Merge branch 'vyos:current' into ocserv_local_otp

29 files changed, 829 insertions, 126 deletions

diff --git a/smoketest/configs/basic-vyos b/smoketest/configs/basic-vyos
new file mode 100644
index 000000000..493feed5b
--- /dev/null
+++ b/smoketest/configs/basic-vyos
@@ -0,0 +1,88 @@
+interfaces {
+    ethernet eth0 {
+        address 192.168.0.1/24
+        duplex auto
+        smp-affinity auto
+        speed auto
+    }
+    ethernet eth1 {
+        address 100.64.0.0/31
+        duplex auto
+        smp-affinity auto
+        speed auto
+    }
+    loopback lo {
+    }
+}
+protocols {
+    static {
+        route 0.0.0.0/0 {
+            next-hop 100.64.0.1 {
+            }
+        }
+    }
+}
+service {
+    dhcp-server {
+        shared-network-name LAN {
+            authoritative
+            subnet 192.168.0.0/24 {
+                default-router 192.168.0.1
+                dns-server 192.168.0.1
+                domain-name vyos.net
+                domain-search vyos.net
+                range LANDynamic {
+                    start 192.168.0.20
+                    stop 192.168.0.240
+                }
+            }
+        }
+    }
+    dns {
+        forwarding {
+            allow-from 192.168.0.0/16
+            cache-size 10000
+            dnssec off
+            listen-address 192.168.0.1
+        }
+    }
+    ssh {
+        ciphers aes128-ctr,aes192-ctr,aes256-ctr
+        ciphers chacha20-poly1305@openssh.com,rijndael-cbc@lysator.liu.se
+        listen-address 192.168.0.1
+        key-exchange curve25519-sha256@libssh.org
+        key-exchange diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256
+        port 22
+    }
+}
+system {
+    config-management {
+        commit-revisions 100
+    }
+    console {
+        device ttyS0 {
+            speed 115200
+        }
+    }
+    host-name vyos
+    login {
+        user vyos {
+            authentication {
+                encrypted-password $6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0
+                plaintext-password ""
+            }
+        }
+    }
+    name-server 192.168.0.1
+    syslog {
+        global {
+            facility all {
+                level info
+            }
+        }
+    }
+    time-zone Europe/Berlin
+}
+/* Warning: Do not remove the following line. */
+/* === vyatta-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack-sync@1:conntrack@1:dhcp-relay@2:dhcp-server@5:dns-forwarding@1:firewall@5:ipsec@5:l2tp@1:mdns@1:nat@4:ntp@1:pptp@1:qos@1:quagga@6:snmp@1:ssh@1:system@9:vrrp@2:wanloadbalance@3:webgui@1:webproxy@1:webproxy@2:zone-policy@1" === */
+/* Release version: 1.2.6 */
diff --git a/smoketest/configs/dialup-router-complex b/smoketest/configs/dialup-router-complex
index fef79ea56..1b62deb5c 100644
--- a/smoketest/configs/dialup-router-complex
+++ b/smoketest/configs/dialup-router-complex
@@ -267,6 +267,22 @@ firewall {
             }
             protocol udp
         }
+        rule 800 {
+            action drop
+            description "SSH anti brute force"
+            destination {
+                port ssh
+            }
+            log enable
+            protocol tcp
+            recent {
+                count 4
+                time 60
+            }
+            state {
+                new enable
+            }
+        }
     }
     name DMZ-WAN {
         default-action accept
diff --git a/smoketest/scripts/cli/base_interfaces_test.py b/smoketest/scripts/cli/base_interfaces_test.py
index 9de961249..ba5acf5d6 100644
--- a/smoketest/scripts/cli/base_interfaces_test.py
+++ b/smoketest/scripts/cli/base_interfaces_test.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2019-2021 VyOS maintainers and contributors
+# Copyright (C) 2019-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -56,6 +56,7 @@ def is_mirrored_to(interface, mirror_if, qdisc):
 
 class BasicInterfaceTest:
     class TestCase(VyOSUnitTestSHIM.TestCase):
+        _test_dhcp = False
         _test_ip = False
         _test_mtu = False
         _test_vlan = False
@@ -96,6 +97,35 @@ class BasicInterfaceTest:
             for intf in self._interfaces:
                 self.assertNotIn(intf, interfaces())
 
+            # No daemon that was started during a test should remain running
+            for daemon in ['dhcp6c', 'dhclient']:
+                self.assertFalse(process_named_running(daemon))
+
+        def test_dhcp_disable_interface(self):
+            if not self._test_dhcp:
+                self.skipTest('not supported')
+
+            # When interface is configured as admin down, it must be admin down
+            # even when dhcpc starts on the given interface
+            for interface in self._interfaces:
+                self.cli_set(self._base_path + [interface, 'disable'])
+                for option in self._options.get(interface, []):
+                    self.cli_set(self._base_path + [interface] + option.split())
+
+                self.cli_set(self._base_path + [interface, 'disable'])
+
+                # Also enable DHCP (ISC DHCP always places interface in admin up
+                # state so we check that we do not start DHCP client.
+                # https://phabricator.vyos.net/T2767
+                self.cli_set(self._base_path + [interface, 'address', 'dhcp'])
+
+            self.cli_commit()
+
+            # Validate interface state
+            for interface in self._interfaces:
+                flags = read_file(f'/sys/class/net/{interface}/flags')
+                self.assertEqual(int(flags, 16) & 1, 0)
+
         def test_span_mirror(self):
             if not self._mirror_interfaces:
                 self.skipTest('not supported')
diff --git a/smoketest/scripts/cli/test_component_version.py b/smoketest/scripts/cli/test_component_version.py
new file mode 100755
index 000000000..777379bdd
--- /dev/null
+++ b/smoketest/scripts/cli/test_component_version.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import unittest
+
+from vyos.systemversions import get_system_versions, get_system_component_version
+
+# After T3474, component versions should be updated in the files in
+# vyos-1x/interface-definitions/include/version/
+# This test verifies that the legacy version in curver_DATA does not exceed
+# that in the xml cache.
+class TestComponentVersion(unittest.TestCase):
+    def setUp(self):
+        self.legacy_d = get_system_versions()
+        self.xml_d = get_system_component_version()
+
+    def test_component_version(self):
+        self.assertTrue(set(self.legacy_d).issubset(set(self.xml_d)))
+        for k, v in self.legacy_d.items():
+            self.assertTrue(v <= self.xml_d[k])
+
+if __name__ == '__main__':
+    unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py
index 6b74e6c92..ecc0c29a0 100755
--- a/smoketest/scripts/cli/test_firewall.py
+++ b/smoketest/scripts/cli/test_firewall.py
@@ -63,7 +63,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
         self.cli_commit()
 
         nftables_search = [
-            ['iifname "eth0"', 'jump smoketest'],
+            ['iifname "eth0"', 'jump NAME_smoketest'],
             ['ip saddr { 172.16.99.0/24 }', 'ip daddr 172.16.10.10', 'th dport { 53, 123 }', 'return'],
             ['ether saddr { 00:01:02:03:04:05 }', 'return']
         ]
@@ -94,7 +94,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
         self.cli_commit()
 
         nftables_search = [
-            ['iifname "eth0"', 'jump smoketest'],
+            ['iifname "eth0"', 'jump NAME_smoketest'],
             ['saddr 172.16.20.10', 'daddr 172.16.10.10', 'return'],
             ['tcp flags & (syn | ack) == syn', 'tcp dport { 8888 }', 'reject'],
             ['smoketest default-action', 'drop']
@@ -124,7 +124,7 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
         self.cli_commit()
 
         nftables_search = [
-            ['iifname "eth0"', 'jump v6-smoketest'],
+            ['iifname "eth0"', 'jump NAME6_v6-smoketest'],
             ['saddr 2002::1', 'daddr 2002::1:1', 'return'],
             ['meta l4proto { tcp, udp }', 'th dport { 8888 }', 'reject'],
             ['smoketest default-action', 'drop']
diff --git a/smoketest/scripts/cli/test_interfaces_bonding.py b/smoketest/scripts/cli/test_interfaces_bonding.py
index 86000553e..4f2fe979a 100755
--- a/smoketest/scripts/cli/test_interfaces_bonding.py
+++ b/smoketest/scripts/cli/test_interfaces_bonding.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -28,6 +28,7 @@ from vyos.util import read_file
 class BondingInterfaceTest(BasicInterfaceTest.TestCase):
     @classmethod
     def setUpClass(cls):
+        cls._test_dhcp = True
         cls._test_ip = True
         cls._test_ipv6 = True
         cls._test_ipv6_pd = True
@@ -36,7 +37,6 @@ class BondingInterfaceTest(BasicInterfaceTest.TestCase):
         cls._test_vlan = True
         cls._test_qinq = True
         cls._base_path = ['interfaces', 'bonding']
-        cls._interfaces = ['bond0']
         cls._mirror_interfaces = ['dum21354']
         cls._members = []
 
