             'validate': lambda v: assert_list(v, ['on', 'off']),
             'possible': lambda i, v: EthernetIf.feature(i, 'sg', v),
-            # 'shellcmd': 'ethtool -K {ifname} sg {value}',
         },
         'tso': {
             'validate': lambda v: assert_list(v, ['on', 'off']),
             'possible': lambda i, v: EthernetIf.feature(i, 'tso', v),
-            # 'shellcmd': 'ethtool -K {ifname} tso {value}',
-        },
-        'ufo': {
-            'validate': lambda v: assert_list(v, ['on', 'off']),
-            'possible': lambda i, v: EthernetIf.feature(i, 'ufo', v),
-            # 'shellcmd': 'ethtool -K {ifname} ufo {value}',
         },
     }}
 
@@ -84,24 +76,9 @@ class EthernetIf(Interface):
         },
     }}
 
-    def get_driver_name(self):
-        """
-        Return the driver name used by NIC. Some NICs don't support all
-        features e.g. changing link-speed, duplex
-
-        Example:
-        >>> from vyos.ifconfig import EthernetIf
-        >>> i = EthernetIf('eth0')
-        >>> i.get_driver_name()
-        'vmxnet3'
-        """
-        ifname = self.config['ifname']
-        sysfs_file = f'/sys/class/net/{ifname}/device/driver/module'
-        if os.path.exists(sysfs_file):
-            link = os.readlink(sysfs_file)
-            return os.path.basename(link)
-        else:
-            return None
+    def __init__(self, ifname, **kargs):
+        super().__init__(ifname, **kargs)
+        self.ethtool = Ethtool(ifname)
 
     def set_flow_control(self, enable):
         """
@@ -119,44 +96,20 @@ class EthernetIf(Interface):
         if enable not in ['on', 'off']:
             raise ValueError("Value out of range")
 
-        driver_name = self.get_driver_name()
-        if driver_name in ['vmxnet3', 'virtio_net', 'xen_netfront']:
-            self._debug_msg(f'{driver_name} driver does not support changing '\
-                            'flow control settings!')
-            return
-
-        # Get current flow control settings:
-        cmd = f'ethtool --show-pause {ifname}'
-        output, code = self._popen(cmd)
-        if code == 76:
-            # the interface does not support it
-            return ''
-        if code:
-            # never fail here as it prevent vyos to boot
-            print(f'unexpected return code {code} from {cmd}')
-            return ''
-
-        # The above command returns - with tabs:
-        #
-        # Pause parameters for eth0:
-        # Autonegotiate:  on
-        # RX:             off
-        # TX:             off
-        if re.search("Autonegotiate:\ton", output):
-            if enable == "on":
-                # flowcontrol is already enabled - no need to re-enable it again
-                # this will prevent the interface from flapping as applying the
-                # flow-control settings will take the interface down and bring
-                # it back up every time.
-                return ''
-
-        # Assemble command executed on system. Unfortunately there is no way
-        # to change this setting via sysfs
-        cmd = f'ethtool --pause {ifname} autoneg {enable} tx {enable} rx {enable}'
-        output, code = self._popen(cmd)
-        if code:
-            print(f'could not set flowcontrol for {ifname}')
-        return output
+        if not self.ethtool.check_flow_control():
+            self._debug_msg(f'NIC driver does not support changing flow control settings!')
+            return False
+
+        current = self.ethtool.get_flow_control()
+        if current != enable:
+            # Assemble command executed on system. Unfortunately there is no way
+            # to change this setting via sysfs
+            cmd = f'ethtool --pause {ifname} autoneg {enable} tx {enable} rx {enable}'
+            output, code = self._popen(cmd)
+            if code:
+                print(f'Could not set flowcontrol for {ifname}')
+            return output
+        return None
 
     def set_speed_duplex(self, speed, duplex):
         """
@@ -178,40 +131,28 @@ class EthernetIf(Interface):
         if duplex not in ['auto', 'full', 'half']:
             raise ValueError("Value out of range (duplex)")
 
-        driver_name = self.get_driver_name()
-        if driver_name in ['vmxnet3', 'virtio_net', 'xen_netfront']:
-            self._debug_msg(f'{driver_name} driver does not support changing '\
-                            'speed/duplex settings!')
+        if not self.ethtool.check_speed_duplex(speed, duplex):
+            self._debug_msg(f'NIC driver does not support changing speed/duplex settings!')
             return
 
         # Get current speed and duplex settings:
         ifname = self.config['ifname']
-        cmd = f'ethtool {ifname}'
-        tmp = self._cmd(cmd)
-
-        if re.search("\tAuto-negotiation: on", tmp):
+        if self.ethtool.get_auto_negotiation():
             if speed == 'auto' and duplex == 'auto':
                 # bail out early as nothing is to change
                 return
         else:
-            # read in current speed and duplex settings
-            cur_speed = 0
-            cur_duplex = ''
-            for line in tmp.splitlines():
-                if line.lstrip().startswith("Speed:"):
-                    non_decimal = re.compile(r'[^\d.]+')
-                    cur_speed = non_decimal.sub('', line)
-                    continue
-
-                if line.lstrip().startswith("Duplex:"):
-                    cur_duplex = line.split()[-1].lower()
-                    break
-
+            # XXX: read in current speed and duplex settings
+            # There are some "nice" NICs like AX88179 which do not support
+            # reading the speed thus we simply fallback to the supplied speed
+            # to not cause any change here and raise an exception.
+            cur_speed = read_file(f'/sys/class/net/{ifname}/speed', speed)
+            cur_duplex = read_file(f'/sys/class/net/{ifname}/duplex', duplex)
             if (cur_speed == speed) and (cur_duplex == duplex):
                 # bail out early as nothing is to change
                 return
 
