From c25c40dfa96dfeb022b203280c607c1f1835417b Mon Sep 17 00:00:00 2001
From: Robert Göhler <github@ghlr.de>
Date: Sun, 24 Jan 2021 22:14:00 +0100
Subject: Migrate new file structure to crux (#435)

* order workflows and add submodule

* rename gitmodules file

* delete docs/.gitignore

* add vyos custom linter

* correct __pycache__ in gitignore

* add test-coverage.py

* move draw.io folder

* arrange changelog, install history and about

* arrange: firewall

* arrange: highavailability

* arrange: loadbalancing

* arrange: nat

* arrange: services

* sort configexamples and configuration interfaces

* wireles: rename wireless

* rearrange: Protocols and Policy

* rearrange: Firewall and Zone Policy

* rearrange: Interfaces

* rearrange: Interfaces

* rearrange: dynamic DNS

* hostinfo: add page to index

* rearrange: appendix

* venv: add Pipfile

* rearrange: contributing

* index: remove debugging

* rearrange: fix all figure and refs

* rearrange: commandtree

* fix: cli, openvpn, install headline level

* protocols: change headline

* firewall: move mss clamping

* ip: separate ipv4 and ipv6

* arp: move to static page

* igmp: rename multicast page

* Update to year 2021
---
 .github/styles/Google/AMPM.yml                     |    9 +
 .github/styles/Google/Acronyms.yml                 |   64 ++
 .github/styles/Google/Colons.yml                   |    7 +
 .github/styles/Google/Contractions.yml             |   28 +
 .github/styles/Google/DateFormat.yml               |    9 +
 .github/styles/Google/Ellipses.yml                 |    7 +
 .github/styles/Google/EmDash.yml                   |    8 +
 .github/styles/Google/EnDash.yml                   |    7 +
 .github/styles/Google/Exclamation.yml              |    7 +
 .github/styles/Google/FirstPerson.yml              |   11 +
 .github/styles/Google/Gender.yml                   |    9 +
 .github/styles/Google/GenderBias.yml               |   45 +
 .github/styles/Google/HeadingPunctuation.yml       |    8 +
 .github/styles/Google/Headings.yml                 |   26 +
 .github/styles/Google/Hyphens.yml                  |    8 +
 .github/styles/Google/Latin.yml                    |    9 +
 .github/styles/Google/LyHyphens.yml                |    8 +
 .github/styles/Google/OptionalPlurals.yml          |    7 +
 .github/styles/Google/Ordinal.yml                  |    7 +
 .github/styles/Google/OxfordComma.yml              |    7 +
 .github/styles/Google/Parens.yml                   |    7 +
 .github/styles/Google/Passive.yml                  |  184 +++
 .github/styles/Google/Periods.yml                  |    7 +
 .github/styles/Google/Quotes.yml                   |    7 +
 .github/styles/Google/Ranges.yml                   |    7 +
 .github/styles/Google/Semicolons.yml               |    8 +
 .github/styles/Google/Slang.yml                    |   11 +
 .github/styles/Google/Spacing.yml                  |    8 +
 .github/styles/Google/Spelling.yml                 |    8 +
 .github/styles/Google/Units.yml                    |    7 +
 .github/styles/Google/Will.yml                     |    7 +
 .github/styles/Google/WordList.yml                 |   79 ++
 .github/styles/Google/meta.json                    |   16 +
 .github/styles/Google/vocab.txt                    |    0
 .github/styles/VyOS/Terminology.yml                |    9 +
 .github/vyos-linter.py                             |  177 +++
 .github/workflows/main.yml                         |   32 +
 .github/workflows/submodules.yml                   |   32 +
 .gitignore                                         |    8 +-
 .gitmodules                                        |    4 +
 .vale                                              |   34 -
 Pipfile                                            |   14 +
 ci/vale/Google/AMPM.yml                            |    9 -
 ci/vale/Google/Acronyms.yml                        |   64 --
 ci/vale/Google/Colons.yml                          |    7 -
 ci/vale/Google/Contractions.yml                    |   28 -
 ci/vale/Google/DateFormat.yml                      |    9 -
 ci/vale/Google/Ellipses.yml                        |    7 -
 ci/vale/Google/EmDash.yml                          |    8 -
 ci/vale/Google/EnDash.yml                          |    7 -
 ci/vale/Google/Exclamation.yml                     |    7 -
 ci/vale/Google/FirstPerson.yml                     |   11 -
 ci/vale/Google/Gender.yml                          |    9 -
 ci/vale/Google/GenderBias.yml                      |   45 -
 ci/vale/Google/HeadingPunctuation.yml              |    8 -
 ci/vale/Google/Headings.yml                        |   26 -
 ci/vale/Google/Hyphens.yml                         |    8 -
 ci/vale/Google/Latin.yml                           |    9 -
 ci/vale/Google/LyHyphens.yml                       |    8 -
 ci/vale/Google/OptionalPlurals.yml                 |    7 -
 ci/vale/Google/Ordinal.yml                         |    7 -
 ci/vale/Google/OxfordComma.yml                     |    7 -
 ci/vale/Google/Parens.yml                          |    7 -
 ci/vale/Google/Passive.yml                         |  184 ---
 ci/vale/Google/Periods.yml                         |    7 -
 ci/vale/Google/Quotes.yml                          |    7 -
 ci/vale/Google/Ranges.yml                          |    7 -
 ci/vale/Google/Semicolons.yml                      |    8 -
 ci/vale/Google/Slang.yml                           |   11 -
 ci/vale/Google/Spacing.yml                         |    8 -
 ci/vale/Google/Spelling.yml                        |    8 -
 ci/vale/Google/Units.yml                           |    7 -
 ci/vale/Google/Will.yml                            |    7 -
 ci/vale/Google/WordList.yml                        |   79 --
 ci/vale/Google/meta.json                           |   16 -
 ci/vale/Google/vocab.txt                           |    0
 ci/vale/VyOS/Terminology.yml                       |    9 -
 docs/.gitignore                                    |    1 -
 docs/_ext/test-coverage.py                         |  351 ++++++
 docs/_include/draw.io/pbr_example_1.drawio         |    1 +
 docs/_include/draw.io/vpn_s2s_ikev2.drawio         |    1 +
 docs/about.rst                                     |   27 -
 docs/appendix/commandtree/configmode.rst           |  524 ---------
 docs/appendix/commandtree/index.rst                |   17 -
 docs/appendix/commandtree/operationmode.rst        |  444 --------
 docs/appendix/examples/azure-vpn-bgp.rst           |  128 ---
 docs/appendix/examples/azure-vpn-dual-bgp.rst      |  155 ---
 docs/appendix/examples/bgp-ipv6-unnumbered.rst     |  171 ---
 .../examples/dhcp-relay-through-gre-bridge.rst     |   77 --
 docs/appendix/examples/dmvpn.rst                   |  106 --
 docs/appendix/examples/index.rst                   |   20 -
 docs/appendix/examples/ospf-unnumbered.rst         |  125 --
 docs/appendix/examples/tunnelbroker-ipv6.rst       |  151 ---
 docs/appendix/examples/wan-load-balancing.rst      |  170 ---
 docs/appendix/examples/zone-policy.rst             |  379 -------
 docs/appendix/migrate-from-vyatta.rst              |  164 ---
 docs/appendix/releasenotes.rst                     |  358 ------
 docs/appendix/troubleshooting.rst                  |  385 -------
 docs/appendix/vyos-on-baremetal.rst                |  380 -------
 docs/appendix/vyos-on-gns3.rst                     |  175 ---
 docs/appendix/vyos-on-vmware.rst                   |   32 -
 docs/automation/command-scripting.rst              |  126 +++
 docs/automation/index.rst                          |   15 +
 docs/changelog/1.2.1.rst                           |   52 +
 docs/changelog/1.2.2.rst                           |   46 +
 docs/changelog/1.2.3.rst                           |   62 +
 docs/changelog/1.2.4.rst                           |   77 ++
 docs/changelog/1.2.5.rst                           |   70 ++
 docs/changelog/1.2.6.rst                           |  106 ++
 docs/changelog/index.rst                           |   18 +
 docs/cli.rst                                       |  743 +++++++++++-
 docs/commandscripting.rst                          |  126 ---
 docs/commandtree/configmode.rst                    |  524 +++++++++
 docs/commandtree/index.rst                         |   17 +
 docs/commandtree/operationmode.rst                 |  444 ++++++++
 docs/conf.py                                       |    2 +-
 docs/configexamples/azure-vpn-bgp.rst              |  128 +++
 docs/configexamples/azure-vpn-dual-bgp.rst         |  155 +++
 docs/configexamples/bgp-ipv6-unnumbered.rst        |  171 +++
 .../dhcp-relay-through-gre-bridge.rst              |   77 ++
 docs/configexamples/dmvpn.rst                      |  106 ++
 docs/configexamples/index.rst                      |   19 +
 docs/configexamples/ospf-unnumbered.rst            |  125 ++
 docs/configexamples/tunnelbroker-ipv6.rst          |  151 +++
 docs/configexamples/wan-load-balancing.rst         |  170 +++
 docs/configexamples/zone-policy.rst                |  379 +++++++
 docs/configuration-overview.rst                    |  730 ------------
 docs/configuration/firewall/index.rst              |  258 +++++
 docs/configuration/highavailability/index.rst      |  158 +++
 docs/configuration/index.rst                       |   22 +
 docs/configuration/interfaces/bonding.rst          |   75 ++
 docs/configuration/interfaces/bridge.rst           |  104 ++
 docs/configuration/interfaces/dummy.rst            |   21 +
 docs/configuration/interfaces/ethernet.rst         |  263 +++++
 docs/configuration/interfaces/index.rst            |  199 ++++
 docs/configuration/interfaces/l2tpv3.rst           |  119 ++
 docs/configuration/interfaces/openvpn.rst          |  468 ++++++++
 docs/configuration/interfaces/tunnel.rst           |  237 ++++
 docs/configuration/interfaces/vxlan.rst            |  305 +++++
 docs/configuration/interfaces/wireguard.rst        |  148 +++
 docs/configuration/interfaces/wireless.rst         |   55 +
 docs/configuration/loadbalancing/index.rst         |  263 +++++
 docs/configuration/nat/index.rst                   |  475 ++++++++
 docs/configuration/policy/index.rst                |  160 +++
 docs/configuration/protocols/bgp.rst               |  144 +++
 docs/configuration/protocols/igmp.rst              |  246 ++++
 docs/configuration/protocols/index.rst             |   18 +
 docs/configuration/protocols/ospf.rst              |  139 +++
 docs/configuration/protocols/rip.rst               |   22 +
 docs/configuration/protocols/static.rst            |   66 ++
 docs/configuration/service/broadcast-relay.rst     |   53 +
 docs/configuration/service/conntrack-sync.rst      |  178 +++
 docs/configuration/service/dhcp-relay.rst          |  165 +++
 docs/configuration/service/dhcp-server.rst         |  444 ++++++++
 docs/configuration/service/dns.rst                 |  226 ++++
 docs/configuration/service/index.rst               |   21 +
 docs/configuration/service/lldp.rst                |   97 ++
 docs/configuration/service/mdns.rst                |   30 +
 docs/configuration/service/pppoe-server.rst        |  217 ++++
 docs/configuration/service/references.rst          |   15 +
 docs/configuration/service/snmp.rst                |  245 ++++
 docs/configuration/service/ssh.rst                 |  150 +++
 docs/configuration/service/tftp-server.rst         |   42 +
 docs/configuration/service/webproxy.rst            |  152 +++
 docs/configuration/system/console.rst              |   17 +
 docs/configuration/system/eventhandler.rst         |   48 +
 docs/configuration/system/flow-accounting.rst      |   81 ++
 docs/configuration/system/host-information.rst     |  175 +++
 docs/configuration/system/index.rst                |   24 +
 docs/configuration/system/ip.rst                   |   75 ++
 docs/configuration/system/ipv6.rst                 |  202 ++++
 docs/configuration/system/login.rst                |  129 +++
 docs/configuration/system/name-server.rst          |   68 ++
 docs/configuration/system/ntp.rst                  |   19 +
 docs/configuration/system/syslog.rst               |  224 ++++
 docs/configuration/system/task-scheduler.rst       |   60 +
 docs/configuration/system/time-zone.rst            |   11 +
 docs/configuration/trafficpolicy/index.rst         | 1197 ++++++++++++++++++++
 docs/configuration/vpn/dmvpn.rst                   |  420 +++++++
 docs/configuration/vpn/index.rst                   |   17 +
 docs/configuration/vpn/ipsec.rst                   |  190 ++++
 docs/configuration/vpn/l2tp.rst                    |  131 +++
 docs/configuration/vpn/pptp.rst                    |   47 +
 docs/configuration/vpn/references.rst              |   10 +
 docs/configuration/vpn/site2site_ipsec.rst         |  299 +++++
 docs/configuration/zonepolicy/index.rst            |    9 +
 docs/contributing/documentation.rst                |  175 ---
 docs/contributing/index.rst                        |   13 +
 docs/contributing/issues-features.rst              |   72 ++
 docs/contributing/issues_features.rst              |   72 --
 docs/copyright.rst                                 |   19 +
 docs/documentation.rst                             |  175 +++
 docs/draw.io/pbr_example_1.drawio                  |    1 -
 docs/draw.io/vpn_s2s_ikev2.drawio                  |    1 -
 docs/firewall.rst                                  |  202 ----
 docs/high-availability.rst                         |  158 ---
 docs/history.rst                                   |   45 -
 docs/image-mgmt.rst                                |  193 ----
 docs/index.rst                                     |   90 +-
 docs/install.rst                                   |  514 ---------
 docs/installation/cloud/index.rst                  |    9 +
 docs/installation/image.rst                        |  115 ++
 docs/installation/index.rst                        |   17 +
 docs/installation/install.rst                      |  514 +++++++++
 docs/installation/migrate-from-vyatta.rst          |  164 +++
 docs/installation/update.rst                       |   79 ++
 docs/installation/virtual/gns3.rst                 |  175 +++
 docs/installation/virtual/index.rst                |    9 +
 docs/installation/virtual/vmware.rst               |   32 +
 docs/installation/vyos-on-baremetal.rst            |  380 +++++++
 docs/interfaces/addresses.rst                      |  178 ---
 docs/interfaces/bonding.rst                        |   75 --
 docs/interfaces/bridging.rst                       |  104 --
 docs/interfaces/dummy.rst                          |   21 -
 docs/interfaces/ethernet.rst                       |   72 --
 docs/interfaces/index.rst                          |   63 --
 docs/interfaces/l2tpv3.rst                         |  119 --
 docs/interfaces/pppoe.rst                          |   82 --
 docs/interfaces/qinq.rst                           |   58 -
 docs/interfaces/tunnel.rst                         |  237 ----
 docs/interfaces/vlan.rst                           |   47 -
 docs/interfaces/vxlan.rst                          |  305 -----
 docs/interfaces/wireless.rst                       |   55 -
 docs/introducing/about.rst                         |   27 +
 docs/introducing/history.rst                       |   47 +
 docs/load-balancing.rst                            |  263 -----
 docs/nat.rst                                       |  475 --------
 docs/operation/boot-options.rst                    |   56 +
 docs/operation/index.rst                           |    9 +
 docs/qos.rst                                       | 1197 --------------------
 docs/routing/arp.rst                               |   34 -
 docs/routing/bgp.rst                               |  144 ---
 docs/routing/index.rst                             |   22 -
 docs/routing/ip-commands.rst                       |  281 -----
 docs/routing/mss-clamp.rst                         |   64 --
 docs/routing/multicast.rst                         |  246 ----
 docs/routing/ospf.rst                              |  139 ---
 docs/routing/pbr.rst                               |   98 --
 docs/routing/rip.rst                               |   22 -
 docs/routing/routing-policy.rst                    |   59 -
 docs/routing/static.rst                            |   30 -
 docs/services/conntrack.rst                        |  178 ---
 docs/services/dhcp-relay.rst                       |  165 ---
 docs/services/dhcp.rst                             |  138 ---
 docs/services/dhcpv6.rst                           |  305 -----
 docs/services/dns-forwarding.rst                   |   72 --
 docs/services/dynamic-dns.rst                      |  152 ---
 docs/services/index.rst                            |   27 -
 docs/services/ipoe-server.rst                      |  129 ---
 docs/services/lldp.rst                             |   97 --
 docs/services/mdns-repeater.rst                    |   30 -
 docs/services/pppoe-server.rst                     |  217 ----
 docs/services/references.rst                       |   15 -
 docs/services/snmp.rst                             |  245 ----
 docs/services/ssh.rst                              |  150 ---
 docs/services/tftp.rst                             |   42 -
 docs/services/udp-broadcast-relay.rst              |   53 -
 docs/services/webproxy.rst                         |  152 ---
 docs/system/boot-options.rst                       |   56 -
 docs/system/eventhandler.rst                       |   48 -
 docs/system/flowaccounting.rst                     |   81 --
 docs/system/host-information.rst                   |  175 ---
 docs/system/index.rst                              |   25 -
 docs/system/login-users.rst                        |  129 ---
 docs/system/ntp.rst                                |   19 -
 docs/system/proxy.rst                              |   28 -
 docs/system/serialconsole.rst                      |   17 -
 docs/system/syslog.rst                             |  224 ----
 docs/system/system-dns.rst                         |   68 --
 docs/system/task-scheduler.rst                     |   60 -
 docs/system/time-zone.rst                          |   11 -
 docs/troubleshooting/index.rst                     |  459 ++++++++
 docs/vpn/dmvpn.rst                                 |  420 -------
 docs/vpn/gre-ipsec.rst                             |  190 ----
 docs/vpn/index.rst                                 |   19 -
 docs/vpn/l2tp.rst                                  |  131 ---
 docs/vpn/openvpn.rst                               |  467 --------
 docs/vpn/pptp.rst                                  |   47 -
 docs/vpn/references.rst                            |   10 -
 docs/vpn/site2site_ipsec.rst                       |  299 -----
 docs/vpn/wireguard.rst                             |  148 ---
 vale.ini                                           |   16 +
 282 files changed, 16917 insertions(+), 16297 deletions(-)
 create mode 100644 .github/styles/Google/AMPM.yml
 create mode 100644 .github/styles/Google/Acronyms.yml
 create mode 100644 .github/styles/Google/Colons.yml
 create mode 100644 .github/styles/Google/Contractions.yml
 create mode 100644 .github/styles/Google/DateFormat.yml
 create mode 100644 .github/styles/Google/Ellipses.yml
 create mode 100644 .github/styles/Google/EmDash.yml
 create mode 100644 .github/styles/Google/EnDash.yml
 create mode 100644 .github/styles/Google/Exclamation.yml
 create mode 100644 .github/styles/Google/FirstPerson.yml
 create mode 100644 .github/styles/Google/Gender.yml
 create mode 100644 .github/styles/Google/GenderBias.yml
 create mode 100644 .github/styles/Google/HeadingPunctuation.yml
 create mode 100644 .github/styles/Google/Headings.yml
 create mode 100644 .github/styles/Google/Hyphens.yml
 create mode 100644 .github/styles/Google/Latin.yml
 create mode 100644 .github/styles/Google/LyHyphens.yml
 create mode 100644 .github/styles/Google/OptionalPlurals.yml
 create mode 100644 .github/styles/Google/Ordinal.yml
 create mode 100644 .github/styles/Google/OxfordComma.yml
 create mode 100644 .github/styles/Google/Parens.yml
 create mode 100644 .github/styles/Google/Passive.yml
 create mode 100644 .github/styles/Google/Periods.yml
 create mode 100644 .github/styles/Google/Quotes.yml
 create mode 100644 .github/styles/Google/Ranges.yml
 create mode 100644 .github/styles/Google/Semicolons.yml
 create mode 100644 .github/styles/Google/Slang.yml
 create mode 100644 .github/styles/Google/Spacing.yml
 create mode 100644 .github/styles/Google/Spelling.yml
 create mode 100644 .github/styles/Google/Units.yml
 create mode 100644 .github/styles/Google/Will.yml
 create mode 100644 .github/styles/Google/WordList.yml
 create mode 100644 .github/styles/Google/meta.json
 create mode 100644 .github/styles/Google/vocab.txt
 create mode 100644 .github/styles/VyOS/Terminology.yml
 create mode 100644 .github/vyos-linter.py
 create mode 100644 .github/workflows/main.yml
 create mode 100644 .github/workflows/submodules.yml
 create mode 100644 .gitmodules
 delete mode 100644 .vale
 create mode 100644 Pipfile
 delete mode 100644 ci/vale/Google/AMPM.yml
 delete mode 100644 ci/vale/Google/Acronyms.yml
 delete mode 100644 ci/vale/Google/Colons.yml
 delete mode 100644 ci/vale/Google/Contractions.yml
 delete mode 100644 ci/vale/Google/DateFormat.yml
 delete mode 100644 ci/vale/Google/Ellipses.yml
 delete mode 100644 ci/vale/Google/EmDash.yml
 delete mode 100644 ci/vale/Google/EnDash.yml
 delete mode 100644 ci/vale/Google/Exclamation.yml
 delete mode 100644 ci/vale/Google/FirstPerson.yml
 delete mode 100644 ci/vale/Google/Gender.yml
 delete mode 100644 ci/vale/Google/GenderBias.yml
 delete mode 100644 ci/vale/Google/HeadingPunctuation.yml
 delete mode 100644 ci/vale/Google/Headings.yml
 delete mode 100644 ci/vale/Google/Hyphens.yml
 delete mode 100644 ci/vale/Google/Latin.yml
 delete mode 100644 ci/vale/Google/LyHyphens.yml
 delete mode 100644 ci/vale/Google/OptionalPlurals.yml
 delete mode 100644 ci/vale/Google/Ordinal.yml
 delete mode 100644 ci/vale/Google/OxfordComma.yml
 delete mode 100644 ci/vale/Google/Parens.yml
 delete mode 100644 ci/vale/Google/Passive.yml
 delete mode 100644 ci/vale/Google/Periods.yml
 delete mode 100644 ci/vale/Google/Quotes.yml
 delete mode 100644 ci/vale/Google/Ranges.yml
 delete mode 100644 ci/vale/Google/Semicolons.yml
 delete mode 100644 ci/vale/Google/Slang.yml
 delete mode 100644 ci/vale/Google/Spacing.yml
 delete mode 100644 ci/vale/Google/Spelling.yml
 delete mode 100644 ci/vale/Google/Units.yml
 delete mode 100644 ci/vale/Google/Will.yml
 delete mode 100644 ci/vale/Google/WordList.yml
 delete mode 100644 ci/vale/Google/meta.json
 delete mode 100644 ci/vale/Google/vocab.txt
 delete mode 100644 ci/vale/VyOS/Terminology.yml
 delete mode 100644 docs/.gitignore
 create mode 100644 docs/_ext/test-coverage.py
 create mode 100644 docs/_include/draw.io/pbr_example_1.drawio
 create mode 100644 docs/_include/draw.io/vpn_s2s_ikev2.drawio
 delete mode 100644 docs/about.rst
 delete mode 100644 docs/appendix/commandtree/configmode.rst
 delete mode 100644 docs/appendix/commandtree/index.rst
 delete mode 100644 docs/appendix/commandtree/operationmode.rst
 delete mode 100644 docs/appendix/examples/azure-vpn-bgp.rst
 delete mode 100644 docs/appendix/examples/azure-vpn-dual-bgp.rst
 delete mode 100644 docs/appendix/examples/bgp-ipv6-unnumbered.rst
 delete mode 100644 docs/appendix/examples/dhcp-relay-through-gre-bridge.rst
 delete mode 100644 docs/appendix/examples/dmvpn.rst
 delete mode 100644 docs/appendix/examples/index.rst
 delete mode 100644 docs/appendix/examples/ospf-unnumbered.rst
 delete mode 100644 docs/appendix/examples/tunnelbroker-ipv6.rst
 delete mode 100644 docs/appendix/examples/wan-load-balancing.rst
 delete mode 100644 docs/appendix/examples/zone-policy.rst
 delete mode 100644 docs/appendix/migrate-from-vyatta.rst
 delete mode 100644 docs/appendix/releasenotes.rst
 delete mode 100644 docs/appendix/troubleshooting.rst
 delete mode 100644 docs/appendix/vyos-on-baremetal.rst
 delete mode 100644 docs/appendix/vyos-on-gns3.rst
 delete mode 100644 docs/appendix/vyos-on-vmware.rst
 create mode 100644 docs/automation/command-scripting.rst
 create mode 100644 docs/automation/index.rst
 create mode 100644 docs/changelog/1.2.1.rst
 create mode 100644 docs/changelog/1.2.2.rst
 create mode 100644 docs/changelog/1.2.3.rst
 create mode 100644 docs/changelog/1.2.4.rst
 create mode 100644 docs/changelog/1.2.5.rst
 create mode 100644 docs/changelog/1.2.6.rst
 create mode 100644 docs/changelog/index.rst
 delete mode 100644 docs/commandscripting.rst
 create mode 100644 docs/commandtree/configmode.rst
 create mode 100644 docs/commandtree/index.rst
 create mode 100644 docs/commandtree/operationmode.rst
 create mode 100644 docs/configexamples/azure-vpn-bgp.rst
 create mode 100644 docs/configexamples/azure-vpn-dual-bgp.rst
 create mode 100644 docs/configexamples/bgp-ipv6-unnumbered.rst
 create mode 100644 docs/configexamples/dhcp-relay-through-gre-bridge.rst
 create mode 100644 docs/configexamples/dmvpn.rst
 create mode 100644 docs/configexamples/index.rst
 create mode 100644 docs/configexamples/ospf-unnumbered.rst
 create mode 100644 docs/configexamples/tunnelbroker-ipv6.rst
 create mode 100644 docs/configexamples/wan-load-balancing.rst
 create mode 100644 docs/configexamples/zone-policy.rst
 delete mode 100644 docs/configuration-overview.rst
 create mode 100644 docs/configuration/firewall/index.rst
 create mode 100644 docs/configuration/highavailability/index.rst
 create mode 100644 docs/configuration/index.rst
 create mode 100644 docs/configuration/interfaces/bonding.rst
 create mode 100644 docs/configuration/interfaces/bridge.rst
 create mode 100644 docs/configuration/interfaces/dummy.rst
 create mode 100644 docs/configuration/interfaces/ethernet.rst
 create mode 100644 docs/configuration/interfaces/index.rst
 create mode 100644 docs/configuration/interfaces/l2tpv3.rst
 create mode 100644 docs/configuration/interfaces/openvpn.rst
 create mode 100644 docs/configuration/interfaces/tunnel.rst
 create mode 100644 docs/configuration/interfaces/vxlan.rst
 create mode 100644 docs/configuration/interfaces/wireguard.rst
 create mode 100644 docs/configuration/interfaces/wireless.rst
 create mode 100644 docs/configuration/loadbalancing/index.rst
 create mode 100644 docs/configuration/nat/index.rst
 create mode 100644 docs/configuration/policy/index.rst
 create mode 100644 docs/configuration/protocols/bgp.rst
 create mode 100644 docs/configuration/protocols/igmp.rst
 create mode 100644 docs/configuration/protocols/index.rst
 create mode 100644 docs/configuration/protocols/ospf.rst
 create mode 100644 docs/configuration/protocols/rip.rst
 create mode 100644 docs/configuration/protocols/static.rst
 create mode 100644 docs/configuration/service/broadcast-relay.rst
 create mode 100644 docs/configuration/service/conntrack-sync.rst
 create mode 100644 docs/configuration/service/dhcp-relay.rst
 create mode 100644 docs/configuration/service/dhcp-server.rst
 create mode 100644 docs/configuration/service/dns.rst
 create mode 100644 docs/configuration/service/index.rst
 create mode 100644 docs/configuration/service/lldp.rst
 create mode 100644 docs/configuration/service/mdns.rst
 create mode 100644 docs/configuration/service/pppoe-server.rst
 create mode 100644 docs/configuration/service/references.rst
 create mode 100644 docs/configuration/service/snmp.rst
 create mode 100644 docs/configuration/service/ssh.rst
 create mode 100644 docs/configuration/service/tftp-server.rst
 create mode 100644 docs/configuration/service/webproxy.rst
 create mode 100644 docs/configuration/system/console.rst
 create mode 100644 docs/configuration/system/eventhandler.rst
 create mode 100644 docs/configuration/system/flow-accounting.rst
 create mode 100644 docs/configuration/system/host-information.rst
 create mode 100644 docs/configuration/system/index.rst
 create mode 100644 docs/configuration/system/ip.rst
 create mode 100644 docs/configuration/system/ipv6.rst
 create mode 100644 docs/configuration/system/login.rst
 create mode 100644 docs/configuration/system/name-server.rst
 create mode 100644 docs/configuration/system/ntp.rst
 create mode 100644 docs/configuration/system/syslog.rst
 create mode 100644 docs/configuration/system/task-scheduler.rst
 create mode 100644 docs/configuration/system/time-zone.rst
 create mode 100644 docs/configuration/trafficpolicy/index.rst
 create mode 100644 docs/configuration/vpn/dmvpn.rst
 create mode 100644 docs/configuration/vpn/index.rst
 create mode 100644 docs/configuration/vpn/ipsec.rst
 create mode 100644 docs/configuration/vpn/l2tp.rst
 create mode 100644 docs/configuration/vpn/pptp.rst
 create mode 100644 docs/configuration/vpn/references.rst
 create mode 100644 docs/configuration/vpn/site2site_ipsec.rst
 create mode 100644 docs/configuration/zonepolicy/index.rst
 delete mode 100644 docs/contributing/documentation.rst
 create mode 100644 docs/contributing/index.rst
 create mode 100644 docs/contributing/issues-features.rst
 delete mode 100644 docs/contributing/issues_features.rst
 create mode 100644 docs/copyright.rst
 create mode 100644 docs/documentation.rst
 delete mode 100644 docs/draw.io/pbr_example_1.drawio
 delete mode 100644 docs/draw.io/vpn_s2s_ikev2.drawio
 delete mode 100644 docs/firewall.rst
 delete mode 100644 docs/high-availability.rst
 delete mode 100644 docs/history.rst
 delete mode 100644 docs/image-mgmt.rst
 delete mode 100644 docs/install.rst
 create mode 100644 docs/installation/cloud/index.rst
 create mode 100644 docs/installation/image.rst
 create mode 100644 docs/installation/index.rst
 create mode 100644 docs/installation/install.rst
 create mode 100644 docs/installation/migrate-from-vyatta.rst
 create mode 100644 docs/installation/update.rst
 create mode 100644 docs/installation/virtual/gns3.rst
 create mode 100644 docs/installation/virtual/index.rst
 create mode 100644 docs/installation/virtual/vmware.rst
 create mode 100644 docs/installation/vyos-on-baremetal.rst
 delete mode 100644 docs/interfaces/addresses.rst
 delete mode 100644 docs/interfaces/bonding.rst
 delete mode 100644 docs/interfaces/bridging.rst
 delete mode 100644 docs/interfaces/dummy.rst
 delete mode 100644 docs/interfaces/ethernet.rst
 delete mode 100644 docs/interfaces/index.rst
 delete mode 100644 docs/interfaces/l2tpv3.rst
 delete mode 100644 docs/interfaces/pppoe.rst
 delete mode 100644 docs/interfaces/qinq.rst
 delete mode 100644 docs/interfaces/tunnel.rst
 delete mode 100644 docs/interfaces/vlan.rst
 delete mode 100644 docs/interfaces/vxlan.rst
 delete mode 100644 docs/interfaces/wireless.rst
 create mode 100644 docs/introducing/about.rst
 create mode 100644 docs/introducing/history.rst
 delete mode 100644 docs/load-balancing.rst
 delete mode 100644 docs/nat.rst
 create mode 100644 docs/operation/boot-options.rst
 create mode 100644 docs/operation/index.rst
 delete mode 100644 docs/qos.rst
 delete mode 100644 docs/routing/arp.rst
 delete mode 100644 docs/routing/bgp.rst
 delete mode 100644 docs/routing/index.rst
 delete mode 100644 docs/routing/ip-commands.rst
 delete mode 100644 docs/routing/mss-clamp.rst
 delete mode 100644 docs/routing/multicast.rst
 delete mode 100644 docs/routing/ospf.rst
 delete mode 100644 docs/routing/pbr.rst
 delete mode 100644 docs/routing/rip.rst
 delete mode 100644 docs/routing/routing-policy.rst
 delete mode 100644 docs/routing/static.rst
 delete mode 100644 docs/services/conntrack.rst
 delete mode 100644 docs/services/dhcp-relay.rst
 delete mode 100644 docs/services/dhcp.rst
 delete mode 100644 docs/services/dhcpv6.rst
 delete mode 100644 docs/services/dns-forwarding.rst
 delete mode 100644 docs/services/dynamic-dns.rst
 delete mode 100644 docs/services/index.rst
 delete mode 100644 docs/services/ipoe-server.rst
 delete mode 100644 docs/services/lldp.rst
 delete mode 100644 docs/services/mdns-repeater.rst
 delete mode 100644 docs/services/pppoe-server.rst
 delete mode 100644 docs/services/references.rst
 delete mode 100644 docs/services/snmp.rst
 delete mode 100644 docs/services/ssh.rst
 delete mode 100644 docs/services/tftp.rst
 delete mode 100644 docs/services/udp-broadcast-relay.rst
 delete mode 100644 docs/services/webproxy.rst
 delete mode 100644 docs/system/boot-options.rst
 delete mode 100644 docs/system/eventhandler.rst
 delete mode 100644 docs/system/flowaccounting.rst
 delete mode 100644 docs/system/host-information.rst
 delete mode 100644 docs/system/index.rst
 delete mode 100644 docs/system/login-users.rst
 delete mode 100644 docs/system/ntp.rst
 delete mode 100644 docs/system/proxy.rst
 delete mode 100644 docs/system/serialconsole.rst
 delete mode 100644 docs/system/syslog.rst
 delete mode 100644 docs/system/system-dns.rst
 delete mode 100644 docs/system/task-scheduler.rst
 delete mode 100644 docs/system/time-zone.rst
 create mode 100644 docs/troubleshooting/index.rst
 delete mode 100644 docs/vpn/dmvpn.rst
 delete mode 100644 docs/vpn/gre-ipsec.rst
 delete mode 100644 docs/vpn/index.rst
 delete mode 100644 docs/vpn/l2tp.rst
 delete mode 100644 docs/vpn/openvpn.rst
 delete mode 100644 docs/vpn/pptp.rst
 delete mode 100644 docs/vpn/references.rst
 delete mode 100644 docs/vpn/site2site_ipsec.rst
 delete mode 100644 docs/vpn/wireguard.rst
 create mode 100644 vale.ini