@@ -52,6 +52,7 @@ class BondingInterfaceTest(BasicInterfaceTest.TestCase):
         cls._options['bond0'] = []
         for member in cls._members:
             cls._options['bond0'].append(f'member interface {member}')
+        cls._interfaces = list(cls._options)
 
         # call base-classes classmethod
         super(cls, cls).setUpClass()
@@ -150,5 +151,19 @@ class BondingInterfaceTest(BasicInterfaceTest.TestCase):
                 defined_policy = read_file(f'/sys/class/net/{interface}/bonding/xmit_hash_policy').split()
                 self.assertEqual(defined_policy[0], hash_policy)
 
+    def test_bonding_multi_use_member(self):
+        # Define available bonding hash policies
+        for interface in ['bond10', 'bond20']:
+            for member in self._members:
+                self.cli_set(self._base_path + [interface, 'member', 'interface', member])
+
+        # check validate() - can not use the same member interfaces multiple times
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+        self.cli_delete(self._base_path + ['bond20'])
+
+        self.cli_commit()
+
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_interfaces_bridge.py b/smoketest/scripts/cli/test_interfaces_bridge.py
index 4f7e03298..f2e111425 100755
--- a/smoketest/scripts/cli/test_interfaces_bridge.py
+++ b/smoketest/scripts/cli/test_interfaces_bridge.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2021 VyOS maintainers and contributors
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -31,6 +31,7 @@ from vyos.validate import is_intf_addr_assigned
 class BridgeInterfaceTest(BasicInterfaceTest.TestCase):
     @classmethod
     def setUpClass(cls):
+        cls._test_dhcp = True
         cls._test_ip = True
         cls._test_ipv6 = True
         cls._test_ipv6_pd = True
diff --git a/smoketest/scripts/cli/test_interfaces_ethernet.py b/smoketest/scripts/cli/test_interfaces_ethernet.py
index 6d80e4c96..ee7649af8 100755
--- a/smoketest/scripts/cli/test_interfaces_ethernet.py
+++ b/smoketest/scripts/cli/test_interfaces_ethernet.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2021 VyOS maintainers and contributors
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -21,29 +21,73 @@ import unittest
 from base_interfaces_test import BasicInterfaceTest
 from vyos.configsession import ConfigSessionError
 from vyos.ifconfig import Section
+from vyos.pki import CERT_BEGIN
 from vyos.util import cmd
 from vyos.util import process_named_running
 from vyos.util import read_file
 
-cert_data = """
-MIICFDCCAbugAwIBAgIUfMbIsB/ozMXijYgUYG80T1ry+mcwCgYIKoZIzj0EAwIw
-WTELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNv
-bWUtQ2l0eTENMAsGA1UECgwEVnlPUzESMBAGA1UEAwwJVnlPUyBUZXN0MB4XDTIx
-MDcyMDEyNDUxMloXDTI2MDcxOTEyNDUxMlowWTELMAkGA1UEBhMCR0IxEzARBgNV
-BAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlP
-UzESMBAGA1UEAwwJVnlPUyBUZXN0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
-01HrLcNttqq4/PtoMua8rMWEkOdBu7vP94xzDO7A8C92ls1v86eePy4QllKCzIw3
-QxBIoCuH2peGRfWgPRdFsKNhMF8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E
-BAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMB0GA1UdDgQWBBSu
-+JnU5ZC4mkuEpqg2+Mk4K79oeDAKBggqhkjOPQQDAgNHADBEAiBEFdzQ/Bc3Lftz
-ngrY605UhA6UprHhAogKgROv7iR4QgIgEFUxTtW3xXJcnUPWhhUFhyZoqfn8dE93
-+dm/LDnp7C0=
+server_ca_root_cert_data = """
+MIIBcTCCARagAwIBAgIUDcAf1oIQV+6WRaW7NPcSnECQ/lUwCgYIKoZIzj0EAwIw
+HjEcMBoGA1UEAwwTVnlPUyBzZXJ2ZXIgcm9vdCBDQTAeFw0yMjAyMTcxOTQxMjBa
+Fw0zMjAyMTUxOTQxMjBaMB4xHDAaBgNVBAMME1Z5T1Mgc2VydmVyIHJvb3QgQ0Ew
+WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ0y24GzKQf4aM2Ir12tI9yITOIzAUj
+ZXyJeCmYI6uAnyAMqc4Q4NKyfq3nBi4XP87cs1jlC1P2BZ8MsjL5MdGWozIwMDAP
+BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRwC/YaieMEnjhYa7K3Flw/o0SFuzAK
+BggqhkjOPQQDAgNJADBGAiEAh3qEj8vScsjAdBy5shXzXDVVOKWCPTdGrPKnu8UW
+a2cCIQDlDgkzWmn5ujc5ATKz1fj+Se/aeqwh4QyoWCVTFLIxhQ==
 """
 
-key_data = """
-MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgPLpD0Ohhoq0g4nhx
-2KMIuze7ucKUt/lBEB2wc03IxXyhRANCAATTUestw222qrj8+2gy5rysxYSQ50G7
-u8/3jHMM7sDwL3aWzW/zp54/LhCWUoLMjDdDEEigK4fal4ZF9aA9F0Ww
+server_ca_intermediate_cert_data = """
+MIIBmTCCAT+gAwIBAgIUNzrtHzLmi3QpPK57tUgCnJZhXXQwCgYIKoZIzj0EAwIw
+HjEcMBoGA1UEAwwTVnlPUyBzZXJ2ZXIgcm9vdCBDQTAeFw0yMjAyMTcxOTQxMjFa
+Fw0zMjAyMTUxOTQxMjFaMCYxJDAiBgNVBAMMG1Z5T1Mgc2VydmVyIGludGVybWVk
+aWF0ZSBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABEl2nJ1CzoqPV6hWII2m
+eGN/uieU6wDMECTk/LgG8CCCSYb488dibUiFN/1UFsmoLIdIhkx/6MUCYh62m8U2
+WNujUzBRMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMV3YwH88I5gFsFUibbQ
+kMR0ECPsMB8GA1UdIwQYMBaAFHAL9hqJ4wSeOFhrsrcWXD+jRIW7MAoGCCqGSM49
+BAMCA0gAMEUCIQC/ahujD9dp5pMMCd3SZddqGC9cXtOwMN0JR3e5CxP13AIgIMQm
+jMYrinFoInxmX64HfshYqnUY8608nK9D2BNPOHo=
+"""
+
+client_ca_root_cert_data = """
+MIIBcDCCARagAwIBAgIUZmoW2xVdwkZSvglnkCq0AHKa6zIwCgYIKoZIzj0EAwIw
+HjEcMBoGA1UEAwwTVnlPUyBjbGllbnQgcm9vdCBDQTAeFw0yMjAyMTcxOTQxMjFa
+Fw0zMjAyMTUxOTQxMjFaMB4xHDAaBgNVBAMME1Z5T1MgY2xpZW50IHJvb3QgQ0Ew
+WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATUpKXzQk2NOVKDN4VULk2yw4mOKPvn
+mg947+VY7lbpfOfAUD0QRg95qZWCw899eKnXp/U4TkAVrmEKhUb6OJTFozIwMDAP
+BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTXu6xGWUl25X3sBtrhm3BJSICIATAK
+BggqhkjOPQQDAgNIADBFAiEAnTzEwuTI9bz2Oae3LZbjP6f/f50KFJtjLZFDbQz7
+DpYCIDNRHV8zBUibC+zg5PqMpQBKd/oPfNU76nEv6xkp/ijO
+"""
+
+client_ca_intermediate_cert_data = """
+MIIBmDCCAT+gAwIBAgIUJEMdotgqA7wU4XXJvEzDulUAGqgwCgYIKoZIzj0EAwIw
+HjEcMBoGA1UEAwwTVnlPUyBjbGllbnQgcm9vdCBDQTAeFw0yMjAyMTcxOTQxMjJa
+Fw0zMjAyMTUxOTQxMjJaMCYxJDAiBgNVBAMMG1Z5T1MgY2xpZW50IGludGVybWVk
+aWF0ZSBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABGyIVIi217s9j3O+WQ2b
+6R65/Z0ZjQpELxPjBRc0CA0GFCo+pI5EvwI+jNFArvTAJ5+ZdEWUJ1DQhBKDDQdI
+avCjUzBRMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFOUS8oNJjChB1Rb9Blcl
+ETvziHJ9MB8GA1UdIwQYMBaAFNe7rEZZSXblfewG2uGbcElIgIgBMAoGCCqGSM49
+BAMCA0cAMEQCIArhaxWgRsAUbEeNHD/ULtstLHxw/P97qPUSROLQld53AiBjgiiz
+9pDfISmpekZYz6bIDWRIR0cXUToZEMFNzNMrQg==
+"""
+
+client_cert_data = """
+MIIBmTCCAUCgAwIBAgIUV5T77XdE/tV82Tk4Vzhp5BIFFm0wCgYIKoZIzj0EAwIw
+JjEkMCIGA1UEAwwbVnlPUyBjbGllbnQgaW50ZXJtZWRpYXRlIENBMB4XDTIyMDIx
+NzE5NDEyMloXDTMyMDIxNTE5NDEyMlowIjEgMB4GA1UEAwwXVnlPUyBjbGllbnQg
+Y2VydGlmaWNhdGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARuyynqfc/qJj5e
+KJ03oOH8X4Z8spDeAPO9WYckMM0ldPj+9kU607szFzPwjaPWzPdgyIWz3hcN8yAh
+CIhytmJao1AwTjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBTIFKrxZ+PqOhYSUqnl
+TGCUmM7wTjAfBgNVHSMEGDAWgBTlEvKDSYwoQdUW/QZXJRE784hyfTAKBggqhkjO
+PQQDAgNHADBEAiAvO8/jvz05xqmP3OXD53XhfxDLMIxzN4KPoCkFqvjlhQIgIHq2
+/geVx3rAOtSps56q/jiDouN/aw01TdpmGKVAa9U=
+"""
+
+client_key_data = """
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgxaxAQsJwjoOCByQE
++qSYKtKtJzbdbOnTsKNSrfgkFH6hRANCAARuyynqfc/qJj5eKJ03oOH8X4Z8spDe
+APO9WYckMM0ldPj+9kU607szFzPwjaPWzPdgyIWz3hcN8yAhCIhytmJa
 """
 