-        cmd = f'ethtool -s {ifname}'
+        cmd = f'ethtool --change {ifname}'
         if speed == 'auto' or duplex == 'auto':
             cmd += ' autoneg on'
         else:
@@ -228,8 +169,15 @@ class EthernetIf(Interface):
         >>> i.set_gro(True)
         """
         if not isinstance(state, bool):
-            raise ValueError("Value out of range")
-        return self.set_interface('gro', 'on' if state else 'off')
+            raise ValueError('Value out of range')
+
+        enabled, fixed = self.ethtool.get_generic_receive_offload()
+        if enabled != state:
+            if not fixed:
+                return self.set_interface('gro', 'on' if state else 'off')
+            else:
+                print('Adapter does not support changing generic-receive-offload settings!')
+        return False
 
     def set_gso(self, state):
         """
@@ -240,8 +188,15 @@ class EthernetIf(Interface):
         >>> i.set_gso(True)
         """
         if not isinstance(state, bool):
-            raise ValueError("Value out of range")
-        return self.set_interface('gso', 'on' if state else 'off')
+            raise ValueError('Value out of range')
+
+        enabled, fixed = self.ethtool.get_generic_segmentation_offload()
+        if enabled != state:
+            if not fixed:
+                return self.set_interface('gso', 'on' if state else 'off')
+            else:
+                print('Adapter does not support changing generic-segmentation-offload settings!')
+        return False
 
     def set_lro(self, state):
         """
@@ -252,12 +207,19 @@ class EthernetIf(Interface):
         >>> i.set_lro(True)
         """
         if not isinstance(state, bool):
-            raise ValueError("Value out of range")
-        return self.set_interface('lro', 'on' if state else 'off')
+            raise ValueError('Value out of range')
+
+        enabled, fixed = self.ethtool.get_large_receive_offload()
+        if enabled != state:
+            if not fixed:
+                return self.set_interface('gro', 'on' if state else 'off')
+            else:
+                print('Adapter does not support changing large-receive-offload settings!')
+        return False
 
     def set_rps(self, state):
         if not isinstance(state, bool):
-            raise ValueError("Value out of range")
+            raise ValueError('Value out of range')
 
         rps_cpus = '0'
         if state:
@@ -282,8 +244,15 @@ class EthernetIf(Interface):
         >>> i.set_sg(True)
         """
         if not isinstance(state, bool):
-            raise ValueError("Value out of range")
-        return self.set_interface('sg', 'on' if state else 'off')
+            raise ValueError('Value out of range')
+
+        enabled, fixed = self.ethtool.get_scatter_gather()
+        if enabled != state:
+            if not fixed:
+                return self.set_interface('gro', 'on' if state else 'off')
+            else:
+                print('Adapter does not support changing scatter-gather settings!')
+        return False
 
     def set_tso(self, state):
         """
@@ -295,40 +264,38 @@ class EthernetIf(Interface):
         >>> i.set_tso(False)
         """
         if not isinstance(state, bool):
-            raise ValueError("Value out of range")
-        return self.set_interface('tso', 'on' if state else 'off')
-
-    def set_ufo(self, state):
-        """
-        Enable UDP fragmentation offloading. State can be either True or False.
-
-        Example:
-        >>> from vyos.ifconfig import EthernetIf
-        >>> i = EthernetIf('eth0')
-        >>> i.set_udp_offload(True)
-        """
-        if not isinstance(state, bool):
-            raise ValueError("Value out of range")
-        return self.set_interface('ufo', 'on' if state else 'off')
+            raise ValueError('Value out of range')
+
+        enabled, fixed = self.ethtool.get_tcp_segmentation_offload()
+        if enabled != state:
+            if not fixed:
+                return self.set_interface('gro', 'on' if state else 'off')
+            else:
+                print('Adapter does not support changing tcp-segmentation-offload settings!')
+        return False
 
-    def set_ring_buffer(self, b_type, b_size):
+    def set_ring_buffer(self, rx_tx, size):
         """
         Example:
         >>> from vyos.ifconfig import EthernetIf
         >>> i = EthernetIf('eth0')
         >>> i.set_ring_buffer('rx', '4096')
         """
+        current_size = self.ethtool.get_ring_buffer(rx_tx)
+        if current_size == size:
+            # bail out early if nothing is about to change
+            return None
+
         ifname = self.config['ifname']
-        cmd = f'ethtool -G {ifname} {b_type} {b_size}'
+        cmd = f'ethtool --set-ring {ifname} {rx_tx} {size}'
         output, code = self._popen(cmd)
         # ethtool error codes:
         #  80 - value already setted
         #  81 - does not possible to set value
         if code and code != 80:
-            print(f'could not set "{b_type}" ring-buffer for {ifname}')
+            print(f'could not set "{rx_tx}" ring-buffer for {ifname}')
         return output
 
-
     def update(self, config):
         """ General helper function which works on a dictionary retrived by
         get_config_dict(). It's main intention is to consolidate the scattered
@@ -357,9 +324,6 @@ class EthernetIf(Interface):
         # TSO (TCP segmentation offloading)
         self.set_tso(dict_search('offload.tso', config) != None)
 
-        # UDP fragmentation offloading
-        self.set_ufo(dict_search('offload.ufo', config) != None)
-
         # Set physical interface speed and duplex
         if {'speed', 'duplex'} <= set(config):
             speed = config.get('speed')
@@ -368,8 +332,8 @@ class EthernetIf(Interface):
 
         # Set interface ring buffer
         if 'ring_buffer' in config:
-            for b_type in config['ring_buffer']:
-                self.set_ring_buffer(b_type, config['ring_buffer'][b_type])
+            for rx_tx, size in config['ring_buffer'].items():
+                self.set_ring_buffer(rx_tx, size)
 
         # call base class first
         super().update(config)
diff --git a/python/vyos/ifconfig/interface.py b/python/vyos/ifconfig/interface.py
index a1928ba51..e6dbd861b 100755
--- a/python/vyos/ifconfig/interface.py
+++ b/python/vyos/ifconfig/interface.py
@@ -37,7 +37,9 @@ from vyos.util import mac2eui64
 from vyos.util import dict_search
 from vyos.util import read_file
 from vyos.util import get_interface_config
+from vyos.util import is_systemd_service_active
 from vyos.template import is_ipv4
+from vyos.template import is_ipv6
 from vyos.validate import is_intf_addr_assigned
 from vyos.validate import is_ipv6_link_local
 from vyos.validate import assert_boolean
@@ -52,6 +54,9 @@ from vyos.ifconfig.vrrp import VRRP
 from vyos.ifconfig.operational import Operational
 from vyos.ifconfig import Section
 