diff --git a/.github/styles/Google/AMPM.yml b/.github/styles/Google/AMPM.yml
new file mode 100644
index 00000000..fbdc6e4f
--- /dev/null
+++ b/.github/styles/Google/AMPM.yml
@@ -0,0 +1,9 @@
+extends: existence
+message: "Use 'AM' or 'PM' (preceded by a space)."
+link: 'https://developers.google.com/style/word-list'
+level: error
+nonword: true
+tokens:
+  - '\d{1,2}[AP]M'
+  - '\d{1,2} ?[ap]m'
+  - '\d{1,2} ?[aApP]\.[mM]\.'
diff --git a/.github/styles/Google/Acronyms.yml b/.github/styles/Google/Acronyms.yml
new file mode 100644
index 00000000..f41af018
--- /dev/null
+++ b/.github/styles/Google/Acronyms.yml
@@ -0,0 +1,64 @@
+extends: conditional
+message: "Spell out '%s', if it's unfamiliar to the audience."
+link: 'https://developers.google.com/style/abbreviations'
+level: suggestion
+ignorecase: false
+# Ensures that the existence of 'first' implies the existence of 'second'.
+first: '\b([A-Z]{3,5})\b'
+second: '(?:\b[A-Z][a-z]+ )+\(([A-Z]{3,5})\)'
+# ... with the exception of these:
+exceptions:
+  - API
+  - ASP
+  - CLI
+  - CPU
+  - CSS
+  - CSV
+  - DEBUG
+  - DOM
+  - DPI
+  - FAQ
+  - GCC
+  - GDB
+  - GET
+  - GPU
+  - GTK
+  - GUI
+  - HTML
+  - HTTP
+  - HTTPS
+  - IDE
+  - JAR
+  - JSON
+  - JSX
+  - LESS
+  - LLDB
+  - NET
+  - NOTE
+  - NVDA
+  - OSS
+  - PATH
+  - PDF
+  - PHP
+  - POST
+  - RAM
+  - REPL
+  - RSA
+  - SCM
+  - SCSS
+  - SDK
+  - SQL
+  - SSH
+  - SSL
+  - SVG
+  - TBD
+  - TCP
+  - TODO
+  - URI
+  - URL
+  - USB
+  - UTF
+  - XML
+  - XSS
+  - YAML
+  - ZIP
diff --git a/.github/styles/Google/Colons.yml b/.github/styles/Google/Colons.yml
new file mode 100644
index 00000000..9a4b4b4a
--- /dev/null
+++ b/.github/styles/Google/Colons.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "'%s' should be in lowercase."
+link: 'https://developers.google.com/style/colons'
+nonword: true
+level: warning
+tokens:
+  - ':\s[A-Z]'
diff --git a/.github/styles/Google/Contractions.yml b/.github/styles/Google/Contractions.yml
new file mode 100644
index 00000000..905a39f4
--- /dev/null
+++ b/.github/styles/Google/Contractions.yml
@@ -0,0 +1,28 @@
+extends: substitution
+message: "Feel free to use '%s' instead of '%s'."
+link: 'https://developers.google.com/style/contractions'
+level: suggestion
+ignorecase: true
+swap:
+  are not: aren't
+  cannot: can't
+  could not: couldn't
+  did not: didn't
+  do not: don't
+  does not: doesn't
+  has not: hasn't
+  have not: haven't
+  how is: how's
+  is not: isn't
+  it is: it's
+  should not: shouldn't
+  that is: that's
+  they are: they're
+  was not: wasn't
+  we are: we're
+  we have: we've
+  were not: weren't
+  what is: what's
+  when is: when's
+  where is: where's
+  will not: won't
diff --git a/.github/styles/Google/DateFormat.yml b/.github/styles/Google/DateFormat.yml
new file mode 100644
index 00000000..e9d227fa
--- /dev/null
+++ b/.github/styles/Google/DateFormat.yml
@@ -0,0 +1,9 @@
+extends: existence
+message: "Use 'July 31, 2016' format, not '%s'."
+link: 'https://developers.google.com/style/dates-times'
+ignorecase: true
+level: error
+nonword: true
+tokens:
+  - '\d{1,2}(?:\.|/)\d{1,2}(?:\.|/)\d{4}'
+  - '\d{1,2} (?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)|May|Jun(?:e)|Jul(?:y)|Aug(?:ust)|Sep(?:tember)?|Oct(?:ober)|Nov(?:ember)?|Dec(?:ember)?) \d{4}'
diff --git a/.github/styles/Google/Ellipses.yml b/.github/styles/Google/Ellipses.yml
new file mode 100644
index 00000000..436e6177
--- /dev/null
+++ b/.github/styles/Google/Ellipses.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "In general, don't use an ellipsis."
+link: 'https://developers.google.com/style/ellipses'
+nonword: true
+level: warning
+tokens:
+  - '\.\.\.'
diff --git a/.github/styles/Google/EmDash.yml b/.github/styles/Google/EmDash.yml
new file mode 100644
index 00000000..c6018db1
--- /dev/null
+++ b/.github/styles/Google/EmDash.yml
@@ -0,0 +1,8 @@
+extends: existence
+message: "Don't put a space before or after an em dash."
+link: 'https://developers.google.com/style/dashes'
+nonword: true
+level: error
+tokens:
+  - '\s—'
+  - '—\s'
diff --git a/.github/styles/Google/EnDash.yml b/.github/styles/Google/EnDash.yml
new file mode 100644
index 00000000..194876aa
--- /dev/null
+++ b/.github/styles/Google/EnDash.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Use an em dash ('—') instead of '–'."
+link: 'https://developers.google.com/style/dashes'
+nonword: true
+level: error
+tokens:
+  - '–'
diff --git a/.github/styles/Google/Exclamation.yml b/.github/styles/Google/Exclamation.yml
new file mode 100644
index 00000000..c4db380b
--- /dev/null
+++ b/.github/styles/Google/Exclamation.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Don't use exclamation points in text."
+link: 'https://developers.google.com/style/exclamation-points'
+nonword: true
+level: error
+tokens:
+  - '!'
diff --git a/.github/styles/Google/FirstPerson.yml b/.github/styles/Google/FirstPerson.yml
new file mode 100644
index 00000000..d2290611
--- /dev/null
+++ b/.github/styles/Google/FirstPerson.yml
@@ -0,0 +1,11 @@
+extends: existence
+message: "Avoid first-person pronouns such as '%s'."
+link: 'https://developers.google.com/style/pronouns#personal-pronouns'
+ignorecase: true
+level: warning
+nonword: true
+tokens:
+  - (?:^|\s)I\s
+  - \bme\b
+  - \bus\b
+  - \bours\b
diff --git a/.github/styles/Google/Gender.yml b/.github/styles/Google/Gender.yml
new file mode 100644
index 00000000..c8486181
--- /dev/null
+++ b/.github/styles/Google/Gender.yml
@@ -0,0 +1,9 @@
+extends: existence
+message: "Don't use '%s' as a gender-neutral pronoun."
+link: 'https://developers.google.com/style/pronouns#gender-neutral-pronouns'
+level: error
+ignorecase: true
+tokens:
+  - he/she
+  - s/he
+  - \(s\)he
diff --git a/.github/styles/Google/GenderBias.yml b/.github/styles/Google/GenderBias.yml
new file mode 100644
index 00000000..261cfb66
--- /dev/null
+++ b/.github/styles/Google/GenderBias.yml
@@ -0,0 +1,45 @@
+extends: substitution
+message: "Consider using '%s' instead of '%s'."
+link: 'https://developers.google.com/style/inclusive-documentation'
+ignorecase: true
+level: error
+swap:
+  (?:alumna|alumnus):          graduate
+  (?:alumnae|alumni):          graduates
+  air(?:m[ae]n|wom[ae]n):      pilot(s)
+  anchor(?:m[ae]n|wom[ae]n):   anchor(s)
+  authoress:                   author
+  camera(?:m[ae]n|wom[ae]n):   camera operator(s)
+  chair(?:m[ae]n|wom[ae]n):    chair(s)
+  congress(?:m[ae]n|wom[ae]n): member(s) of congress
+  door(?:m[ae]|wom[ae]n):      concierge(s)
+  draft(?:m[ae]n|wom[ae]n):    drafter(s)
+  fire(?:m[ae]n|wom[ae]n):     firefighter(s)
+  fisher(?:m[ae]n|wom[ae]n):   fisher(s)
+  fresh(?:m[ae]n|wom[ae]n):    first-year student(s)
+  garbage(?:m[ae]n|wom[ae]n):  waste collector(s)
+  lady lawyer:                 lawyer
+  ladylike:                    courteous
+  landlord:                    building manager
+  mail(?:m[ae]n|wom[ae]n):     mail carriers
+  man and wife:                husband and wife
+  man enough:                  strong enough
+  mankind:                     human kind
+  manmade:                     manufactured
+  manpower:                    personnel
+  men and girls:               men and women
+  middle(?:m[ae]n|wom[ae]n):   intermediary
+  news(?:m[ae]n|wom[ae]n):     journalist(s)
+  ombuds(?:man|woman):         ombuds
+  oneupmanship:                upstaging
+  poetess:                     poet
+  police(?:m[ae]n|wom[ae]n):   police officer(s)
+  repair(?:m[ae]n|wom[ae]n):   technician(s)
+  sales(?:m[ae]n|wom[ae]n):    salesperson or sales people
+  service(?:m[ae]n|wom[ae]n):  soldier(s)
+  steward(?:ess)?:             flight attendant
+  tribes(?:m[ae]n|wom[ae]n):   tribe member(s)
+  waitress:                    waiter
+  woman doctor:                doctor
+  woman scientist[s]?:         scientist(s)
+  work(?:m[ae]n|wom[ae]n):     worker(s)
diff --git a/.github/styles/Google/HeadingPunctuation.yml b/.github/styles/Google/HeadingPunctuation.yml
new file mode 100644
index 00000000..5c39abbf
--- /dev/null
+++ b/.github/styles/Google/HeadingPunctuation.yml
@@ -0,0 +1,8 @@
+extends: existence
+message: "Don't put a period at the end of a heading."
+link: 'https://developers.google.com/style/capitalization#capitalization-in-titles-and-headings'
+nonword: true
+level: warning
+scope: heading
+tokens:
+  - '[a-z0-9][.](?:\s|$)'
diff --git a/.github/styles/Google/Headings.yml b/.github/styles/Google/Headings.yml
new file mode 100644
index 00000000..5afb968d
--- /dev/null
+++ b/.github/styles/Google/Headings.yml
@@ -0,0 +1,26 @@
+extends: capitalization
+message: "'%s' should use sentence-style capitalization."
+link: 'https://developers.google.com/style/capitalization#capitalization-in-titles-and-headings'
+level: warning
+scope: heading
+match: $sentence
+exceptions:
+  - Azure
+  - CLI
+  - Code
+  - Cosmos
+  - Docker
+  - Emmet
+  - I
+  - Kubernetes
+  - Linux
+  - macOS
+  - Marketplace
+  - MongoDB
+  - REPL
+  - Studio
+  - TypeScript
+  - URLs
+  - Visual
+  - VS
+  - Windows
diff --git a/.github/styles/Google/Hyphens.yml b/.github/styles/Google/Hyphens.yml
new file mode 100644
index 00000000..f9779637
--- /dev/null
+++ b/.github/styles/Google/Hyphens.yml
@@ -0,0 +1,8 @@
+extends: existence
+message: "Don't place a space on either side of a hyphen (unless it's suspended)."
+link: 'https://developers.google.com/style/hyphens'
+level: warning
+nonword: true
+tokens:
+  - '\s-'
+  - '-\s'
diff --git a/.github/styles/Google/Latin.yml b/.github/styles/Google/Latin.yml
new file mode 100644
index 00000000..f032b349
--- /dev/null
+++ b/.github/styles/Google/Latin.yml
@@ -0,0 +1,9 @@
+extends: substitution
+message: "Use '%s' instead of '%s'."
+link: 'https://developers.google.com/style/abbreviations'
+ignorecase: true
+level: error
+nonword: true
+swap:
+  '\b(?:eg|e\.g\.)[\s,]': for example
+  '\b(?:ie|i\.e\.)[\s,]': that is
diff --git a/.github/styles/Google/LyHyphens.yml b/.github/styles/Google/LyHyphens.yml
new file mode 100644
index 00000000..d5b6a942
--- /dev/null
+++ b/.github/styles/Google/LyHyphens.yml
@@ -0,0 +1,8 @@
+extends: existence
+message: "'%s' doesn't need a hyphen."
+link: 'https://developers.google.com/style/hyphens'
+level: error
+ignorecase: false
+nonword: true
+tokens:
+  - '\s[^\s-]+ly-'
diff --git a/.github/styles/Google/OptionalPlurals.yml b/.github/styles/Google/OptionalPlurals.yml
new file mode 100644
index 00000000..7058932f
--- /dev/null
+++ b/.github/styles/Google/OptionalPlurals.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Don't use plurals in parentheses such as in '%s'."
+link: 'https://developers.google.com/style/plurals-parentheses'
+level: error
+nonword: true
+tokens:
+  - '\b\w+\(s\)'
diff --git a/.github/styles/Google/Ordinal.yml b/.github/styles/Google/Ordinal.yml
new file mode 100644
index 00000000..8c429e0f
--- /dev/null
+++ b/.github/styles/Google/Ordinal.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Spell out all ordinal numbers ('%s') in text."
+link: 'https://developers.google.com/style/numbers'
+level: error
+nonword: true
+tokens:
+  - \d+(?:st|th|rd)
diff --git a/.github/styles/Google/OxfordComma.yml b/.github/styles/Google/OxfordComma.yml
new file mode 100644
index 00000000..98b07113
--- /dev/null
+++ b/.github/styles/Google/OxfordComma.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Use the Oxford comma in '%s'."
+link: 'https://developers.google.com/style/commas'
+scope: sentence
+level: warning
+tokens:
+  - '(?:[^,]+,){1,}\s\w+\sand'
diff --git a/.github/styles/Google/Parens.yml b/.github/styles/Google/Parens.yml
new file mode 100644
index 00000000..3b8711d0
--- /dev/null
+++ b/.github/styles/Google/Parens.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Use parentheses judiciously."
+link: 'https://developers.google.com/style/parentheses'
+nonword: true
+level: suggestion
+tokens:
+  - '\(.+\)'
diff --git a/.github/styles/Google/Passive.yml b/.github/styles/Google/Passive.yml
new file mode 100644
index 00000000..3265890e
--- /dev/null
+++ b/.github/styles/Google/Passive.yml
@@ -0,0 +1,184 @@
+extends: existence
+link: 'https://developers.google.com/style/voice'
+message: "In general, use active voice instead of passive voice ('%s')."
+ignorecase: true
+level: suggestion
+raw:
+  - \b(am|are|were|being|is|been|was|be)\b\s*
+tokens:
+  - '[\w]+ed'
+  - awoken
+  - beat
+  - become
+  - been
+  - begun
+  - bent
+  - beset
+  - bet
+  - bid
+  - bidden
+  - bitten
+  - bled
+  - blown
+  - born
+  - bought
+  - bound
+  - bred
+  - broadcast
+  - broken
+  - brought
+  - built
+  - burnt
+  - burst
+  - cast
+  - caught
+  - chosen
+  - clung
+  - come
+  - cost
+  - crept
+  - cut
+  - dealt
+  - dived
+  - done
+  - drawn
+  - dreamt
+  - driven
+  - drunk
+  - dug
+  - eaten
+  - fallen
+  - fed
+  - felt
+  - fit
+  - fled
+  - flown
+  - flung
+  - forbidden
+  - foregone
+  - forgiven
+  - forgotten
+  - forsaken
+  - fought
+  - found
+  - frozen
+  - given
+  - gone
+  - gotten
+  - ground
+  - grown
+  - heard
+  - held
+  - hidden
+  - hit
+  - hung
+  - hurt
+  - kept
+  - knelt
+  - knit
+  - known
+  - laid
+  - lain
+  - leapt
+  - learnt
+  - led
+  - left
+  - lent
+  - let
+  - lighted
+  - lost
+  - made
+  - meant
+  - met
+  - misspelt
+  - mistaken
+  - mown
+  - overcome
+  - overdone
+  - overtaken
+  - overthrown
+  - paid
+  - pled
+  - proven
+  - put
+  - quit
+  - read
+  - rid
+  - ridden
+  - risen
+  - run
+  - rung
+  - said
+  - sat
+  - sawn
+  - seen
+  - sent
+  - set
+  - sewn
+  - shaken
+  - shaven
+  - shed
+  - shod
+  - shone
+  - shorn
+  - shot
+  - shown
+  - shrunk
+  - shut
+  - slain
+  - slept
+  - slid
+  - slit
+  - slung
+  - smitten
+  - sold
+  - sought
+  - sown
+  - sped
+  - spent
+  - spilt
+  - spit
+  - split
+  - spoken
+  - spread
+  - sprung
+  - spun
+  - stolen
+  - stood
+  - stridden
+  - striven
+  - struck
+  - strung
+  - stuck
+  - stung
+  - stunk
+  - sung
+  - sunk
+  - swept
+  - swollen
+  - sworn
+  - swum
+  - swung
+  - taken
+  - taught
+  - thought
+  - thrived
+  - thrown
+  - thrust
+  - told
+  - torn
+  - trodden
+  - understood
+  - upheld
+  - upset
+  - wed
+  - wept
+  - withheld
+  - withstood
+  - woken
+  - won
+  - worn
+  - wound
+  - woven
+  - written
+  - wrung
diff --git a/.github/styles/Google/Periods.yml b/.github/styles/Google/Periods.yml
new file mode 100644
index 00000000..d24a6a6c
--- /dev/null
+++ b/.github/styles/Google/Periods.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Don't use periods with acronyms or initialisms such as '%s'."
+link: 'https://developers.google.com/style/abbreviations'
+level: error
+nonword: true
+tokens:
+  - '\b(?:[A-Z]\.){3,}'
diff --git a/.github/styles/Google/Quotes.yml b/.github/styles/Google/Quotes.yml
new file mode 100644
index 00000000..3cb6f1ab
--- /dev/null
+++ b/.github/styles/Google/Quotes.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Commas and periods go inside quotation marks."
+link: 'https://developers.google.com/style/quotation-marks'
+level: error
+nonword: true
+tokens:
+  - '"[^"]+"[.,?]'
diff --git a/.github/styles/Google/Ranges.yml b/.github/styles/Google/Ranges.yml
new file mode 100644
index 00000000..3ec045e7
--- /dev/null
+++ b/.github/styles/Google/Ranges.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Don't add words such as 'from' or 'between' to describe a range of numbers."
+link: 'https://developers.google.com/style/hyphens'
+nonword: true
+level: warning
+tokens:
+  - '(?:from|between)\s\d+\s?-\s?\d+'
diff --git a/.github/styles/Google/Semicolons.yml b/.github/styles/Google/Semicolons.yml
new file mode 100644
index 00000000..bb8b85b4
--- /dev/null
+++ b/.github/styles/Google/Semicolons.yml
@@ -0,0 +1,8 @@
+extends: existence
+message: "Use semicolons judiciously."
+link: 'https://developers.google.com/style/semicolons'
+nonword: true
+scope: sentence
+level: suggestion
+tokens:
+  - ';'
diff --git a/.github/styles/Google/Slang.yml b/.github/styles/Google/Slang.yml
new file mode 100644
index 00000000..63f4c248
--- /dev/null
+++ b/.github/styles/Google/Slang.yml
@@ -0,0 +1,11 @@
+extends: existence
+message: "Don't use internet slang abbreviations such as '%s'."
+link: 'https://developers.google.com/style/abbreviations'
+ignorecase: true
+level: error
+tokens:
+  - 'tl;dr'
+  - ymmv
+  - rtfm
+  - imo
+  - fwiw
diff --git a/.github/styles/Google/Spacing.yml b/.github/styles/Google/Spacing.yml
new file mode 100644
index 00000000..5f209a9f
--- /dev/null
+++ b/.github/styles/Google/Spacing.yml
@@ -0,0 +1,8 @@
+extends: existence
+message: "'%s' should have one space."
+link: 'https://developers.google.com/style/sentence-spacing'
+level: error
+nonword: true
+tokens:
+  - '[.?!] {2,}[A-Z]'
+  - '[.?!][A-Z]'
diff --git a/.github/styles/Google/Spelling.yml b/.github/styles/Google/Spelling.yml
new file mode 100644
index 00000000..57acb884
--- /dev/null
+++ b/.github/styles/Google/Spelling.yml
@@ -0,0 +1,8 @@
+extends: existence
+message: "In general, use American spelling instead of '%s'."
+link: 'https://developers.google.com/style/spelling'
+ignorecase: true
+level: warning
+tokens:
+  - '(?:\w+)nised?'
+  - '(?:\w+)logue'
diff --git a/.github/styles/Google/Units.yml b/.github/styles/Google/Units.yml
new file mode 100644
index 00000000..220de3e9
--- /dev/null
+++ b/.github/styles/Google/Units.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Put a nonbreaking space between the number and the unit in '%s'."
+link: 'https://developers.google.com/style/units-of-measure'
+nonword: true
+level: error
+tokens:
+  - \d+(?:GB|TB|MB)
diff --git a/.github/styles/Google/Will.yml b/.github/styles/Google/Will.yml
new file mode 100644
index 00000000..128a9183
--- /dev/null
+++ b/.github/styles/Google/Will.yml
@@ -0,0 +1,7 @@
+extends: existence
+message: "Avoid using '%s'."
+link: 'https://developers.google.com/style/tense'
+ignorecase: true
+level: warning
+tokens:
+  - will
diff --git a/.github/styles/Google/WordList.yml b/.github/styles/Google/WordList.yml
new file mode 100644
index 00000000..d5d6bea5
--- /dev/null
+++ b/.github/styles/Google/WordList.yml
@@ -0,0 +1,79 @@
+extends: substitution
+message: "Use %s instead of '%s'."
+link: 'https://developers.google.com/style/word-list'
+level: warning
+ignorecase: false
+swap:
+  '(?:API Console|dev|developer) key': "'API key'"
+  '(?:cell ?phone|smart ?phone)': "'phone' or 'mobile phone'"
+  '(?:dev|developer|APIs) console': "'API console'"
+  '(?:e-mail|Email|E-mail)':  "'email'"
+  '(?:file ?path|path ?name)':  "'path'"
+  '(?:kill|terminate)': "'stop', 'exit', 'cancel', or 'end'"
+  '(?:OAuth ?2|Oauth)': "'OAuth 2.0'"
+  '(?:ok|Okay)': "'OK' or 'okay'"
+  '(?:WiFi|wifi)': "'Wi-Fi'"
+  '[\.]+apk': "'APK'"
+  '3\-D': "'3D'"
+  'Google (?:I\-O|IO)': "'Google I/O'"
+  'tap (?:&|and) hold': "'touch & hold'"
+  'un(?:check|select)': "'clear'"
+  abort: "'stop', 'exit', 'cancel' or 'end'"
+  above: "'preceding'"
+  account name: "'username'"
+  action bar: "'app bar'"
+  admin: "'administrator'"
+  Ajax: "'AJAX'"
+  Android device: "'Android-powered device'"
+  android: "'Android'"
+  API explorer: "'APIs Explorer'"
+  application: "'app'"
+  approx\.: "'approximately'"
+  authN: "'authentication'"
+  authZ: "'authorization'"
+  autoupdate: "'automatically update'"
+  cellular data: "'mobile data'"
+  cellular network: "'mobile network'"
+  chapter: "'documents', 'pages', 'sections'"
+  check box: "'checkbox'"
+  check: "'select'"
+  CLI: "'command-line tool'"
+  click on: "'click' or 'click in'"
+  Cloud: "'Google Cloud Platform' or 'GCP'"
+  Container Engine: "'Kubernetes Engine'"
+  content type: "'media type'"
+  curated roles: "'predefined roles'"
+  data are: "'data is'"
+  Developers Console: "'Google API Console' or 'API Console'"
+  disabled?: "'turn off' or 'off'"
+  ephemeral IP address: "'ephemeral external IP address'"
+  fewer data: "'less data'"
+  file name: "'filename'"
+  firewalls: "'firewall rules'"
+  functionality: "'capability' or 'feature'"
+  Google account: "'Google Account'"
+  Google accounts: "'Google Accounts'"
+  Googling: "'search with Google'"
+  grayed-out: "'unavailable'"
+  HTTPs: "'HTTPS'"
+  in order to: "'to'"
+  ingest: "'import' or 'load'"
+  k8s: "'Kubernetes'"
+  long press: "'touch & hold'"
+  network IP address: "'internal IP address'"
+  omnibox: "'address bar'"
+  open-source: "'open source'"
+  overview screen: "'recents screen'"
+  regex: "'regular expression'"
+  SHA1: "'SHA-1' or 'HAS-SHA1'"
+  sign into: "'sign in to'"
+  sign-?on: "'single sign-on'"
+  static IP address: "'static external IP address'"
+  stylesheet: "'style sheet'"
+  synch: "'sync'"
+  tablename: "'table name'"
+  tablet: "'device'"
+  touch: "'tap'"
+  url:  "'URL'"
+  vs\.: "'versus'"
+  World Wide Web: "'web'"
diff --git a/.github/styles/Google/meta.json b/.github/styles/Google/meta.json
new file mode 100644
index 00000000..3ae5fb21
--- /dev/null
+++ b/.github/styles/Google/meta.json
@@ -0,0 +1,16 @@
+{
+  "author": "Joseph Kato",
+  "description": "A Vale-compatible implementation of the Microsoft Writing Style Guide.",
+  "email": "support@errata.ai",
+  "lang": "en",
+  "url": "https://github.com/errata-ai/Google/releases/latest/download/Google.zip",
+  "feed": "https://github.com/errata-ai/Google/releases.atom",
+  "issues": "https://github.com/errata-ai/Google/issues/new",
+  "license": "MIT",
+  "name": "Google",
+  "sources": [
+    "https://developers.google.com/style/"
+  ],
+  "vale_version": ">=1.0.0",
+  "coverage": 0.0
+}
diff --git a/.github/styles/Google/vocab.txt b/.github/styles/Google/vocab.txt
new file mode 100644
index 00000000..e69de29b
diff --git a/.github/styles/VyOS/Terminology.yml b/.github/styles/VyOS/Terminology.yml
new file mode 100644
index 00000000..57c1e6d6
--- /dev/null
+++ b/.github/styles/VyOS/Terminology.yml
@@ -0,0 +1,9 @@
+extends: substitution
+message: Prefer '%s' over '%s'
+ignorecase: false
+level: warning
+swap:
+  vyos: VyOS
+  Vyos: VyOS
+  VYOS: VyOS
+  Gre: GRE
\ No newline at end of file
diff --git a/.github/vyos-linter.py b/.github/vyos-linter.py
new file mode 100644
index 00000000..502e47ae
--- /dev/null
+++ b/.github/vyos-linter.py
@@ -0,0 +1,177 @@
+import os
+import re
+import ipaddress
+import sys
+import ast
+
+IPV4SEG  = r'(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])'
+IPV4ADDR = r'\b(?:(?:' + IPV4SEG + r'\.){3,3}' + IPV4SEG + r')\b'
+IPV6SEG  = r'(?:(?:[0-9a-fA-F]){1,4})'
+IPV6GROUPS = (
+    r'(?:' + IPV6SEG + r':){7,7}' + IPV6SEG,                  # 1:2:3:4:5:6:7:8
+    r'(?:\s' + IPV6SEG + r':){1,7}:',                           # 1::                                 1:2:3:4:5:6:7::
+    r'(?:' + IPV6SEG + r':){1,6}:' + IPV6SEG,                 # 1::8               1:2:3:4:5:6::8   1:2:3:4:5:6::8
+    r'(?:' + IPV6SEG + r':){1,5}(?::' + IPV6SEG + r'){1,2}',  # 1::7:8             1:2:3:4:5::7:8   1:2:3:4:5::8
+    r'(?:' + IPV6SEG + r':){1,4}(?::' + IPV6SEG + r'){1,3}',  # 1::6:7:8           1:2:3:4::6:7:8   1:2:3:4::8
+    r'(?:' + IPV6SEG + r':){1,3}(?::' + IPV6SEG + r'){1,4}',  # 1::5:6:7:8         1:2:3::5:6:7:8   1:2:3::8
+    r'(?:' + IPV6SEG + r':){1,2}(?::' + IPV6SEG + r'){1,5}',  # 1::4:5:6:7:8       1:2::4:5:6:7:8   1:2::8
+    IPV6SEG + r':(?:(?::' + IPV6SEG + r'){1,6})',             # 1::3:4:5:6:7:8     1::3:4:5:6:7:8   1::8
+    r':(?:(?::' + IPV6SEG + r'){1,7}|:)',                     # ::2:3:4:5:6:7:8    ::2:3:4:5:6:7:8  ::8       ::
+    r'fe80:(?::' + IPV6SEG + r'){0,4}%[0-9a-zA-Z]{1,}',       # fe80::7:8%eth0     fe80::7:8%1  (link-local IPv6 addresses with zone index)
+    r'::(?:ffff(?::0{1,4}){0,1}:){0,1}[^\s:]' + IPV4ADDR,     # ::255.255.255.255  ::ffff:255.255.255.255  ::ffff:0:255.255.255.255 (IPv4-mapped IPv6 addresses and IPv4-translated addresses)
+    r'(?:' + IPV6SEG + r':){1,4}:[^\s:]' + IPV4ADDR,          # 2001:db8:3:4::192.0.2.33  64:ff9b::192.0.2.33 (IPv4-Embedded IPv6 Address)
+)
+IPV6ADDR = '|'.join(['(?:{})'.format(g) for g in IPV6GROUPS[::-1]])  # Reverse rows for greedy match
+
+MAC = r'([0-9A-F]{2}[:-]){5}([0-9A-F]{2})'
+
+NUMBER = r"([\s']\d+[\s'])"
+
+
+def lint_mac(cnt, line):
+    mac = re.search(MAC, line, re.I)
+    if mac is not None:
+        mac = mac.group()
+        u_mac = re.search(r'((00)[:-](53)([:-][0-9A-F]{2}){4})', mac, re.I)
+        m_mac = re.search(r'((90)[:-](10)([:-][0-9A-F]{2}){4})', mac, re.I)
+        if u_mac is None and m_mac is None:
+            return (f"Use MAC reserved for Documentation (RFC7042): {mac}", cnt, 'error')
+
+
+def lint_ipv4(cnt, line):
+    ip = re.search(IPV4ADDR, line, re.I)
+    if ip is not None:
+        ip = ipaddress.ip_address(ip.group().strip(' '))
+        # https://docs.python.org/3/library/ipaddress.html#ipaddress.IPv4Address.is_private
+        if ip.is_private:
+            return None
+        if ip.is_multicast:
+            return None
+        if ip.is_global is False:
+            return None
+        return (f"Use IPv4 reserved for Documentation (RFC 5737) or private Space: {ip}", cnt, 'error')
+
+
+def lint_ipv6(cnt, line):
+    ip = re.search(IPV6ADDR, line, re.I)
+    if ip is not None:
+        ip = ipaddress.ip_address(ip.group().strip(' '))
+        if ip.is_private:
+            return None
+        if ip.is_multicast:
+            return None
+        if ip.is_global is False:
+            return None
+        return (f"Use IPv6 reserved for Documentation (RFC 3849) or private Space: {ip}", cnt, 'error')
+
+
+def lint_AS(cnt, line):
+    number = re.search(NUMBER, line, re.I)
+    if number:
+        pass
+        # find a way to detect AS numbers
+
+
+def lint_linelen(cnt, line):
+    line = line.rstrip()
+    if len(line) > 80:
+        return (f"Line too long: len={len(line)}", cnt, 'warning')
+
+def handle_file_action(filepath):
+    errors = []
+    try:
+        with open(filepath) as fp:
+            line = fp.readline()
+            cnt = 1
+            test_line_lenght = True
+            start_vyoslinter = True
+            indentation = 0
+            while line:
+                # search for ignore linter comments in lines
+                if ".. stop_vyoslinter" in line:
+                    start_vyoslinter = False
+                if ".. start_vyoslinter" in line:
+                    start_vyoslinter = True
+                if start_vyoslinter:
+                    # ignore every '.. code-block::' for line lenght
+                    # rst code-block have its own style in html the format in rst
+                    # and the build page must be the same
+                    if test_line_lenght is False:
+                        if len(line) > indentation:
+                            #print(f"'{line}'")
+                            #print(indentation)
+                            if line[indentation].isspace() is False:
+                                test_line_lenght = True
+
+                    if ".. code-block::" in line:
+                        test_line_lenght = False
+                        indentation = 0
+                        for i in line:
+                            if i.isspace():
+                                indentation = indentation + 1
+                            else:
+                                break
+                    
+                    err_mac = lint_mac(cnt, line.strip())
+                    # disable mac detection for the moment, too many false positives
+                    err_mac = None
+                    err_ip4 = lint_ipv4(cnt, line.strip())
+                    err_ip6 = lint_ipv6(cnt, line.strip())
+                    if test_line_lenght:
+                        err_len = lint_linelen(cnt, line)
+                    else:
+                        err_len = None
+                    if err_mac:
+                        errors.append(err_mac)
+                    if err_ip4:
+                        errors.append(err_ip4)
+                    if err_ip6:
+                        errors.append(err_ip6)
+                    if err_len:
+                        errors.append(err_len)
+                
+                line = fp.readline()
+                cnt += 1
+            
+            # ensure linter was not stop on top and forgot to tun on again
+            if start_vyoslinter == False:
+                errors.append((f"Don't forgett to turn linter back on", cnt, 'error'))
+    finally:
+        fp.close()
+
+    if len(errors) > 0:
+        '''
+        "::{$type} file={$filename},line={$line},col=$column::{$log}"
+        '''
+        print(f"File: {filepath}")
+        for error in errors:
+            print(f"::{error[2]} file={filepath},line={error[1]}::{error[0]}")
+        print('')
+        return False
+
+
+def main():
+    bool_error = True
+    print('start')
+    try:
+        files = ast.literal_eval(sys.argv[1])
+        for file in files:
+                if file[-4:] in [".rst", ".txt"] and "_build" not in file:
+                    if handle_file_action(file) is False:
+                        bool_error = False
+    except Exception as e:
+        for root, dirs, files in os.walk("docs"):
+            path = root.split(os.sep)
+            for file in files:
+                if file[-4:] in [".rst", ".txt"] and "_build" not in path:
+                    fpath = '/'.join(path)
+                    filepath = f"{fpath}/{file}"
+                    if handle_file_action(filepath) is False:
+                        bool_error = False
+
+    return bool_error
+
+
+if __name__ == "__main__":
+    if main() == False:
+        exit(1)
\ No newline at end of file
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
new file mode 100644
index 00000000..fe87074c
--- /dev/null
+++ b/.github/workflows/main.yml
@@ -0,0 +1,32 @@
+name: Linting
+on:
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v2
+
+    - name: File Changes
+      id: file_changes
+      uses: trilom/file-changes-action@v1.2.3
+
+    #- name: Vale
+    #  uses: errata-ai/vale-action@v1.3.0
+    #  with:
+    #    files: '${{ steps.file_changes.outputs.files_modified }}' 
+
+    - name: Set up Python
+      uses: actions/setup-python@v2
+      with:
+        python-version: '3.x'
+
+    - name: run python based linter
+      run: python .github/vyos-linter.py '${{ steps.file_changes.outputs.files_modified }}'
+
+    env:
+      GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+    
+    
\ No newline at end of file
diff --git a/.github/workflows/submodules.yml b/.github/workflows/submodules.yml
new file mode 100644
index 00000000..d32530ba
--- /dev/null
+++ b/.github/workflows/submodules.yml
@@ -0,0 +1,32 @@
+name: Update submodule vyos-1x
+on:
+  workflow_dispatch:
+  schedule:
+  # 06:00 UTC on Monday
+    - cron:  '0 6 * * 1'
+jobs:
+  updatVyOS-1x:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          repository: ${{ github.repository }}
+      - name: update submodule
+        run: |
+          git submodule status
+          git submodule update --init --force
+          cd docs/_include/vyos-1x
+          git checkout crux
+          git pull
+          git submodule status
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v3
+        with:
+          token: ${{secrets.GITHUB_TOKEN}}
+          commit-message: Update vyos-1x submodule
+          committer: GitHub <noreply@github.com>
+          author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          title: Update vyos-1x submodule
+          body: |
+            Autoupdate vyos-1x submodule
+          branch: update-dependencies
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 06d7c4cd..053e3cd4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,8 @@
+# Sphinx
+_build/
+
 # python virtualenv
+Pipfile.lock
 venv/
 ENV/
 .venv
@@ -12,11 +16,11 @@ ENV/
 