 def get_wpa_supplicant_value(interface, key):
@@ -51,9 +95,14 @@ def get_wpa_supplicant_value(interface, key):
     tmp = re.findall(r'\n?{}=(.*)'.format(key), tmp)
     return tmp[0]
 
+def get_certificate_count(interface, cert_type):
+    tmp = read_file(f'/run/wpa_supplicant/{interface}_{cert_type}.pem')
+    return tmp.count(CERT_BEGIN)
+
 class EthernetInterfaceTest(BasicInterfaceTest.TestCase):
     @classmethod
     def setUpClass(cls):
+        cls._test_dhcp = True
         cls._test_ip = True
         cls._test_ipv6 = True
         cls._test_ipv6_pd = True
@@ -98,24 +147,6 @@ class EthernetInterfaceTest(BasicInterfaceTest.TestCase):
 
         self.cli_commit()
 
-    def test_dhcp_disable_interface(self):
-        # When interface is configured as admin down, it must be admin down
-        # even when dhcpc starts on the given interface
-        for interface in self._interfaces:
-            self.cli_set(self._base_path + [interface, 'disable'])
-
-            # Also enable DHCP (ISC DHCP always places interface in admin up
-            # state so we check that we do not start DHCP client.
-            # https://phabricator.vyos.net/T2767
-            self.cli_set(self._base_path + [interface, 'address', 'dhcp'])
-
-        self.cli_commit()
-
-        # Validate interface state
-        for interface in self._interfaces:
-            flags = read_file(f'/sys/class/net/{interface}/flags')
-            self.assertEqual(int(flags, 16) & 1, 0)
-
     def test_offloading_rps(self):
         # enable RPS on all available CPUs, RPS works woth a CPU bitmask,
         # where each bit represents a CPU (core/thread). The formula below
@@ -165,16 +196,23 @@ class EthernetInterfaceTest(BasicInterfaceTest.TestCase):
             self.cli_commit()
 
     def test_eapol_support(self):
-        ca_name = 'eapol'
-        cert_name = 'eapol'
+        ca_certs = {
+            'eapol-server-ca-root': server_ca_root_cert_data,
+            'eapol-server-ca-intermediate': server_ca_intermediate_cert_data,
+            'eapol-client-ca-root': client_ca_root_cert_data,
+            'eapol-client-ca-intermediate': client_ca_intermediate_cert_data,
+        }
+        cert_name = 'eapol-client'
 
-        self.cli_set(['pki', 'ca', ca_name, 'certificate', cert_data.replace('\n','')])
-        self.cli_set(['pki', 'certificate', cert_name, 'certificate', cert_data.replace('\n','')])
-        self.cli_set(['pki', 'certificate', cert_name, 'private', 'key', key_data.replace('\n','')])
+        for name, data in ca_certs.items():
+            self.cli_set(['pki', 'ca', name, 'certificate', data.replace('\n','')])
+
+        self.cli_set(['pki', 'certificate', cert_name, 'certificate', client_cert_data.replace('\n','')])
+        self.cli_set(['pki', 'certificate', cert_name, 'private', 'key', client_key_data.replace('\n','')])
 
         for interface in self._interfaces:
             # Enable EAPoL
-            self.cli_set(self._base_path + [interface, 'eapol', 'ca-certificate', ca_name])
+            self.cli_set(self._base_path + [interface, 'eapol', 'ca-certificate', 'eapol-server-ca-intermediate'])
             self.cli_set(self._base_path + [interface, 'eapol', 'certificate', cert_name])
 
         self.cli_commit()
@@ -206,7 +244,12 @@ class EthernetInterfaceTest(BasicInterfaceTest.TestCase):
             tmp = get_wpa_supplicant_value(interface, 'identity')
             self.assertEqual(f'"{mac}"', tmp)
 
-        self.cli_delete(['pki', 'ca', ca_name])
+        # Check certificate files have the full chain
+        self.assertEqual(get_certificate_count(interface, 'ca'), 2)
+        self.assertEqual(get_certificate_count(interface, 'cert'), 3)
+
+        for name in ca_certs:
+            self.cli_delete(['pki', 'ca', name])
         self.cli_delete(['pki', 'certificate', cert_name])
 
 if __name__ == '__main__':
diff --git a/smoketest/scripts/cli/test_interfaces_macsec.py b/smoketest/scripts/cli/test_interfaces_macsec.py
index e4280a5b7..5b10bfa44 100755
--- a/smoketest/scripts/cli/test_interfaces_macsec.py
+++ b/smoketest/scripts/cli/test_interfaces_macsec.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2021 VyOS maintainers and contributors
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -40,6 +40,7 @@ def get_cipher(interface):
 class MACsecInterfaceTest(BasicInterfaceTest.TestCase):
     @classmethod
     def setUpClass(cls):
+        cls._test_dhcp = True
         cls._test_ip = True
         cls._test_ipv6 = True
         cls._base_path = ['interfaces', 'macsec']
diff --git a/smoketest/scripts/cli/test_interfaces_pseudo_ethernet.py b/smoketest/scripts/cli/test_interfaces_pseudo_ethernet.py
index ae899cddd..adcadc5eb 100755
--- a/smoketest/scripts/cli/test_interfaces_pseudo_ethernet.py
+++ b/smoketest/scripts/cli/test_interfaces_pseudo_ethernet.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2021 VyOS maintainers and contributors
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -23,6 +23,7 @@ from base_interfaces_test import BasicInterfaceTest
 class PEthInterfaceTest(BasicInterfaceTest.TestCase):
     @classmethod
     def setUpClass(cls):
+        cls._test_dhcp = True
         cls._test_ip = True
         cls._test_ipv6 = True
         cls._test_ipv6_pd = True
diff --git a/smoketest/scripts/cli/test_interfaces_tunnel.py b/smoketest/scripts/cli/test_interfaces_tunnel.py
index fc2e254d6..99c25c374 100755
--- a/smoketest/scripts/cli/test_interfaces_tunnel.py
+++ b/smoketest/scripts/cli/test_interfaces_tunnel.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2021 VyOS maintainers and contributors
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -44,14 +44,14 @@ class TunnelInterfaceTest(BasicInterfaceTest.TestCase):
         # call base-classes classmethod
         super(cls, cls).setUpClass()
 
-    def setUp(self):
-        super().setUp()
-        self.cli_set(['interfaces', 'dummy', source_if, 'address', self.local_v4 + '/32'])
-        self.cli_set(['interfaces', 'dummy', source_if, 'address', self.local_v6 + '/128'])
+        # create some test interfaces
+        cls.cli_set(cls, ['interfaces', 'dummy', source_if, 'address', cls.local_v4 + '/32'])
+        cls.cli_set(cls, ['interfaces', 'dummy', source_if, 'address', cls.local_v6 + '/128'])
 
-    def tearDown(self):
-        self.cli_delete(['interfaces', 'dummy', source_if])
-        super().tearDown()
+    @classmethod
+    def tearDownClass(cls):
+        cls.cli_delete(cls, ['interfaces', 'dummy', source_if])
+        super().tearDownClass()
 
     def test_ipv4_encapsulations(self):
         # When running tests ensure that for certain encapsulation types the
@@ -202,7 +202,7 @@ class TunnelInterfaceTest(BasicInterfaceTest.TestCase):
         self.assertEqual(encapsulation, conf['linkinfo']['info_kind'])
         self.assertEqual(self.local_v4, conf['linkinfo']['info_data']['local'])
         self.assertEqual(remote_ip4,    conf['linkinfo']['info_data']['remote'])
-        self.assertEqual(64,           conf['linkinfo']['info_data']['ttl'])
+        self.assertEqual(64,            conf['linkinfo']['info_data']['ttl'])
 