+from netaddr import EUI
+from netaddr import mac_unix_expanded
+
 class Interface(Control):
     # This is the class which will be used to create
     # self.operational, it allows subclasses, such as
@@ -103,6 +108,10 @@ class Interface(Control):
             'shellcmd': 'ip -json -detail link list dev {ifname}',
             'format': lambda j: jmespath.search('[*].operstate | [0]', json.loads(j)),
         },
+        'vrf': {
+            'shellcmd': 'ip -json -detail link list dev {ifname}',
+            'format': lambda j: jmespath.search('[*].master | [0]', json.loads(j)),
+        },
     }
 
     _command_set = {
@@ -134,7 +143,6 @@ class Interface(Control):
 
     _sysfs_set = {
         'arp_cache_tmo': {
-            'convert': lambda tmo: (int(tmo) * 1000),
             'location': '/proc/sys/net/ipv4/neigh/{ifname}/base_reachable_time_ms',
         },
         'arp_filter': {
@@ -204,6 +212,51 @@ class Interface(Control):
         },
     }
 
+    _sysfs_get = {
+        'arp_cache_tmo': {
+            'location': '/proc/sys/net/ipv4/neigh/{ifname}/base_reachable_time_ms',
+        },
+        'arp_filter': {
+            'location': '/proc/sys/net/ipv4/conf/{ifname}/arp_filter',
+        },
+        'arp_accept': {
+            'location': '/proc/sys/net/ipv4/conf/{ifname}/arp_accept',
+        },
+        'arp_announce': {
+            'location': '/proc/sys/net/ipv4/conf/{ifname}/arp_announce',
+        },
+        'arp_ignore': {
+            'location': '/proc/sys/net/ipv4/conf/{ifname}/arp_ignore',
+        },
+        'ipv4_forwarding': {
+            'location': '/proc/sys/net/ipv4/conf/{ifname}/forwarding',
+        },
+        'rp_filter': {
+            'location': '/proc/sys/net/ipv4/conf/{ifname}/rp_filter',
+        },
+        'ipv6_accept_ra': {
+            'location': '/proc/sys/net/ipv6/conf/{ifname}/accept_ra',
+        },
+        'ipv6_autoconf': {
+            'location': '/proc/sys/net/ipv6/conf/{ifname}/autoconf',
+        },
+        'ipv6_forwarding': {
+            'location': '/proc/sys/net/ipv6/conf/{ifname}/forwarding',
+        },
+        'ipv6_dad_transmits': {
+            'location': '/proc/sys/net/ipv6/conf/{ifname}/dad_transmits',
+        },
+        'proxy_arp': {
+            'location': '/proc/sys/net/ipv4/conf/{ifname}/proxy_arp',
+        },
+        'proxy_arp_pvlan': {
+            'location': '/proc/sys/net/ipv4/conf/{ifname}/proxy_arp_pvlan',
+        },
+        'link_detect': {
+            'location': '/proc/sys/net/ipv4/conf/{ifname}/link_filter',
+        },
+    }
+
     @classmethod
     def exists(cls, ifname):
         return os.path.exists(f'/sys/class/net/{ifname}')
@@ -322,9 +375,7 @@ class Interface(Control):
                 'info_data', {}).get('table')
             # Add map element with interface and zone ID
             if vrf_table_id:
-                self._cmd(
-                    f'nft add element inet vrf_zones ct_iface_map {{ "{self.ifname}" : {vrf_table_id} }}'
-                )
+                self._cmd(f'nft add element inet vrf_zones ct_iface_map {{ "{self.ifname}" : {vrf_table_id} }}')
         else:
             nft_del_element = f'delete element inet vrf_zones ct_iface_map {{ "{self.ifname}" }}'
             # Check if deleting is possible first to avoid raising errors
@@ -376,6 +427,9 @@ class Interface(Control):
         >>> Interface('eth0').get_mtu()
         '1400'
         """
+        tmp = self.get_interface('mtu')
+        if str(tmp) == mtu:
+            return None
         return self.set_interface('mtu', mtu)
 
     def get_mac(self):
@@ -389,6 +443,47 @@ class Interface(Control):
         """
         return self.get_interface('mac')
 
+    def get_mac_synthetic(self):
+        """
+        Get a synthetic MAC address. This is a common method which can be called
+        from derived classes to overwrite the get_mac() call in a generic way.
+
+        NOTE: Tunnel interfaces have no "MAC" address by default. The content
+              of the 'address' file in /sys/class/net/device contains the
+              local-ip thus we generate a random MAC address instead
+
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> Interface('eth0').get_mac()
+        '00:50:ab:cd:ef:00'
+        """
+        from hashlib import sha256
+
+        # Get processor ID number
+        cpu_id = self._cmd('sudo dmidecode -t 4 | grep ID | head -n1 |  sed "s/.*ID://;s/ //g"')
+        # Get system eth0 base MAC address - every system has eth0
+        eth0_mac = Interface('eth0').get_mac()
+
+        sha = sha256()
+        # Calculate SHA256 sum based on the CPU ID number, eth0 mac address and
+        # this interface identifier - this is as predictable as an interface
+        # MAC address and thus can be used in the same way
+        sha.update(cpu_id.encode())
+        sha.update(eth0_mac.encode())
+        sha.update(self.ifname.encode())
+        # take the most significant 48 bits from the SHA256 string
+        tmp = sha.hexdigest()[:12]
+        # Convert pseudo random string into EUI format which now represents a
+        # MAC address
+        tmp = EUI(tmp).value
+        # set locally administered bit in MAC address
+        tmp |= 0xf20000000000
+        # convert integer to "real" MAC address representation
+        mac = EUI(hex(tmp).split('x')[-1])
+        # change dialect to use : as delimiter instead of -
+        mac.dialect = mac_unix_expanded
+        return str(mac)
+
     def set_mac(self, mac):
         """
         Set interface MAC (Media Access Contrl) address to given value.
@@ -413,7 +508,7 @@ class Interface(Control):
         if prev_state == 'up':
             self.set_admin_state('up')
 
-    def set_vrf(self, vrf=''):
+    def set_vrf(self, vrf):
         """
         Add/Remove interface from given VRF instance.
 