 # python cache files
 *.pyc
-__pychache__
+__pycache__
 
 # dotenv
 .env
 .envrc
 
 # os specific
-.DS_Store
+.DS_Store
\ No newline at end of file
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 00000000..16e68e7a
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,4 @@
+[submodule "docs/_include/vyos-1x"]
+	path = docs/_include/vyos-1x
+	url = https://github.com/vyos/vyos-1x
+	branch = crux
\ No newline at end of file
diff --git a/.vale b/.vale
deleted file mode 100644
index a23be76b..00000000
--- a/.vale
+++ /dev/null
@@ -1,34 +0,0 @@
-StylesPath = ci/vale
-MinAlertLevel = suggestion
-
-[*.rst]
-BasedOnStyles = VyOS
-
-Google.DateFormat = YES
-vale.GenderBias = NO
-vale.Hedging = NO
-vale.Redundancy = NO
-vale.Repetition = YES
-vale.Uncomparables = NO
-proselint.GenderBias = YES
-
-# Custom block scoping (see the regex101 links for unit tests):
-#
-# Rule #1 (https://regex101.com/r/TJQLJ4/2/tests): Ignore `{%comment%}` blocks. This
-# keeps Vale from flagging 'endcomment' as a spelling mistake.
-#
-# Rule #2 (https://regex101.com/r/7VA2lV/2/tests): Ignore `<div>`s and `<section>`s
-# that specify `markdown="1"` since it isn't supported by Vale's Markdown
-# parser (https://github.com/russross/blackfriday/issues/184).
-#
-# Rule #3 (https://regex101.com/r/NxFflU/1/tests): Ignore `{% include %}`-codeblock
-# pairs.
-BlockIgnores = (?s)({%\s?comment\s?%}.+?{%\s?endcomment\s?%}), \
-(?s)(<(?:div|section)[^>]*markdown="1"[^>]*>.*?</(?:div|section)>), \
-(?s)((?: *{% include [^%]+ %}\n)? *~~~.*?~~~~?)
-
-# Custom inline scoping (see the regex101 links for unit tests):
-#
-# Rule #1 (https://regex101.com/r/cTiITH/2/tests): Ignore `{% include %}`s, which
-# contain file paths.
-TokenIgnores = ({%\s?include\s? {{ [^}]+ }}[^%]+\s?%})
diff --git a/Pipfile b/Pipfile
new file mode 100644
index 00000000..e0d3438f
--- /dev/null
+++ b/Pipfile
@@ -0,0 +1,14 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+sphinx-rtd-theme = "*"
+docutils = "*"
+Sphinx = ">=1.4.3"
+
+[dev-packages]
+
+[requires]
+python_version = "3.9"
diff --git a/ci/vale/Google/AMPM.yml b/ci/vale/Google/AMPM.yml
deleted file mode 100644
index fbdc6e4f..00000000
--- a/ci/vale/Google/AMPM.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-extends: existence
-message: "Use 'AM' or 'PM' (preceded by a space)."
-link: 'https://developers.google.com/style/word-list'
-level: error
-nonword: true
-tokens:
-  - '\d{1,2}[AP]M'
-  - '\d{1,2} ?[ap]m'
-  - '\d{1,2} ?[aApP]\.[mM]\.'
diff --git a/ci/vale/Google/Acronyms.yml b/ci/vale/Google/Acronyms.yml
deleted file mode 100644
index f41af018..00000000
--- a/ci/vale/Google/Acronyms.yml
+++ /dev/null
@@ -1,64 +0,0 @@
-extends: conditional
-message: "Spell out '%s', if it's unfamiliar to the audience."
-link: 'https://developers.google.com/style/abbreviations'
-level: suggestion
-ignorecase: false
-# Ensures that the existence of 'first' implies the existence of 'second'.
-first: '\b([A-Z]{3,5})\b'
-second: '(?:\b[A-Z][a-z]+ )+\(([A-Z]{3,5})\)'
-# ... with the exception of these:
-exceptions:
-  - API
-  - ASP
-  - CLI
-  - CPU
-  - CSS
-  - CSV
-  - DEBUG
-  - DOM
-  - DPI
-  - FAQ
-  - GCC
-  - GDB
-  - GET
-  - GPU
-  - GTK
-  - GUI
-  - HTML
-  - HTTP
-  - HTTPS
-  - IDE
-  - JAR
-  - JSON
-  - JSX
-  - LESS
-  - LLDB
-  - NET
-  - NOTE
-  - NVDA
-  - OSS
-  - PATH
-  - PDF
-  - PHP
-  - POST
-  - RAM
-  - REPL
-  - RSA
-  - SCM
-  - SCSS
-  - SDK
-  - SQL
-  - SSH
-  - SSL
-  - SVG
-  - TBD
-  - TCP
-  - TODO
-  - URI
-  - URL
-  - USB
-  - UTF
-  - XML
-  - XSS
-  - YAML
-  - ZIP
diff --git a/ci/vale/Google/Colons.yml b/ci/vale/Google/Colons.yml
deleted file mode 100644
index 9a4b4b4a..00000000
--- a/ci/vale/Google/Colons.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "'%s' should be in lowercase."
-link: 'https://developers.google.com/style/colons'
-nonword: true
-level: warning
-tokens:
-  - ':\s[A-Z]'
diff --git a/ci/vale/Google/Contractions.yml b/ci/vale/Google/Contractions.yml
deleted file mode 100644
index 905a39f4..00000000
--- a/ci/vale/Google/Contractions.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-extends: substitution
-message: "Feel free to use '%s' instead of '%s'."
-link: 'https://developers.google.com/style/contractions'
-level: suggestion
-ignorecase: true
-swap:
-  are not: aren't
-  cannot: can't
-  could not: couldn't
-  did not: didn't
-  do not: don't
-  does not: doesn't
-  has not: hasn't
-  have not: haven't
-  how is: how's
-  is not: isn't
-  it is: it's
-  should not: shouldn't
-  that is: that's
-  they are: they're
-  was not: wasn't
-  we are: we're
-  we have: we've
-  were not: weren't
-  what is: what's
-  when is: when's
-  where is: where's
-  will not: won't
diff --git a/ci/vale/Google/DateFormat.yml b/ci/vale/Google/DateFormat.yml
deleted file mode 100644
index e9d227fa..00000000
--- a/ci/vale/Google/DateFormat.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-extends: existence
-message: "Use 'July 31, 2016' format, not '%s'."
-link: 'https://developers.google.com/style/dates-times'
-ignorecase: true
-level: error
-nonword: true
-tokens:
-  - '\d{1,2}(?:\.|/)\d{1,2}(?:\.|/)\d{4}'
-  - '\d{1,2} (?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)|May|Jun(?:e)|Jul(?:y)|Aug(?:ust)|Sep(?:tember)?|Oct(?:ober)|Nov(?:ember)?|Dec(?:ember)?) \d{4}'
diff --git a/ci/vale/Google/Ellipses.yml b/ci/vale/Google/Ellipses.yml
deleted file mode 100644
index 436e6177..00000000
--- a/ci/vale/Google/Ellipses.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "In general, don't use an ellipsis."
-link: 'https://developers.google.com/style/ellipses'
-nonword: true
-level: warning
-tokens:
-  - '\.\.\.'
diff --git a/ci/vale/Google/EmDash.yml b/ci/vale/Google/EmDash.yml
deleted file mode 100644
index c6018db1..00000000
--- a/ci/vale/Google/EmDash.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-extends: existence
-message: "Don't put a space before or after an em dash."
-link: 'https://developers.google.com/style/dashes'
-nonword: true
-level: error
-tokens:
-  - '\s—'
-  - '—\s'
diff --git a/ci/vale/Google/EnDash.yml b/ci/vale/Google/EnDash.yml
deleted file mode 100644
index 194876aa..00000000
--- a/ci/vale/Google/EnDash.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Use an em dash ('—') instead of '–'."
-link: 'https://developers.google.com/style/dashes'
-nonword: true
-level: error
-tokens:
-  - '–'
diff --git a/ci/vale/Google/Exclamation.yml b/ci/vale/Google/Exclamation.yml
deleted file mode 100644
index c4db380b..00000000
--- a/ci/vale/Google/Exclamation.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Don't use exclamation points in text."
-link: 'https://developers.google.com/style/exclamation-points'
-nonword: true
-level: error
-tokens:
-  - '!'
diff --git a/ci/vale/Google/FirstPerson.yml b/ci/vale/Google/FirstPerson.yml
deleted file mode 100644
index d2290611..00000000
--- a/ci/vale/Google/FirstPerson.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-extends: existence
-message: "Avoid first-person pronouns such as '%s'."
-link: 'https://developers.google.com/style/pronouns#personal-pronouns'
-ignorecase: true
-level: warning
-nonword: true
-tokens:
-  - (?:^|\s)I\s
-  - \bme\b
-  - \bus\b
-  - \bours\b
diff --git a/ci/vale/Google/Gender.yml b/ci/vale/Google/Gender.yml
deleted file mode 100644
index c8486181..00000000
--- a/ci/vale/Google/Gender.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-extends: existence
-message: "Don't use '%s' as a gender-neutral pronoun."
-link: 'https://developers.google.com/style/pronouns#gender-neutral-pronouns'
-level: error
-ignorecase: true
-tokens:
-  - he/she
-  - s/he
-  - \(s\)he
diff --git a/ci/vale/Google/GenderBias.yml b/ci/vale/Google/GenderBias.yml
deleted file mode 100644
index 261cfb66..00000000
--- a/ci/vale/Google/GenderBias.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-extends: substitution
-message: "Consider using '%s' instead of '%s'."
-link: 'https://developers.google.com/style/inclusive-documentation'
-ignorecase: true
-level: error
-swap:
-  (?:alumna|alumnus):          graduate
-  (?:alumnae|alumni):          graduates
-  air(?:m[ae]n|wom[ae]n):      pilot(s)
-  anchor(?:m[ae]n|wom[ae]n):   anchor(s)
-  authoress:                   author
-  camera(?:m[ae]n|wom[ae]n):   camera operator(s)
-  chair(?:m[ae]n|wom[ae]n):    chair(s)
-  congress(?:m[ae]n|wom[ae]n): member(s) of congress
-  door(?:m[ae]|wom[ae]n):      concierge(s)
-  draft(?:m[ae]n|wom[ae]n):    drafter(s)
-  fire(?:m[ae]n|wom[ae]n):     firefighter(s)
-  fisher(?:m[ae]n|wom[ae]n):   fisher(s)
-  fresh(?:m[ae]n|wom[ae]n):    first-year student(s)
-  garbage(?:m[ae]n|wom[ae]n):  waste collector(s)
-  lady lawyer:                 lawyer
-  ladylike:                    courteous
-  landlord:                    building manager
-  mail(?:m[ae]n|wom[ae]n):     mail carriers
-  man and wife:                husband and wife
-  man enough:                  strong enough
-  mankind:                     human kind
-  manmade:                     manufactured
-  manpower:                    personnel
-  men and girls:               men and women
-  middle(?:m[ae]n|wom[ae]n):   intermediary
-  news(?:m[ae]n|wom[ae]n):     journalist(s)
-  ombuds(?:man|woman):         ombuds
-  oneupmanship:                upstaging
-  poetess:                     poet
-  police(?:m[ae]n|wom[ae]n):   police officer(s)
-  repair(?:m[ae]n|wom[ae]n):   technician(s)
-  sales(?:m[ae]n|wom[ae]n):    salesperson or sales people
-  service(?:m[ae]n|wom[ae]n):  soldier(s)
-  steward(?:ess)?:             flight attendant
-  tribes(?:m[ae]n|wom[ae]n):   tribe member(s)
-  waitress:                    waiter
-  woman doctor:                doctor
-  woman scientist[s]?:         scientist(s)
-  work(?:m[ae]n|wom[ae]n):     worker(s)
diff --git a/ci/vale/Google/HeadingPunctuation.yml b/ci/vale/Google/HeadingPunctuation.yml
deleted file mode 100644
index 5c39abbf..00000000
--- a/ci/vale/Google/HeadingPunctuation.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-extends: existence
-message: "Don't put a period at the end of a heading."
-link: 'https://developers.google.com/style/capitalization#capitalization-in-titles-and-headings'
-nonword: true
-level: warning
-scope: heading
-tokens:
-  - '[a-z0-9][.](?:\s|$)'
diff --git a/ci/vale/Google/Headings.yml b/ci/vale/Google/Headings.yml
deleted file mode 100644
index 5afb968d..00000000
--- a/ci/vale/Google/Headings.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-extends: capitalization
-message: "'%s' should use sentence-style capitalization."
-link: 'https://developers.google.com/style/capitalization#capitalization-in-titles-and-headings'
-level: warning
-scope: heading
-match: $sentence
-exceptions:
-  - Azure
-  - CLI
-  - Code
-  - Cosmos
-  - Docker
-  - Emmet
-  - I
-  - Kubernetes
-  - Linux
-  - macOS
-  - Marketplace
-  - MongoDB
-  - REPL
-  - Studio
-  - TypeScript
-  - URLs
-  - Visual
-  - VS
-  - Windows
diff --git a/ci/vale/Google/Hyphens.yml b/ci/vale/Google/Hyphens.yml
deleted file mode 100644
index f9779637..00000000
--- a/ci/vale/Google/Hyphens.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-extends: existence
-message: "Don't place a space on either side of a hyphen (unless it's suspended)."
-link: 'https://developers.google.com/style/hyphens'
-level: warning
-nonword: true
-tokens:
-  - '\s-'
-  - '-\s'
diff --git a/ci/vale/Google/Latin.yml b/ci/vale/Google/Latin.yml
deleted file mode 100644
index f032b349..00000000
--- a/ci/vale/Google/Latin.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-extends: substitution
-message: "Use '%s' instead of '%s'."
-link: 'https://developers.google.com/style/abbreviations'
-ignorecase: true
-level: error
-nonword: true
-swap:
-  '\b(?:eg|e\.g\.)[\s,]': for example
-  '\b(?:ie|i\.e\.)[\s,]': that is
diff --git a/ci/vale/Google/LyHyphens.yml b/ci/vale/Google/LyHyphens.yml
deleted file mode 100644
index d5b6a942..00000000
--- a/ci/vale/Google/LyHyphens.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-extends: existence
-message: "'%s' doesn't need a hyphen."
-link: 'https://developers.google.com/style/hyphens'
-level: error
-ignorecase: false
-nonword: true
-tokens:
-  - '\s[^\s-]+ly-'
diff --git a/ci/vale/Google/OptionalPlurals.yml b/ci/vale/Google/OptionalPlurals.yml
deleted file mode 100644
index 7058932f..00000000
--- a/ci/vale/Google/OptionalPlurals.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Don't use plurals in parentheses such as in '%s'."
-link: 'https://developers.google.com/style/plurals-parentheses'
-level: error
-nonword: true
-tokens:
-  - '\b\w+\(s\)'
diff --git a/ci/vale/Google/Ordinal.yml b/ci/vale/Google/Ordinal.yml
deleted file mode 100644
index 8c429e0f..00000000
--- a/ci/vale/Google/Ordinal.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Spell out all ordinal numbers ('%s') in text."
-link: 'https://developers.google.com/style/numbers'
-level: error
-nonword: true
-tokens:
-  - \d+(?:st|th|rd)
diff --git a/ci/vale/Google/OxfordComma.yml b/ci/vale/Google/OxfordComma.yml
deleted file mode 100644
index 98b07113..00000000
--- a/ci/vale/Google/OxfordComma.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Use the Oxford comma in '%s'."
-link: 'https://developers.google.com/style/commas'
-scope: sentence
-level: warning
-tokens:
-  - '(?:[^,]+,){1,}\s\w+\sand'
diff --git a/ci/vale/Google/Parens.yml b/ci/vale/Google/Parens.yml
deleted file mode 100644
index 3b8711d0..00000000
--- a/ci/vale/Google/Parens.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Use parentheses judiciously."
-link: 'https://developers.google.com/style/parentheses'
-nonword: true
-level: suggestion
-tokens:
-  - '\(.+\)'
diff --git a/ci/vale/Google/Passive.yml b/ci/vale/Google/Passive.yml
deleted file mode 100644
index 3265890e..00000000
--- a/ci/vale/Google/Passive.yml
+++ /dev/null
@@ -1,184 +0,0 @@
-extends: existence
-link: 'https://developers.google.com/style/voice'
-message: "In general, use active voice instead of passive voice ('%s')."
-ignorecase: true
-level: suggestion
-raw:
-  - \b(am|are|were|being|is|been|was|be)\b\s*
-tokens:
-  - '[\w]+ed'
-  - awoken
-  - beat
-  - become
-  - been
-  - begun
-  - bent
-  - beset
-  - bet
-  - bid
-  - bidden
-  - bitten
-  - bled
-  - blown
-  - born
-  - bought
-  - bound
-  - bred
-  - broadcast
-  - broken
-  - brought
-  - built
-  - burnt
-  - burst
-  - cast
-  - caught
-  - chosen
-  - clung
-  - come
-  - cost
-  - crept
-  - cut
-  - dealt
-  - dived
-  - done
-  - drawn
-  - dreamt
-  - driven
-  - drunk
-  - dug
-  - eaten
-  - fallen
-  - fed
-  - felt
-  - fit
-  - fled
-  - flown
-  - flung
-  - forbidden
-  - foregone
-  - forgiven
-  - forgotten
-  - forsaken
-  - fought
-  - found
-  - frozen
-  - given
-  - gone
-  - gotten
-  - ground
-  - grown
-  - heard
-  - held
-  - hidden
-  - hit
-  - hung
-  - hurt
-  - kept
-  - knelt
-  - knit
-  - known
-  - laid
-  - lain
-  - leapt
-  - learnt
-  - led
-  - left
-  - lent
-  - let
-  - lighted
-  - lost
-  - made
-  - meant
-  - met
-  - misspelt
-  - mistaken
-  - mown
-  - overcome
-  - overdone
-  - overtaken
-  - overthrown
-  - paid
-  - pled
-  - proven
-  - put
-  - quit
-  - read
-  - rid
-  - ridden
-  - risen
-  - run
-  - rung
-  - said
-  - sat
-  - sawn
-  - seen
-  - sent
-  - set
-  - sewn
-  - shaken
-  - shaven
-  - shed
-  - shod
-  - shone
-  - shorn
-  - shot
-  - shown
-  - shrunk
-  - shut
-  - slain
-  - slept
-  - slid
-  - slit
-  - slung
-  - smitten
-  - sold
-  - sought
-  - sown
-  - sped
-  - spent
-  - spilt
-  - spit
-  - split
-  - spoken
-  - spread
-  - sprung
-  - spun
-  - stolen
-  - stood
-  - stridden
-  - striven
-  - struck
-  - strung
-  - stuck
-  - stung
-  - stunk
-  - sung
-  - sunk
-  - swept
-  - swollen
-  - sworn
-  - swum
-  - swung
-  - taken
-  - taught
-  - thought
-  - thrived
-  - thrown
-  - thrust
-  - told
-  - torn
-  - trodden
-  - understood
-  - upheld
-  - upset
-  - wed
-  - wept
-  - withheld
-  - withstood
-  - woken
-  - won
-  - worn
-  - wound
-  - woven
-  - written
-  - wrung
diff --git a/ci/vale/Google/Periods.yml b/ci/vale/Google/Periods.yml
deleted file mode 100644
index d24a6a6c..00000000
--- a/ci/vale/Google/Periods.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Don't use periods with acronyms or initialisms such as '%s'."
-link: 'https://developers.google.com/style/abbreviations'
-level: error
-nonword: true
-tokens:
-  - '\b(?:[A-Z]\.){3,}'
diff --git a/ci/vale/Google/Quotes.yml b/ci/vale/Google/Quotes.yml
deleted file mode 100644
index 3cb6f1ab..00000000
--- a/ci/vale/Google/Quotes.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Commas and periods go inside quotation marks."
-link: 'https://developers.google.com/style/quotation-marks'
-level: error
-nonword: true
-tokens:
-  - '"[^"]+"[.,?]'
diff --git a/ci/vale/Google/Ranges.yml b/ci/vale/Google/Ranges.yml
deleted file mode 100644
index 3ec045e7..00000000
--- a/ci/vale/Google/Ranges.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Don't add words such as 'from' or 'between' to describe a range of numbers."
-link: 'https://developers.google.com/style/hyphens'
-nonword: true
-level: warning
-tokens:
-  - '(?:from|between)\s\d+\s?-\s?\d+'
diff --git a/ci/vale/Google/Semicolons.yml b/ci/vale/Google/Semicolons.yml
deleted file mode 100644
index bb8b85b4..00000000
--- a/ci/vale/Google/Semicolons.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-extends: existence
-message: "Use semicolons judiciously."
-link: 'https://developers.google.com/style/semicolons'
-nonword: true
-scope: sentence
-level: suggestion
-tokens:
-  - ';'
diff --git a/ci/vale/Google/Slang.yml b/ci/vale/Google/Slang.yml
deleted file mode 100644
index 63f4c248..00000000
--- a/ci/vale/Google/Slang.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-extends: existence
-message: "Don't use internet slang abbreviations such as '%s'."
-link: 'https://developers.google.com/style/abbreviations'
-ignorecase: true
-level: error
-tokens:
-  - 'tl;dr'
-  - ymmv
-  - rtfm
-  - imo
-  - fwiw
diff --git a/ci/vale/Google/Spacing.yml b/ci/vale/Google/Spacing.yml
deleted file mode 100644
index 5f209a9f..00000000
--- a/ci/vale/Google/Spacing.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-extends: existence
-message: "'%s' should have one space."
-link: 'https://developers.google.com/style/sentence-spacing'
-level: error
-nonword: true
-tokens:
-  - '[.?!] {2,}[A-Z]'
-  - '[.?!][A-Z]'
diff --git a/ci/vale/Google/Spelling.yml b/ci/vale/Google/Spelling.yml
deleted file mode 100644
index 57acb884..00000000
--- a/ci/vale/Google/Spelling.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-extends: existence
-message: "In general, use American spelling instead of '%s'."
-link: 'https://developers.google.com/style/spelling'
-ignorecase: true
-level: warning
-tokens:
-  - '(?:\w+)nised?'
-  - '(?:\w+)logue'
diff --git a/ci/vale/Google/Units.yml b/ci/vale/Google/Units.yml
deleted file mode 100644
index 220de3e9..00000000
--- a/ci/vale/Google/Units.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Put a nonbreaking space between the number and the unit in '%s'."
-link: 'https://developers.google.com/style/units-of-measure'
-nonword: true
-level: error
-tokens:
-  - \d+(?:GB|TB|MB)
diff --git a/ci/vale/Google/Will.yml b/ci/vale/Google/Will.yml
deleted file mode 100644
index 128a9183..00000000
--- a/ci/vale/Google/Will.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-extends: existence
-message: "Avoid using '%s'."
-link: 'https://developers.google.com/style/tense'
-ignorecase: true
-level: warning
-tokens:
-  - will
diff --git a/ci/vale/Google/WordList.yml b/ci/vale/Google/WordList.yml
deleted file mode 100644
index d5d6bea5..00000000
--- a/ci/vale/Google/WordList.yml
+++ /dev/null
@@ -1,79 +0,0 @@
-extends: substitution
-message: "Use %s instead of '%s'."
-link: 'https://developers.google.com/style/word-list'
-level: warning
-ignorecase: false
-swap:
-  '(?:API Console|dev|developer) key': "'API key'"
-  '(?:cell ?phone|smart ?phone)': "'phone' or 'mobile phone'"
-  '(?:dev|developer|APIs) console': "'API console'"
-  '(?:e-mail|Email|E-mail)':  "'email'"
-  '(?:file ?path|path ?name)':  "'path'"
-  '(?:kill|terminate)': "'stop', 'exit', 'cancel', or 'end'"
-  '(?:OAuth ?2|Oauth)': "'OAuth 2.0'"
-  '(?:ok|Okay)': "'OK' or 'okay'"
-  '(?:WiFi|wifi)': "'Wi-Fi'"
-  '[\.]+apk': "'APK'"
-  '3\-D': "'3D'"
-  'Google (?:I\-O|IO)': "'Google I/O'"
-  'tap (?:&|and) hold': "'touch & hold'"
-  'un(?:check|select)': "'clear'"
-  abort: "'stop', 'exit', 'cancel' or 'end'"
-  above: "'preceding'"
-  account name: "'username'"
-  action bar: "'app bar'"
-  admin: "'administrator'"
-  Ajax: "'AJAX'"
-  Android device: "'Android-powered device'"
-  android: "'Android'"
-  API explorer: "'APIs Explorer'"
-  application: "'app'"
-  approx\.: "'approximately'"
-  authN: "'authentication'"
-  authZ: "'authorization'"
-  autoupdate: "'automatically update'"
-  cellular data: "'mobile data'"
-  cellular network: "'mobile network'"
-  chapter: "'documents', 'pages', 'sections'"
-  check box: "'checkbox'"
-  check: "'select'"
-  CLI: "'command-line tool'"
-  click on: "'click' or 'click in'"
-  Cloud: "'Google Cloud Platform' or 'GCP'"
-  Container Engine: "'Kubernetes Engine'"
-  content type: "'media type'"
-  curated roles: "'predefined roles'"
-  data are: "'data is'"
-  Developers Console: "'Google API Console' or 'API Console'"
-  disabled?: "'turn off' or 'off'"
-  ephemeral IP address: "'ephemeral external IP address'"
-  fewer data: "'less data'"
-  file name: "'filename'"
-  firewalls: "'firewall rules'"
-  functionality: "'capability' or 'feature'"
-  Google account: "'Google Account'"
-  Google accounts: "'Google Accounts'"
-  Googling: "'search with Google'"
-  grayed-out: "'unavailable'"
-  HTTPs: "'HTTPS'"
-  in order to: "'to'"
-  ingest: "'import' or 'load'"
-  k8s: "'Kubernetes'"
-  long press: "'touch & hold'"
-  network IP address: "'internal IP address'"
-  omnibox: "'address bar'"
-  open-source: "'open source'"
-  overview screen: "'recents screen'"
-  regex: "'regular expression'"
-  SHA1: "'SHA-1' or 'HAS-SHA1'"
-  sign into: "'sign in to'"
-  sign-?on: "'single sign-on'"
-  static IP address: "'static external IP address'"
-  stylesheet: "'style sheet'"
-  synch: "'sync'"
-  tablename: "'table name'"
-  tablet: "'device'"
-  touch: "'tap'"
-  url:  "'URL'"
-  vs\.: "'versus'"
-  World Wide Web: "'web'"
diff --git a/ci/vale/Google/meta.json b/ci/vale/Google/meta.json
deleted file mode 100644
index 3ae5fb21..00000000
--- a/ci/vale/Google/meta.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "author": "Joseph Kato",
-  "description": "A Vale-compatible implementation of the Microsoft Writing Style Guide.",
-  "email": "support@errata.ai",
-  "lang": "en",
-  "url": "https://github.com/errata-ai/Google/releases/latest/download/Google.zip",
-  "feed": "https://github.com/errata-ai/Google/releases.atom",
-  "issues": "https://github.com/errata-ai/Google/issues/new",
-  "license": "MIT",
-  "name": "Google",
-  "sources": [
-    "https://developers.google.com/style/"
-  ],
-  "vale_version": ">=1.0.0",
-  "coverage": 0.0
-}
diff --git a/ci/vale/Google/vocab.txt b/ci/vale/Google/vocab.txt
deleted file mode 100644
index e69de29b..00000000
diff --git a/ci/vale/VyOS/Terminology.yml b/ci/vale/VyOS/Terminology.yml
deleted file mode 100644
index 57c1e6d6..00000000
--- a/ci/vale/VyOS/Terminology.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-extends: substitution
-message: Prefer '%s' over '%s'
-ignorecase: false
-level: warning
-swap:
-  vyos: VyOS
-  Vyos: VyOS
-  VYOS: VyOS
-  Gre: GRE
\ No newline at end of file
diff --git a/docs/.gitignore b/docs/.gitignore
deleted file mode 100644
index 69fa449d..00000000
--- a/docs/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-_build/
diff --git a/docs/_ext/test-coverage.py b/docs/_ext/test-coverage.py
new file mode 100644
index 00000000..70714d6b
--- /dev/null
+++ b/docs/_ext/test-coverage.py
@@ -0,0 +1,351 @@
+'''
+generate json with all commands from xml for vyos documentation coverage
+
+'''
+
+
+import sys
+import os
+import json
+import re
+import logging
+
+from io import BytesIO
+from lxml import etree as ET
+import shutil
+
+default_constraint_err_msg = "Invalid value"
+validator_dir = ""
+
+
+input_data = [
+    {
+        "kind": "cfgcmd",
+        "input_dir": "_include/vyos-1x/interface-definitions/",
+        "schema_file": "_include/vyos-1x/schema/interface_definition.rng",
+        "files": []
+    },
+    {
+        "kind": "opcmd",
+        "input_dir": "_include/vyos-1x/op-mode-definitions/",
+        "schema_file": "_include/vyos-1x/schema/op-mode-definition.rng",
+        "files": []
+    }
+]
+
+node_data = {
+    'cfgcmd': {},
+    'opcmd': {},
+}
+
+def get_properties(p):
+    props = {}
+    props['valueless'] = False
+
+    try:
+        if p.find("valueless") is not None:
+            props['valueless'] = True
+    except:
+        pass
+
+    if p is None:
+        return props
+
+    # Get the help string
+    try:
+        props["help"] = p.find("help").text
+    except:
+        pass
+
+    # Get value help strings
+    try:
+        vhe = p.findall("valueHelp")
+        vh = []
+        for v in vhe:
+            vh.append( (v.find("format").text, v.find("description").text) )
+        props["val_help"] = vh
+    except:
+        props["val_help"] = []
+
+    # Get the constraint statements
+    error_msg = default_constraint_err_msg
+    # Get the error message if it's there
+    try:
+        error_msg = p.find("constraintErrorMessage").text
+    except:
+        pass
+    
+
+    vce = p.find("constraint")
+    vc = []
+    if vce is not None:
+        # The old backend doesn't support multiple validators in OR mode
+        # so we emulate it
+
+        regexes = []
+        regex_elements = vce.findall("regex")
+        if regex_elements is not None:
+            regexes = list(map(lambda e: e.text.strip(), regex_elements))
+        if "" in regexes:
+            print("Warning: empty regex, node will be accepting any value")
+
+        validator_elements = vce.findall("validator")
+        validators = []
+        if validator_elements is not None:
+            for v in validator_elements:
+                v_name = os.path.join(validator_dir, v.get("name"))
+
+                # XXX: lxml returns None for empty arguments
+                v_argument = None
+                try:
+                    v_argument = v.get("argument")
+                except:
+                    pass
+                if v_argument is None:
+                    v_argument = ""
+
+                validators.append("{0} {1}".format(v_name, v_argument))
+
+
+        regex_args = " ".join(map(lambda s: "--regex \\\'{0}\\\'".format(s), regexes))
+        validator_args = " ".join(map(lambda s: "--exec \\\"{0}\\\"".format(s), validators))
+        validator_script = '${vyos_libexec_dir}/validate-value.py'
+        validator_string = "exec \"{0} {1} {2} --value \\\'$VAR(@)\\\'\"; \"{3}\"".format(validator_script, regex_args, validator_args, error_msg)
+
+        props["constraint"] = validator_string
+
+    # Get the completion help strings
+    try:
+        che = p.findall("completionHelp")
+        ch = ""
+        for c in che:
+            scripts = c.findall("script")
+            paths = c.findall("path")
+            lists = c.findall("list")
+
+            # Current backend doesn't support multiple allowed: tags