         # Change remote ip address (inc host by 2
         new_remote = inc_ip(remote_ip4, 2)
@@ -239,7 +239,7 @@ class TunnelInterfaceTest(BasicInterfaceTest.TestCase):
         self.assertEqual(encapsulation,     conf['linkinfo']['info_kind'])
         self.assertEqual(self.local_v4,     conf['linkinfo']['info_data']['local'])
         self.assertEqual(remote_ip4,        conf['linkinfo']['info_data']['remote'])
-        self.assertEqual(64,               conf['linkinfo']['info_data']['ttl'])
+        self.assertEqual(64,                conf['linkinfo']['info_data']['ttl'])
         self.assertEqual(f'0.0.0.{ip_key}', conf['linkinfo']['info_data']['ikey'])
         self.assertEqual(f'0.0.0.{ip_key}', conf['linkinfo']['info_data']['okey'])
         self.assertEqual(int(idx),          conf['linkinfo']['info_data']['erspan_index'])
@@ -295,7 +295,7 @@ class TunnelInterfaceTest(BasicInterfaceTest.TestCase):
         self.assertEqual(encapsulation,     conf['linkinfo']['info_kind'])
         self.assertEqual(self.local_v6,     conf['linkinfo']['info_data']['local'])
         self.assertEqual(remote_ip6,        conf['linkinfo']['info_data']['remote'])
-        self.assertEqual(64,               conf['linkinfo']['info_data']['ttl'])
+        self.assertEqual(64,                conf['linkinfo']['info_data']['ttl'])
         self.assertEqual(f'0.0.0.{ip_key}', conf['linkinfo']['info_data']['ikey'])
         self.assertEqual(f'0.0.0.{ip_key}', conf['linkinfo']['info_data']['okey'])
         self.assertEqual(erspan_ver,        conf['linkinfo']['info_data']['erspan_ver'])
@@ -312,5 +312,89 @@ class TunnelInterfaceTest(BasicInterfaceTest.TestCase):
         conf = get_interface_config(interface)
         self.assertEqual(new_remote,    conf['linkinfo']['info_data']['remote'])
 
+    def test_tunnel_src_any_gre_key(self):
+        interface = f'tun1280'
+        encapsulation = 'gre'
+        src_addr = '0.0.0.0'
+        key = '127'
+
+        self.cli_set(self._base_path + [interface, 'encapsulation', encapsulation])
+        self.cli_set(self._base_path + [interface, 'source-address', src_addr])
+        # GRE key must be supplied with a 0.0.0.0 source address
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+        self.cli_set(self._base_path + [interface, 'parameters', 'ip', 'key', key])
+
+        self.cli_commit()
+
+    def test_multiple_gre_tunnel_same_remote(self):
+        tunnels = {
+            'tun10' : {
+                'encapsulation' : 'gre',
+                'source_interface' : source_if,
+                'remote' : '1.2.3.4',
+            },
+            'tun20' : {
+                'encapsulation' : 'gre',
+                'source_interface' : source_if,
+                'remote' : '1.2.3.4',
+            },
+        }
+
+        for tunnel, tunnel_config in tunnels.items():
+            self.cli_set(self._base_path + [tunnel, 'encapsulation', tunnel_config['encapsulation']])
+            if 'source_interface' in tunnel_config:
+                self.cli_set(self._base_path + [tunnel, 'source-interface', tunnel_config['source_interface']])
+            if 'remote' in tunnel_config:
+                self.cli_set(self._base_path + [tunnel, 'remote', tunnel_config['remote']])
+
+        # GRE key must be supplied when two or more tunnels are formed to the same desitnation
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+        for tunnel, tunnel_config in tunnels.items():
+            self.cli_set(self._base_path + [tunnel, 'parameters', 'ip', 'key', tunnel.lstrip('tun')])
+
+        self.cli_commit()
+
+        for tunnel, tunnel_config in tunnels.items():
+            conf = get_interface_config(tunnel)
+            ip_key = tunnel.lstrip('tun')
+
+            self.assertEqual(tunnel_config['source_interface'], conf['link'])
+            self.assertEqual(tunnel_config['encapsulation'],    conf['linkinfo']['info_kind'])
+            self.assertEqual(tunnel_config['remote'],           conf['linkinfo']['info_data']['remote'])
+            self.assertEqual(f'0.0.0.{ip_key}',                 conf['linkinfo']['info_data']['ikey'])
+            self.assertEqual(f'0.0.0.{ip_key}',                 conf['linkinfo']['info_data']['okey'])
+
+    def test_multiple_gre_tunnel_different_remote(self):
+        tunnels = {
+            'tun10' : {
+                'encapsulation' : 'gre',
+                'source_interface' : source_if,
+                'remote' : '1.2.3.4',
+            },
+            'tun20' : {
+                'encapsulation' : 'gre',
+                'source_interface' : source_if,
+                'remote' : '1.2.3.5',
+            },
+        }
+
+        for tunnel, tunnel_config in tunnels.items():
+            self.cli_set(self._base_path + [tunnel, 'encapsulation', tunnel_config['encapsulation']])
+            if 'source_interface' in tunnel_config:
+                self.cli_set(self._base_path + [tunnel, 'source-interface', tunnel_config['source_interface']])
+            if 'remote' in tunnel_config:
+                self.cli_set(self._base_path + [tunnel, 'remote', tunnel_config['remote']])
+
+        self.cli_commit()
+
+        for tunnel, tunnel_config in tunnels.items():
+            conf = get_interface_config(tunnel)
+
+            self.assertEqual(tunnel_config['source_interface'], conf['link'])
+            self.assertEqual(tunnel_config['encapsulation'],    conf['linkinfo']['info_kind'])
+            self.assertEqual(tunnel_config['remote'],           conf['linkinfo']['info_data']['remote'])
+
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_interfaces_vxlan.py b/smoketest/scripts/cli/test_interfaces_vxlan.py
index 9278adadd..f34b99ea4 100755
--- a/smoketest/scripts/cli/test_interfaces_vxlan.py
+++ b/smoketest/scripts/cli/test_interfaces_vxlan.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2021 VyOS maintainers and contributors
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -18,8 +18,9 @@ import unittest
 
 from vyos.configsession import ConfigSessionError
 from vyos.ifconfig import Interface
+from vyos.util import get_bridge_fdb
 from vyos.util import get_interface_config
-
+from vyos.template import is_ipv6
 from base_interfaces_test import BasicInterfaceTest
 
 class VXLANInterfaceTest(BasicInterfaceTest.TestCase):
@@ -33,6 +34,8 @@ class VXLANInterfaceTest(BasicInterfaceTest.TestCase):
             'vxlan10': ['vni 10', 'remote 127.0.0.2'],
             'vxlan20': ['vni 20', 'group 239.1.1.1', 'source-interface eth0'],
             'vxlan30': ['vni 30', 'remote 2001:db8:2000::1', 'source-address 2001:db8:1000::1', 'parameters ipv6 flowlabel 0x1000'],
+            'vxlan40': ['vni 40', 'remote 127.0.0.2', 'remote 127.0.0.3'],
+            'vxlan50': ['vni 50', 'remote 2001:db8:2000::1', 'remote 2001:db8:2000::2', 'parameters ipv6 flowlabel 0x1000'],
         }
         cls._interfaces = list(cls._options)
         # call base-classes classmethod
@@ -55,21 +58,34 @@ class VXLANInterfaceTest(BasicInterfaceTest.TestCase):
         ttl = 20
         for interface in self._interfaces:
             options = get_interface_config(interface)
+            bridge = get_bridge_fdb(interface)
 
             vni = options['linkinfo']['info_data']['id']
             self.assertIn(f'vni {vni}', self._options[interface])
 
-            if any('link' in s for s in self._options[interface]):
+            if any('source-interface' in s for s in self._options[interface]):
                 link = options['linkinfo']['info_data']['link']
                 self.assertIn(f'source-interface {link}', self._options[interface])
 