@@ -422,6 +517,11 @@ class Interface(Control):
         >>> Interface('eth0').set_vrf('foo')
         >>> Interface('eth0').set_vrf()
         """
+
+        tmp = self.get_interface('vrf')
+        if tmp == vrf:
+            return None
+
         self.set_interface('vrf', vrf)
         self._set_vrf_ct_zone(vrf)
 
@@ -434,8 +534,68 @@ class Interface(Control):
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_arp_cache_tmo(40)
         """
+        tmo = str(int(tmo) * 1000)
+        tmp = self.get_interface('arp_cache_tmo')
+        if tmp == tmo:
+            return None
         return self.set_interface('arp_cache_tmo', tmo)
 
+    def set_tcp_ipv4_mss(self, mss):
+        """
+        Set IPv4 TCP MSS value advertised when TCP SYN packets leave this
+        interface. Value is in bytes.
+
+        A value of 0 will disable the MSS adjustment
+
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> Interface('eth0').set_tcp_ipv4_mss(1340)
+        """
+        iptables_bin = 'iptables'
+        base_options = f'-A FORWARD -o {self.ifname} -p tcp -m tcp --tcp-flags SYN,RST SYN'
+        out = self._cmd(f'{iptables_bin}-save -t mangle')
+        for line in out.splitlines():
+            if line.startswith(base_options):
+                # remove OLD MSS mangling configuration
+                line = line.replace('-A FORWARD', '-D FORWARD')
+                self._cmd(f'{iptables_bin} -t mangle {line}')
+
+        cmd_mss = f'{iptables_bin} -t mangle {base_options} --jump TCPMSS'
+        if mss == 'clamp-mss-to-pmtu':
+            self._cmd(f'{cmd_mss} --clamp-mss-to-pmtu')
+        elif int(mss) > 0:
+            # probably add option to clamp only if bigger:
+            low_mss = str(int(mss) + 1)
+            self._cmd(f'{cmd_mss} -m tcpmss --mss {low_mss}:65535 --set-mss {mss}')
+
+    def set_tcp_ipv6_mss(self, mss):
+        """
+        Set IPv6 TCP MSS value advertised when TCP SYN packets leave this
+        interface. Value is in bytes.
+
+        A value of 0 will disable the MSS adjustment
+
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> Interface('eth0').set_tcp_mss(1320)
+        """
+        iptables_bin = 'ip6tables'
+        base_options = f'-A FORWARD -o {self.ifname} -p tcp -m tcp --tcp-flags SYN,RST SYN'
+        out = self._cmd(f'{iptables_bin}-save -t mangle')
+        for line in out.splitlines():
+            if line.startswith(base_options):
+                # remove OLD MSS mangling configuration
+                line = line.replace('-A FORWARD', '-D FORWARD')
+                self._cmd(f'{iptables_bin} -t mangle {line}')
+
+        cmd_mss = f'{iptables_bin} -t mangle {base_options} --jump TCPMSS'
+        if mss == 'clamp-mss-to-pmtu':
+            self._cmd(f'{cmd_mss} --clamp-mss-to-pmtu')
+        elif int(mss) > 0:
+            # probably add option to clamp only if bigger:
+            low_mss = str(int(mss) + 1)
+            self._cmd(f'{cmd_mss} -m tcpmss --mss {low_mss}:65535 --set-mss {mss}')
+
     def set_arp_filter(self, arp_filter):
         """
         Filter ARP requests
@@ -454,6 +614,9 @@ class Interface(Control):
             particular interfaces. Only for more complex setups like load-
             balancing, does this behaviour cause problems.
         """
+        tmp = self.get_interface('arp_filter')
+        if tmp == arp_filter:
+            return None
         return self.set_interface('arp_filter', arp_filter)
 
     def set_arp_accept(self, arp_accept):
@@ -470,6 +633,9 @@ class Interface(Control):
         gratuitous arp frame, the arp table will be updated regardless
         if this setting is on or off.
         """
+        tmp = self.get_interface('arp_accept')
+        if tmp == arp_accept:
+            return None
         return self.set_interface('arp_accept', arp_accept)
 
     def set_arp_announce(self, arp_announce):
@@ -491,6 +657,9 @@ class Interface(Control):
         receiving answer from the resolved target while decreasing
         the level announces more valid sender's information.
         """
+        tmp = self.get_interface('arp_announce')
+        if tmp == arp_announce:
+            return None
         return self.set_interface('arp_announce', arp_announce)
 
     def set_arp_ignore(self, arp_ignore):
@@ -503,12 +672,16 @@ class Interface(Control):
         1 - reply only if the target IP address is local address
             configured on the incoming interface
         """
+        tmp = self.get_interface('arp_ignore')
+        if tmp == arp_ignore:
+            return None
         return self.set_interface('arp_ignore', arp_ignore)
 
     def set_ipv4_forwarding(self, forwarding):
-        """
-        Configure IPv4 forwarding.
-        """
+        """ Configure IPv4 forwarding. """
+        tmp = self.get_interface('ipv4_forwarding')
+        if tmp == forwarding:
+            return None
         return self.set_interface('ipv4_forwarding', forwarding)
 
     def set_ipv4_source_validation(self, value):
@@ -537,6 +710,9 @@ class Interface(Control):
             print(f'WARNING: Global source-validation is set to "{global_setting}\n"' \
                    'this overrides per interface setting!')
 