+            # so we get to emulate it
+            comp_exprs = []
+            for i in lists:
+                comp_exprs.append("echo \"{0}\"".format(i.text))
+            for i in paths:
+                comp_exprs.append("/bin/cli-shell-api listNodes {0}".format(i.text))
+            for i in scripts:
+                comp_exprs.append("sh -c \"{0}\"".format(i.text))
+            comp_help = " && ".join(comp_exprs)
+            props["comp_help"] = comp_help
+    except:
+        props["comp_help"] = []
+
+    # Get priority
+    try:
+        props["priority"] = p.find("priority").text
+    except:
+        pass
+
+    # Get "multi"
+    if p.find("multi") is not None:
+        props["multi"] = True
+
+    # Get "valueless"
+    if p.find("valueless") is not None:
+        props["valueless"] = True
+
+    return props
+
+def process_node(n, f):
+
+    props_elem = n.find("properties")
+    children = n.find("children")
+    command = n.find("command")
+    children_nodes = []
+    owner = n.get("owner")
+    node_type = n.tag
+
+    name = n.get("name")
+    props = get_properties(props_elem)
+
+    if node_type != "node":
+        if "valueless" not in props.keys():
+            props["type"] = "txt"
+    if node_type == "tagNode":
+        props["tag"] = "True"
+    
+    if node_type == "node" and children is not None:
+        inner_nodes = children.iterfind("*")
+        index_child = 0
+        for inner_n in inner_nodes:
+            children_nodes.append(process_node(inner_n, f))
+            index_child = index_child + 1
+
+    if node_type == "tagNode" and children is not None:
+        inner_nodes = children.iterfind("*")
+        index_child = 0
+        for inner_n in inner_nodes:
+            children_nodes.append(process_node(inner_n, f))
+            index_child = index_child + 1
+    else:
+        # This is a leaf node
+        pass
+    
+    if command is not None:
+        test_command = True
+    else:
+        test_command = False
+    node = {
+        'name': name,
+        'type': node_type,
+        'children': children_nodes,
+        'props': props,
+        'command': test_command,
+        'filename': f
+    }
+    return node
+
+
+
+def create_commands(data, parent_list=[], level=0):
+    result = []
+    command = {
+        'name': [],
+        'help': None,
+        'tag_help': [],
+        'level': level,
+        'no_childs': False,
+        'filename': None
+    }
+    command['filename'] = data['filename']
+    command['name'].extend(parent_list)
+    command['name'].append(data['name'])
+
+    if data['type'] == 'tagNode':
+        command['name'].append("<" + data['name'] + ">")
+
+    if 'val_help' in data['props'].keys():
+        for val_help in data['props']['val_help']:
+            command['tag_help'].append(val_help)
+    
+    if len(data['children']) == 0:
+        command['no_childs'] = True
+    
+    if data['command']:
+        command['no_childs'] = True
+    
+    try:
+        help_text = data['props']['help']
+        command['help'] = re.sub(r"[\n\t]*", "", help_text)
+        
+    except:
+        command['help'] = ""
+    
+    command['valueless'] = data['props']['valueless']
+    
+    if 'children' in data.keys():
+        children_bool = True
+        for child in data['children']:
+            result.extend(create_commands(child, command['name'], level + 1))
+    
+    if command['no_childs']:
+        result.append(command)
+    
+
+
+    return result
+
+
+def include_file(line, input_dir):
+    string = ""
+    if "#include <include" in line.strip():
+        include_filename = line.strip().split('<')[1][:-1]
+        with open(input_dir + include_filename) as ifp:
+            iline = ifp.readline()
+            while iline:
+                string = string + include_file(iline.strip(), input_dir)
+                iline = ifp.readline()
+    else:
+        string = line
+    return string
+
+
+def get_working_commands():
+    for entry in input_data:
+        for (dirpath, dirnames, filenames) in os.walk(entry['input_dir']):
+            entry['files'].extend(filenames)
+            break
+
+        for f in entry['files']:
+
+            string = ""
+            with open(entry['input_dir'] + f) as fp:
+                line = fp.readline()
+                while line:                
+                    string = string + include_file(line.strip(), entry['input_dir'])
+                    line = fp.readline()
+            
+            try:
+                xml = ET.parse(BytesIO(bytes(string, 'utf-8')))
+            except Exception as e:
+                print("Failed to load interface definition file {0}".format(f))
+                print(e)
+                sys.exit(1)
+            
+            try:
+                relaxng_xml = ET.parse(entry['schema_file'])
+                validator = ET.RelaxNG(relaxng_xml)
+
+                if not validator.validate(xml):
+                    print(validator.error_log)
+                    print("Interface definition file {0} does not match the schema!".format(f))
+                    sys.exit(1)
+            except Exception as e:
+                print("Failed to load the XML schema {0}".format(entry['schema_file']))
+                print(e)
+                sys.exit(1)
+
+            root = xml.getroot()
+            nodes = root.iterfind("*")
+            for n in nodes:
+                node_data[entry['kind']][f] = process_node(n, f)
+
+    # build config tree and sort
+
+    config_tree_new = {
+        'cfgcmd': {},
+        'opcmd': {},
+    }
+
+    for kind in node_data:
+        for entry in node_data[kind]:
+            node_0 = node_data[kind][entry]['name']
+            
+            if node_0 not in config_tree_new[kind].keys():
+                config_tree_new[kind][node_0] = {
+                    'name': node_0,
+                    'type': node_data[kind][entry]['type'],
+                    'props': node_data[kind][entry]['props'],
+                    'children': [],
+                    'command': node_data[kind][entry]['command'],
+                    'filename': node_data[kind][entry]['filename'],
+                }
+            config_tree_new[kind][node_0]['children'].extend(node_data[kind][entry]['children'])
+    
+    result = {
+        'cfgcmd': [],
+        'opcmd': [],
+    }
+    for kind in  config_tree_new:
+        for e in config_tree_new[kind]:
+            result[kind].extend(create_commands(config_tree_new[kind][e]))
+    
+    for cmd in result['cfgcmd']:
+        cmd['cmd'] = " ".join(cmd['name'])
+    for cmd in result['opcmd']:
+        cmd['cmd'] = " ".join(cmd['name'])
+    return result
+
+
+
+if __name__ == "__main__":
+    res = get_working_commands()
+    print(json.dumps(res))
+    #print(res['cfgcmd'][0])
\ No newline at end of file
diff --git a/docs/_include/draw.io/pbr_example_1.drawio b/docs/_include/draw.io/pbr_example_1.drawio
new file mode 100644
index 00000000..0d496572
--- /dev/null
+++ b/docs/_include/draw.io/pbr_example_1.drawio
@@ -0,0 +1 @@
+<mxfile modified="2019-06-20T09:46:15.910Z" host="www.draw.io" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" etag="pgW5M9QC_GIVY4GNWbyF" version="10.7.9" type="device"><diagram name="Page-1" id="c37626ed-c26b-45fb-9056-f9ebc6bb27b6">7VrbcqM4EP0aP4ZCgLk8xkk8u1UzW97K7FyepmRQsGoEYoUc2/P1K4G4CLBNJo7j2rLzAGpJrVafPq2WnYl9l2w/MJitPtEIkYllRtuJfT+xLMtzTPGQkl0pCQKnFMQMR6UINIJH/AspoZoXr3GEcm0gp5RwnOnCkKYpCrkmg4zRjT7siRJ91QzGqCd4DCHpS7/iiK+UFJhm0/EHwvFKLe1PVccShj9jRtepWm9i2U/Fp+xOYKVLjc9XMKKblsh+mNh3jFJeviXbO0Skbyu3lfPme3pruxlK+ZgJn4MU/ArY39bX3eKfT37yffHh8w2wSzXPkKxRtQ+XCIWzCD9Lq/lOecr9dy1NnXG05TeQ4Did2LdiBEFPXDxET+H+lN/kBciyD9jZtpkp3mL1LFbIM5h2ZcuuQGoctGPUUn8+LkClSbimVKYvIMS9RYVsyDghLryiS9/HUa/zCwgswzSAMcI5YxxhaZZYK54Q8QZE3zNiHAu2fYRLRBY0xxxT4Y/7JeWcJmKActB9KMIYMSEgcuSsJtcdJZQVait6NUpv1VxOM+klzujPmsRWLWlpME3fnEsEnjAhQ5prkspBEcxXKFIN0ZPJ7SXbWCZCA9PcM7DISrkRErqOaj9I49B2L0lBTX2RUhFNEGc7MURNuAkCv5yj0qkTlM1NKzf5SrZqpSVgqbQLVT6Ma91NThAvKi28JEU4r04RrLDzgnOEdZwG58kRJ/bUKZKEZYzwzjVJnDNJeO6lJQnLHUgSHcBRJAov1cxRnIjdPjSiGUqjW1nPSZgJzHMcCmErSNAW82+t9+/S58ZUte63CoKisVMNGa0tBGf2fO66fWSjKfIjZygWXHdmzee9uLFrIOWmDsMofEDXLEQHvBcMw92Csyo622hWMoYI5PhZN2MIYbXCguIiK1TR5HeiyfV94VZNS7kDNbFdY/Z0TXVdoK+LQxYj3tMlsIe71rBMDsgPmd1Zyp0GaqnR1gnz9CnipbSjYUKNxyvIEZyNHOb/jxzWu5LD87wqgOs48w3fbj6/SxXPORtVukv1qPI2cQ+s43HfPTFDnIfUEIe6OOdz9dRDXTtwO7Fq2q4feEOx2hzevQLgaPUxXEkUhUf75G9qgpAmkqA1y+YwwUT6/gtiEUyhEqsvQ4B1qruDr0eq5Vcwt9li+85AZVCVCyevDGxwPAhkEZft9YD65gcuq+Hmiz3jAZ0AU98Z8AzwBxIJqDLJ6WumnmO+fLz9C9RX8iUbLvH3lfMbZbUs6FPKEkiGS3rg+obA2xD7msuCcE8R38Fos8IcPWawyNUbwVWdlSPZoLMPjOOHM1CLT+Vfj+gpTVE1WZkO9hJ4FOUOxPTBM+nMsTR0Rx+VaQU4WZFrf8A0+pEhhrMVYpDkRtYpMS4j754cM6XGcbUEMXCj8vw+oN5b4TniOnXF8xCeUx3P6TvjaY8ohd78FARmtb9LOgb7l6PiGDTPcwz612Pw9yl4/Gp25liqflS85s0Xg3aZ5yAYcXu4AnoRB6FoNj9ml18hNP8xYD/8Bw==</diagram></mxfile>
\ No newline at end of file
diff --git a/docs/_include/draw.io/vpn_s2s_ikev2.drawio b/docs/_include/draw.io/vpn_s2s_ikev2.drawio
new file mode 100644
index 00000000..b240c191
--- /dev/null
+++ b/docs/_include/draw.io/vpn_s2s_ikev2.drawio
@@ -0,0 +1 @@
+<mxfile modified="2019-07-18T20:12:29.116Z" host="www.draw.io" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36" etag="se-JT0q6YZwCfwyGJaAA" version="10.9.8" type="device"><diagram name="Page-1" id="c37626ed-c26b-45fb-9056-f9ebc6bb27b6">7Zrdk6I4EMD/Gh+lSMLn4zgz7j7cVk3V1H3svWxFiJhaIB7EUfevv4QEIYCje6eOW4XzIOmQTtL5ddP0OEGP2e5TgderLywm6QTa8W6CniYQIoCA+JKSvZJA2/WVJClorGSgEbzSH0QLbS3d0JiUxo2csZTTtSmMWJ6TiBsyXBRsa962ZKk56xonpCd4jXDal/5JY77SUmDbTcdnQpOVnjpwdccCR9+Tgm1yPd8EomX1Ud0ZrnXp+8sVjtm2JULPE/RYMMbVVbZ7JKk0bm02NW5+pPew7oLk/JwBv/tf4d9PP749rV+/8DAihK2iqRwg1bzhdEPqfVSr5fvaQtUeidQCJmi2XVFOXtc4kr1bAYWQrXiW6m6tjhSc7I4uFBy2L7giLCO82Itb9ICp43pqjGZqilytZNuckOM4SrZqHQ6qccSaiuSgvbGMuNDG+RlDgTs0FLADdHeWOsNQwhXW8jLbJTKqWBEtI2YJ83FSlPrbtFaMy1VlWVs0ljRNH1nKikobspEXhL6Ql7xg30mrR/tj3VP7tzDpTBqeiijwG16Q9IWVlFOWi74F45xlrRseUprIDs7kATZHLBdycGnZiFhGo3qFLOdznNFUnssfpIhxjrVYR0AAL8aA65gMwNDtMYCCAQZAEF7LW0YGbsmAg+4PATQicEsEfMe3XBOCAKCPhsA5DQGJRTqmmyVJMrHh50Y0I3n8ILM80ZuznJg4kB3lf0lbi62r1ldteXn9tGs39q0zabExQ/O55/Vpil0SxM4QTZ43g/N5jyakJ3ohBRXGk+SqyXNhSLXI6rCrdrVMK6ybzUqr1r7d6uuL51SeQtVS5pQ2fB8cYXK2KSJy+rnNcZEQfsqx+yC2IKsz5DZjtawgKeb0zVzuEHd6hhdGxUYazgMPWQFqPp30B3qmRrVrraSdHPf0hu/p9UPf8lof15xF2aw3iwAX71u3reUN5bubOxLHjy+7O8LxT4zwbfDuCHGh1t14/eGU/3sgcMdA0AoEQXDPgQD+EoHA8aDhsHbHZcWbutVx07ODAfKBBfruXqt2PTAQKy4dDKADf9K1nbqmclPXBkOZnpeK454txEXCKzqVQPqc4fXePxtWd0zLKid6EDeAYL1rOmstwIcWCCzRbYmNzqFTqxUNpdmcTYhbK+iEG5FrcTOImA6ug0w7GmgR1qlgJDyrSlC7OWJG47iKWUMlADN1vETq13sGuHY/+weO2/fFujR1+RrAUOJ3FSYs6I4YqAd7FwOvrvu0a0H+LSkYeupfhwIZ+UYI4DSEdvc1EDWiDwPBG8PBrUlw7LsLB/4YDm4MAewWBg9l/w+DILh5tgjHbLH9bhPeXbYYHkXi/xHwxmkTCBZF98DLNc6PK9/qnUv1OSsynA4gZlvyT25f+tWBI6W5h5dJXYewE/8uPLPibJYiwOSsGrQz6VU9lq78O4q5HKyXDgaQVkXyS9AK7O7LdwgGshlYv/0blQZ0JV5rR/hlgUUjsNcCtle1Ce2PpvUK7+LQGcK3qHYzPmWrUlwv8Rp8CxsokF7tMQuv8Do+DEJKliMH+vnldP9FNZSBXwYD0Wx+TqbKu82P9tDzvw==</diagram></mxfile>
\ No newline at end of file
diff --git a/docs/about.rst b/docs/about.rst
deleted file mode 100644
index 383c95eb..00000000
--- a/docs/about.rst
+++ /dev/null
@@ -1,27 +0,0 @@
-.. _about:
-
-#####
-About
-#####
-
-VyOS is an open source network operating system based on Debian GNU/Linux.
-
-VyOS provides a free routing platform that competes directly with other
-commercially available solutions from well known network providers. Because
-VyOS is run on standard amd64, i586 and ARM systems, it can be used
-as a router and firewall platform for cloud deployments.
-
-We use multiple live versions of our manual hosted thankfully by
-https://readthedocs.org. We will provide one version of the manual for every
-VyOS major version starting with VyOS 1.2 which will receive Long-term support
-(LTS).
-
-The manual version is selected/specified by its Git branch name. You can
-switch between versions of the documentation by selecting the appropriate
-branch on the bottom left corner.
-
-VyOS CLI syntax may change between major (and sometimes minor) versions. Please
-always refer to the documentation matching your current, running installation.
-If a change in the CLI is required, VyOS will ship a so called migration script
-which will take care of adjusting the syntax. No action needs to be taken by
-you.
diff --git a/docs/appendix/commandtree/configmode.rst b/docs/appendix/commandtree/configmode.rst
deleted file mode 100644
index d4148c22..00000000
--- a/docs/appendix/commandtree/configmode.rst
+++ /dev/null
@@ -1,524 +0,0 @@
-.. _commandtree_configmode:
-
-Configuration mode
-------------------
-
-.. code-block:: none
-
-  confirm           Confirm prior commit-confirm
-  comment           Add comment to this configuration element
-  commit            Commit the current set of changes
-  commit-confirm    Commit the current set of changes with 'confirm' required
-  compare           Compare configuration revisions
-  copy              Copy a configuration element
-  delete            Delete a configuration element
-  discard           Discard uncommitted changes
-  edit              Edit a sub-element
-  exit              Exit from this configuration level
-  load              Load configuration from a file and replace running configuration
-  loadkey           Load user SSH key from a file
-  merge             Load configuration from a file and merge running configuration
-  rename            Rename a configuration element
-  rollback          Rollback to a prior config revision (requires reboot)
-  run               Run an operational-mode command
-  save              Save configuration to a file
-  set               Set the value of a parameter or create a new element
-  show              Show the configuration (default values may be suppressed)
-
-
-Confirm
-^^^^^^^
-
-The ``confirm`` command confirms the prior ``commit-confirm``.
-
-Comment
-^^^^^^^
-
-The ``comment`` commands allow you to insert a comment above the current configuration section.
-The command cannot be used at the top of the configuration hierarchy, only on subsections. Comments needs to be commited, just like other config changes.
-
-To add a comment to a section, while being already at the proper section level:
-
-.. code-block:: none
-
-  [edit <section>]
-  vyos@vyos# comment "Type Comment Here"
-
-To add a comment directly to a section, from the top or a higher section:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# comment <section> "Type Comment Here"
-
-To remove a comment, add a blank comment to overwrite:
-
-.. code-block:: none
-
-  [edit <section>]
-  vyos@vyos# comment ""
-
-Examples
-********
-
-To add a comment to the "interfaces" section:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# edit interfaces
-  [edit interfaces]
-  vyos@vyos# comment "Here is a comment"
-  [edit interfaces]
-  vyos@vyos# commit
-
-The comment would then appear like this:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# show
-   /* Here is a comment */
-    interfaces {
-        ethernet eth0 {
-    [...]
-
-
-An important thing to note is that since the comment is added on top of the section, it will not appear if the ``show <section>`` command is used. With the above example, the ``show interfaces`` command would return starting after the "interfaces {" line, hiding the comment:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# show interfaces
-   ethernet eth0 {
-  [...]
-
-
-To add a comment to the interfaces section from the top:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# comment interfaces "test"
-
-
-The comment can be added to any node that already exists, even if it's multiple levels lower:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# comment interfaces ethernet eth0 vif 222 address "Far down comment"
-
-
-Commit
-^^^^^^
-
-The ``commit`` command commits the proposed changes to the configuration file.
-Every changes done in the configuration session is only applied when the configuration is committed. To view the changes that will be applied, use the show command.
-To discard the changes without committing, use the ``discard`` command. The ``commit`` command doesn't save the configuration, you need to manually use the ``save`` command.
-
-The confirm keyword can be added, see ``commit-confirm``. A comment can be entered, it will appear in the commit log.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# commit
-  Possible completions:
-    <Enter>       Commit working configuration
-    comment       Comment for commit log
-
-Commit-confirm
-^^^^^^^^^^^^^^
-
-The ``commit-confirm`` command commits the proposed changes to the configuration file and starts a timer.
-If the ``confirm`` command is not entered before the timer expiration, the configuration will be rolled back and VyOS will reboot.
-The default timer value is 10 minutes, but a custom value can be entered.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# commit-confirm
-  Possible completions:
-    <Enter>       Commit, rollback/reboot in 10 minutes if no confirm
-    <N>           Commit, rollback/reboot in N minutes if no confirm
-    comment       Comment for commit log
-
-
-Compare
-^^^^^^^
-
-VyOS maintains backups of previous configurations. To compare configuration revisions in configuration mode, use the compare command:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# compare
-  Possible completions:
-    <Enter>	Compare working & active configurations
-    saved		Compare working & saved configurations
-    <N>		Compare working with revision N
-    <N> <M>	Compare revision N with M
-  
-    Revisions:
-      0	2019-03-20 20:57:22 root by boot-config-loader
-      1	2019-03-15 20:00:04 root by boot-config-loader
-      2	2019-03-05 01:58:39 vyos by cli
-      3	2019-03-05 01:54:59 vyos by cli
-      4	2019-03-05 01:53:08 vyos by cli
-      5	2019-03-05 01:52:21 vyos by cli
-      6	2019-02-24 21:01:24 root by boot-config-loader
-      7	2019-02-21 22:00:12 vyos by cli
-      8	2019-02-21 21:56:49 vyos by cli
-
-
-Copy
-^^^^
-
-The ``copy`` command allows you to copy a configuration object.
-
-Copy the configuration entrys from a firewall name WAN rule 1 to rule 2.
-
-.. code-block:: none
-
-  [edit firewall name WAN]
-  vyos@vyos# show
-   rule 1 {
-       action accept
-       source {
-           address 10.1.0.0/24
-       }
-   }
-  [edit firewall name WAN]
-  vyos@vyos# copy rule 1 to rule 2
-  [edit firewall name WAN]
-  vyos@vyos# show
-   rule 1 {
-       action accept
-       source {
-           address 10.1.0.0/24
-       }
-   }
-  +rule 2 {
-  +    action accept
-  +    source {
-  +        address 10.1.0.0/24
-  +    }
-  +}
-
-Delete
-^^^^^^
-
-The ``delte`` command is to delete a configuration entry.
-
-This Example delete the hole ``service tftp-server`` section.
-
-.. code-block:: none
-
-  delete service tftp-server
-
-Discard
-^^^^^^^
-
-The ``discard`` command removes all pending configuration changes.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# discard
-  
-    Changes have been discarded
-
-Edit
-^^^^
-
-The ``edit`` command allows you to navigate down into the configuration tree.
-To get back to an upper level, use the ``up`` command or use the ``top`` command to get back to the upper most level.
-The ``[edit]`` text displays where the user is located in the configuration tree.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# edit interfaces
-  [edit interfaces]
-  vyos@vyos# edit ethernet eth0
-  [edit interfaces ethernet eth0]
-
-Exit
-^^^^
-
-The ``exit`` command exits the current configuration mode. If the current configuration level isn't the top-most, then the configuration level is put back to the top-most level.
-If the configuration level is at the top-most level, then it exits the configuration mode and returns to operational mode.
-The ``exit`` command cannot be used if uncommitted changes exists in the configuration file. To exit with uncommitted changes, you either need to use the ``exit discard`` command or you need to commit the changes before exiting.
-The ``exit`` command doesn't save the configuration, only the ``save`` command does. A warning will be given when exiting with unsaved changes. Using the ``exit`` command in operational mode will logout the session.
-
-
-Exiting from a configuration level:
-
-
-.. code-block:: none
-
-  [edit interfaces ethernet eth0]
-  vyos@vyos# exit
-  [edit]
-  vyos@vyos#
-
-Exiting from configuration mode:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# exit
-  exit
-  vyos@vyos:~$
-
-Exiting from operational mode:
-
-.. code-block:: none
-
-  vyos@vyos:~$ exit
-  logout
-
-Error message when trying to exit with uncommitted changes:
-
-.. code-block:: none
-
-  vyos@vyos# exit
-  Cannot exit: configuration modified.
-  Use 'exit discard' to discard the changes and exit.
-  [edit]
-  vyos@vyos#
-
-
-Warning message when exiting with unsaved changes:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# exit
-  Warning: configuration changes have not been saved.
-  exit
-  vyos@vyos:~$
-
-Load
-^^^^
-
-The ``load`` command load a configuration from a local or remote file. You have to be use ``commit`` to make the change active
-
-.. code-block:: none
-
-  <Enter>				Load from system config file
-  <file>				Load from file on local machine
-  scp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
-  sftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
-  ftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
-  http://<host>/<file>			Load from file on remote machine
-  https://<host>/<file>			Load from file on remote machine
-  tftp://<host>/<file>			Load from file on remote machine
-
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# load
-  Loading configuration from '/config/config.boot'...
-
-  Load complete.  Use 'commit' to make changes active.
-
-
-Loadkey
-^^^^^^^^
-
-Copies the content of a public key to the ~/.ssh/authorized_keys file.
-
-.. code-block:: none
-
-  loadkey <username> [tab]
-
-  <file>                      Load from file on local machine
-  scp://<user>@<host>/<file>  Load from file on remote machine
-  sftp://<user>@<host>/<file> Load from file on remote machine
-  ftp://<user>@<host>/<file>  Load from file on remote machine
-  http://<host>/<file>        Load from file on remote machine
-  tftp://<host>/<file>        Load from file on remote machine
-
-Merge
-^^^^^
-
-The ``merge`` command merge the config from a local or remote file with the running config.
-
-In the example below exist a ``default-firewall.config`` file with some common firewall rules you saved earlier.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# show firewall
-  Configuration under specified path is empty
-  [edit]
-  vyos@vyos# merge default-firewall.config
-  Loading configuration from '/config/default-firewall.config'...
-
-  Merge complete.  Use 'commit' to make changes active.
-  [edit]
-  vyos@vyos#
-
-  vyos@vyos# show firewall
-  +all-ping enable
-  +broadcast-ping disable
-  +config-trap disable
-  +ipv6-receive-redirects disable
-  +ipv6-src-route disable
-  +ip-src-route disable
-  +log-martians enable
-  +name WAN {
-  +    default-action drop
-  +    rule 1 {
-  +        action accept
-  +        source {
-  +            address 10.1.0.0/24
-  +        }
-  +    }
-  +    rule 2 {
-  +        action accept
-  +        source {
-  +            address 10.1.0.0/24
-  +        }
-  ......
-
-
-Rename
-^^^^^^
-
-The ``rename`` command allows you to rename or move a configuration object.
-
-See here how to move the configuration entrys from vlanid 3 to 2
-
-.. code-block:: none
-
-  [edit interfaces ethernet eth1]
-  vyos@vyos# show
-   duplex auto
-   hw-id 08:00:27:81:c6:59
-   smp-affinity auto
-   speed auto
-   vif 3 {
-       address 10.4.4.4/32
-   }
-  [edit interfaces ethernet eth1]
-  vyos@vyos# rename vif 3 to vif 2
-  [edit interfaces ethernet eth1]
-  vyos@vyos# show
-   duplex auto
-   hw-id 08:00:27:81:c6:59
-   smp-affinity auto
-   speed auto
-  +vif 2 {
-  +    address 10.4.4.4/32
-  +}
-  -vif 3 {
-  -    address 10.4.4.4/32
-  -}
-  [edit interfaces ethernet eth1]
-  vyos@vyos#
-
-
-Rollback
-^^^^^^^^
-
-You can ``rollback`` configuration using the rollback command, however this command will currently trigger a system reboot.
-Use the compare command to verify the configuration you want to rollback to.
-
-.. code-block:: none
-
-  vyos@vyos# compare 1
-  [edit system]
-  >host-name vyos-1
-  [edit]
-  vyos@vyos# rollback 1
-  Proceed with reboot? [confirm][y]
-  
-  Broadcast message from root@vyos-1 (pts/0) (Tue Dec 17 21:07:45 2018):
-  
-  The system is going down for reboot NOW!
-  [edit]
-  vyos@vyos#
-
-Run
-^^^
-
-The ``run`` command allows you to execute any operational mode commands without exiting the configuration session.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# run show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             10.1.1.1/24                        u/u
-
-
-Save
-^^^^
-
-The ``save`` command saves the current configuration to non-volatile storage. VyOS also supports saving and loading configuration remotely using SCP, FTP, or TFTP.
-
-.. code-block:: none
-
-  <Enter>				Save to system config file
-  <file>				Save to file on local machine
-  scp://<user>:<passwd>@<host>/<file>	Save to file on remote machine
-  sftp://<user>:<passwd>@<host>/<file>	Save to file on remote machine
-  ftp://<user>:<passwd>@<host>/<file>	Save to file on remote machine
-  tftp://<host>/<file>			Save to file on remote machine
-
-Set
-^^^
-
-The ``set`` command create all configuration entrys
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
-
-Show
-^^^^
-
-The ``show`` command in the configuration mode displays the configuration and show uncommitted changes.
-
-Show the hole config, the address and description of eth1 is moving to vlan 2 if you commit the changes.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# show
-   interfaces {
-       dummy dum0 {
-           address 10.3.3.3/24
-       }
-       ethernet eth0 {
-           address dhcp
-           duplex auto
-           hw-id 08:00:27:2b:c0:0b
-           smp-affinity auto
-           speed auto
-       }
-       ethernet eth1 {
-  -        address 10.1.1.1/32
-  -        description "MGMT Interface"
-           duplex auto
-           hw-id 08:00:27:81:c6:59
-           smp-affinity auto
-           speed auto
-  +        vif 2 {
-  +            address 10.1.1.1/32
-  +            description "MGMT Interface"
-  +        }
-       }
-       loopback lo {
-       }
-   }
-   service {
-       ssh {
-           port 22
-  ......
\ No newline at end of file
diff --git a/docs/appendix/commandtree/index.rst b/docs/appendix/commandtree/index.rst
deleted file mode 100644
index c3bca008..00000000
--- a/docs/appendix/commandtree/index.rst
+++ /dev/null
@@ -1,17 +0,0 @@
-.. _commandtree:
-
-Command tree
-============
-
-See the the full Command tree in Operational mode and Configuration mode
-
-
-
-.. toctree::
-   :maxdepth: 2
-   :hidden:
-
-
-   operationmode
-   configmode
-
diff --git a/docs/appendix/commandtree/operationmode.rst b/docs/appendix/commandtree/operationmode.rst
deleted file mode 100644
index 8092f248..00000000
--- a/docs/appendix/commandtree/operationmode.rst
+++ /dev/null
@@ -1,444 +0,0 @@
-.. _commandtree_operationmode:
-
-Operational mode
-----------------
-
-Operational mode allows for commands to perform operational system tasks and view system and service status.
-After this is the first view after the login.