-            if any('local6' in s for s in self._options[interface]):
-                remote = options['linkinfo']['info_data']['local6']
-                self.assertIn(f'source-address {local6}', self._options[interface])
-
-            if any('remote6' in s for s in self._options[interface]):
-                remote = options['linkinfo']['info_data']['remote6']
-                self.assertIn(f'remote {remote}', self._options[interface])
+            # Verify source-address setting was properly configured on the Kernel
+            if any('source-address' in s for s in self._options[interface]):
+                for s in self._options[interface]:
+                    if 'source-address' in s:
+                        address = s.split()[-1]
+                        if is_ipv6(address):
+                            tmp = options['linkinfo']['info_data']['local6']
+                        else:
+                            tmp = options['linkinfo']['info_data']['local']
+                        self.assertIn(f'source-address {tmp}', self._options[interface])
+
+            # Verify remote setting was properly configured on the Kernel
+            if any('remote' in s for s in self._options[interface]):
+                for s in self._options[interface]:
+                    if 'remote' in s:
+                        for fdb in bridge:
+                            if 'mac' in fdb and fdb['mac'] == '00:00:00:00:00:00':
+                                remote = fdb['dst']
+                                self.assertIn(f'remote {remote}', self._options[interface])
 
             if any('group' in s for s in self._options[interface]):
                 group = options['linkinfo']['info_data']['group']
diff --git a/smoketest/scripts/cli/test_nat66.py b/smoketest/scripts/cli/test_nat66.py
index 8afe0da26..6b7b49792 100755
--- a/smoketest/scripts/cli/test_nat66.py
+++ b/smoketest/scripts/cli/test_nat66.py
@@ -185,4 +185,4 @@ class TestNAT66(VyOSUnitTestSHIM.TestCase):
         self.cli_commit()
 
 if __name__ == '__main__':
-    unittest.main(verbosity=2, failfast=True)
+    unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_policy.py b/smoketest/scripts/cli/test_policy.py
index 73d93c986..0acd41903 100755
--- a/smoketest/scripts/cli/test_policy.py
+++ b/smoketest/scripts/cli/test_policy.py
@@ -1030,7 +1030,7 @@ class TestPolicy(VyOSUnitTestSHIM.TestCase):
                         tmp = f'match ipv6 address prefix-list {rule_config["match"]["ipv6-address-pfx"]}'
                         self.assertIn(tmp, config)
                     if 'ipv6-nexthop' in rule_config['match']:
-                        tmp = f'match ipv6 next-hop {rule_config["match"]["ipv6-nexthop"]}'
+                        tmp = f'match ipv6 next-hop address {rule_config["match"]["ipv6-nexthop"]}'
                         self.assertIn(tmp, config)
                     if 'large-community' in rule_config['match']:
                         tmp = f'match large-community {rule_config["match"]["large-community"]}'
@@ -1206,6 +1206,32 @@ class TestPolicy(VyOSUnitTestSHIM.TestCase):
 
         self.assertEqual(sort_ip(tmp), sort_ip(original))
 
+    # Test set table for sources with iif
+    def test_iif_sources_table_id(self):
+        path = base_path + ['local-route']
+
+        sources = ['203.0.113.11', '203.0.113.12']
+        iif = 'lo'
+        rule = '100'
+        table = '150'
+
+        self.cli_set(path + ['rule', rule, 'set', 'table', table])
+        self.cli_set(path + ['rule', rule, 'inbound-interface', iif])
+        for src in sources:
+            self.cli_set(path + ['rule', rule, 'source', src])
+
+        self.cli_commit()
+
+        # Check generated configuration
+        # Expected values
+        original = """
+        100:	from 203.0.113.11 iif lo lookup 150
+        100:	from 203.0.113.12 iif lo lookup 150
+        """
+        tmp = cmd('ip rule show prio 100')
+
+        self.assertEqual(sort_ip(tmp), sort_ip(original))
+
     # Test set table for sources and destinations with fwmark
     def test_fwmark_sources_destination_table_id(self):
         path = base_path + ['local-route']
@@ -1318,6 +1344,31 @@ class TestPolicy(VyOSUnitTestSHIM.TestCase):
 
         self.assertEqual(sort_ip(tmp), sort_ip(original))
 
+    # Test set table for sources with iif ipv6
+    def test_iif_sources_ipv6_table_id(self):
+        path = base_path + ['local-route6']
+
+        sources = ['2001:db8:1338::/126', '2001:db8:1339::/126']
+        iif = 'lo'
+        rule = '102'
+        table = '150'
+        for src in sources:
+            self.cli_set(path + ['rule', rule, 'set', 'table', table])
+            self.cli_set(path + ['rule', rule, 'source', src])
+            self.cli_set(path + ['rule', rule, 'inbound-interface', iif])
+
+        self.cli_commit()
+
+        # Check generated configuration
+        # Expected values
+        original = """
+        102:	from 2001:db8:1338::/126 iif lo lookup 150
+        102:	from 2001:db8:1339::/126 iif lo lookup 150
+        """
+        tmp = cmd('ip -6 rule show prio 102')
+
+        self.assertEqual(sort_ip(tmp), sort_ip(original))
+
     # Test set table for sources and destinations with fwmark ipv6
     def test_fwmark_sources_destination_ipv6_table_id(self):
         path = base_path + ['local-route6']
@@ -1384,7 +1435,7 @@ class TestPolicy(VyOSUnitTestSHIM.TestCase):
         103:	from 2001:db8:1338::/126 to 2001:db8:16::/48 fwmark 0x17 lookup 150
         103:	from 2001:db8:1339::/56 to 2001:db8:13::/48 fwmark 0x17 lookup 150
         103:	from 2001:db8:1339::/56 to 2001:db8:16::/48 fwmark 0x17 lookup 150
-        103:    from 2001:db8:1338::/126 to 2001:db8:13::/48 fwmark 0x17 lookup 150
+        103:	from 2001:db8:1338::/126 to 2001:db8:13::/48 fwmark 0x17 lookup 150
         """
         tmp = cmd('ip rule show prio 103')
         tmp_v6 = cmd('ip -6 rule show prio 103')
diff --git a/smoketest/scripts/cli/test_protocols_mpls.py b/smoketest/scripts/cli/test_protocols_mpls.py
index 13d38d01b..c6751cc42 100755
--- a/smoketest/scripts/cli/test_protocols_mpls.py
+++ b/smoketest/scripts/cli/test_protocols_mpls.py
@@ -81,7 +81,6 @@ class TestProtocolsMPLS(VyOSUnitTestSHIM.TestCase):
         self.assertTrue(process_named_running(PROCESS_NAME))
 
     def test_mpls_basic(self):
-        self.debug = True
         router_id = '1.2.3.4'
         transport_ipv4_addr = '5.6.7.8'
         interfaces = Section.interfaces('ethernet')
@@ -114,4 +113,4 @@ class TestProtocolsMPLS(VyOSUnitTestSHIM.TestCase):
             self.assertIn(f'  interface {interface}', afiv4_config)
 
 if __name__ == '__main__':
-    unittest.main(verbosity=2, failfast=True)
+    unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_protocols_ospf.py b/smoketest/scripts/cli/test_protocols_ospf.py
index ee58b0fe2..5d8e9cff2 100755
--- a/smoketest/scripts/cli/test_protocols_ospf.py
+++ b/smoketest/scripts/cli/test_protocols_ospf.py
@@ -368,6 +368,30 @@ class TestProtocolsOSPF(VyOSUnitTestSHIM.TestCase):
         self.cli_delete(['vrf', 'name', vrf])
         self.cli_delete(['interfaces', 'ethernet', vrf_iface, 'vrf'])
 
+    def test_ospf_13_export_list(self):
+        # Verify explort-list works on ospf-area
+        acl = '100'
+        seq = '10'
+        area = '0.0.0.10'
+        network = '10.0.0.0/8'
+
+
+        self.cli_set(['policy', 'access-list', acl, 'rule', seq, 'action', 'permit'])
+        self.cli_set(['policy', 'access-list', acl, 'rule', seq, 'source', 'any'])
+        self.cli_set(['policy', 'access-list', acl, 'rule', seq, 'destination', 'any'])
+        self.cli_set(base_path + ['area', area, 'network', network])
+        self.cli_set(base_path + ['area', area, 'export-list', acl])
+
+        # commit changes
+        self.cli_commit()
+
+        # Verify FRR ospfd configuration
+        frrconfig = self.getFRRconfig('router ospf')
+        self.assertIn(f'router ospf', frrconfig)
+        self.assertIn(f' timers throttle spf 200 1000 10000', frrconfig) # default
+        self.assertIn(f' network {network} area {area}', frrconfig)
+        self.assertIn(f' area {area} export-list {acl}', frrconfig)
+
 if __name__ == '__main__':
     logging.basicConfig(stream=sys.stderr, level=logging.DEBUG)
     unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_protocols_ospfv3.py b/smoketest/scripts/cli/test_protocols_ospfv3.py
index 1327fd910..2fc694fd7 100755
--- a/smoketest/scripts/cli/test_protocols_ospfv3.py
+++ b/smoketest/scripts/cli/test_protocols_ospfv3.py
@@ -265,8 +265,8 @@ class TestProtocolsOSPFv3(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f'router ospf6', frrconfig)
         self.assertIn(f' ospf6 router-id {router_id}', frrconfig)
 
