2 files changed, 26 insertions, 5 deletions
diff --git a/docs/configuration/vpn/dmvpn.rst b/docs/configuration/vpn/dmvpn.rst
index a85e03b4..7a4b81f7 100644
--- a/docs/configuration/vpn/dmvpn.rst
+++ b/docs/configuration/vpn/dmvpn.rst
@@ -190,7 +190,7 @@ Hub
 
   set interfaces tunnel tun100 address '172.16.253.134/29'
   set interfaces tunnel tun100 encapsulation 'gre'
-  set interfaces tunnel tun100 local-ip '192.0.2.1'
+  set interfaces tunnel tun100 source-address '192.0.2.1'
   set interfaces tunnel tun100 enable-multicast
   set interfaces tunnel tun100 parameters ip key '1'
 
@@ -294,7 +294,7 @@ VyOS can also run in DMVPN spoke mode.
   set interfaces ethernet eth0 address 'dhcp'
 
   set interfaces tunnel tun100 address '172.16.253.133/29'
-  set interfaces tunnel tun100 local-ip 0.0.0.0
+  set interfaces tunnel tun100 source-address 0.0.0.0
   set interfaces tunnel tun100 encapsulation 'gre'
   set interfaces tunnel tun100 enable-multicast
   set interfaces tunnel tun100 parameters ip key '1'
diff --git a/docs/configuration/vpn/site2site_ipsec.rst b/docs/configuration/vpn/site2site_ipsec.rst
index 5f8e5263..2b3403f5 100644
--- a/docs/configuration/vpn/site2site_ipsec.rst
+++ b/docs/configuration/vpn/site2site_ipsec.rst
@@ -284,17 +284,31 @@ Imagine the following topology
 
    IPSec IKEv2 site2site VPN (source ./draw.io/vpn_s2s_ikev2.drawio)
 
+**LEFT:**
+* WAN interface on `eth0.201`
+* `eth0.201` interface IP: `172.18.201.10/24`
+* `vti10` interface IP: `10.0.0.2/31`
+* `dum0` interface IP: `10.0.11.1/24` (for testing purposes)
+
+**RIGHT:**
+* WAN interface on `eth0.202`
+* `eth0.201` interface IP: `172.18.202.10/24`
+* `vti10` interface IP: `10.0.0.3/31`
+* `dum0` interface IP: `10.0.12.1/24` (for testing purposes)
 
 .. note:: Don't get confused about the used /31 tunnel subnet. :rfc:`3021`
    gives you additional information for using /31 subnets on point-to-point
    links.
 
-**left**
+**LEFT**
 
 .. code-block:: none
 
+  set interfaces ethernet eth0 vif 201 address '172.18.201.10/24'
+  set interfaces dummy dum0 address '10.0.11.1/24'
   set interfaces vti vti10 address '10.0.0.2/31'
 
+  set vpn ipsec option disable-route-autoinstall
   set vpn ipsec authentication psk OFFICE-B id '172.18.201.10'
   set vpn ipsec authentication psk OFFICE-B id '172.18.202.10'
   set vpn ipsec authentication psk OFFICE-B secret 'secretkey'
@@ -315,17 +329,22 @@ Imagine the following topology
   set vpn ipsec site-to-site peer OFFICE-B authentication remote-id '172.18.202.10'
   set vpn ipsec site-to-site peer OFFICE-B connection-type 'respond'
   set vpn ipsec site-to-site peer OFFICE-B ike-group 'IKEv2_DEFAULT'
-  set vpn ipsec site-to-site peer OFFICE-B local-address '192.168.0.10'
+  set vpn ipsec site-to-site peer OFFICE-B local-address '172.18.201.10'
   set vpn ipsec site-to-site peer OFFICE-B remote-address '172.18.202.10'
   set vpn ipsec site-to-site peer OFFICE-B vti bind 'vti10'
   set vpn ipsec site-to-site peer OFFICE-B vti esp-group 'ESP_DEFAULT'
 
-**right**
+  set protocols static interface-route 10.0.12.0/24 next-hop-interface vti10
+
+**RIGHT**
 
 .. code-block:: none
 
+  set interfaces ethernet eth0 vif 202 address '172.18.202.10/24'
+  set interfaces dummy dum0 address '10.0.12.1/24'
   set interfaces vti vti10 address '10.0.0.3/31'
 
+  set vpn ipsec option disable-route-autoinstall
   set vpn ipsec authentication psk OFFICE-A id '172.18.201.10'
   set vpn ipsec authentication psk OFFICE-A id '172.18.202.10'
   set vpn ipsec authentication psk OFFICE-A secret 'secretkey'
@@ -354,6 +373,8 @@ Imagine the following topology
   set vpn ipsec site-to-site peer OFFICE-A vti bind 'vti10'
   set vpn ipsec site-to-site peer OFFICE-A vti esp-group 'ESP_DEFAULT'
 
+  set protocols static interface-route 10.0.11.0/24 next-hop-interface vti10
+
 Key Parameters:
 
 * ``authentication local-id/remote-id`` - IKE identification is used for