-Please see :ref:`cli` for navigation in the CLI
-
-
-.. code-block:: none
-
-
-  vyos@vyos:~$ [tab]
-  Possible completions:
-    add               Add an object to a service
-    clear             Clear system information
-    clone             Clone an object
-    configure         Enter configure mode
-    connect           Establish a connection
-    copy              Copy an object
-    delete            Delete an object
-    disconnect        Take down a connection
-    force             Force an operation
-    format            Format a device
-    generate          Generate an object
-    install           Install a new system
-    monitor           Monitor system information
-    ping              Send IPv4 or IPv6 ICMP (Internet Control Message Protocol) echo requests
-    poweroff          Poweroff the system
-    reboot            Reboot the system
-    release           Release specified variable
-    rename            Rename an object
-    renew             Renew specified variable
-    reset             Reset a service
-    restart           Restart a service
-    set               Set operational options
-    show              Show system information
-    telnet            Telnet to a node
-    traceroute        Track network path to node
-    update            Update data for a service
-
-
-Add
-^^^
-
-.. code-block:: none
-
- raid         Add a RAID set element
- system       Add an item to a system facility
-
-Clear
-^^^^^
-
-.. code-block:: none
-
-  console            Clear screen
-  firewall           Clear firewall statistics
-  flow-accounting    Clear flow accounting
-  interfaces         Clear interface information
-  ip                 Clear Internet Protocol (IP) statistics or status
-  ipv6               Clear Internet Protocol (IPv6) statistics or status
-  nat                Clear network address translation (NAT) tables
-  policy             Clear policy statistics
-
-
-Clone
-^^^^^
-The ``clone`` command allows you to clone a configuration from a system image to another one, or from the running config to another system image.
-To clone the running config to a system image:
-
-.. code-block:: none
-
-  clone system config <system-image> from running
-
-To clone from system image A to system image B:
-
-.. code-block:: none
-
-  clone system config <system-image-B> from <system-image-A>
-
-
-Configure
-^^^^^^^^^
-
-The ``configure`` command allows you to enter configuration mode.
-
-.. code-block:: none
-
-  vyos@vyos:~$ configure
-  [edit]
-  vyos@vyos#
-
-
-Connect
-^^^^^^^
-
-The ``connect`` command allows you to bring up a connection oriented interface, like a pppoe interface.
-
-.. code-block:: none
-
-  connect interface <interface>
-
-Copy
-^^^^
-
-The ``copy`` command allows you to copy a file to your running config or over images.
-
-It can look like this example:
-
-.. code-block:: none
-
-  vyos@vyos:~$  copy file [tab]
-  Possible completions:
-    http://<user>:<passwd>@<host>/<file>
-                  Copy files from specified source
-    scp://<user>:<passwd>@<host>/<file>
-    ftp://<user>:<passwd>@<host>/<file>
-    tftp://<host>/<file>
-    1.2.0://config/
-    1.2.0-rolling+201902251818://config/
-    1.2.0-rolling+201902201040://config/
-    1.2.0-rolling+201902080337://config/
-    1.2.0-H4://config/
-    running://config/
-
-
-To copy from file A to file B:
-
-.. code-block:: none
-
-  copy <file A> to <file B>
-
-
-Delete
-^^^^^^
-
-.. code-block:: none
-
-  conntrack     Delete Conntrack entries
-  file          Delete files in a particular image
-  log           Delete a log file
-  raid          Remove a RAID set element
-  system        Delete system objects
-
-
-Disconnect
-^^^^^^^^^^
-
-The ``disconnect`` command allows you to take down a connection oriented interface, like a pppoe interface.
-
-.. code-block:: none
-
-  disconnect interface <interface>
-
-Force
-^^^^^
-
-.. code-block:: none
-
-  arp           Send gratuitous ARP request or reply
-  cluster       Force a cluster state transition
-
-
-Format
-^^^^^^
-
-The ``format`` command allows you to format a disk the same way as another one.
-
-.. code-block:: none
-
-  format disk <target> like <source>
-
-Generate
-^^^^^^^^
-
-.. code-block:: none
-
-  openvpn       OpenVPN key generation tool
-  ssh-server-key
-                Regenerate the host SSH keys and restart the SSH server
-  tech-support  Generate tech-support archive
-  vpn           VPN key generation utility
-  wireguard     wireguard key generation utility
-
-Install
-^^^^^^^
-
-The ``install`` command allows you to install the system image on the disk.
-
-.. code-block:: none
-
-  install image
-
-
-Monitor
-^^^^^^^
-
-``monitor`` can be used to continually view what is happening on the router.
-
-.. code-block:: none
-
-  bandwidth     Monitor interface bandwidth in real time
-  bandwidth-test
-                Initiate or wait for bandwidth test
-  cluster       Monitor clustering service
-  command       Monitor an operational mode command (refreshes every 2 seconds)
-  conntrack-sync
-                Monitor conntrack-sync
-  content-inspection
-                Monitor Content-Inspection
-  dhcp          Monitor Dynamic Host Control Protocol (DHCP)
-  dns           Monitor a Domain Name Service (DNS) daemon
-  firewall      Monitor Firewall
-  https         Monitor the Secure Hypertext Transfer Protocol (HTTPS) service
-  lldp          Monitor Link Layer Discovery Protocol (LLDP) daemon
-  log           Monitor last lines of messages file
-  nat           Monitor network address translation (NAT)
-  openvpn       Monitor OpenVPN
-  protocol      Monitor routing protocols
-  snmp          Monitor Simple Network Management Protocol (SNMP) daemon
-  stop-all      Stop all current background monitoring processes
-  traceroute    Monitor the path to a destination in realtime
-  traffic       Monitor traffic dumps
-  vpn           Monitor VPN
-  vrrp          Monitor Virtual Router Redundancy Protocol (VRRP)
-  webproxy      Monitor Webproxy service
-
-
-Ping
-^^^^
-
-The ``ping`` command allows you to send an ICMP-EchoRequest packet and display the ICMP-EchoReply received.
-
-.. code-block:: none
-
-  <hostname>    Send Internet Control Message Protocol (ICMP) echo request
-  <x.x.x.x>
-  <h:h:h:h:h:h:h:h>
-
-
-Poweroff
-^^^^^^^^
-
-The ``poweroff`` command allows you to properly shut down the VyOS instance. Without any modifier, the command is executed immediately.
-
-.. code-block:: none
-
-  <Enter>       Execute the current command
-  at            Poweroff at a specific time
-  cancel        Cancel a pending poweroff
-  in            Poweroff in X minutes
-  now           Poweroff the system without confirmation
-
-Reboot
-^^^^^^
-The ``reboot`` command allows you to properly restart the VyOS instance. Without any modifier, the command is executed immediately.
-
-.. code-block:: none
-
-  <Enter>       Execute the current command
-  at            Poweroff at a specific time
-  cancel        Cancel a pending poweroff
-  in            Poweroff in X minutes
-  now           Poweroff the system without confirmation
-
-Release
-^^^^^^^
-
-The ``release`` command allows you to release a DHCP or DHCPv6 lease.
-
-.. code-block:: none
-
-  vyos@vyos:~$ release dhcp interface <int>
-  vyos@vyos:~$ release dhcpv6 interface <int>
-
-
-Rename
-^^^^^^
-
-The ``rename`` command allows you to rename a system image.
-
-.. code-block:: none
-
- rename system image <currentname> <newname>
-
-
-Renew
-^^^^^
-
-The ``renew`` command allows you to renew a DHCP or DHCPv6 lease.
-
-.. code-block:: none
-
-  vyos@vyos:~$ renew dhcp interface <int>
-  vyos@vyos:~$ renew dhcpv6 interface <int>
-
-Reset
-^^^^^
-
-.. code-block:: none
-
-  conntrack     Reset all currently tracked connections
-  conntrack-sync
-                Reset connection syncing parameters
-  dns           Reset a DNS service state
-  firewall      reset a firewall group
-  ip            Reset Internet Protocol (IP) parameters
-  ipv6          Reset Internet Protocol version 6 (IPv6) parameters
-  nhrp          Clear/Purge NHRP entries
-  openvpn       Reset OpenVPN
-  terminal      Reset terminal
-  vpn           Reset Virtual Private Network (VPN) information
-
-Restart
-^^^^^^^
-
-.. code-block:: none
-
-  cluster       Restart cluster node
-  conntrack-sync
-                Restart connection tracking synchronization service
-  dhcp          Restart DHCP processes
-  dhcpv6        Restart DHCPv6 processes
-  dns           Restart a DNS service
-  flow-accounting
-                Restart flow-accounting service
-  https         Restart https server
-  vpn           Restart IPsec VPN
-  vrrp          Restart the VRRP (Virtual Router Redundancy Protocol) process
-  wan-load-balance
-                Restart WAN load balancing
-  webproxy      Restart webproxy service
-
-Set
-^^^
-
-.. code-block:: none
-
-  <OPTION>      Bash builtin set command
-  console       Control console behaviors
-  date          Set system date and time
-  system        Set system operational parameters
-  terminal      Control terminal behaviors
-
-Show
-^^^^
-
-.. code-block:: none
-
-  arp           Show Address Resolution Protocol (ARP) information
-  bridge        Show bridging information
-  cluster       Show clustering information
-  configuration Show available saved configurations
-  conntrack     Show conntrack entries in the conntrack table
-  conntrack-sync
-                Show connection syncing information
-  date          Show system time and date
-  dhcp          Show DHCP (Dynamic Host Configuration Protocol) information
-  dhcpv6        Show DHCPv6 (IPv6 Dynamic Host Configuration Protocol) information
-  disk          Show status of disk device
-  dns           Show DNS information
-  file          Show files for a particular image
-  firewall      Show firewall information
-  flow-accounting
-                Show flow accounting statistics
-  hardware      Show system hardware details
-  history       show command history
-  host          Show host information
-  incoming      Show ethernet input-policy information
-  interfaces    Show network interface information
-  ip            Show IPv4 routing information
-  ipv6          Show IPv6 routing information
-  license       Show VyOS license information
-  lldp          Show lldp
-  log           Show contents of current master log file
-  login         Show current login credentials
-  monitoring    Show currently monitored services
-  nat           Show Network Address Translation (NAT) information
-  nhrp          Show NHRP info
-  ntp           Show peer status of NTP daemon
-  openvpn       Show OpenVPN information
-  policy        Show policy information
-  poweroff      Show scheduled poweroff
-  pppoe-server  show pppoe-server status
-  queueing      Show ethernet queueing information
-  raid          Show statis of RAID set
-  reboot        Show scheduled reboot
-  remote-config Show remote side config
-  route-map     Show route-map information
-  snmp          Show status of SNMP on localhost
-  system        Show system information
-  system-integrity
-                checks the integrity of the system
-  table         Show routing table
-  tech-support  Show consolidated tech-support report (private information removed)
-  users         Show user information
-  version       Show system version information
-  vpn           Show Virtual Private Network (VPN) information
-  vrrp          Show VRRP (Virtual Router Redundancy Protocol) information
-  wan-load-balance
-                Show Wide Area Network (WAN) load-balancing information
-  webproxy      Show webproxy information
-  wireguard     Show wireguard properties
-  zone-policy   Show summary of zone policy for a specific zone
-
-Telnet
-^^^^^^
-In the past the ``telnet`` command allowed you to connect remotely to another device using the telnet protocol.
-Telnet is unencrypted and should not use anymore. But its nice to test if an TCP Port to a host is open.
-
-
-.. code-block:: none
-
-  vyos@vyos:~$ telnet 192.168.1.3 443
-  Trying 192.168.1.3...
-  telnet: Unable to connect to remote host: Network is unreachable
-
-  vyos@vyos:~$ telnet 192.168.1.4 443
-  Trying 192.168.1.4...
-  Connected to 192.168.1.4.
-  Escape character is '^]'.
-
-Traceroute
-^^^^^^^^^^
-
-The ``traceroute`` command allows you to trace the path taken to a particular device.
-
-.. code-block:: none
-
-  <hostname>    Track network path to specified node
-  <x.x.x.x>
-  <h:h:h:h:h:h:h:h>
-  ipv4          Track network path to <hostname|IPv4 address>
-  ipv6          Track network path to <hostname|IPv6 address>
-
-
-Update
-^^^^^^
-
-.. code-block:: none
-
-  dns           Update DNS information
-  webproxy      Update webproxy
\ No newline at end of file
diff --git a/docs/appendix/examples/azure-vpn-bgp.rst b/docs/appendix/examples/azure-vpn-bgp.rst
deleted file mode 100644
index 57f82396..00000000
--- a/docs/appendix/examples/azure-vpn-bgp.rst
+++ /dev/null
@@ -1,128 +0,0 @@
-.. _examples-azure-vpn-bgp:
-
-Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
-------------------------------------------------------------
-
-This guide shows an example of a route-based IKEv2 site-to-site VPN to
-Azure using VTI and BGP for dynamic routing updates.
-
-Prerequisites
-^^^^^^^^^^^^^
-
-- A pair of Azure VNet Gateways deployed in active-passive
-  configuration with BGP enabled.
-
-- A local network gateway deployed in Azure representing
-  the Vyos device, matching the below Vyos settings except for
-  address space, which only requires the Vyos private IP, in
-  this example 10.10.0.5/32
-
-- A connection resource deployed in Azure linking the
-  Azure VNet gateway and the local network gateway representing
-  the Vyos device.
-
-Example
-^^^^^^^
-
-+---------------------------------------+---------------------+
-| WAN Interface                         | eth0                |
-+---------------------------------------+---------------------+
-| On-premises address space             | 10.10.0.0/16        |
-+---------------------------------------+---------------------+
-| Azure address space                   |  10.0.0.0/16        |
-+---------------------------------------+---------------------+
-| Vyos public IP                        | 198.51.100.3        |
-+---------------------------------------+---------------------+
-| Vyos private IP                       | 10.10.0.5           |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway public IP          |  203.0.113.2        |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway BGP IP             |  10.0.0.4           |
-+---------------------------------------+---------------------+
-| Pre-shared key                        | ch00s3-4-s3cur3-psk |
-+---------------------------------------+---------------------+
-| Vyos ASN                              | 64499               |
-+---------------------------------------+---------------------+
-| Azure ASN                             | 65540               |
-+---------------------------------------+---------------------+
-
-Vyos configuration
-^^^^^^^^^^^^^^^^^^
-
-- Configure the IKE and ESP settings to match a subset
-  of those supported by Azure:
-
-.. code-block:: none
-
-  set vpn ipsec esp-group AZURE compression 'disable'
-  set vpn ipsec esp-group AZURE lifetime '3600'
-  set vpn ipsec esp-group AZURE mode 'tunnel'
-  set vpn ipsec esp-group AZURE pfs 'dh-group2'
-  set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
-
-  set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
-  set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
-  set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
-  set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
-  set vpn ipsec ike-group AZURE key-exchange 'ikev2'
-  set vpn ipsec ike-group AZURE lifetime '28800'
-  set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
-  set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
-
-- Enable IPsec on eth0
-
-.. code-block:: none
-
-  set vpn ipsec ipsec-interfaces interface 'eth0'
-
-- Configure a VTI with a dummy IP address
-
-.. code-block:: none
-
-  set interfaces vti vti1 address '10.10.1.5/32'
-  set interfaces vti vti1 description 'Azure Tunnel'
-
-- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
-
-.. code-block:: none
-
-  set firewall options interface vti1 adjust-mss 1350
-
-- Configure the VPN tunnel
-
-.. code-block:: none
-
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
-  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
-  set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
-  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
-  set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
-  set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
-  set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
-
-- **Important**: Add an interface route to reach Azure's BGP listener
-
-.. code-block:: none
-
-  set protocols static interface-route 10.0.0.4/32 next-hop-interface vti1
-
-- Configure your BGP settings
-
-.. code-block:: none
-
-  set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
-  set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
-  set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
-  set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
-
-- **Important**: Disable connected check \
-
-.. code-block:: none
-
-  set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check
diff --git a/docs/appendix/examples/azure-vpn-dual-bgp.rst b/docs/appendix/examples/azure-vpn-dual-bgp.rst
deleted file mode 100644
index cbe9a4d9..00000000
--- a/docs/appendix/examples/azure-vpn-dual-bgp.rst
+++ /dev/null
@@ -1,155 +0,0 @@
-.. _examples-azure-vpn-dual-bgp:
-
-Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
-----------------------------------------------------------------------
-
-This guide shows an example of a redundant (active-active) route-based IKEv2
-site-to-site VPN to Azure using VTI
-and BGP for dynamic routing updates.
-
-Prerequisites
-^^^^^^^^^^^^^
-
-- A pair of Azure VNet Gateways deployed in active-passive
-  configuration with BGP enabled.
-
-- A local network gateway deployed in Azure representing
-  the Vyos device, matching the below Vyos settings except for
-  address space, which only requires the Vyos private IP, in
-  this example 10.10.0.5/32
-
-- A connection resource deployed in Azure linking the
-  Azure VNet gateway and the local network gateway representing
-  the Vyos device.
-
-Example
-^^^^^^^
-
-+---------------------------------------+---------------------+
-| WAN Interface                         | eth0                |
-+---------------------------------------+---------------------+
-| On-premises address space             | 10.10.0.0/16        |
-+---------------------------------------+---------------------+
-| Azure address space                   |  10.0.0.0/16        |
-+---------------------------------------+---------------------+
-| Vyos public IP                        | 198.51.100.3        |
-+---------------------------------------+---------------------+
-| Vyos private IP                       | 10.10.0.5           |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway 1 public IP        |  203.0.113.2        |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway 2 public IP        |  203.0.113.3        |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway BGP IP             |  10.0.0.4,10.0.0.5  |
-+---------------------------------------+---------------------+
-| Pre-shared key                        | ch00s3-4-s3cur3-psk |
-+---------------------------------------+---------------------+
-| Vyos ASN                              | 64499               |
-+---------------------------------------+---------------------+
-| Azure ASN                             | 65540               |
-+---------------------------------------+---------------------+
-
-Vyos configuration
-^^^^^^^^^^^^^^^^^^
-
-- Configure the IKE and ESP settings to match a subset
-  of those supported by Azure:
-
-.. code-block:: none
-
-  set vpn ipsec esp-group AZURE compression 'disable'
-  set vpn ipsec esp-group AZURE lifetime '3600'
-  set vpn ipsec esp-group AZURE mode 'tunnel'
-  set vpn ipsec esp-group AZURE pfs 'dh-group2'
-  set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
-
-  set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
-  set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
-  set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
-  set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
-  set vpn ipsec ike-group AZURE key-exchange 'ikev2'
-  set vpn ipsec ike-group AZURE lifetime '28800'
-  set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
-  set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
-
-- Enable IPsec on eth0
-
-.. code-block:: none
-
-  set vpn ipsec ipsec-interfaces interface 'eth0'
-
-- Configure two VTIs with a dummy IP address each
-
-.. code-block:: none
-
-  set interfaces vti vti1 address '10.10.1.5/32'
-  set interfaces vti vti1 description 'Azure Primary Tunnel'
-
-  set interfaces vti vti2 address '10.10.1.6/32'
-  set interfaces vti vti2 description 'Azure Secondary Tunnel'
-
-- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
-
-.. code-block:: none
-
-  set firewall options interface vti1 adjust-mss 1350
-  set firewall options interface vti2 adjust-mss 1350
-
-- Configure the VPN tunnels
-
-.. code-block:: none
-
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
-  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
-  set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
-  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
-  set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
-  set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
-  set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
-
-  set vpn ipsec site-to-site peer 203.0.113.3 authentication id '198.51.100.3'
-  set vpn ipsec site-to-site peer 203.0.113.3 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 203.0.113.3 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
-  set vpn ipsec site-to-site peer 203.0.113.3 authentication remote-id '203.0.113.3'
-  set vpn ipsec site-to-site peer 203.0.113.3 connection-type 'respond'
-  set vpn ipsec site-to-site peer 203.0.113.3 description 'AZURE SECONDARY TUNNEL'
-  set vpn ipsec site-to-site peer 203.0.113.3 ike-group 'AZURE'
-  set vpn ipsec site-to-site peer 203.0.113.3 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 203.0.113.3 local-address '10.10.0.5'
-  set vpn ipsec site-to-site peer 203.0.113.3 vti bind 'vti2'
-  set vpn ipsec site-to-site peer 203.0.113.3 vti esp-group 'AZURE'
-
-- **Important**: Add an interface route to reach both Azure's BGP listeners
-
-.. code-block:: none
-
-  set protocols static interface-route 10.0.0.4/32 next-hop-interface vti1
-  set protocols static interface-route 10.0.0.5/32 next-hop-interface vti2
-
-- Configure your BGP settings
-
-.. code-block:: none
-
-  set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
-  set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
-  set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
-  set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
-
-  set protocols bgp 64499 neighbor 10.0.0.5 remote-as '65540'
-  set protocols bgp 64499 neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound'
-  set protocols bgp 64499 neighbor 10.0.0.5 timers holdtime '30'
-  set protocols bgp 64499 neighbor 10.0.0.5 timers keepalive '10'
-
-- **Important**: Disable connected check, otherwise the routes learned
-  from Azure will not be imported into the routing table.
-
-.. code-block:: none
-
-  set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check
-  set protocols bgp 64499 neighbor 10.0.0.5 disable-connected-check
diff --git a/docs/appendix/examples/bgp-ipv6-unnumbered.rst b/docs/appendix/examples/bgp-ipv6-unnumbered.rst
deleted file mode 100644
index 283dcd45..00000000
--- a/docs/appendix/examples/bgp-ipv6-unnumbered.rst
+++ /dev/null
@@ -1,171 +0,0 @@
-.. _examples-bgp-ipv6-unnumbered:
-
-VyOS BGP ipv6 unnumbered with extended nexthop
-----------------------------------------------
-
-General infomration can be found in the :ref:`routing-bgp` chapter.
-
-Configuration
-^^^^^^^^^^^^^
-
-- Router A:
-
-.. code-block:: none
-
-  set protocols bgp 65020 address-family ipv4-unicast redistribute connected
-  set protocols bgp 65020 address-family ipv6-unicast redistribute connected
-  set protocols bgp 65020 neighbor eth1 interface v6only
-  set protocols bgp 65020 neighbor eth1 interface v6only peer-group 'fabric'
-  set protocols bgp 65020 neighbor eth2 interface v6only
-  set protocols bgp 65020 neighbor eth2 interface v6only peer-group 'fabric'
-  set protocols bgp 65020 parameters bestpath as-path multipath-relax
-  set protocols bgp 65020 parameters bestpath compare-routerid
-  set protocols bgp 65020 parameters default no-ipv4-unicast
-  set protocols bgp 65020 parameters router-id '192.168.0.1'
-  set protocols bgp 65020 peer-group fabric address-family ipv4-unicast
-  set protocols bgp 65020 peer-group fabric address-family ipv6-unicast
-  set protocols bgp 65020 peer-group fabric capability extended-nexthop
-  set protocols bgp 65020 peer-group fabric remote-as 'external'
-
-- Router B:
-
-.. code-block:: none
-
-  set protocols bgp 65021 address-family ipv4-unicast redistribute connected
-  set protocols bgp 65021 address-family ipv6-unicast redistribute connected
-  set protocols bgp 65021 neighbor eth1 interface v6only
-  set protocols bgp 65021 neighbor eth1 interface v6only peer-group 'fabric'
-  set protocols bgp 65021 neighbor eth2 interface v6only
-  set protocols bgp 65021 neighbor eth2 interface v6only peer-group 'fabric'
-  set protocols bgp 65021 parameters bestpath as-path multipath-relax
-  set protocols bgp 65021 parameters bestpath compare-routerid
-  set protocols bgp 65021 parameters default no-ipv4-unicast
-  set protocols bgp 65021 parameters router-id '192.168.0.2'
-  set protocols bgp 65021 peer-group fabric address-family ipv4-unicast
-  set protocols bgp 65021 peer-group fabric address-family ipv6-unicast
-  set protocols bgp 65021 peer-group fabric capability extended-nexthop
-  set protocols bgp 65021 peer-group fabric remote-as 'external'
-
-Results
-^^^^^^^^^^^^^
-
-- Router A:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             62.104.XXX.XXX/24                 u/u
-  eth1             -                                 u/u
-  eth2             -                                 u/u
-  lo               127.0.0.1/8                       u/u
-                   192.168.0.1/32
-                   ::1/128
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip route
-  Codes: K - kernel route, C - connected, S - static, R - RIP,
-         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
-         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
-         F - PBR, f - OpenFabric,
-         > - selected route, * - FIB route
-
-  S>* 0.0.0.0/0 [210/0] via 62.104.XXX.XXX, eth0, 03:21:53
-  C>* 62.104.56.0/24 is directly connected, eth0, 03:21:53
-  C>* 192.168.0.1/32 is directly connected, lo, 03:21:56
-  B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07
-    *                       via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07
-
-.. code-block:: none
-
-  vyos@vyos:~$ ping 192.168.0.2