+        tmp = self.get_interface('rp_filter')
+        if int(tmp) == value:
+            return None
         return self.set_interface('rp_filter', value)
 
     def set_ipv6_accept_ra(self, accept_ra):
@@ -552,6 +728,9 @@ class Interface(Control):
         2 - Overrule forwarding behaviour. Accept Router Advertisements even if
             forwarding is enabled.
         """
+        tmp = self.get_interface('ipv6_accept_ra')
+        if tmp == accept_ra:
+            return None
         return self.set_interface('ipv6_accept_ra', accept_ra)
 
     def set_ipv6_autoconf(self, autoconf):
@@ -559,6 +738,9 @@ class Interface(Control):
         Autoconfigure addresses using Prefix Information in Router
         Advertisements.
         """
+        tmp = self.get_interface('ipv6_autoconf')
+        if tmp == autoconf:
+            return None
         return self.set_interface('ipv6_autoconf', autoconf)
 
     def add_ipv6_eui64_address(self, prefix):
@@ -582,9 +764,10 @@ class Interface(Control):
         Delete the address based on the interface's MAC-based EUI64
         combined with the prefix address.
         """
-        eui64 = mac2eui64(self.get_mac(), prefix)
-        prefixlen = prefix.split('/')[1]
-        self.del_addr(f'{eui64}/{prefixlen}')
+        if is_ipv6(prefix):
+            eui64 = mac2eui64(self.get_mac(), prefix)
+            prefixlen = prefix.split('/')[1]
+            self.del_addr(f'{eui64}/{prefixlen}')
 
     def set_ipv6_forwarding(self, forwarding):
         """
@@ -611,6 +794,9 @@ class Interface(Control):
         3. Router Advertisements are ignored unless accept_ra is 2.
         4. Redirects are ignored.
         """
+        tmp = self.get_interface('ipv6_forwarding')
+        if tmp == forwarding:
+            return None
         return self.set_interface('ipv6_forwarding', forwarding)
 
     def set_ipv6_dad_messages(self, dad):
@@ -618,6 +804,9 @@ class Interface(Control):
         The amount of Duplicate Address Detection probes to send.
         Default: 1
         """
+        tmp = self.get_interface('ipv6_dad_transmits')
+        if tmp == dad:
+            return None
         return self.set_interface('ipv6_dad_transmits', dad)
 
     def set_link_detect(self, link_filter):
@@ -640,6 +829,9 @@ class Interface(Control):
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_link_detect(1)
         """
+        tmp = self.get_interface('link_detect')
+        if tmp == link_filter:
+            return None
         return self.set_interface('link_detect', link_filter)
 
     def get_alias(self):
@@ -664,6 +856,9 @@ class Interface(Control):
 
         >>> Interface('eth0').set_ifalias('')
         """
+        tmp = self.get_interface('alias')
+        if tmp == ifalias:
+            return None
         self.set_interface('alias', ifalias)
 
     def get_admin_state(self):
@@ -739,6 +934,9 @@ class Interface(Control):
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_proxy_arp(1)
         """
+        tmp = self.get_interface('proxy_arp')
+        if tmp == enable:
+            return None
         self.set_interface('proxy_arp', enable)
 
     def set_proxy_arp_pvlan(self, enable):
@@ -765,6 +963,9 @@ class Interface(Control):
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_proxy_arp_pvlan(1)
         """
+        tmp = self.get_interface('proxy_arp_pvlan')
+        if tmp == enable:
+            return None
         self.set_interface('proxy_arp_pvlan', enable)
 
     def get_addr_v4(self):
@@ -899,6 +1100,8 @@ class Interface(Control):
         >>> j.get_addr()
         ['2001:db8::ffff/64']
         """
+        if not addr:
+            raise ValueError()
 
         # remove from interface
         if addr == 'dhcp':
@@ -1005,7 +1208,9 @@ class Interface(Control):
         lease_file = f'{config_base}_{ifname}.leases'
 
         # Stop client with old config files to get the right IF_METRIC.
-        self._cmd(f'systemctl stop dhclient@{ifname}.service')
+        systemd_service = f'dhclient@{ifname}.service'
+        if is_systemd_service_active(systemd_service):
+            self._cmd(f'systemctl stop {systemd_service}')
 
         if enable and 'disable' not in self._config:
             if dict_search('dhcp_options.host_name', self._config) == None:
@@ -1025,7 +1230,7 @@ class Interface(Control):
             # 'up' check is mandatory b/c even if the interface is A/D, as soon as
             # the DHCP client is started the interface will be placed in u/u state.
             # This is not what we intended to do when disabling an interface.
-            return self._cmd(f'systemctl start dhclient@{ifname}.service')
+            return self._cmd(f'systemctl restart {systemd_service}')
         else:
             # cleanup old config files
             for file in [config_file, options_file, pid_file, lease_file]:
@@ -1042,17 +1247,18 @@ class Interface(Control):
 
         ifname = self.ifname
         config_file = f'/run/dhcp6c/dhcp6c.{ifname}.conf'
+        systemd_service = f'dhcp6c@{ifname}.service'
 
         if enable and 'disable' not in self._config:
             render(config_file, 'dhcp-client/ipv6.tmpl',
                    self._config)
 
-            # We must ignore any return codes. This is required to enable DHCPv6-PD
-            # for interfaces which are yet not up and running.
-            return self._popen(f'systemctl restart dhcp6c@{ifname}.service')
+            # We must ignore any return codes. This is required to enable
+            # DHCPv6-PD for interfaces which are yet not up and running.
+            return self._popen(f'systemctl restart {systemd_service}')
         else:
-            self._popen(f'systemctl stop dhcp6c@{ifname}.service')
-
+            if is_systemd_service_active(systemd_service):
+                self._cmd(f'systemctl stop {systemd_service}')
             if os.path.isfile(config_file):
                 os.remove(config_file)
 
@@ -1069,12 +1275,14 @@ class Interface(Control):
             source_if = next(iter(self._config['is_mirror_intf']))
             config = self._config['is_mirror_intf'][source_if].get('mirror', None)
 