-        frrconfig = self.getFRRconfig(f'interface {vrf_iface} vrf {vrf}')
-        self.assertIn(f'interface {vrf_iface} vrf {vrf}', frrconfig)
+        frrconfig = self.getFRRconfig(f'interface {vrf_iface}')
+        self.assertIn(f'interface {vrf_iface}', frrconfig)
         self.assertIn(f' ipv6 ospf6 bfd', frrconfig)
 
         frrconfig = self.getFRRconfig(f'router ospf6 vrf {vrf}')
@@ -278,4 +278,4 @@ class TestProtocolsOSPFv3(VyOSUnitTestSHIM.TestCase):
         self.cli_delete(['interfaces', 'ethernet', vrf_iface, 'vrf'])
 
 if __name__ == '__main__':
-    unittest.main(verbosity=2, failfast=True)
+    unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_protocols_static.py b/smoketest/scripts/cli/test_protocols_static.py
index 4c4eb5a7c..3ef9c76d8 100755
--- a/smoketest/scripts/cli/test_protocols_static.py
+++ b/smoketest/scripts/cli/test_protocols_static.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -52,9 +52,16 @@ routes = {
         },
         'blackhole' : { 'distance' : '90' },
     },
-    '100.64.0.0/10' : {
+    '100.64.0.0/16' : {
         'blackhole' : { },
     },
+    '100.65.0.0/16' : {
+        'reject'    : { 'distance' : '10', 'tag' : '200' },
+    },
+    '100.66.0.0/16' : {
+        'blackhole' : { },
+        'reject'    : { 'distance' : '10', 'tag' : '200' },
+    },
     '2001:db8:100::/40' : {
         'next_hop' : {
             '2001:db8::1' : { 'distance' : '10' },
@@ -74,6 +81,9 @@ routes = {
         },
         'blackhole' : { 'distance' : '250', 'tag' : '500' },
     },
+    '2001:db8:300::/40' : {
+        'reject'    : { 'distance' : '250', 'tag' : '500' },
+    },
     '2001:db8::/32' : {
         'blackhole' : { 'distance' : '200', 'tag' : '600' },
     },
@@ -82,9 +92,15 @@ routes = {
 tables = ['80', '81', '82']
 
 class TestProtocolsStatic(VyOSUnitTestSHIM.TestCase):
-    def setUp(self):
-        # This is our "target" VRF when leaking routes:
-        self.cli_set(['vrf', 'name', 'black', 'table', '43210'])
+    @classmethod
+    def setUpClass(cls):
+        super(cls, cls).setUpClass()
+        cls.cli_set(cls, ['vrf', 'name', 'black', 'table', '43210'])
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.cli_delete(cls, ['vrf'])
+        super(cls, cls).tearDownClass()
 
     def tearDown(self):
         for route, route_config in routes.items():
@@ -135,6 +151,20 @@ class TestProtocolsStatic(VyOSUnitTestSHIM.TestCase):
                 if 'tag' in route_config['blackhole']:
                     self.cli_set(base + ['blackhole', 'tag', route_config['blackhole']['tag']])
 
+            if 'reject' in route_config:
+                self.cli_set(base + ['reject'])
+                if 'distance' in route_config['reject']:
+                    self.cli_set(base + ['reject', 'distance', route_config['reject']['distance']])
+                if 'tag' in route_config['reject']:
+                    self.cli_set(base + ['reject', 'tag', route_config['reject']['tag']])
+
+            if {'blackhole', 'reject'} <= set(route_config):
+                # Can not use blackhole and reject at the same time
+                with self.assertRaises(ConfigSessionError):
+                    self.cli_commit()
+                self.cli_delete(base + ['blackhole'])
+                self.cli_delete(base + ['reject'])
+
         # commit changes
         self.cli_commit()
 
@@ -177,6 +207,11 @@ class TestProtocolsStatic(VyOSUnitTestSHIM.TestCase):
                     else:
                         self.assertIn(tmp, frrconfig)
 
+            if {'blackhole', 'reject'} <= set(route_config):
+                # Can not use blackhole and reject at the same time
+                # Config error validated above - skip this route
+                continue
+
             if 'blackhole' in route_config:
                 tmp = f'{ip_ipv6} route {route} blackhole'
                 if 'tag' in route_config['blackhole']:
@@ -186,6 +221,15 @@ class TestProtocolsStatic(VyOSUnitTestSHIM.TestCase):
 
                 self.assertIn(tmp, frrconfig)
 
+            if 'reject' in route_config:
+                tmp = f'{ip_ipv6} route {route} reject'
+                if 'tag' in route_config['reject']:
+                    tmp += ' tag ' + route_config['reject']['tag']
+                if 'distance' in route_config['reject']:
+                    tmp += ' ' + route_config['reject']['distance']
+
+                self.assertIn(tmp, frrconfig)
+
     def test_02_static_table(self):
         for table in tables:
             for route, route_config in routes.items():
@@ -389,11 +433,8 @@ class TestProtocolsStatic(VyOSUnitTestSHIM.TestCase):
 
                     self.assertIn(tmp, frrconfig)
 
-        self.cli_delete(['vrf'])
-
     def test_04_static_zebra_route_map(self):
         # Implemented because of T3328
-        self.debug = True
         route_map = 'foo-static-in'
         self.cli_set(['policy', 'route-map', route_map, 'rule', '10', 'action', 'permit'])
 
diff --git a/smoketest/scripts/cli/test_service_dhcp-server.py b/smoketest/scripts/cli/test_service_dhcp-server.py
index 14666db15..9adb9c042 100755
--- a/smoketest/scripts/cli/test_service_dhcp-server.py
+++ b/smoketest/scripts/cli/test_service_dhcp-server.py
@@ -461,12 +461,11 @@ class TestServiceDHCPServer(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f'mclt 1800;', config)
         self.assertIn(f'mclt 1800;', config)
         self.assertIn(f'split 128;', config)
-        self.assertIn(f'port 520;', config)
-        self.assertIn(f'peer port 520;', config)
+        self.assertIn(f'port 647;', config)
+        self.assertIn(f'peer port 647;', config)
         self.assertIn(f'max-response-delay 30;', config)
         self.assertIn(f'max-unacked-updates 10;', config)
         self.assertIn(f'load balance max seconds 3;', config)
-        self.assertIn(f'peer port 520;', config)
         self.assertIn(f'address {failover_local};', config)
         self.assertIn(f'peer address {failover_remote};', config)
 
diff --git a/smoketest/scripts/cli/test_service_lldp.py b/smoketest/scripts/cli/test_service_lldp.py
new file mode 100755
index 000000000..64fdd9d1b
--- /dev/null
+++ b/smoketest/scripts/cli/test_service_lldp.py
@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import re
+import os
+import unittest
+
+from base_vyostest_shim import VyOSUnitTestSHIM
+
+from vyos.configsession import ConfigSessionError
+from vyos.ifconfig import Section
+from vyos.util import cmd
+from vyos.util import process_named_running
+from vyos.util import read_file
+from vyos.version import get_version_data
+
+PROCESS_NAME = 'lldpd'
+LLDPD_CONF = '/etc/lldpd.d/01-vyos.conf'
+base_path = ['service', 'lldp']
+mgmt_if = 'dum83513'
+mgmt_addr = ['1.2.3.4', '1.2.3.5']
+
+class TestServiceLLDP(VyOSUnitTestSHIM.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        # call base-classes classmethod
+        super(cls, cls).setUpClass()
+
+        # create a test interfaces
+        for addr in mgmt_addr:
+            cls.cli_set(cls, ['interfaces', 'dummy', mgmt_if, 'address', addr + '/32'])
+
+        # ensure we can also run this test on a live system - so lets clean
+        # out the current configuration :)
+        cls.cli_delete(cls, base_path)
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.cli_delete(cls, ['interfaces', 'dummy', mgmt_if])
+        super().tearDownClass()
+
+    def tearDown(self):
+        # service must be running after it was configured
+        self.assertTrue(process_named_running(PROCESS_NAME))
+
+        # delete/stop LLDP service
+        self.cli_delete(base_path)
+        self.cli_commit()
+
+        # service is no longer allowed to run after it was removed
+        self.assertFalse(process_named_running(PROCESS_NAME))
+
+    def test_01_lldp_basic(self):
+        self.cli_set(base_path)
+        self.cli_commit()
+
+        config = read_file(LLDPD_CONF)
+        version_data = get_version_data()
+        version = version_data['version']
+        self.assertIn(f'configure system platform VyOS', config)
+        self.assertIn(f'configure system description "VyOS {version}"', config)
+
+    def test_02_lldp_mgmt_address(self):
+        for addr in mgmt_addr:
+            self.cli_set(base_path + ['management-address', addr])
+        self.cli_commit()
+
+        config = read_file(LLDPD_CONF)
+        self.assertIn(f'configure system ip management pattern {",".join(mgmt_addr)}', config)
+
+    def test_03_lldp_interfaces(self):
+        for interface in Section.interfaces('ethernet'):
+            if not '.' in interface:
+                self.cli_set(base_path + ['interface', interface])
+
+        # commit changes
+        self.cli_commit()
+
+        # verify configuration
+        config = read_file(LLDPD_CONF)
+
+        interface_list = []
+        for interface in Section.interfaces('ethernet'):
+            if not '.' in interface:
+                interface_list.append(interface)
+        tmp = ','.join(interface_list)
+        self.assertIn(f'configure system interface pattern "{tmp}"', config)
+
+    def test_04_lldp_all_interfaces(self):
+        self.cli_set(base_path + ['interface', 'all'])
+        # commit changes
+        self.cli_commit()
+
+        # verify configuration
+        config = read_file(LLDPD_CONF)
+        self.assertIn(f'configure system interface pattern "*"', config)
+
+    def test_05_lldp_location(self):
+        interface = 'eth0'
+        elin = '1234567890'
+        self.cli_set(base_path + ['interface', interface, 'location', 'elin', elin])
+
+        # commit changes
+        self.cli_commit()
+
+        # verify configuration
+        config = read_file(LLDPD_CONF)
+
+        self.assertIn(f'configure ports {interface} med location elin "{elin}"', config)
+        self.assertIn(f'configure system interface pattern "{interface}"', config)
+
+
+if __name__ == '__main__':
+    unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_service_monitoring_telegraf.py b/smoketest/scripts/cli/test_service_monitoring_telegraf.py
index b857926e2..09937513e 100755
--- a/smoketest/scripts/cli/test_service_monitoring_telegraf.py
+++ b/smoketest/scripts/cli/test_service_monitoring_telegraf.py
@@ -54,7 +54,7 @@ class TestMonitoringTelegraf(VyOSUnitTestSHIM.TestCase):
 