-  PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
-  64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms
-  64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms
-  64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms
-  64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms
-  64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms
-
-  --- 192.168.0.2 ping statistics ---
-  5 packets transmitted, 5 received, 0% packet loss, time 4086ms
-  rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip bgp summary
-
-  IPv4 Unicast Summary:
-  BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0
-  BGP table version 4
-  RIB entries 5, using 800 bytes of memory
-  Peers 2, using 41 KiB of memory
-  Peer groups 1, using 64 bytes of memory
-
-  Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
-  eth1            4      65021      13      13        0    0    0 00:05:33            2
-  eth2            4      65021      13      14        0    0    0 00:05:29            2
-
-  Total number of neighbors 2
-
-- Router B:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             62.104.XXX.XXX/24                 u/u
-  eth1             -                                 u/u
-  eth2             -                                 u/u
-  lo               127.0.0.1/8                       u/u
-                   192.168.0.2/32
-                   ::1/128
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip route
-  Codes: K - kernel route, C - connected, S - static, R - RIP,
-         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
-         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
-         F - PBR, f - OpenFabric,
-         > - selected route, * - FIB route
-
-  S>* 0.0.0.0/0 [210/0] via 62.104.XXX.XXX, eth0, 00:44:08
-  C>* 62.104.56.0/24 is directly connected, eth0, 00:44:09
-  B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18
-    *                       via fe80::a00:27ff:fe93:e142, eth2, 00:06:18
-  C>* 192.168.0.2/32 is directly connected, lo, 00:44:11
-
-.. code-block:: none
-
-  vyos@vyos:~$ ping 192.168.0.1
-  PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
-  64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms
-  64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms
-  64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms
-  64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms
-
-  --- 192.168.0.1 ping statistics ---
-  4 packets transmitted, 4 received, 0% packet loss, time 3051ms
-  rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip bgp summary
-  IPv4 Unicast Summary:
-  BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0
-  BGP table version 4
-  RIB entries 5, using 800 bytes of memory
-  Peers 2, using 41 KiB of memory
-  Peer groups 1, using 64 bytes of memory
-
-  Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
-  eth1            4      65020      14      14        0    0    0 00:06:40            2
-  eth2            4      65020      14      14        0    0    0 00:06:37            2
-
-  Total number of neighbors 2
-
diff --git a/docs/appendix/examples/dhcp-relay-through-gre-bridge.rst b/docs/appendix/examples/dhcp-relay-through-gre-bridge.rst
deleted file mode 100644
index f94eb67f..00000000
--- a/docs/appendix/examples/dhcp-relay-through-gre-bridge.rst
+++ /dev/null
@@ -1,77 +0,0 @@
-.. _examples-dhcp-relay-through-gre-bridge:
-
-
-DHCP Relay through GRE-Bridge
------------------------------
-
-Diagram
-^^^^^^^
-
-.. image:: /_static/images/dhcp-relay-through-gre-bridge.png
-   :width: 80%
-   :align: center
-   :alt: Network Topology Diagram
-
-Configuration
-^^^^^^^^^^^^^
-
-DHCP Server
-"""""""""""
-
-.. code-block:: none
-
-   set interfaces ethernet eth0 address '10.0.2.1/24'
-   set interfaces loopback lo address '3.3.3.3/24'
-   set interfaces tunnel tun100 address '172.16.0.2/30'
-   set interfaces tunnel tun100 encapsulation 'gre-bridge'
-   set interfaces tunnel tun100 local-ip '10.0.2.1'
-   set interfaces tunnel tun100 remote-ip '192.168.0.1'
-   set protocols ospf area 0 network '3.3.3.0/24'
-   set protocols ospf area 0 network '10.0.2.0/24'
-   set protocols ospf parameters router-id '3.3.3.3'
-   set protocols static interface-route 10.0.1.2/32 next-hop-interface tun100
-   set service dhcp-server shared-network-name asdf authoritative
-   set service dhcp-server shared-network-name asdf subnet 3.3.3.0/24 range 0 start '3.3.3.30'
-   set service dhcp-server shared-network-name asdf subnet 3.3.3.0/24 range 0 stop '3.3.3.40'
-   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 default-router '10.0.1.2'
-   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 range 0 start '10.0.1.200'
-   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 range 0 stop '10.0.1.210'
-   set service dhcp-server shared-network-name asdf subnet 10.2.1.0/24 range 0 start '10.2.1.222'
-   set service dhcp-server shared-network-name asdf subnet 10.2.1.0/24 range 0 stop '10.2.1.233'
-   set service dhcp-server shared-network-name asdf subnet 172.16.0.0/30 range 0 start '172.16.0.1'
-   set service dhcp-server shared-network-name asdf subnet 172.16.0.0/30 range 0 stop '172.16.0.2'
-   
-
-In-Between Router
-"""""""""""""""""
-
-.. code-block:: none
-
-   set interfaces ethernet eth0 address '192.168.0.2/24'
-   set interfaces ethernet eth1 address '10.0.2.2/24'
-   set protocols ospf area 0 network '192.168.0.0/24'
-   set protocols ospf area 0 network '10.0.2.0/24'
-   set protocols ospf parameters router-id '192.168.0.2'
-   
-
-DHCP Relay
-""""""""""
-
-.. code-block:: none
-
-   set interfaces ethernet eth0 address '10.0.1.2/24'
-   set interfaces ethernet eth1 address '192.168.0.1/24'
-   set interfaces loopback lo address '1.1.1.1'
-   set interfaces tunnel tun100 address '172.16.0.1/30'
-   set interfaces tunnel tun100 encapsulation 'gre-bridge'
-   set interfaces tunnel tun100 local-ip '192.168.0.1'
-   set interfaces tunnel tun100 remote-ip '10.0.2.1'
-   set protocols ospf area 0 network '10.0.1.0/24'
-   set protocols ospf area 0 network '192.168.0.0/24'
-   set protocols ospf area 0 network '1.1.1.0/24'
-   set protocols ospf parameters router-id '1.1.1.1'
-   set protocols static interface-route 3.3.3.3/32 next-hop-interface tun100
-   set service dhcp-relay interface 'eth0'
-   set service dhcp-relay interface 'tun100'
-   set service dhcp-relay server '3.3.3.3'
-   
diff --git a/docs/appendix/examples/dmvpn.rst b/docs/appendix/examples/dmvpn.rst
deleted file mode 100644
index 30ca8e86..00000000
--- a/docs/appendix/examples/dmvpn.rst
+++ /dev/null
@@ -1,106 +0,0 @@
-
-.. _examples-dmvpn:
-
-VyOS DMVPN Hub
---------------
-
-General infomration can be found in the :ref:`vpn-dmvpn` chapter.
-
-Configuration
-^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  set interfaces tunnel tun100 address '172.16.253.134/29'
-  set interfaces tunnel tun100 encapsulation 'gre'
-  set interfaces tunnel tun100 local-ip '11.22.33.44'
-  set interfaces tunnel tun100 multicast 'enable'
-  set interfaces tunnel tun100 parameters ip key '1'
-
-  set protocols nhrp tunnel tun100 cisco-authentication '<nhrp secret key>'
-  set protocols nhrp tunnel tun100 holding-time '300'
-  set protocols nhrp tunnel tun100 multicast 'dynamic'
-  set protocols nhrp tunnel tun100 redirect
-  set protocols nhrp tunnel tun100 shortcut
-
-  set vpn ipsec esp-group ESP-HUB compression 'disable'
-  set vpn ipsec esp-group ESP-HUB lifetime '1800'
-  set vpn ipsec esp-group ESP-HUB mode 'tunnel'
-  set vpn ipsec esp-group ESP-HUB pfs 'dh-group2'
-  set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
-  set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des'
-  set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5'
-  set vpn ipsec ike-group IKE-HUB ikev2-reauth 'no'
-  set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
-  set vpn ipsec ike-group IKE-HUB lifetime '3600'
-  set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
-  set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
-  set vpn ipsec ike-group IKE-HUB proposal 2 dh-group '2'
-  set vpn ipsec ike-group IKE-HUB proposal 2 encryption 'aes128'
-  set vpn ipsec ike-group IKE-HUB proposal 2 hash 'sha1'
-  set vpn ipsec ipsec-interfaces interface 'eth0'
-
-  set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
-  set vpn ipsec profile NHRPVPN authentication pre-shared-secret '<secretkey>'
-  set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
-  set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
-  set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
-
-Cisco IOS Spoke
-^^^^^^^^^^^^^^^
-
-This example is verified with a Cisco 2811 platform running IOS 15.1(4)M9 and
-VyOS 1.1.7 (helium) up to VyOS 1.2 (Crux).
-
-.. code-block:: none
-
-  Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 15.1(4)M9, RELEASE SOFTWARE (fc3)
-  Technical Support: http://www.cisco.com/techsupport
-  Copyright (c) 1986-2014 by Cisco Systems, Inc.
-  Compiled Fri 12-Sep-14 10:45 by prod_rel_team
-
-  ROM: System Bootstrap, Version 12.3(8r)T7, RELEASE SOFTWARE (fc1)
-
-Use this configuration on your Cisco device:
-
-.. code-block:: none
-
-  crypto pki token default removal timeout 0
-  crypto keyring DMVPN
-    pre-shared-key address 1.2.3.4 key <secretkey>
-  !
-  crypto isakmp policy 10
-   encr aes 256
-   authentication pre-share
-   group 2
-  !
-  crypto isakmp invalid-spi-recovery
-  crypto isakmp keepalive 30 30 periodic
-  crypto isakmp profile DMVPN
-     keyring DMVPN
-     match identity address 11.22.33.44 255.255.255.255
-  !
-  crypto ipsec transform-set DMVPN-AES256 esp-aes 256 esp-sha-hmac
-   mode transport
-  !
-  crypto ipsec profile DMVPN
-   set security-association idle-time 720
-   set transform-set DMVPN-AES256
-   set isakmp-profile DMVPN
-  !
-  interface Tunnel10
-   description Tunnel to DMVPN HUB
-   ip address 172.16.253.129 255.255.255.248
-   no ip redirects
-   ip nhrp authentication <nhrp secret key>
-   ip nhrp map multicast 11.22.33.44
-   ip nhrp map 172.16.253.134 11.22.33.44
-   ip nhrp network-id 1
-   ip nhrp holdtime 600
-   ip nhrp nhs 172.16.253.134
-   ip nhrp registration timeout 75
-   tunnel source Dialer1
-   tunnel mode gre multipoint
-   tunnel key 1
diff --git a/docs/appendix/examples/index.rst b/docs/appendix/examples/index.rst
deleted file mode 100644
index 5216b18f..00000000
--- a/docs/appendix/examples/index.rst
+++ /dev/null
@@ -1,20 +0,0 @@
-.. _examples:
-
-Configuration Examples
-======================
-
-This chapter contains various configuration Examples
-
-
-.. toctree::
-   :maxdepth: 2
-
-   dmvpn
-   zone-policy
-   bgp-ipv6-unnumbered
-   ospf-unnumbered
-   azure-vpn-bgp
-   azure-vpn-dual-bgp
-   tunnelbroker-ipv6
-   dhcp-relay-through-gre-bridge
-   wan-load-balancing
diff --git a/docs/appendix/examples/ospf-unnumbered.rst b/docs/appendix/examples/ospf-unnumbered.rst
deleted file mode 100644
index 84fc691e..00000000
--- a/docs/appendix/examples/ospf-unnumbered.rst
+++ /dev/null
@@ -1,125 +0,0 @@
-.. _examples-ospf-unnumbered:
-
-VyOS OSPF unnumbered with ecmp
-----------------------------------------------
-
-General infomration can be found in the :ref:`routing-ospf` chapter.
-
-Configuration
-^^^^^^^^^^^^^
-
-- Router A:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address '10.0.0.1/24'
-  set interfaces ethernet eth1 address '192.168.0.1/32'
-  set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-  set interfaces ethernet eth1 ip ospf network 'point-to-point'
-  set interfaces ethernet eth2 address '192.168.0.1/32'
-  set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-  set interfaces ethernet eth2 ip ospf network 'point-to-point'
-  set interfaces loopback lo address '192.168.0.1/32'
-  set protocols ospf area 0.0.0.0 authentication 'md5'
-  set protocols ospf area 0.0.0.0 network '192.168.0.1/32'
-  set protocols ospf parameters router-id '192.168.0.1'
-  set protocols ospf redistribute connected
-
-- Router B:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address '10.0.0.2/24'
-  set interfaces ethernet eth1 address '192.168.0.2/32'
-  set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-  set interfaces ethernet eth1 ip ospf network 'point-to-point'
-  set interfaces ethernet eth2 address '192.168.0.2/32'
-  set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-  set interfaces ethernet eth2 ip ospf network 'point-to-point'
-  set interfaces loopback lo address '192.168.0.2/32'
-  set protocols ospf area 0.0.0.0 authentication 'md5'
-  set protocols ospf area 0.0.0.0 network '192.168.0.2/32'
-  set protocols ospf parameters router-id '192.168.0.2'
-  set protocols ospf redistribute connected
-
-
-Results
-^^^^^^^^^^^^^
-
-- Router A:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces 
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             10.0.0.1/24                       u/u  
-  eth1             192.168.0.1/32                    u/u  
-  eth2             192.168.0.1/32                    u/u  
-  lo               127.0.0.1/8                       u/u  
-                   192.168.0.1/32
-                   ::1/128
-  vyos@vyos:~$ 
-
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip route 
-  Codes: K - kernel route, C - connected, S - static, R - RIP,
-         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
-         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
-         F - PBR, f - OpenFabric,
-         > - selected route, * - FIB route, q - queued route, r - rejected route
-  
-  S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
-  O   10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21
-                              via 192.168.0.2, eth2 onlink, 00:13:21
-  C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
-  O   192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53
-  C * 192.168.0.1/32 is directly connected, eth2, 00:56:31
-  C * 192.168.0.1/32 is directly connected, eth1, 00:56:31
-  C>* 192.168.0.1/32 is directly connected, lo, 00:57:36
-  O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03
-    *                        via 192.168.0.2, eth2 onlink, 00:29:03
-  vyos@vyos:~$ 
-
-
-- Router B:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces 
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             10.0.0.2/24                       u/u  
-  eth1             192.168.0.2/32                    u/u  
-  eth2             192.168.0.2/32                    u/u  
-  lo               127.0.0.1/8                       u/u  
-                   192.168.0.2/32
-                   ::1/128
-  vyos@vyos:~$ 
-
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip route 
-  Codes: K - kernel route, C - connected, S - static, R - RIP,
-         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
-         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
-         F - PBR, f - OpenFabric,
-         > - selected route, * - FIB route, q - queued route, r - rejected route
-  
-  S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
-  O   10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21
-                              via 192.168.0.1, eth2 onlink, 00:13:21
-  C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
-  O   192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53
-  C * 192.168.0.2/32 is directly connected, eth2, 00:56:31
-  C * 192.168.0.2/32 is directly connected, eth1, 00:56:31
-  C>* 192.168.0.2/32 is directly connected, lo, 00:57:36
-  O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03
-    *                        via 192.168.0.1, eth2 onlink, 00:29:03
-  vyos@vyos:~$ 
-
diff --git a/docs/appendix/examples/tunnelbroker-ipv6.rst b/docs/appendix/examples/tunnelbroker-ipv6.rst
deleted file mode 100644
index ca3921ec..00000000
--- a/docs/appendix/examples/tunnelbroker-ipv6.rst
+++ /dev/null
@@ -1,151 +0,0 @@
-.. _examples-tunnelbroker-ipv6:
-
-VyOS Tunnelbroker.net IPv6
---------------------------
-
-This guides walks through the setup of `Tunnelbroker.net <https://www.tunnelbroker.net/>`_ for an IPv6 Tunnel.  
-
-Prerequisites
-^^^^^^^^^^^^^
-
-- A public IP address.  This does not necessarily need to be static, but you will need to update the tunnel endpoint when/if your IP address changes, which can be done with a script and a scheduled task.
-- An account at `Tunnelbroker.net <https://www.tunnelbroker.net/>`_.
-- Requested a "Regular Tunnel".  You want to choose a location that is closest to your physical location for the best response time.
-
-Setting up the initial tunnel
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-- Set up the initial IPv6 tunnel. Replace the field below from the fields on the `Tunnelbroker.net <https://www.tunnelbroker.net/>`_ tunnel information page.
-
-.. code-block:: none
-
-    conf
-    set interfaces tunnel tun0 address Client_IPv6_from_Tunnelbroker    # This will be your VyOS install's public IPv6 address
-    set interfaces tunnel tun0 description 'HE.NET IPv6 Tunnel'
-    set interfaces tunnel tun0 encapsulation 'sit'
-    set interfaces tunnel tun0 local-ip Client_IPv4_from_Tunnelbroker   # This is your public IP
-    set interfaces tunnel tun0 mtu '1472'
-    set interfaces tunnel tun0 multicast 'disable'
-    set interfaces tunnel tun0 remote-ip Server_IPv4_from_Tunnelbroker  # This is the IP of the Tunnelbroker server
-    set protocols static interface-route6 ::/0 next-hop-interface tun0  # Tell all traffic to go over this tunnel
-    commit
-
-- If your WAN connection is over PPPoE, you may need to set the MTU on the above tunnel lower than 1472.
-
-- At this point you should be able to ping an IPv6 address. Try pinging Google:
-
-.. code-block:: none
-
-   ping6 -c2 2001:4860:4860::8888
-
-   64 bytes from 2001:4860:4860::8888: icmp_seq=1 ttl=57 time=21.7 ms
-   64 bytes from 2001:4860:4860::8888: icmp_seq=2 ttl=57 time=21.1 ms
-
-   --- 2001:4860:4860::8888 ping statistics ---
-   2 packets transmitted, 2 received, 0% packet loss, time 1001ms
-   rtt min/avg/max/mdev = 21.193/21.459/21.726/0.304 ms
-
-- Assuming the pings are successful, you need to add some DNS servers. Some options:
-
-.. code-block:: none
-
-   set system name-server 2001:4860:4860::8888  # Google
-   set system name-server 2001:4860:4860::8844  # Google
-   set system name-server 2606:4700:4700::1111  # Cloudflare
-   set system name-server 2606:4700:4700::1001  # Cloudflare
-   commit
-
-- You should now be able to ping something by IPv6 DNS name:
-
-.. code-block:: none
-
-   # ping6 -c2 one.one.one.one
-   PING one.one.one.one(one.one.one.one) 56 data bytes
-   64 bytes from one.one.one.one: icmp_seq=1 ttl=58 time=16.8 ms
-   64 bytes from one.one.one.one: icmp_seq=2 ttl=58 time=17.4 ms
-
-   --- one.one.one.one ping statistics ---
-   2 packets transmitted, 2 received, 0% packet loss, time 1001ms
-   rtt min/avg/max/mdev = 16.880/17.153/17.426/0.273 ms
-
--  Assuming everything works, you can proceed to client configuration
-
-LAN Configuration
-^^^^^^^^^^^^^^^^^
-
-At this point your VyOS install should have full IPv6, but now your LAN devices need access.
-
-With Tunnelbroker.net, you have two options:
-
-- Routed /64. This is the default assignment.  In IPv6-land, it's good for a single "LAN", and is somewhat equivalent to a /24.  Example: `2001:470:xxxx:xxxx::/64`
-- Routed /48. This is something you can request by clicking the "Assign /48" link in the Tunnelbroker.net tunnel config.  It allows you to have up to 65k LANs. Example: `2001:470:xxxx::/48` 
-
-Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64.  So if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore the assigned /64, and request the /48 and use that.  
-
-Single LAN Setup
-^^^^^^^^^^^^^^^^
-
-Single LAN setup where eth1 is your LAN interface.  Use the /64 (all the xxxx should be replaced with the information from your `Routed /64` tunnel):
-
-.. code-block:: none
-
-   set interfaces ethernet eth1 address '2001:470:xxxx:xxxx::1/64'    
-   set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8888'
-   set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8844'
-   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:xxxx::/64 autonomous-flag 'true'
-   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:xxxx::/64 on-link-flag 'true'
-   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:xxxx::/64 valid-lifetime '2592000'
-
-
-- This accomplishes a few things:
-
-  - Sets your LAN interface's IP address
-  - Enables router advertisements.  This is an IPv6 alternative for DHCP (though DHCPv6 can still be used). With RAs, Your devices will automatically find the information they need for routing and DNS. 
-
-Multiple LAN/DMZ Setup
-^^^^^^^^^^^^^^^^^^^^^^
-
-In this, you use the `Routed /48` information. This allows you to assign a different /64 to every interface, LAN, or even device.  Or you could break your network into smaller chunks like /56 or /60.
-
-The format of these addresses:
-
-- `2001:470:xxxx::/48`: The whole subnet.  xxxx should come from Tunnelbroker.
-- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN
-- `2001:470:xxxx:2::/64`: Another subnet
-- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet.
-
-In the above examples, 1,2,ffff are all chosen by you.  You can use 1-ffff (1-65535). 
-
-So, when your LAN is eth1, your DMZ is eth2, your cameras live on eth3, etc:
-
-.. code-block:: none
-
-   set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64'
-   set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8888'
-   set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8844'
-   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:1::/64 autonomous-flag 'true'
-   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:1::/64 on-link-flag 'true'
-   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:1::/64 valid-lifetime '2592000'
-
-   set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64'
-   set interfaces ethernet eth2 ipv6 router-advert name-server '2001:4860:4860::8888'
-   set interfaces ethernet eth2 ipv6 router-advert name-server '2001:4860:4860::8844'
-   set interfaces ethernet eth2 ipv6 router-advert prefix 2001:470:xxxx:2::/64 autonomous-flag 'true'
-   set interfaces ethernet eth2 ipv6 router-advert prefix 2001:470:xxxx:2::/64 on-link-flag 'true'
-   set interfaces ethernet eth2 ipv6 router-advert prefix 2001:470:xxxx:2::/64 valid-lifetime '2592000'
-
-   set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64'
-   set interfaces ethernet eth3 ipv6 router-advert name-server '2001:4860:4860::8888'
-   set interfaces ethernet eth3 ipv6 router-advert name-server '2001:4860:4860::8844'
-   set interfaces ethernet eth3 ipv6 router-advert prefix 2001:470:xxxx:3::/64 autonomous-flag 'true'
-   set interfaces ethernet eth3 ipv6 router-advert prefix 2001:470:xxxx:3::/64 on-link-flag 'true'
-   set interfaces ethernet eth3 ipv6 router-advert prefix 2001:470:xxxx:3::/64 valid-lifetime '2592000'
-
-Firewall
-^^^^^^^^
-
-Finally, don't forget the :ref:`firewall`.  The usage is identical, except for instead of `set firewall name NAME`, you would use `set firewall ipv6-name NAME`. 
-
-Similarly, to attach the firewall, you would use `set interfaces ethernet eth0 firewall in ipv6-name` or `set zone-policy zone LOCAL from WAN firewall ipv6-name`
-
-
diff --git a/docs/appendix/examples/wan-load-balancing.rst b/docs/appendix/examples/wan-load-balancing.rst
deleted file mode 100644
index 7093defe..00000000
--- a/docs/appendix/examples/wan-load-balancing.rst
+++ /dev/null
@@ -1,170 +0,0 @@
-.. _wan-load-balancing:
-
-WAN Load Balancer examples
-==========================
-
-
-Example 1: Distributing load evenly
------------------------------------
-
-The setup used in this example is shown in the following diagram:
-
-.. image:: /_static/images/Wan_load_balancing1.png
-   :width: 80%
-   :align: center
-   :alt: Network Topology Diagram
-
-
-Overview
-^^^^^^^^
- * All traffic coming in trough eth2 is balanced between eth0 and eth1
-   on the router.
- * Pings will be sent to four targets for health testing (33.44.55.66,
-   44.55.66.77, 55.66.77.88 and 66.77.88.99).
- * All outgoing packets are assigned the source address of the assigned
-   interface (SNAT).
- * eth0 is set to be removed from the load balancer's interface pool
-   after 5 ping failures, eth1 will be removed after 4 ping failures.
-
-Create static routes to ping targets
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-Create static routes through the two ISPs towards the ping targets and
-commit the changes:
-
-.. code-block:: none
-
-   set protocols static route 33.44.55.66/32 next-hop 11.22.33.1
-   set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 
-   set protocols static route 55.66.77.88/32 next-hop 22.33.44.1
-   set protocols static route 66.77.88.99/32 next-hop 22.33.44.1
-
-Configure the load balancer
-^^^^^^^^^^^^^^^^^^^^^^^^^^^
-Configure the WAN load balancer with the parameters described above:
-
-.. code-block:: none
-
-   set load-balancing wan interface-health eth0 failure-count 5
-   set load-balancing wan interface-health eth0 nexthop 11.22.33.1
-   set load-balancing wan interface-health eth0 test 10 type ping
-   set load-balancing wan interface-health eth0 test 10 target 33.44.55.66
-   set load-balancing wan interface-health eth0 test 20 type ping
-   set load-balancing wan interface-health eth0 test 20 target 44.55.66.77
-   set load-balancing wan interface-health eth1 failure-count 4
-   set load-balancing wan interface-health eth1 nexthop 22.33.44.1
-   set load-balancing wan interface-health eth1 test 10 type ping
-   set load-balancing wan interface-health eth1 test 10 target 55.66.77.88
-   set load-balancing wan interface-health eth1 test 20 type ping
-   set load-balancing wan interface-health eth1 test 20 target 66.77.88.99
-   set load-balancing wan rule 10 inbound-interface eth2
-   set load-balancing wan rule 10 interface eth0
-   set load-balancing wan rule 10 interface eth1
-
-Example 2: Failover based on interface weights
-----------------------------------------------
-
-This examples uses the failover mode.
-
-Overview
-^^^^^^^^
-In this example eth0 is the primary interface and eth1 is the secondary
-interface to provide simple failover functionality. If eth0 fails, eth1
-takes over.
-
-Create interface weight based configuration
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-The configuration steps are the same as in the previous example, except
-rule 10 so we keep the configuration, remove rule 10 and add a new rule
-for the failover mode:
-
-.. code-block:: none
-
-   delete load-balancing wan rule 10
-   set load-balancing wan rule 10 failover
-   set load-balancing wan rule 10 inbound-interface eth2
-   set load-balancing wan rule 10 interface eth0 weight 10
-   set load-balancing wan rule 10 interface eth1 weight 1
-
-Example 3: Failover based on rule order
----------------------------------------
-
-The previous example used the failover command to send traffic thorugh
-eth1 if eth0 fails. In this example failover functionality is provided
-by rule order.
-
-Overview
-^^^^^^^^
-Two rules will be created, the first rule directs traffic coming in
-from eth2 to eth0 and the second rule directs the traffic to eth1. If
-eth0 fails the first rule is bypassed and the second rule matches,
-directing traffic to eth1.
-
-Create rule order based configuration
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-We keep the configurtation from the previous example, delete rule 10