-        # Please do not clear the 'set $? = 0 '. It's meant to force a return of 0
-        # Remove existing mirroring rules
-        delete_tc_cmd  = f'tc qdisc del dev {source_if} handle ffff: ingress 2> /dev/null;'
-        delete_tc_cmd += f'tc qdisc del dev {source_if} handle 1: root prio 2> /dev/null;'
-        delete_tc_cmd += 'set $?=0'
-        self._popen(delete_tc_cmd)
+        # Check configuration stored by old perl code before delete T3782
+        if not 'redirect' in self._config:
+            # Please do not clear the 'set $? = 0 '. It's meant to force a return of 0
+            # Remove existing mirroring rules
+            delete_tc_cmd  = f'tc qdisc del dev {source_if} handle ffff: ingress 2> /dev/null;'
+            delete_tc_cmd += f'tc qdisc del dev {source_if} handle 1: root prio 2> /dev/null;'
+            delete_tc_cmd += 'set $?=0'
+            self._popen(delete_tc_cmd)
 
         # Bail out early if nothing needs to be configured
         if not config:
@@ -1097,7 +1305,6 @@ class Interface(Control):
             mirror_cmd += f'tc filter add dev {source_if} parent {parent} protocol all prio 10 u32 match u32 0 0 flowid 1:1 action mirred egress mirror dev {mirror_if}'
             self._popen(mirror_cmd)
 
-
     def set_xdp(self, state):
         """
         Enable Kernel XDP support. State can be either True or False.
@@ -1174,16 +1381,16 @@ class Interface(Control):
 
         # determine IP addresses which are assigned to the interface and build a
         # list of addresses which are no longer in the dict so they can be removed
-        cur_addr = self.get_addr()
-        for addr in list_diff(cur_addr, new_addr):
-            # we will delete all interface specific IP addresses if they are not
-            # explicitly configured on the CLI
-            if is_ipv6_link_local(addr):
-                eui64 = mac2eui64(self.get_mac(), 'fe80::/64')
-                if addr != f'{eui64}/64':
+        if 'address_old' in config:
+            for addr in list_diff(config['address_old'], new_addr):
+                # we will delete all interface specific IP addresses if they are not
+                # explicitly configured on the CLI
+                if is_ipv6_link_local(addr):
+                    eui64 = mac2eui64(self.get_mac(), 'fe80::/64')
+                    if addr != f'{eui64}/64':
+                        self.del_addr(addr)
+                else:
                     self.del_addr(addr)
-            else:
-                self.del_addr(addr)
 
         for addr in new_addr:
             self.add_addr(addr)
@@ -1202,6 +1409,16 @@ class Interface(Control):
             # checked before
             self.set_vrf(config.get('vrf', ''))
 
+        # Configure MSS value for IPv4 TCP connections
+        tmp = dict_search('ip.adjust_mss', config)
+        value = tmp if (tmp != None) else '0'
+        self.set_tcp_ipv4_mss(value)
+
+        # Configure MSS value for IPv6 TCP connections
+        tmp = dict_search('ipv6.adjust_mss', config)
+        value = tmp if (tmp != None) else '0'
+        self.set_tcp_ipv6_mss(value)
+
         # Configure ARP cache timeout in milliseconds - has default value
         tmp = dict_search('ip.arp_cache_timeout', config)
         value = tmp if (tmp != None) else '30'
@@ -1274,16 +1491,11 @@ class Interface(Control):
             self.set_mtu(config.get('mtu'))
 
         # Delete old IPv6 EUI64 addresses before changing MAC
-        tmp = dict_search('ipv6.address.eui64_old', config)
-        if tmp:
-            for addr in tmp:
-                self.del_ipv6_eui64_address(addr)
+        for addr in (dict_search('ipv6.address.eui64_old', config) or []):
+            self.del_ipv6_eui64_address(addr)
 
         # Manage IPv6 link-local addresses
-        tmp = dict_search('ipv6.address.no_default_link_local', config)
-        # we must check explicitly for None type as if the key is set we will
-        # get an empty dict (<class 'dict'>)
-        if isinstance(tmp, dict):
+        if dict_search('ipv6.address.no_default_link_local', config) != None:
             self.del_ipv6_eui64_address('fe80::/64')
         else:
             self.add_ipv6_eui64_address('fe80::/64')
diff --git a/python/vyos/ifconfig/pppoe.py b/python/vyos/ifconfig/pppoe.py
index 65575cf99..1d13264bf 100644
--- a/python/vyos/ifconfig/pppoe.py
+++ b/python/vyos/ifconfig/pppoe.py
@@ -1,4 +1,4 @@
-# Copyright 2020 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2020-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -14,12 +14,11 @@
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from vyos.ifconfig.interface import Interface
+from vyos.util import get_interface_config
 
 @Interface.register
 class PPPoEIf(Interface):
-    default = {
-        'type': 'pppoe',
-    }
+    iftype = 'pppoe'
     definition = {
         **Interface.definition,
         **{
@@ -28,7 +27,31 @@ class PPPoEIf(Interface):
         },
     }
 
-    # stub this interface is created in the configure script
+    def _remove_routes(self, vrf=''):
+        # Always delete default routes when interface is removed
+        if vrf:
+            vrf = f'-c "vrf {vrf}"'
+        self._cmd(f'vtysh -c "conf t" {vrf} -c "no ip route 0.0.0.0/0 {self.ifname} tag 210"')
+        self._cmd(f'vtysh -c "conf t" {vrf} -c "no ipv6 route ::/0 {self.ifname} tag 210"')
+
+    def remove(self):
+        """
+        Remove interface from operating system. Removing the interface
+        deconfigures all assigned IP addresses and clear possible DHCP(v6)
+        client processes.
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> i = Interface('pppoe0')
+        >>> i.remove()
+        """
+
+        tmp = get_interface_config(self.ifname)
+        vrf = ''
+        if 'master' in tmp:
+            self._remove_routes(tmp['master'])
+
+        # remove bond master which places members in disabled state
+        super().remove()
 