         # Check telegraf config
         self.assertIn(f'organization = "{org}"', config)
-        self.assertIn(token, config)
+        self.assertIn(f'  token = "$INFLUX_TOKEN"', config)
         self.assertIn(f'urls = ["{url}:{port}"]', config)
         self.assertIn(f'bucket = "{bucket}"', config)
 
diff --git a/smoketest/scripts/cli/test_service_upnp.py b/smoketest/scripts/cli/test_service_upnp.py
index 9fbbdaff9..c3e9b600f 100755
--- a/smoketest/scripts/cli/test_service_upnp.py
+++ b/smoketest/scripts/cli/test_service_upnp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -20,52 +20,86 @@ import unittest
 from base_vyostest_shim import VyOSUnitTestSHIM
 
 from vyos.configsession import ConfigSession
+from vyos.configsession import ConfigSessionError
+from vyos.template import ip_from_cidr
 from vyos.util import read_file
 from vyos.util import process_named_running
 
 UPNP_CONF = '/run/upnp/miniupnp.conf'
+DAEMON = 'miniupnpd'
 interface = 'eth0'
 base_path = ['service', 'upnp']
 address_base = ['interfaces', 'ethernet', interface, 'address']
 
+ipv4_addr = '100.64.0.1/24'
+ipv6_addr = '2001:db8::1/64'
+
 class TestServiceUPnP(VyOSUnitTestSHIM.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        super(cls, cls).setUpClass()
+
+        # ensure we can also run this test on a live system - so lets clean
+        # out the current configuration :)
+        cls.cli_delete(cls, base_path)
+
+        cls.cli_set(cls, address_base + [ipv4_addr])
+        cls.cli_set(cls, address_base + [ipv6_addr])
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.cli_delete(cls, address_base)
+        cls._session.commit()
+
+        super(cls, cls).tearDownClass()
+
     def tearDown(self):
-        self.cli_delete(address_base)
+        # Check for running process
+        self.assertTrue(process_named_running(DAEMON))
+
         self.cli_delete(base_path)
         self.cli_commit()
-    
+
+        # Check for running process
+        self.assertFalse(process_named_running(DAEMON))
+
     def test_ipv4_base(self):
-        self.cli_set(address_base + ['100.64.0.1/24'])
         self.cli_set(base_path + ['nat-pmp'])
-        self.cli_set(base_path + ['wan-interface', interface])
         self.cli_set(base_path + ['listen', interface])
+
+        # check validate() - WAN interface is mandatory
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+        self.cli_set(base_path + ['wan-interface', interface])
+
         self.cli_commit()
-        
+
         config = read_file(UPNP_CONF)
         self.assertIn(f'ext_ifname={interface}', config)
         self.assertIn(f'listening_ip={interface}', config)
         self.assertIn(f'enable_natpmp=yes', config)
         self.assertIn(f'enable_upnp=yes', config)
-        
-        # Check for running process
-        self.assertTrue(process_named_running('miniupnpd'))
-    
+
     def test_ipv6_base(self):
-        self.cli_set(address_base + ['2001:db8::1/64'])
+        v6_addr = ip_from_cidr(ipv6_addr)
+
         self.cli_set(base_path + ['nat-pmp'])
-        self.cli_set(base_path + ['wan-interface', interface])
         self.cli_set(base_path + ['listen', interface])
-        self.cli_set(base_path + ['listen', '2001:db8::1'])
+        self.cli_set(base_path + ['listen', v6_addr])
+
+        # check validate() - WAN interface is mandatory
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+        self.cli_set(base_path + ['wan-interface', interface])
+
         self.cli_commit()
-        
+
         config = read_file(UPNP_CONF)
         self.assertIn(f'ext_ifname={interface}', config)
         self.assertIn(f'listening_ip={interface}', config)
+        self.assertIn(f'ipv6_listening_ip={v6_addr}', config)
         self.assertIn(f'enable_natpmp=yes', config)
         self.assertIn(f'enable_upnp=yes', config)
-        
-        # Check for running process
-        self.assertTrue(process_named_running('miniupnpd'))
 
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_service_webproxy.py b/smoketest/scripts/cli/test_service_webproxy.py
index 8a1a03ce7..ebbd9fe55 100755
--- a/smoketest/scripts/cli/test_service_webproxy.py
+++ b/smoketest/scripts/cli/test_service_webproxy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -30,11 +30,19 @@ listen_if = 'dum3632'
 listen_ip = '192.0.2.1'
 
 class TestServiceWebProxy(VyOSUnitTestSHIM.TestCase):
-    def setUp(self):
-        self.cli_set(['interfaces', 'dummy', listen_if, 'address', listen_ip + '/32'])
+    @classmethod
+    def setUpClass(cls):
+        # call base-classes classmethod
+        super(cls, cls).setUpClass()
+        # create a test interfaces
+        cls.cli_set(cls, ['interfaces', 'dummy', listen_if, 'address', listen_ip + '/32'])
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.cli_delete(cls, ['interfaces', 'dummy', listen_if])
+        super().tearDownClass()
 
     def tearDown(self):
-        self.cli_delete(['interfaces', 'dummy', listen_if])
         self.cli_delete(base_path)
         self.cli_commit()
 
diff --git a/smoketest/scripts/cli/test_system_flow-accounting.py b/smoketest/scripts/cli/test_system_flow-accounting.py
index 857df1be6..84f17bcb0 100755
--- a/smoketest/scripts/cli/test_system_flow-accounting.py
+++ b/smoketest/scripts/cli/test_system_flow-accounting.py
@@ -39,6 +39,9 @@ class TestSystemFlowAccounting(VyOSUnitTestSHIM.TestCase):
         cls.cli_delete(cls, base_path)
 
     def tearDown(self):
+        # after service removal process must no longer run
+        self.assertTrue(process_named_running(PROCESS_NAME))
+
         self.cli_delete(base_path)
         self.cli_commit()
 
@@ -213,9 +216,9 @@ class TestSystemFlowAccounting(VyOSUnitTestSHIM.TestCase):
         uacctd = read_file(uacctd_conf)
 
         tmp = []
-        tmp.append('memory')
         for server, server_config in netflow_server.items():
             tmp.append(f'nfprobe[nf_{server}]')
+        tmp.append('memory')
         self.assertIn('plugins: ' + ','.join(tmp), uacctd)
 
         for server, server_config in netflow_server.items():
diff --git a/smoketest/scripts/cli/test_system_ipv6.py b/smoketest/scripts/cli/test_system_ipv6.py
index 1325d4b39..3112d2e46 100755
--- a/smoketest/scripts/cli/test_system_ipv6.py
+++ b/smoketest/scripts/cli/test_system_ipv6.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -22,7 +22,7 @@ from vyos.util import read_file
 base_path = ['system', 'ipv6']
 
 file_forwarding = '/proc/sys/net/ipv6/conf/all/forwarding'
-file_disable = '/etc/modprobe.d/vyos_disable_ipv6.conf'
+file_disable = '/proc/sys/net/ipv6/conf/all/disable_ipv6'
 file_dad = '/proc/sys/net/ipv6/conf/all/accept_dad'
 file_multipath = '/proc/sys/net/ipv6/fib_multipath_hash_policy'
 
@@ -48,7 +48,7 @@ class TestSystemIPv6(VyOSUnitTestSHIM.TestCase):
         self.cli_commit()
 