-and create the two new rules as described:
-
-.. code-block:: none
-
-   delete load-balancing wan rule 10
-   set load-balancing wan rule 10 inbound-interface eth2
-   set load-balancing wan rule 10 interface eth0
-   set load-balancing wan rule 20 inbound-interface eth2
-   set load-balancing wan rule 20 interface eth1
-
-Example 4: Failover based on rule order - priority traffic
-----------------------------------------------------------
-
-A rule order for prioritising traffic is useful in scenarios where the
-secondary link has a lower speed and should only carry high priority
-traffic. It is assumed for this example that eth1 is connected to a
-slower connection than eth0 and should prioritise VoIP traffic.
-
-Overview
-^^^^^^^^
-A rule order for prioritising traffic is useful in scenarios where the
-secondary link has a lower speed and should only carry high priority
-traffic. It is assumed for this example that eth1 is connected to a
-slower connection than eth0 and should prioritise VoIP traffic. 
-
-Create rule order based configuration with low speed secondary link
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-We keep the configuration from the previous example, delete rule 20 and
-create a new rule as described: 
-
-.. code-block:: none
-
-   delete load-balancing wan rule 20
-   set load-balancing wan rule 20 inbound-interface eth2
-   set load-balancing wan rule 20 interface eth1
-   set load-balancing wan rule 20 destination port sip
-   set load-balancing wan rule 20 protocol tcp
-   set protocols static route 0.0.0.0/0 next-hop 11.22.33.1
-
-Example 5: Exclude traffic from load balancing
-----------------------------------------------
-
-In this example two LAN interfaces exist in different subnets instead
-of one like in the previous examples:
-
-.. image:: /_static/images/Wan_load_balancing_exclude1.png                      
-   :width: 80%                                                          
-   :align: center                                                       
-   :alt: Network Topology Diagram 
-
-Adding a rule for the second interface
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Based on the previous example, another rule for traffic from the second
-interface eth3 can be added to the load balancer. However, traffic meant
-to flow between the LAN subnets will be sent to eth0 and eth1 as well.
-To prevent this, another rule is required. This rule excludes traffic
-between the local subnets from the load balancer. It also excludes
-locally-sources packets (required for web caching with load balancing).
-eth+ is used as an alias that refers to all ethernet interfaces:
-
-.. code-block:: none
-
-   set load-balancing wan rule 5 exclude
-   set load-balancing wan rule 5 inbound-interface eth+
-   set load-balancing wan rule 5 destination address 10.0.0.0/8
diff --git a/docs/appendix/examples/zone-policy.rst b/docs/appendix/examples/zone-policy.rst
deleted file mode 100644
index 7a25d063..00000000
--- a/docs/appendix/examples/zone-policy.rst
+++ /dev/null
@@ -1,379 +0,0 @@
-.. _examples-zone-policy:
-
-Zone-Policy example
--------------------
-
-Native IPv4 and IPv6
-^^^^^^^^^^^^^^^^^^^^
-
-We have three networks.
-
-.. code-block:: none
-
-  WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64
-  LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64
-  DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64
-
-
-This specific example is for a router on a stick, but is very easily adapted
-for however many NICs you have.
-
-[http://imgur.com/Alz1J.png Topology Image]
-
-The VyOS interface is assigned the .1/:1 address of their respective networks.
-WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30.
-
-It will look something like this:
-
-.. code-block:: none
-
-  interfaces {
-      ethernet eth0 {
-          duplex auto
-          hw-id 00:0c:29:6e:2a:92
-          smp_affinity auto
-          speed auto
-          vif 10 {
-              address 172.16.10.1/24
-              address 2001:db8:0:9999::1/64
-          }
-          vif 20 {
-              address 192.168.100.1/24
-              address 2001:db8:0:AAAA::1/64
-          }
-          vif 30 {
-              address 192.168.200.1/24
-              address 2001:db8:0:BBBB::1/64
-          }
-      }
-      loopback lo {
-      }
-  }
-
-
-Zones Basics
-^^^^^^^^^^^^
-
-Each interface is assigned to a zone. The interface can be physical or virtual
-such as tunnels (VPN, pptp, gre, etc) and are treated exactly the same.
-
-Traffic flows from zone A to zone B. That flow is what I refer to as a
-zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations.
-
-Ruleset are created per zone-pair-direction.
-
-I name rule sets to indicate which zone-pair-direction they represent. eg.
-ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN.
-
-In VyOS, you have to have unique Ruleset names. In the event of overlap, I
-add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This allows for
-each auto-completion and uniqueness.
-
-In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is the
-firewall itself.
-
-If your computer is on the LAN and you need to SSH into your VyOS box, you
-would need a rule to allow it in the LAN-Local ruleset. If you want to access
-a webpage from your VyOS box, you need a rule to allow it in the Local-LAN
-ruleset.
-
-In rules, it is good to keep them named consistently. As the number of rules
-you have grows, the more consistency you have, the easier your life will be.
-
-.. code-block:: none
-
-  Rule 1 - State Established, Related
-  Rule 2 - State Invalid
-  Rule 100 - ICMP
-  Rule 200 - Web
-  Rule 300 - FTP
-  Rule 400 - NTP
-  Rule 500 - SMTP
-  Rule 600 - DNS
-  Rule 700 - DHCP
-  Rule 800 - SSH
-  Rule 900 - IMAPS
-
-The first two rules are to deal with the idiosyncrasies of VyOS and iptables.
-
-Zones and Rulesets both have a default action statement. When using
-Zone-Policies, the default action is set by the zone-policy statement and is
-represented by rule 10000.
-
-It is good practice to log both accepted and denied traffic. It can save you
-significant headaches when trying to troubleshoot a connectivity issue.
-
-To add logging to the default rule, do:
-
-.. code-block:: none
-
-  set firewall name <ruleSet> enable-default-log
-
-
-By default, iptables does not allow traffic for established session to return,
-so you must explicitly allow this. I do this by adding two rules to every
-ruleset. 1 allows established and related state packets through and rule 2
-drops and logs invalid state packets. We place the established/related rule at
-the top because the vast majority of traffic on a network is established and
-the invalid rule to prevent invalid state packets from mistakenly being matched
-against other rules. Having the most matched rule listed first reduces CPU load
-in high volume environments. Note: I have filed a bug to have this added as a
-default action as well.
-
-''It is important to note, that you do not want to add logging to the
-established state rule as you will be logging both the inbound and outbound
-packets for each session instead of just the initiation of the session.
-Your logs will be massive in a very short period of time.''
-
-In VyOS you must have the interfaces created before you can apply it to the
-zone and the rulesets must be created prior to applying it to a zone-policy.
-
-I create/configure the interfaces first. Build out the rulesets for each
-zone-pair-direction which includes at least the three state rules. Then I setup
-the zone-policies.
-
-Zones do not allow for a default action of accept; either drop or reject.
-It is important to remember this because if you apply an interface to a zone
-and commit, any active connections will be dropped. Specifically, if you are
-SSH’d into VyOS and add local or the interface you are connecting through to a
-zone and do not have rulesets in place to allow SSH and established sessions,
-you will not be able to connect.
-
-The following are the rules that were created for this example
-(may not be complete), both in IPv4 and IPv6. If there is no IP specified,
-then the source/destination address is not explicit.
-
-.. code-block:: none
-
-  WAN – DMZ:192.168.200.200 – tcp/80
-  WAN – DMZ:192.168.200.200 – tcp/443
-  WAN – DMZ:192.168.200.200 – tcp/25
-  WAN – DMZ:192.168.200.200 – tcp/53
-  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/80
-  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/443
-  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/25
-  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/53
-
-  DMZ - Local - tcp/53
-  DMZ - Local - tcp/123
-  DMZ - Local - tcp/67,68
-
-  LAN - Local - tcp/53
-  LAN - Local - tcp/123
-  LAN - Local - tcp/67,68
-  LAN:192.168.100.10 - Local - tcp/22
-  LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22
-
-  LAN - WAN - tcp/80
-  LAN - WAN - tcp/443
-  LAN - WAN - tcp/22
-  LAN - WAN - tcp/20,21
-
-  DMZ - WAN - tcp/80
-  DMZ - WAN - tcp/443
-  DMZ - WAN - tcp/22
-  DMZ - WAN - tcp/20,21
-  DMZ - WAN - tcp/53
-  DMZ - WAN - udp/53
-
-  Local - WAN - tcp/80
-  Local - WAN - tcp/443
-  Local - WAN - tcp/20,21
-
-  Local - DMZ - tcp/25
-  Local - DMZ - tcp/67,68
-  Local - DMZ - tcp/53
-  Local - DMZ - udp/53
-
-  Local - LAN - tcp/67,68
-
-  LAN - DMZ - tcp/80
-  LAN - DMZ - tcp/443
-  LAN - DMZ - tcp/993
-  LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22
-  LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22
-
-Since we have 4 zones, we need to setup the following rulesets.
-
-.. code-block:: none
-
-  Lan-wan
-  Lan-local
-  Lan-dmz
-  Wan-lan
-  Wan-local
-  Wan-dmz
-  Local-lan
-  Local-wan
-  Local-dmz
-  Dmz-lan
-  Dmz-wan
-  Dmz-local
-
-Even if the two zones will never communicate, it is a good idea to create the
-zone-pair-direction rulesets and set enable-default-log. This will allow you to
-log attempts to access the networks. Without it, you will never see the
-connection attempts.
-
-This is an example of the three base rules.
-
-.. code-block:: none
-
-  name wan-lan {
-    default-action drop
-    enable-default-log
-    rule 1 {
-      action accept
-      state {
-        established enable
-        related enable
-      }
-    }
-    rule 2 {
-      action drop
-      log enable
-      state {
-        invalid enable
-      }
-    }
-  }
-
-
-Here is an example of an IPv6 DMZ-WAN ruleset.
-
-.. code-block:: none
-
-  ipv6-name dmz-wan-6 {
-    default-action drop
-    enable-default-log
-    rule 1 {
-      action accept
-      state {
-        established enable
-        related enable
-      }
-    }
-    rule 2 {
-      action drop
-      log enable
-      state {
-        invalid enable
-    }
-    rule 100 {
-      action accept
-      log enable
-      protocol ipv6-icmp
-    }
-    rule 200 {
-      action accept
-      destination {
-        port 80,443
-      }
-      log enable
-      protocol tcp
-    }
-    rule 300 {
-      action accept
-      destination {
-        port 20,21
-      }
-      log enable
-      protocol tcp
-    }
-    rule 500 {
-      action accept
-      destination {
-        port 25
-      }
-      log enable
-      protocol tcp
-      source {
-        address 2001:db8:0:BBBB::200
-      }
-    }
-    rule 600 {
-      action accept
-      destination {
-        port 53
-      }
-      log enable
-      protocol tcp_udp
-      source {
-        address 2001:db8:0:BBBB::200
-      }
-    }
-    rule 800 {
-      action accept
-      destination {
-      port 22
-      }
-      log enable
-      protocol tcp
-    }
-  }
-
-Once you have all of your rulesets built, then you need to create your
-zone-policy.
-
-Start by setting the interface and default action for each zone.
-
-.. code-block:: none
-
-  set zone-policy zone dmz default-action drop
-  set zone-policy zone dmz interface eth0.30
-
-In this case, we are setting the v6 ruleset that represents traffic sourced
-from the LAN, destined for the DMZ.
-Because the zone-policy firewall syntax is a little awkward, I keep it straight
-by thinking of it backwards.
-
- set zone-policy zone dmz from lan firewall ipv6-name lan-dmz-6
-
-dmz-lan policy is lan-dmz. You can get a rhythm to it when you build out a bunch at one time.
-
-In the end, you will end up with something like this config. I took out everything but the Firewall, Interfaces, and zone-policy sections. It is long enough as is.
-== IPv6 Tunnel ==
-
-If you are using a IPv6 tunnel from HE.net or someone else, the basis is the same except you have two WAN interface. One for v4 and one for v6.
-
-You would have 5 zones instead of just 4 and you would configure your v6 ruleset between your tunnel interface and your LAN/DMZ zones instead of to the WAN.
-
-LAN, WAN, DMZ, local and TUN (tunnel)
-
-v6 pairs would be:
-
-.. code-block:: none
-
-  lan-tun
-  lan-local
-  lan-dmz
-  tun-lan
-  tun-local
-  tun-dmz
-  local-lan
-  local-tun
-  local-dmz
-  dmz-lan
-  dmz-tun
-  dmz-local
-
-Notice, none go to WAN since WAN wouldn't have a v6 address on it.
-
-You would have to add a couple of rules on your wan-local ruleset to allow protocol 41 in.
-
-Something like:
-
-.. code-block:: none
-
-  rule 400 {
-    action accept
-    destination {
-      address 172.16.10.1
-    }
-    log enable
-    protocol 41
-    source {
-      address ip.of.tunnel.broker
-    }
-  }
-
diff --git a/docs/appendix/migrate-from-vyatta.rst b/docs/appendix/migrate-from-vyatta.rst
deleted file mode 100644
index eba9dc59..00000000
--- a/docs/appendix/migrate-from-vyatta.rst
+++ /dev/null
@@ -1,164 +0,0 @@
-.. _migrate_from_vyatta:
-
-Migrate from Vyatta Core
-========================
-
-VyOS 1.x line aims to preserve backward compatibility and provide a safe
-upgrade path for existing Vyatta Core users. You may think of VyOS 1.0.0 as
-VC7.0.
-
-Vyatta release compatiblity
----------------------------
-
-Vyatta Core releases from 6.5 to 6.6 should be 100% compatible.
-
-Vyatta Core 6.4 and earlier may have incompatibilities. In Vyatta 6.5 the
-"modify" firewall was removed and replaced with the ``set policy route``
-command family, old configs can not be automatically converted. You will have
-to adapt it to post-6.5 Vyatta syntax manually.
-
-.. note:: Also, in Vyatta Core 6.5 remote access VPN interfaces have been
-   renamed from ``pppX``  to ``l2tpX`` and ``pptpX``. If you are using
-   zone based firewalling in Vyatta Core pre-6.5 versions, make sure to change
-   interface names in rules for remote access VPN.
-
-Upgrade procedure
------------------
-
-You just use ``add system image``, as if it was a new VC release (see
-:ref:`update_vyos` for additional information). The only thing you want to do
-is to verify the new images digital signature. You will have to add the public
-key manually once as it is not shipped the first time.
-
-.. code-block:: none
-
-  vyatta@vyatta:~$ wget http://wiki.vyos.net/so3group_maintainers.key
-  Connecting to vyos.net (x.x.x.x:80)
-  so3group_maintainers 100% |*************************|  3125  --:--:-- ETA
-  vyatta@vyatta:~$ sudo apt-key add so3group_maintainers.key
-  OK
-  vyatta@vyatta:~$
-
-For completion the key below corresponds to the key listed in the URL above.
-
-.. code-block:: none
-
-  -----BEGIN PGP PUBLIC KEY BLOCK-----
-  Version: GnuPG v1.4.12 (GNU/Linux)
-  
-  mQINBFIIUZwBEADGl+wkZpYytQxd6LnjDZZScziBKYJbjInetYeS0SUrgpqnPkzL
-  2CiGfPczLwpYY0zWxpUhTvqjFsE5yDpgs0sPXIgUTFE1qfZQE+WD1I1EUM6sp/38
-  2xKQ9QaNc8oHuYINLYYmNYra6ZjIGtQP9WOX//IDYB3fhdwlmiW2z0hux2OnPWdh
-  hPZAmSrx5AiXFEEREJ1cAQyvYk7hgIRvM/rdQMUm+u4/z+S4mxCHE10KzlqOGhRv
-  hA8WQxHCVusMFGwXoKHxYf9OQpV7lsfOCODfXOMP/L9kHQ5/gBsLL5hHst+o/3VG
-  ec0QuVrVkBBehgrqhfJW2noq+9gTooURGImQHEOyE0xpJdFrrgk5Ii9RqQwdVRzI
-  ZPbqbo8uuldZIRJRGnfx+vAR9812yo38NVZ/X0P/hkkrx+UeGVgpC/ao5XLRiOzL
-  7ZBMWLA6FVmZ7mkpqdzuMXX5548ApACm6EKErULIhTYDGDzFxA3cf6gr5VVi4usD
-  wglVs+FHuiLehmuuPTMoVcT2R6+Ht44hG3BmQmKzh/SSEa1g9gKgrhZrMdIyK4hu
-  GvMqLw9z9BgJbWB3BgXOUdlkXLDwBvVpEcWsPJgxSjAvjAbLLE4YkKAdYU8bQ0Pd
-  JuN485tcXxgQCadFZB0gcipQAvVf4b810HrY88g6FldfauHxiACOlXscZwARAQAB
-  tDBTTzMgR3JvdXAgTWFpbnRhaW5lcnMgPG1haW50YWluZXJzQHNvM2dyb3VwLm5l
-  dD6JAjgEEwECACIFAlIIUZwCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJ
-  ELdE4lqkQubp8GsQAKntoRFG6bWX/4WPw7Vo7kIF5kWcmv3lVb0AQkacscWope7T
-  Iq0VcgpAycJue2bSS9LAsvNtpVkQmFawbwFjqB3CC5NbPNQ4Kf+gswKa+yaHwejo
-  7dkslAwxgXHe5g76DG7CVLMsMg6zVDFYuzeksPywls/OJBIpkuGqeXy9tAHjQzjA
-  SlZV3Gsx7azESjiVQ73EUBt2OXkwN4TN9TEHAnVsrNIXHwFl1VfFsSG1Q6uZDtkk
-  CB4DZJKN4RzCY2QSwMAqRRC2OXdwk5IAk8wwCGoFpp0UV6CO9YCeOaqJderEcBA4
-  MGHqdiPDIbH5wvckjZzFznU/Paz3MwPwBdtN+WSKvwf+JItSiUqm8Dy2Pl/1cnux
-  1g1I4WQlXUVaS/MDusqL7tbS8k5A5a2+YVMxShWH9BhXZwNXzEihl4sm8Hrg5SvZ
-  givJj2y93WoL69Wq0/86wkkH2xcrz4gsiUcQf5YXU/RHXOLnPR29/pg8TS0L7sST
-  dv0X23C2IpfqYoqN7YZ3K0Wczhi0yLPCrc27IczuHgjt/8ICda11xhB1t/pUbvnX
-  oksehaLp8O3uU8GyAsTfUgpijZFc/3jIadOl0L9NGUbYYgPzFeaZTa/njeEbz3wX
-  PZMn278sbL9UhupI5Hx7eREbKzV4VPVKz81ndKNMXyuJHXv2R0xou3nvuo1WuQIN
-  BFIIUZwBEADAhoYPDCSogG41Naq+wFkG+IPszqe0dW/UWg0xrZDT0UblwDSd4OGY
-  7FATMIhjOUyFxk6+XKA5CDCWP8Npkl0modTL59uVWNxU1vUKincc/j4ipHQeAhE6
-  fvZkrprvADD8TYIGesl/3EGNc7bzc5ZqX71hKPHG+autRtgFSOR2PSXD9MlJXIBb
-  RzHAXxlh72zvsGadcxLJm4pSWXitkR/5Wc3e0IippKdzGwZnCDpNmcBGtSTFgixP
-  JqyRZFVCPWs7jr/oQeZnq65wJp1KD2HvhhKHJfsPrnNjLSm1SQVh8hXzE9odcv6N
-  mJB7tNXywuROBt6a01ojBa9J3zuMYQj3iQl2MhxtHylKVBjr7NjZ4evZbLsRMxY1
-  hYk7sl+ZxCPFeOZ9D2ppU/CUDXCS095I1x+s+VuiUNf/3yd8ahCWDXVp9nsXyYjm
-  2pHIxb2F6r8Vd4AjlD2MQwszECS88INF3l/9ksIHEMKuuW+JAC9FiZ7k4IGcIltv
-  If/V2TgE6t6qoWIlmLhMTjOyJpwnokY1nIuXHH7yp+HsuqnYnf/dgLnt4czPLeHO
-  +TdIDHhUym0AKlCcbdgn0C6EJVTnA8BFgFjiIOMAeT0rhATg0W/cND8KQcX4V9wM
-  nHSEsgSEuP9H+67xuRx5Imuh5ntecrcuCYSNuOneUXWPThDKQPO9lQARAQABiQIf
-  BBgBAgAJBQJSCFGcAhsMAAoJELdE4lqkQubpc+0P/0IzUx8nTpF0/ii2TA0YCOgj
-  tviM6PRTVPrFcxijNeXiIMHZYrALYUvXxXGp1IZBP3IcOyuZNp2WLqF/f9a3cIr1
-  9b/LJPrwopGqV3K30lormk7hH0s3IXbhd0ZYWvRj+5kQ8TFRAFfPwjlItzjYJmYX
-  AGJmM9PxJID/4LgWSfQ/ZfNu7MJ7+2goQLu9b6x7UC1FlE4q1lcjBvHjVPM//S9G
-  lGAHaysyTjVu88W2wwBpBrO1MQnDvqFRddXPOIWp0jecBMUd4E0fB36yuStsXZT3
-  RN4V8vKRBYXuqHhiTwZeh153cHZk2EZBwz5A6DJubMaGdJTesHW5Qf2goph0pmjC
-  +XuXn8J6tc5nFDf8DP4AFVMtqa3Brj2fodWd0Zzxq3AVsbX144c1oqJUhO4t3+ie
-  8fD/6/jx4iuPCQTfyhHG+zGfyUb2LQ+OVLW1WYTxH5tzHaZUmZFdV2I1kuhuvZ1t
-  WRlmTnHZOnEb3+t8KCRWzRMfweTzXfRRKBC0/QpeX1r5pbaMHH8zF/J5PKmL0+jg
-  +DS8JSbSfv7Ke6rplf7lHYaDumAFZfxXuQkajzLZbX0E5Xu5BNz4Vq6LGBj7LDXL
-  gswIK8FFgZB+W8zwOqUV1vjIr9wkdLifXXezKpTeYpFDGLdfsK+uNAtGyvI61TDi
-  Pr6fWpIruuc7Gg9rUF0L
-  =VQTr
-  -----END PGP PUBLIC KEY BLOCK-----
-
-Next add the VyOS image.
-
-This example uses VyOS 1.0.0, however, it's better to install the latest
-release.
-
-.. code-block:: none
-
-  vyatta@vyatta:~$ show system image
-  The system currently has the following image(s) installed:
-    1: VC6.6R1 (default boot) (running image)
-
-  vyatta@vyatta:~$ add system image https://downloads.vyos.io/release/legacy/1.0.0/vyos-1.0.0-amd64.iso
-   Trying to fetch ISO file from https://downloads.vyos.io/release/legacy/1.0.0/vyos-1.0.0-amd64.iso
-     % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
-                                    Dload  Upload   Total   Spent    Left  Speed
-   100  223M  100  223M    0     0   960k      0  0:03:57  0:03:57 --:--:--  657k
-   ISO download succeeded.
-   Checking for digital signature file...
-     % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
-                                    Dload  Upload   Total   Spent    Left  Speed
-   100   836  100   836    0     0   4197      0 --:--:-- --:--:-- --:--:--  4287
-   Found it.  Checking digital signature...
-   gpg: directory `/root/.gnupg' created
-   gpg: new configuration file `/root/.gnupg/gpg.conf' created
-   gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
-   gpg: keyring `/root/.gnupg/pubring.gpg' created
-   gpg: Signature made Sun Dec 22 16:51:42 2013 GMT using RSA key ID A442E6E9
-   gpg: /root/.gnupg/trustdb.gpg: trustdb created
-   gpg: Good signature from "SO3 Group Maintainers <maintainers@so3group.net>"
-   gpg: WARNING: This key is not certified with a trusted signature!
-   gpg:          There is no indication that the signature belongs to the owner.
-   Primary key fingerprint: DD5B B405 35E7 F6E3 4278  1ABF B744 E25A A442 E6E9
-   Digital signature is valid.
-   Checking MD5 checksums of files on the ISO image...OK.
-   Done!
-   
-   What would you like to name this image? [1.0.0]: [return]
-   OK.  This image will be named: 1.0.0
-   Installing "1.0.0" image.
-   Copying new release files...
-
-   Would you like to save the current configuration
-   directory and config file? (Yes/No) [Yes]: [return]
-   Copying current configuration...
-
-   Would you like to save the SSH host keys from your
-   current configuration? (Yes/No) [Yes]: [return]
-   Copying SSH keys...
-   Setting up grub configuration...
-   Done.
-   
-   vyatta@vyatta:~$ show system image
-   The system currently has the following image(s) installed:
-
-      1: 1.0.0 (default boot)
-      2: VC6.6R1 (running image)
-
-Upon reboot, you should have a working installation of VyOS.
-
-You can go back to your Vyatta install using the ``set system image
-default-boot`` command and selecting the your previous Vyatta Core image.
-
-.. note:: Future releases of VyOS will break the direct upgrade path from
-   Vyatta core. Please upgrade through an intermediate VyOS version e.g. VyOS
-   1.2. After this you can continue upgrading to newer releases once you bootet
-   into VyOS 1.2 once.
diff --git a/docs/appendix/releasenotes.rst b/docs/appendix/releasenotes.rst
deleted file mode 100644
index f08786a0..00000000
--- a/docs/appendix/releasenotes.rst
+++ /dev/null
@@ -1,358 +0,0 @@
-.. _releasenotes:
-
-Release notes
-#############
-
-1.2 (Crux)
-==========
-
-1.2.6-S1
---------
-
-1.2.6-S1 is a security release release made in September 2020.
-
-Resolved issues
-^^^^^^^^^^^^^^^
-
-VyOS 1.2.6 release was found to be suspectible to CVE-2020-10995. It's a low-
-impact vulnerability in the PowerDNS recursor that allows an attacker to cause
-performance degradation via a specially crafted authoritative DNS server reply.
-
-* `2899 <https://phabricator.vyos.net/T2899>`_ remote syslog server migration error on update
-
-1.2.6
------
-
-1.2.6 is a maintenance release made in September 2019.
-
-Resolved issues
-^^^^^^^^^^^^^^^
-
-* `103 <https://phabricator.vyos.net/T103>`_ DHCP server prepends shared network name to hostnames
-* `125 <https://phabricator.vyos.net/T125>`_ Missing PPPoE interfaces in l2tp configuration
-* `1194 <https://phabricator.vyos.net/T1194>`_ cronjob is being setup even if not saved
-* `1205 <https://phabricator.vyos.net/T1205>`_ module pcspkr missing
-* `1219 <https://phabricator.vyos.net/T1219>`_ Redundant active-active configuration, asymmetric routing and conntrack-sync cache
-* `1220 <https://phabricator.vyos.net/T1220>`_ Show transceiver information from plugin modules, e.g SFP+, QSFP
-* `1221 <https://phabricator.vyos.net/T1221>`_ BGP - Default route injection is not processed by the specific route-map
-* `1241 <https://phabricator.vyos.net/T1241>`_ Remove of policy route throws CLI error
-* `1291 <https://phabricator.vyos.net/T1291>`_ Under certain conditions the VTI will stay forever down
-* `1463 <https://phabricator.vyos.net/T1463>`_ Missing command `show ip bgp scan` appears in command completion
-* `1575 <https://phabricator.vyos.net/T1575>`_ `show snmp mib ifmib` crashes with IndexError
-* `1699 <https://phabricator.vyos.net/T1699>`_ Default net.ipv6.route.max_size 32768 is too low
-* `1729 <https://phabricator.vyos.net/T1729>`_ PIM (Protocol Independent Multicast) implementation
-* `1901 <https://phabricator.vyos.net/T1901>`_ Semicolon in values is interpreted as a part of the shell command by validators
-* `1934 <https://phabricator.vyos.net/T1934>`_ Change default hostname when deploy from OVA without params.
-* `1938 <https://phabricator.vyos.net/T1938>`_ syslog doesn't start automatically
-* `1949 <https://phabricator.vyos.net/T1949>`_ Multihop IPv6 BFD is unconfigurable
-* `1953 <https://phabricator.vyos.net/T1953>`_ DDNS service name validation rejects valid service names
-* `1956 <https://phabricator.vyos.net/T1956>`_ PPPoE server: support PADO-delay
-* `1973 <https://phabricator.vyos.net/T1973>`_ Allow route-map to match on BGP local preference value
-* `1974 <https://phabricator.vyos.net/T1974>`_ Allow route-map to set administrative distance
-* `1982 <https://phabricator.vyos.net/T1982>`_ Increase rotation for atop.acct
-* `1983 <https://phabricator.vyos.net/T1983>`_ Expose route-map when BGP routes are programmed in to FIB
-* `1985 <https://phabricator.vyos.net/T1985>`_ pppoe: Enable ipv6 modules without configured ipv6 pools
-* `2000 <https://phabricator.vyos.net/T2000>`_ strongSwan does not install routes to table 220 in certain cases
-* `2021 <https://phabricator.vyos.net/T2021>`_ OSPFv3 doesn't support decimal area syntax
-* `2062 <https://phabricator.vyos.net/T2062>`_ Wrong dhcp-server static route subnet bytes
-* `2091 <https://phabricator.vyos.net/T2091>`_ swanctl.conf file is not generated properly is more than one IPsec profile is used
-* `2131 <https://phabricator.vyos.net/T2131>`_ Improve syslog remote host CLI definition
-* `2224 <https://phabricator.vyos.net/T2224>`_ Update Linux Kernel to v4.19.114
-* `2286 <https://phabricator.vyos.net/T2286>`_ IPoE server vulnerability
-* `2303 <https://phabricator.vyos.net/T2303>`_ Unable to delete the image version that came from OVA
-* `2305 <https://phabricator.vyos.net/T2305>`_ Add release name to "show version" command
-* `2311 <https://phabricator.vyos.net/T2311>`_ Statically configured name servers may not take precedence over ones from DHCP
-* `2327 <https://phabricator.vyos.net/T2327>`_ Unable to create syslog server entry with different port
-* `2332 <https://phabricator.vyos.net/T2332>`_ Backport node option for a syslog server
-* `2342 <https://phabricator.vyos.net/T2342>`_ Bridge l2tpv3 + ethX errors
-* `2344 <https://phabricator.vyos.net/T2344>`_ PPPoE server client static IP assignment silently fails
-* `2385 <https://phabricator.vyos.net/T2385>`_ salt-minion: improve completion helpers
-* `2389 <https://phabricator.vyos.net/T2389>`_ BGP community-list unknown command
-* `2398 <https://phabricator.vyos.net/T2398>`_ op-mode "dhcp client leases interface" completion helper misses interfaces
-* `2402 <https://phabricator.vyos.net/T2402>`_ Live ISO should warn when configuring that changes won't persist
-* `2443 <https://phabricator.vyos.net/T2443>`_ NHRP: Add debugging information to syslog
-* `2448 <https://phabricator.vyos.net/T2448>`_ `monitor protocol bgp` subcommands fail with 'command incomplete'
-* `2458 <https://phabricator.vyos.net/T2458>`_ Update FRR to 7.3.1
-* `2476 <https://phabricator.vyos.net/T2476>`_ Bond member description change leads to network outage
-* `2478 <https://phabricator.vyos.net/T2478>`_ login radius: use NAS-IP-Address if defined source address
-* `2482 <https://phabricator.vyos.net/T2482>`_ Update PowerDNS recursor to 4.3.1 for CVE-2020-10995
-* `2517 <https://phabricator.vyos.net/T2517>`_ vyos-container: link_filter: No such file or directory
-* `2526 <https://phabricator.vyos.net/T2526>`_ Wake-On-Lan CLI implementation
-* `2528 <https://phabricator.vyos.net/T2528>`_ "update dns dynamic" throws FileNotFoundError excepton
-* `2536 <https://phabricator.vyos.net/T2536>`_ "show log dns forwarding" still refers to dnsmasq