     def _create(self):
         # we can not create this interface as it is managed outside
@@ -37,3 +60,92 @@ class PPPoEIf(Interface):
     def _delete(self):
         # we can not create this interface as it is managed outside
         pass
+
+    def del_addr(self, addr):
+        # we can not create this interface as it is managed outside
+        pass
+
+    def get_mac(self):
+        """ Get a synthetic MAC address. """
+        return self.get_mac_synthetic()
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # Cache the configuration - it will be reused inside e.g. DHCP handler
+        # XXX: maybe pass the option via __init__ in the future and rename this
+        # method to apply()?
+        #
+        # We need to copy this from super().update() as we utilize self.set_dhcpv6()
+        # before this is done by the base class.
+        self._config = config
+
+        # remove old routes from an e.g. old VRF assignment
+        vrf = ''
+        if 'vrf_old' in config:
+            vrf = config['vrf_old']
+        self._remove_routes(vrf)
+
+        # DHCPv6 PD handling is a bit different on PPPoE interfaces, as we do
+        # not require an 'address dhcpv6' CLI option as with other interfaces
+        if 'dhcpv6_options' in config and 'pd' in config['dhcpv6_options']:
+            self.set_dhcpv6(True)
+        else:
+            self.set_dhcpv6(False)
+
+        super().update(config)
+
+        if 'default_route' not in config or config['default_route'] == 'none':
+            return
+
+        #
+        # Set default routes pointing to pppoe interface
+        #
+        vrf = ''
+        sed_opt = '^ip route'
+
+        install_v4 = True
+        install_v6 = True
+
+        # generate proper configuration string when VRFs are in use
+        if 'vrf' in config:
+            tmp = config['vrf']
+            vrf = f'-c "vrf {tmp}"'
+            sed_opt = f'vrf {tmp}'
+
+        if config['default_route'] == 'auto':
+            # only add route if there is no default route present
+            tmp = self._cmd(f'vtysh -c "show running-config staticd no-header" | sed -n "/{sed_opt}/,/!/p"')
+            for line in tmp.splitlines():
+                line = line.lstrip()
+                if line.startswith('ip route 0.0.0.0/0'):
+                    install_v4 = False
+                    continue
+
+                if 'ipv6' in config and line.startswith('ipv6 route ::/0'):
+                    install_v6 = False
+                    continue
+
+        elif config['default_route'] == 'force':
+            # Force means that all static routes are replaced with the ones from this interface
+            tmp = self._cmd(f'vtysh -c "show running-config staticd no-header" | sed -n "/{sed_opt}/,/!/p"')
+            for line in tmp.splitlines():
+                if self.ifname in line:
+                    # It makes no sense to remove a route with our interface and the later re-add it.
+                    # This will only make traffic disappear - which is a no-no!
+                    continue
+
+                line = line.lstrip()
+                if line.startswith('ip route 0.0.0.0/0'):
+                    self._cmd(f'vtysh -c "conf t" {vrf} -c "no {line}"')
+
+                if 'ipv6' in config and line.startswith('ipv6 route ::/0'):
+                    self._cmd(f'vtysh -c "conf t" {vrf} -c "no {line}"')
+
+        if install_v4:
+            self._cmd(f'vtysh -c "conf t" {vrf} -c "ip route 0.0.0.0/0 {self.ifname} tag 210"')
+        if install_v6 and 'ipv6' in config:
+            self._cmd(f'vtysh -c "conf t" {vrf} -c "ipv6 route ::/0 {self.ifname} tag 210"')
diff --git a/python/vyos/ifconfig/section.py b/python/vyos/ifconfig/section.py
index 173a90bb4..0e4447b9e 100644
--- a/python/vyos/ifconfig/section.py
+++ b/python/vyos/ifconfig/section.py
@@ -46,7 +46,7 @@ class Section:
         return klass
 
     @classmethod
-    def _basename (cls, name, vlan):
+    def _basename(cls, name, vlan, vrrp):
         """
         remove the number at the end of interface name
         name: name of the interface
@@ -56,16 +56,18 @@ class Section:
         name = name.rstrip('.')
         if vlan:
             name = name.rstrip('0123456789.')
+        if vrrp:
+            name = name.rstrip('0123456789v')
         return name
 
     @classmethod
-    def section(cls, name, vlan=True):
+    def section(cls, name, vlan=True, vrrp=True):
         """
         return the name of a section an interface should be under
         name: name of the interface (eth0, dum1, ...)
         vlan: should we try try to remove the VLAN from the number
         """
-        name = cls._basename(name, vlan)
+        name = cls._basename(name, vlan, vrrp)
 
         if name in cls._prefixes:
             return cls._prefixes[name].definition['section']
@@ -79,8 +81,8 @@ class Section:
         return list(set([cls._prefixes[_].definition['section'] for _ in cls._prefixes]))
 
     @classmethod
-    def klass(cls, name, vlan=True):
-        name = cls._basename(name, vlan)
+    def klass(cls, name, vlan=True, vrrp=True):
+        name = cls._basename(name, vlan, vrrp)
         if name in cls._prefixes:
             return cls._prefixes[name]
         raise ValueError(f'No type found for interface name: {name}')
diff --git a/python/vyos/ifconfig/tunnel.py b/python/vyos/ifconfig/tunnel.py
index 64c735824..5258a2cb1 100644
--- a/python/vyos/ifconfig/tunnel.py
+++ b/python/vyos/ifconfig/tunnel.py
@@ -16,10 +16,6 @@
 # https://developers.redhat.com/blog/2019/05/17/an-introduction-to-linux-virtual-interfaces-tunnels/
 # https://community.hetzner.com/tutorials/linux-setup-gre-tunnel
 