         # Verify configuration file
-        self.assertEqual(read_file(file_disable), 'options ipv6 disable_ipv6=1')
+        self.assertEqual(read_file(file_disable), '1')
 
     def test_system_ipv6_strict_dad(self):
         # This defaults to 1
diff --git a/smoketest/scripts/cli/test_system_login.py b/smoketest/scripts/cli/test_system_login.py
index 69a06eeac..095300de3 100755
--- a/smoketest/scripts/cli/test_system_login.py
+++ b/smoketest/scripts/cli/test_system_login.py
@@ -235,4 +235,4 @@ class TestSystemLogin(VyOSUnitTestSHIM.TestCase):
         self.assertTrue(tmp)
 
 if __name__ == '__main__':
-    unittest.main(verbosity=2, failfast=True)
+    unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_system_logs.py b/smoketest/scripts/cli/test_system_logs.py
index 0c11c4663..92fa9c3d9 100755
--- a/smoketest/scripts/cli/test_system_logs.py
+++ b/smoketest/scripts/cli/test_system_logs.py
@@ -114,4 +114,4 @@ class TestSystemLogs(VyOSUnitTestSHIM.TestCase):
 
 
 if __name__ == '__main__':
-    unittest.main(verbosity=2, failfast=True)
+    unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py
index 1433c7329..1338fe81c 100755
--- a/smoketest/scripts/cli/test_vpn_ipsec.py
+++ b/smoketest/scripts/cli/test_vpn_ipsec.py
@@ -28,6 +28,7 @@ vti_path = ['interfaces', 'vti']
 nhrp_path = ['protocols', 'nhrp']
 base_path = ['vpn', 'ipsec']
 
+charon_file = '/etc/strongswan.d/charon.conf'
 dhcp_waiting_file = '/tmp/ipsec_dhcp_waiting'
 swanctl_file = '/etc/swanctl/swanctl.conf'
 
@@ -171,8 +172,13 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         # Site to site
         local_address = '192.0.2.10'
         priority = '20'
+        life_bytes = '100000'
+        life_packets = '2000000'
         peer_base_path = base_path + ['site-to-site', 'peer', peer_ip]
 
+        self.cli_set(base_path + ['esp-group', esp_group, 'life-bytes', life_bytes])
+        self.cli_set(base_path + ['esp-group', esp_group, 'life-packets', life_packets])
+
         self.cli_set(peer_base_path + ['authentication', 'mode', 'pre-shared-secret'])
         self.cli_set(peer_base_path + ['authentication', 'pre-shared-secret', secret])
         self.cli_set(peer_base_path + ['ike-group', ike_group])
@@ -197,6 +203,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         swanctl_conf_lines = [
             f'version = 2',
             f'auth = psk',
+            f'life_bytes = {life_bytes}',
+            f'life_packets = {life_packets}',
             f'rekey_time = 28800s', # default value
             f'proposals = aes128-sha1-modp1024',
             f'esp_proposals = aes128-sha1-modp1024',
@@ -237,6 +245,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         peer_base_path = base_path + ['site-to-site', 'peer', peer_ip]
         self.cli_set(peer_base_path + ['authentication', 'mode', 'pre-shared-secret'])
         self.cli_set(peer_base_path + ['authentication', 'pre-shared-secret', secret])
+        self.cli_set(peer_base_path + ['connection-type', 'none'])
         self.cli_set(peer_base_path + ['ike-group', ike_group])
         self.cli_set(peer_base_path + ['default-esp-group', esp_group])
         self.cli_set(peer_base_path + ['local-address', local_address])
@@ -265,6 +274,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
             f'mode = tunnel',
             f'local_ts = 172.16.10.0/24,172.16.11.0/24',
             f'remote_ts = 172.17.10.0/24,172.17.11.0/24',
+            f'start_action = none',
             f'if_id_in = {if_id}', # will be 11 for vti10 - shifted by one
             f'if_id_out = {if_id}',
             f'updown = "/etc/ipsec.d/vti-up-down {vti}"'
@@ -416,5 +426,75 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         # There is only one VTI test so no need to delete this globally in tearDown()
         self.cli_delete(vti_path)
 
+
+    def test_06_flex_vpn_vips(self):
+        local_address = '192.0.2.5'
+        local_id = 'vyos-r1'
+        remote_id = 'vyos-r2'
+        peer_base_path = base_path + ['site-to-site', 'peer', peer_ip]
+
+        self.cli_set(tunnel_path + ['tun1', 'encapsulation', 'gre'])
+        self.cli_set(tunnel_path + ['tun1', 'source-address', local_address])
+
+        self.cli_set(base_path + ['interface', interface])
+        self.cli_set(base_path + ['options', 'flexvpn'])
+        self.cli_set(base_path + ['options', 'interface', 'tun1'])
+        self.cli_set(base_path + ['ike-group', ike_group, 'ikev2-reauth', 'no'])
+        self.cli_set(base_path + ['ike-group', ike_group, 'key-exchange', 'ikev2'])
+
+        self.cli_set(peer_base_path + ['authentication', 'id', local_id])
+        self.cli_set(peer_base_path + ['authentication', 'mode', 'pre-shared-secret'])
+        self.cli_set(peer_base_path + ['authentication', 'pre-shared-secret', secret])
+        self.cli_set(peer_base_path + ['authentication', 'remote-id', remote_id])
+        self.cli_set(peer_base_path + ['connection-type', 'initiate'])
+        self.cli_set(peer_base_path + ['ike-group', ike_group])
+        self.cli_set(peer_base_path + ['default-esp-group', esp_group])
+        self.cli_set(peer_base_path + ['local-address', local_address])
+        self.cli_set(peer_base_path + ['tunnel', '1', 'protocol', 'gre'])
+
+        self.cli_set(peer_base_path + ['virtual-address', '203.0.113.55'])
+        self.cli_set(peer_base_path + ['virtual-address', '203.0.113.56'])
+
+        self.cli_commit()
+
+        # Verify strongSwan configuration
+        swanctl_conf = read_file(swanctl_file)
+        swanctl_conf_lines = [
+            f'version = 2',
+            f'vips = 203.0.113.55, 203.0.113.56',
+            f'life_time = 3600s', # default value
+            f'local_addrs = {local_address} # dhcp:no',
+            f'remote_addrs = {peer_ip}',
+            f'peer_{peer_ip.replace(".","-")}_tunnel_1',
+            f'mode = tunnel',
+        ]
+
+        for line in swanctl_conf_lines:
+            self.assertIn(line, swanctl_conf)
+
+        swanctl_secrets_lines = [
+            f'id-local = {local_address} # dhcp:no',
+            f'id-remote = {peer_ip}',
+            f'id-localid = {local_id}',
+            f'id-remoteid = {remote_id}',
+            f'secret = "{secret}"',
+        ]
+
+        for line in swanctl_secrets_lines:
+            self.assertIn(line, swanctl_conf)
+
+        # Verify charon configuration
+        charon_conf = read_file(charon_file)
+        charon_conf_lines = [
+            f'# Cisco FlexVPN',
+            f'cisco_flexvpn = yes',
+            f'install_virtual_ip = yes',
+            f'install_virtual_ip_on = tun1',
+        ]
+
+        for line in charon_conf_lines:
+            self.assertIn(line, charon_conf)
+
+
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_zone_policy.py b/smoketest/scripts/cli/test_zone_policy.py
index c0af6164b..6e34f3179 100755
--- a/smoketest/scripts/cli/test_zone_policy.py
+++ b/smoketest/scripts/cli/test_zone_policy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -21,12 +21,18 @@ from base_vyostest_shim import VyOSUnitTestSHIM
 from vyos.util import cmd
 
 class TestZonePolicy(VyOSUnitTestSHIM.TestCase):
-    def setUp(self):
-        self.cli_set(['firewall', 'name', 'smoketest', 'default-action', 'drop'])
+    @classmethod
+    def setUpClass(cls):
+        super(cls, cls).setUpClass()
+        cls.cli_set(cls, ['firewall', 'name', 'smoketest', 'default-action', 'drop'])
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.cli_delete(cls, ['firewall'])
+        super(cls, cls).tearDownClass()
 
     def tearDown(self):
         self.cli_delete(['zone-policy'])
-        self.cli_delete(['firewall'])
         self.cli_commit()
 
     def test_basic_zone(self):
@@ -44,8 +50,8 @@ class TestZonePolicy(VyOSUnitTestSHIM.TestCase):
             ['oifname { "eth0" }', 'jump VZONE_smoketest-eth0'],
             ['jump VZONE_smoketest-local_IN'],
             ['jump VZONE_smoketest-local_OUT'],
-            ['iifname { "eth0" }', 'jump smoketest'],
-            ['oifname { "eth0" }', 'jump smoketest']
+            ['iifname { "eth0" }', 'jump NAME_smoketest'],
+            ['oifname { "eth0" }', 'jump NAME_smoketest']
         ]
 
         nftables_output = cmd('sudo nft list table ip filter')