-from netaddr import EUI
-from netaddr import mac_unix_expanded
-from random import getrandbits
-
 from vyos.ifconfig.interface import Interface
 from vyos.util import dict_search
 from vyos.validate import assert_list
@@ -163,28 +159,8 @@ class TunnelIf(Interface):
         self._cmd(cmd.format(**self.config))
 
     def get_mac(self):
-        """
-        Get current interface MAC (Media Access Contrl) address used.
-
-        NOTE: Tunnel interfaces have no "MAC" address by default. The content
-              of the 'address' file in /sys/class/net/device contains the
-              local-ip thus we generate a random MAC address instead
-
-        Example:
-        >>> from vyos.ifconfig import Interface
-        >>> Interface('eth0').get_mac()
-        '00:50:ab:cd:ef:00'
-        """
-        # we choose 40 random bytes for the MAC address, this gives
-        # us e.g. EUI('00-EA-EE-D6-A3-C8') or EUI('00-41-B9-0D-F2-2A')
-        tmp = EUI(getrandbits(48)).value
-        # set locally administered bit in MAC address
-        tmp |= 0xf20000000000
-        # convert integer to "real" MAC address representation
-        mac = EUI(hex(tmp).split('x')[-1])
-        # change dialect to use : as delimiter instead of -
-        mac.dialect = mac_unix_expanded
-        return str(mac)
+        """ Get a synthetic MAC address. """
+        return self.get_mac_synthetic()
 
     def update(self, config):
         """ General helper function which works on a dictionary retrived by
diff --git a/python/vyos/ifconfig/vrrp.py b/python/vyos/ifconfig/vrrp.py
index b522cc1ab..47aaadecd 100644
--- a/python/vyos/ifconfig/vrrp.py
+++ b/python/vyos/ifconfig/vrrp.py
@@ -22,6 +22,7 @@ from time import sleep
 from tabulate import tabulate
 
 from vyos import util
+from vyos.configquery import ConfigTreeQuery
 
 class VRRPError(Exception):
     pass
@@ -32,14 +33,13 @@ class VRRPNoData(VRRPError):
 class VRRP(object):
     _vrrp_prefix = '00:00:5E:00:01:'
     location = {
-        'pid':      '/run/keepalived.pid',
-        'fifo':     '/run/keepalived_notify_fifo',
+        'pid':      '/run/keepalived/keepalived.pid',
+        'fifo':     '/run/keepalived/keepalived_notify_fifo',
         'state':    '/tmp/keepalived.data',
         'stats':    '/tmp/keepalived.stats',
         'json':     '/tmp/keepalived.json',
         'daemon':   '/etc/default/keepalived',
-        'config':   '/etc/keepalived/keepalived.conf',
-        'vyos':     '/run/keepalived_config.dict',
+        'config':   '/run/keepalived/keepalived.conf',
     }
 
     _signal = {
@@ -111,17 +111,20 @@ class VRRP(object):
 
     @classmethod
     def disabled(cls):
-        if not os.path.exists(cls.location['vyos']):
-            return []
-
         disabled = []
-        config = json.loads(util.read_file(cls.location['vyos']))
-
-        # add disabled groups to the list
-        for group in config['vrrp_groups']:
-            if group['disable']:
-                disabled.append(
-                    [group['name'], group['interface'], group['vrid'], 'DISABLED', ''])
+        base = ['high-availability', 'vrrp']
+        conf = ConfigTreeQuery()
+        if conf.exists(base):
+            # Read VRRP configuration directly from CLI
+            vrrp_config_dict = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                                    get_first_key=True)
+
+            # add disabled groups to the list
+            if 'group' in vrrp_config_dict:
+                for group, group_config in vrrp_config_dict['group'].items():
+                    if 'disable' not in group_config:
+                        continue
+                    disabled.append([group, group_config['interface'], group_config['vrid'], 'DISABLED', ''])
 
         # return list with disabled instances
         return disabled
diff --git a/python/vyos/ifconfig/vti.py b/python/vyos/ifconfig/vti.py
index 470ebbff3..c50cd5ce9 100644
--- a/python/vyos/ifconfig/vti.py
+++ b/python/vyos/ifconfig/vti.py
@@ -35,8 +35,11 @@ class VTIIf(Interface):
         mapping = {
             'source_interface' : 'dev',
         }
-
         if_id = self.ifname.lstrip('vti')
+        # The key defaults to 0 and will match any policies which similarly do
+        # not have a lookup key configuration - thus we shift the key by one
+        # to also support a vti0 interface
+        if_id = str(int(if_id) +1)
         cmd = f'ip link add {self.ifname} type xfrm if_id {if_id}'
         for vyos_key, iproute2_key in mapping.items():
             # dict_search will return an empty dict "{}" for valueless nodes like
diff --git a/python/vyos/ifconfig/wireguard.py b/python/vyos/ifconfig/wireguard.py
index c4cf2fbbf..28b5e2991 100644
--- a/python/vyos/ifconfig/wireguard.py
+++ b/python/vyos/ifconfig/wireguard.py
@@ -17,9 +17,6 @@ import os
 import time
 
 from datetime import timedelta
-from netaddr import EUI
-from netaddr import mac_unix_expanded
-from random import getrandbits
 
 from hurry.filesize import size
 from hurry.filesize import alternative
@@ -159,28 +156,8 @@ class WireGuardIf(Interface):
     }
 
     def get_mac(self):
-        """
-        Get current interface MAC (Media Access Contrl) address used.
-
-        NOTE: Tunnel interfaces have no "MAC" address by default. The content
-              of the 'address' file in /sys/class/net/device contains the
-              local-ip thus we generate a random MAC address instead
-
-        Example:
-        >>> from vyos.ifconfig import Interface
-        >>> Interface('eth0').get_mac()
-        '00:50:ab:cd:ef:00'
-        """
-        # we choose 40 random bytes for the MAC address, this gives
-        # us e.g. EUI('00-EA-EE-D6-A3-C8') or EUI('00-41-B9-0D-F2-2A')
-        tmp = EUI(getrandbits(48)).value
-        # set locally administered bit in MAC address
-        tmp |= 0xf20000000000
-        # convert integer to "real" MAC address representation
-        mac = EUI(hex(tmp).split('x')[-1])
-        # change dialect to use : as delimiter instead of -
-        mac.dialect = mac_unix_expanded
-        return str(mac)
+        """ Get a synthetic MAC address. """
+        return self.get_mac_synthetic()
 
     def update(self, config):
         """ General helper function which works on a dictionary retrived by