-* `2538 <https://phabricator.vyos.net/T2538>`_ Update Intel NIC drivers to recent release (preparation for Kernel >=5.4)
-* `2545 <https://phabricator.vyos.net/T2545>`_ Show physical device offloading capabilities for specified ethernet interface
-* `2563 <https://phabricator.vyos.net/T2563>`_ Wrong interface binding for Dell VEP 1445
-* `2605 <https://phabricator.vyos.net/T2605>`_ SNMP service is not disabled by default
-* `2625 <https://phabricator.vyos.net/T2625>`_ Provide generic Library for package builds
-* `2686 <https://phabricator.vyos.net/T2686>`_ FRR: BGP: large-community configuration is not applied properly after upgrading FRR to 7.3.x series
-* `2701 <https://phabricator.vyos.net/T2701>`_ `vpn ipsec pfs enable` doesn't work with IKE groups
-* `2728 <https://phabricator.vyos.net/T2728>`_ Protocol option ignored for IPSec peers in transport mode
-* `2734 <https://phabricator.vyos.net/T2734>`_ WireGuard: fwmark CLI definition is inconsistent
-* `2757 <https://phabricator.vyos.net/T2757>`_ "show system image version" contains additional new-line character breaking output
-* `2797 <https://phabricator.vyos.net/T2797>`_ Update Linux Kernel to v4.19.139
-* `2822 <https://phabricator.vyos.net/T2822>`_ Update Linux Kernel to v4.19.141
-* `2829 <https://phabricator.vyos.net/T2829>`_ PPPoE server: mppe setting is implemented as node instead of leafNode
-* `2831 <https://phabricator.vyos.net/T2831>`_ Update Linux Kernel to v4.19.142
-* `2852 <https://phabricator.vyos.net/T2852>`_ rename dynamic dns interface breaks ddclient.cache permissions
-* `2853 <https://phabricator.vyos.net/T2853>`_ Intel QAT acceleration does not work
-
-
-1.2.5
------
-
-1.2.5 is a maintenance release made in April 2019.
-
-Resolved issues
-^^^^^^^^^^^^^^^
-
-* `1020 <https://phabricator.vyos.net/T1020>`_ OSPF Stops distributing default route after a while
-* `1228 <https://phabricator.vyos.net/T1228>`_ pppoe default-route force option not working (Rel 1.2.0-rc11)
-* `1301 <https://phabricator.vyos.net/T1301>`_ bgp peer-groups don't work when "no-ipv4-unicast" is enabled.
-* `1341 <https://phabricator.vyos.net/T1341>`_ Adding rate-limiter for pppoe server users
-* `1376 <https://phabricator.vyos.net/T1376>`_ Incorrect DHCP lease counting
-* `1392 <https://phabricator.vyos.net/T1392>`_ Large firewall rulesets cause the system to lose configuration and crash at startup
-* `1416 <https://phabricator.vyos.net/T1416>`_ 2 dhcp server run in failover mode can't sync hostname with each other
-* `1452 <https://phabricator.vyos.net/T1452>`_ accel-pppoe - add vendor option to shaper
-* `1490 <https://phabricator.vyos.net/T1490>`_ BGP configuration (is lost|not applied) when updating 1.1.8 -> 1.2.1
-* `1780 <https://phabricator.vyos.net/T1780>`_ Adding ipsec ike closeaction
-* `1803 <https://phabricator.vyos.net/T1803>`_ Unbind NTP while it's not requested...
-* `1821 <https://phabricator.vyos.net/T1821>`_ "authentication mode radius" has no effect for PPPoE server
-* `1827 <https://phabricator.vyos.net/T1827>`_ Increase default gc_thresh
-* `1828 <https://phabricator.vyos.net/T1828>`_ Missing completion helper for "set system syslog host 192.0.2.1 facility all protocol"
-* `1832 <https://phabricator.vyos.net/T1832>`_ radvd adding feature DNSSL branch.example.com example.com to existing package
-* `1837 <https://phabricator.vyos.net/T1837>`_ PPPoE unrecognized option 'replacedefaultroute'
-* `1851 <https://phabricator.vyos.net/T1851>`_ wireguard - changing the pubkey on an existing peer seems to destroy the running config.
-* `1858 <https://phabricator.vyos.net/T1858>`_ l2tp: Delete depricated outside-nexthop and add gateway-address
-* `1864 <https://phabricator.vyos.net/T1864>`_ Lower IPSec DPD timeout lower limit from 10s -> 2s
-* `1879 <https://phabricator.vyos.net/T1879>`_ Extend Dynamic DNS XML definition value help strings and validators
-* `1881 <https://phabricator.vyos.net/T1881>`_ Execute permissions are removed from custom SNMP scripts at commit time
-* `1884 <https://phabricator.vyos.net/T1884>`_ Keeping VRRP transition-script native behaviour and adding stop-script
-* `1891 <https://phabricator.vyos.net/T1891>`_ Router announcements broken on boot
-* `1900 <https://phabricator.vyos.net/T1900>`_ Enable SNMP for VRRP.
-* `1902 <https://phabricator.vyos.net/T1902>`_ Add redistribute non main table in bgp
-* `1909 <https://phabricator.vyos.net/T1909>`_ Incorrect behaviour of static routes with overlapping networks
-* `1913 <https://phabricator.vyos.net/T1913>`_ "system ipv6 blacklist" command has no effect
-* `1914 <https://phabricator.vyos.net/T1914>`_ IPv6 multipath hash policy does not apply
-* `1917 <https://phabricator.vyos.net/T1917>`_ Update WireGuard to Debian release 0.0.20191219-1
-* `1934 <https://phabricator.vyos.net/T1934>`_ Change default hostname when deploy from OVA without params.
-* `1935 <https://phabricator.vyos.net/T1935>`_ NIC identification and usage problem in Hyper-V environments
-* `1936 <https://phabricator.vyos.net/T1936>`_ pppoe-server CLI control features
-* `1964 <https://phabricator.vyos.net/T1964>`_ SNMP Script-extensions allows names with spaces, but commit fails
-* `1967 <https://phabricator.vyos.net/T1967>`_ BGP parameter "enforce-first-as" does not work anymore
-* `1970 <https://phabricator.vyos.net/T1970>`_ Correct adding interfaces on boot
-* `1971 <https://phabricator.vyos.net/T1971>`_ Missing modules in initrd.img for PXE boot
-* `1998 <https://phabricator.vyos.net/T1998>`_ Update FRR to 7.3
-* `2001 <https://phabricator.vyos.net/T2001>`_ Error when router reboot
-* `2032 <https://phabricator.vyos.net/T2032>`_ Monitor bandwidth bits
-* `2059 <https://phabricator.vyos.net/T2059>`_ Set source-validation on bond vif don't work
-* `2066 <https://phabricator.vyos.net/T2066>`_ PPPoE interface can be created multiple times - last wins
-* `2069 <https://phabricator.vyos.net/T2069>`_ PPPoE-client does not works with service-name option
-* `2077 <https://phabricator.vyos.net/T2077>`_ ISO build from crux branch is failing
-* `2079 <https://phabricator.vyos.net/T2079>`_ Update Linux Kernel to v4.19.106
-* `2087 <https://phabricator.vyos.net/T2087>`_ Add maxfail 0 option to pppoe configuration.
-* `2100 <https://phabricator.vyos.net/T2100>`_ BGP route adverisement wih checks rib
-* `2120 <https://phabricator.vyos.net/T2120>`_ "reset vpn ipsec-peer" doesn't work with named peers
-* `2197 <https://phabricator.vyos.net/T2197>`_ Cant add vif-s interface into a bridge
-* `2228 <https://phabricator.vyos.net/T2228>`_ WireGuard does not allow ports < 1024 to be used
-* `2252 <https://phabricator.vyos.net/T2252>`_ HTTP API add system image can return '504 Gateway Time-out'
-* `2272 <https://phabricator.vyos.net/T2272>`_ Set system flow-accounting disable-imt has syntax error
-* `2276 <https://phabricator.vyos.net/T2276>`_ PPPoE server vulnerability
-
-
-1.2.4
------
-
-1.2.4 is a maintenance release made in December 2019.
-
-Resolved issues
-^^^^^^^^^^^^^^^
-
-* `T258 <https://phabricator.vyos.net/T258>`_ Can not configure wan load-balancing on vyos-1.2
-* `T818 <https://phabricator.vyos.net/T818>`_ SNMP v3 - remove required engineid from user node
-* `T1030 <https://phabricator.vyos.net/T1030>`_ Upgrade ddclient from 3.8.2 to 3.9.0 (support Cloudflare API v4)
-* `T1183 <https://phabricator.vyos.net/T1183>`_ BFD Support via FRR
-* `T1299 <https://phabricator.vyos.net/T1299>`_ Allow SNMPd to be extended with custom scripts
-* `T1351 <https://phabricator.vyos.net/T1351>`_ accel-pppoe adding CIDR based IP pool option
-* `T1391 <https://phabricator.vyos.net/T1391>`_ In route-map set community additive
-* `T1394 <https://phabricator.vyos.net/T1394>`_ syslog systemd and host_name.py race condition
-* `T1401 <https://phabricator.vyos.net/T1401>`_ Copying files with the FTP protocol fails if the password contains special characters
-* `T1421 <https://phabricator.vyos.net/T1421>`_ OpenVPN client push-route stopped working, needs added quotes to fix
-* `T1447 <https://phabricator.vyos.net/T1447>`_ Python subprocess called without import in host_name.py
-* `T1470 <https://phabricator.vyos.net/T1470>`_ improve output of "show dhcpv6 server leases"
-* `T1485 <https://phabricator.vyos.net/T1485>`_ Enable 'AdvIntervalOpt' option in for radvd.conf
-* `T1496 <https://phabricator.vyos.net/T1496>`_ Separate rolling release and LTS kernel builds
-* `T1560 <https://phabricator.vyos.net/T1560>`_ "set load-balancing wan rule 0" causes segfault and prevents load balancing from starting
-* `T1568 <https://phabricator.vyos.net/T1568>`_ strip-private command improvement for additional masking of IPv6 and MAC address
-* `T1578 <https://phabricator.vyos.net/T1578>`_ completion offers "show table", but show table does not exist
-* `T1593 <https://phabricator.vyos.net/T1593>`_ Support ip6gre
-* `T1597 <https://phabricator.vyos.net/T1597>`_ /usr/sbin/rsyslogd after deleting "system syslog"
-* `T1638 <https://phabricator.vyos.net/T1638>`_ vyos-hostsd not setting system domain name
-* `T1678 <https://phabricator.vyos.net/T1678>`_ hostfile-update missing line feed
-* `T1694 <https://phabricator.vyos.net/T1694>`_ NTPd: Do not listen on all interfaces by default
-* `T1701 <https://phabricator.vyos.net/T1701>`_ Delete domain-name and domain-search won't work
-* `T1705 <https://phabricator.vyos.net/T1705>`_ High CPU usage by bgpd when snmp is active
-* `T1707 <https://phabricator.vyos.net/T1707>`_ DHCP static mapping and exclude address not working
-* `T1708 <https://phabricator.vyos.net/T1708>`_ Update Rolling Release Kernel to 4.19.76
-* `T1709 <https://phabricator.vyos.net/T1709>`_ Update WireGuard to 0.0.20190913
-* `T1716 <https://phabricator.vyos.net/T1716>`_ Update Intel NIC drivers to recent versions
-* `T1726 <https://phabricator.vyos.net/T1726>`_ Update Linux Firmware binaries to a more recent version 2019-03-14 -> 2019-10-07
-* `T1728 <https://phabricator.vyos.net/T1728>`_ Update Linux Kernel to 4.19.79
-* `T1737 <https://phabricator.vyos.net/T1737>`_ SNMP tab completion missing
-* `T1738 <https://phabricator.vyos.net/T1738>`_ Copy SNMP configuration from node to node raises exception
-* `T1740 <https://phabricator.vyos.net/T1740>`_ Broken OSPFv2 virtual-link authentication
-* `T1742 <https://phabricator.vyos.net/T1742>`_ NHRP unable to commit.
-* `T1745 <https://phabricator.vyos.net/T1745>`_ dhcp-server commit fails with "DHCP range stop address x must be greater or equal to the range start address y!" when static mapping has same IP as range stop
-* `T1749 <https://phabricator.vyos.net/T1749>`_ numeric validator doesn't support multiple ranges
-* `T1769 <https://phabricator.vyos.net/T1769>`_ Remove complex SNMPv3 Transport Security Model (TSM)
-* `T1772 <https://phabricator.vyos.net/T1772>`_ <regex> constraints in XML are partially broken
-* `T1778 <https://phabricator.vyos.net/T1778>`_ Kilobits/Megabits difference in configuration Vyos/FRR
-* `T1780 <https://phabricator.vyos.net/T1780>`_ Adding ipsec ike closeaction
-* `T1786 <https://phabricator.vyos.net/T1786>`_ disable-dhcp-nameservers is missed in current host_name.py implementation
-* `T1788 <https://phabricator.vyos.net/T1788>`_ Intel QAT (QuickAssist Technology ) implementation
-* `T1792 <https://phabricator.vyos.net/T1792>`_ Update WireGuard to Debian release 0.0.20191012-1
-* `T1800 <https://phabricator.vyos.net/T1800>`_ Update Linux Kernel to v4.19.84
-* `T1809 <https://phabricator.vyos.net/T1809>`_ Wireless: SSID scan does not work in AP mode
-* `T1811 <https://phabricator.vyos.net/T1811>`_ Upgrade from 1.1.8: Config file migration failed: module=l2tp
-* `T1812 <https://phabricator.vyos.net/T1812>`_ DHCP: hostnames of clients not resolving after update v1.2.3 -> 1.2-rolling
-* `T1819 <https://phabricator.vyos.net/T1819>`_ Reboot kills SNMPv3 configuration
-* `T1822 <https://phabricator.vyos.net/T1822>`_ Priority inversion wireless interface dhcpv6
-* `T1836 <https://phabricator.vyos.net/T1836>`_ import-conf-mode-commands in vyos-1x/scripts fails to create an xml
-* `T1839 <https://phabricator.vyos.net/T1839>`_ LLDP shows "VyOS unknown" instead of "VyOS"
-* `T1841 <https://phabricator.vyos.net/T1841>`_ PPP ipv6-up.d direcotry missing
-* `T1893 <https://phabricator.vyos.net/T1893>`_ igmp-proxy: Do not allow adding unknown interface
-* `T1904 <https://phabricator.vyos.net/T1904>`_ update eth1 and eth2 link files for the vep4600
-
-
-1.2.3
------
-
-1.2.3 is a maintenance and feature backport release made in September 2019.
-
-New features
-^^^^^^^^^^^^
-
-* HTTP API
-* "set service dns forwarding allow-from <IPv4 net|IPv6 net>" option for limiting queries to specific client networks (T1524)
-* Functions for checking if a commit is in progress (T1503)
-* "set system contig-mangement commit-archive source-address" option (T1543)
-* Intel NIC drivers now support receive side scaling and multiqueue (T1554)
-
-Resolved issues
-^^^^^^^^^^^^^^^
-
-* OSPF max-metric values over 100 no longer causes commit errors (T1209)
-* Fixes issue with DNS forwarding not performing recursive lookups on domain specific forwarders (T1333)
-* Special characters in VRRP passwords are handled correctly (T1362)
-* BGP weight is applied properly (T1377)
-* Fixed permission for log files (T1420)
-* Wireguard interfaces now support /31 addresses (T1425)
-* Wireguard correctly handles firewall marks (T1428)
-* DHCPv6 static mappings now work correctly (T1439)
-* Flood ping commands now works correctly (T1450)
-* Op mode "show firewall" commands now support counters longer than 8 digits (T1460)
-* Fixed priority inversion in VTI commands (T1465)
-* Fixed remote-as check in the BGP route-reflector-client option (T1468)
-* It's now possible to re-create VRRP groups with RFC compatibility mode enabled (T1472)
-* Fixed a typo in DHCPv6 server help strings  (T1527)
-* Unnumbered BGP peers now support VLAN interfaces (T1529)
-* Fixed "set system syslog global archive file" command (T1530)
-* Multiple fixes in cluster configuration scripts (T1531)
-* Fixed missing help text for "service dns" (T1537)
-* Fixed input validation in DHCPv6 relay options (T1541)
-* It's now possible to create a QinQ interface and a firewall assigned to it in one commit (T1551)
-* URL filtering now uses correct rule database path and works again (T1559)
-* "show log vpn ipsec" command works again (T1579)
-* "show arp interface <intf>" command works again (T1576)
-* Fixed regression in L2TP/IPsec server (T1605)
-* Netflow/sFlow captures IPv6 traffic correctly (T1613)
-* "renew dhcpv6" command now works from op mode (T1616)
-* BGP remove-private-as option iBGP vs eBGP check works correctly now (T1642)
-* Multiple improvements in name servers and hosts configuration handling (T1540, T1360, T1264, T1623)
-
-Internals
-^^^^^^^^^
-
-/etc/resolv.conf and /etc/hosts files are now managed by the vyos-hostsd service that listens on a ZMQ socket for update messages.
-
-1.2.2
------
-
-1.2.2 is a maintenance release made in July 2019.
-
-New features
-^^^^^^^^^^^^
-
-* Options for per-interface MSS clamping.
-* BGP extended next-hop capability
-* Relaxed BGP multipath option
-* Internal and external options for "remote-as" (accept any AS as long as it's the same to this router or different, respectively)
-* "Unnumbered" (interface-based) BGP peers
-* BGP no-prepend option
-* Additive BGP community option
-* OSPFv3 network type option
-* Custom arguments for VRRP scripts
-* A script for querying values from config files
-
-Resolved issues
-^^^^^^^^^^^^^^^
-
-* Linux kernel 4.19.54, including a fix for the TCP SACK vulnerability
-* VRRP health-check scripts now can use arguments (T1371)
-* DNS server addresses coming from a DHCP server are now correctly propagated to resolv.conf (T1497)
-* Domain-specific name servers in DNS forwarding are now used for recursive queries (T1469)
-* “run show dhcpv6 server leases” now display leases correctly (T1433)
-* Deleting “firewall options” node no longer causes errors (T1461)
-* Correct hostname is sent to remote syslog again (T1458)
-* Board serial number from DMI is correctly displayed in “show version” (T1438)
-* Multiple corrections in remote syslog config (T1358, T1355, T1294)
-* Fixed missing newline in /etc/hosts (T1255)
-* “system domain-name” is correctly included in /etc/resolv.conf (T1174)
-* Fixed priority inversion in “interfaces vti vtiX ip” settings (T1465)
-* Fixed errors when installing with RAID1 on UEFI machines (T1446)
-* Fixed an error on disabling an interfaces that has no address (T1387)
-* Fixed deleting VLAN interface with non-default MTU (T1367)
-* vyos.config return_effective_values() function now correctly returns a list rather than a string (T1505)
-
-1.2.1
------
-
-VyOS 1.2.1 is a maintenance release made in April 2019.
-
-Resolved issues
-^^^^^^^^^^^^^^^
-
-* Package updates: kernel 4.19.32, open-vm-tools 10.3, latest Intel NIC drivers.
-* The kernel now includes drivers for various USB serial adapters, which allows people to add a serial console to a machine without onboard RS232, or connect to something else from the router (`T1326 <https://phabricator.vyos.net/T1326>`_).
-* The collection of network card firmware is now much more extensive.
-* VRRP now correctly uses a virtual rather than physical MAC addresses in the RFC-compliant mode (`T1271 <https://phabricator.vyos.net/T1271>`_).
-* DHCP WPAD URL option works correctly again (`T1330 <https://phabricator.vyos.net/T1330>`_)
-* Many to many NAT rules now can use source/destination and translation networks of non-matching size (`T1312 <https://phabricator.vyos.net/T1312>`_). If 1:1 network bits translation is desired, it’s now user’s responsibility to check if prefix length matches.
-* IPv6 network prefix translation is fixed (`T1290 <https://phabricator.vyos.net/T1290>`_).
-* Non-alphanumeric characters such as “>” can now be safely used in PPPoE passwords (`T1308 <https://phabricator.vyos.net/T1308>`_).
-* “show | commands” no longer fails when a config section ends with a leaf node such as “timezone” in “show system | commands” (`T1305 <https://phabricator.vyos.net/T1305>`_).
-* “show | commands” correctly works in config mode now (`T1235 <https://phabricator.vyos.net/T1235>`_).
-* VTI is now compatible with the DHCP-interface IPsec option (`T1298 <https://phabricator.vyos.net/T1298>`_).
-* “show dhcp server statistics” command was broken in latest Crux (`T1277 <https://phabricator.vyos.net/T1277>`_).
-* An issue with TFTP server refusing to listen on addresses other than loopback was fixed (`T1261 <https://phabricator.vyos.net/T1261>`_).
-* Template issue that might cause UDP broadcast relay fail to start is fixed (`T1224 <https://phabricator.vyos.net/T1224>`_).
-* VXLAN value validation is improved (`T1067 <https://phabricator.vyos.net/T1067>`_).
-* Blank hostnames in DHCP updates no longer can crash DNS forwarding (`T1211 <https://phabricator.vyos.net/T1211>`_).
-* Correct configuration is now generated for DHCPv6 relays with more than one upstream interface (`T1322 <https://phabricator.vyos.net/T1322>`_).
-* “relay-agents-packets” option works correctly now (`T1234 <https://phabricator.vyos.net/T1234>`_).
-* Dynamic DNS data is now cleaned on configuration change (`T1231 <https://phabricator.vyos.net/T1231>`_).
-* Remote Syslog can now use a fully qualified domain name (`T1282 <https://phabricator.vyos.net/T1282>`_).
-* ACPI power off works again (`T1279 <https://phabricator.vyos.net/T1279>`_).
-* Negation in WAN load balancing rules works again (`T1247 <https://phabricator.vyos.net/T1247>`_).
-* FRR’s staticd now starts on boot correctly (`T1218 <https://phabricator.vyos.net/T1218>`_).
-* The installer now correctly detects SD card devices (`T1296 <https://phabricator.vyos.net/T1296>`_).
-* Wireguard peers can be disabled now (`T1225 <https://phabricator.vyos.net/T1225>`_).
-* The issue with wireguard interfaces impossible to delete is fixed (`T1217 <https://phabricator.vyos.net/T1217>`_).
-* Unintended IPv6 access is fixed in SNMP configuration (`T1160 <https://phabricator.vyos.net/T1160>`_).
-* It’s now possible to exclude hosts from the transparent web proxy (`T1060 <https://phabricator.vyos.net/T1060>`_).
-* An issue with rules impossible to delete from the zone-based firewall is fixed (`T484 <https://phabricator.vyos.net/T484>`_).
-
-Earlier releases
-================
-
-See `the wiki <https://wiki.vyos.net/wiki/1.2.0/release_notes>`_.
diff --git a/docs/appendix/troubleshooting.rst b/docs/appendix/troubleshooting.rst
deleted file mode 100644
index b1ae27ae..00000000
--- a/docs/appendix/troubleshooting.rst
+++ /dev/null
@@ -1,385 +0,0 @@
-.. _troubleshooting:
-
-Troubleshooting
-===============
-
-Sometimes things break or don't work as expected. This section describes
-several troubleshooting tools provided by VyOS that can help when something
-goes wrong.
-
-Basic Connectivity Verification
--------------------------------
-
-Verifying connectivity can be done with the familiar `ping` and `traceroute`
-commands. The options for each are shown (the options for each command were
-displayed using the built-in help as described in the :ref:`cli`
-section and are omitted from the output here):
-
-.. code-block:: none
-
-  vyos@vyos:~$ ping
-  Possible completions:
-    <hostname>    Send Internet Control Message Protocol (ICMP) echo request
-    <x.x.x.x>
-    <h:h:h:h:h:h:h:h>
-
-Several options are available when more extensive troubleshooting is needed:
-
-.. code-block:: none
-
-  vyos@vyos:~$ ping 8.8.8.8
-  Possible completions:
-    <Enter>       Execute the current command
-    adaptive      Ping options
-    allow-broadcast
-    audible
-    bypass-route
-    count
-    deadline
-    flood
-    interface
-    interval
-    mark
-    no-loopback
-    numeric
-    pattern
-    quiet
-    record-route
-    size
-    timestamp
-    tos
-    ttl
-    verbose
-
-.. code-block:: none
-
-  vyos@vyos:~$ traceroute
-  Possible completions:
-    <hostname>    Track network path to specified node
-    <x.x.x.x>
-    <h:h:h:h:h:h:h:h>
-    ipv4          Track network path to <hostname|IPv4 address>
-    ipv6          Track network path to <hostname|IPv6 address>
-
-However, another tool, mtr_, is available which combines ping and traceroute
-into a single tool. An example of its output is shown:
-
-.. code-block:: none
-
-  vyos@vyos:~$ mtr 10.62.212.12
-
-                             My traceroute  [v0.85]
-  vyos (0.0.0.0)
-  Keys:  Help   Display mode   Restart statistics   Order of fields   quit
-                                    Packets               Pings
-  Host                            Loss%   Snt   Last   Avg  Best  Wrst StDev
-  1. 10.11.110.4                   0.0%    34    0.5   0.5   0.4   0.8   0.1
-  2. 10.62.255.184                 0.0%    34    1.1   1.0   0.9   1.4   0.1
-  3. 10.62.255.71                  0.0%    34    1.4   1.4   1.3   2.0   0.1
-  4. 10.62.212.12                  0.0%    34    1.6   1.6   1.6   1.7   0.0
-
-.. note:: The output of ``mtr`` consumes the screen and will replace your
-   command prompt.
-
-Several options are available for changing the display output. Press `h` to
-invoke the built in help system. To quit, just press `q` and you'll be returned
-to the VyOS command prompt.
-
-
-
-Interface names
----------------
-
-If you find the names of your interfaces have changed, this could be
-because your MAC addresses have changed.
-
-* For example, you have a VyOS VM with 4 Ethernet interfaces named
-  eth0, eth1, eth2 and eth3. Then, you migrate your VyOS VM to a different host and find your interfaces now are eth4, eth5, eth6 and eth7.
-
-  One way to fix this issue **taking control of the MAC addresses** is:
-
-  Log into VyOS and run this command to display your interface settings.
-
-  .. code-block:: none
-
-     show interfaces detail
-
-  Take note of MAC addresses.
-
-  Now, in order to update a MAC address in the configuration, run this
-  command specifying the interface name and MAC address you want.
-
-  .. code-block:: none
-
-     set interfaces eth0 hw-id 00:0c:29:da:a4:fe
-
-  If it is a VM, go into the settings of the host and set the MAC
-  address to the settings found in the config.boot file. You can also
-  set the MAC to static if the host allows so.
-
-
-* Another example could be when cloning VyOS VMs in GNS3 and you get
-  into the same issue: interface names have changed.
-
-  And **a more generic way to fix it** is just deleting every MAC
-  address at the configuration file of the cloned machine. They will be
-  correctly regenerated automatically.
-
-
-
-Monitoring
-----------
-
-Network Interfaces
-^^^^^^^^^^^^^^^^^^
-
-It's possible to monitor network traffic, either at the flow level or protocol
-level. This can be useful when troubleshooting a variety of protocols and
-configurations. The following interface types can be monitored:
-
-.. code-block:: none
-
-  vyos@vyos:~$ monitor interfaces
-  Possible completions:
-    <Enter>       Execute the current command
-    bonding       Monitor a bonding interface
-    bridge        Monitor a bridge interface
-    ethernet      Monitor a ethernet interface
-    loopback      Monitor a loopback interface
-    openvpn       Monitor an openvpn interface
-    pppoe         Monitor pppoe interface
-    pseudo-ethernet
-                  Monitor a pseudo-ethernet interface
-    tunnel        Monitor a tunnel interface
-    vrrp          Monitor a vrrp interface
-    vti           Monitor a vti interface
-    wireless      Monitor wireless interface
-
-To monitor traffic flows, issue the :code:`monitor interfaces <type> <name> flow`
-command, replacing `<type>` and `<name>` with your desired interface type and
-name, respectively. Output looks like the following:
-
-.. code-block:: none
-
-                     12.5Kb              25.0Kb              37.5Kb              50.0Kb        62.5Kb
-  ????????????????????????????????????????????????????????????????????????????????????????????????????
-  10.11.111.255                        => 10.11.110.37                            0b      0b      0b
-                                      <=                                       624b    749b    749b
-  10.11.110.29                         => 10.62.200.11                            0b    198b    198b
-                                      <=                                         0b    356b    356b
-  255.255.255.255                      => 10.11.110.47                            0b      0b      0b
-                                      <=                                       724b    145b    145b
-  10.11.111.255                        => 10.11.110.47                            0b      0b      0b
-                                      <=                                       724b    145b    145b
-  10.11.111.255                        => 10.11.110.255                           0b      0b      0b
-                                      <=                                       680b    136b    136b
-  ????????????????????????????????????????????????????????????????????????????????????????????????????
-  TX:             cumm:  26.7KB   peak:   40.6Kb                      rates:   23.2Kb  21.4Kb  21.4Kb
-  RX:                    67.5KB           63.6Kb                               54.6Kb  54.0Kb  54.0Kb
-  TOTAL:                 94.2KB            104Kb                               77.8Kb  75.4Kb  75.4Kb
-
-Several options are available for changing the display output. Press `h` to
-invoke the built in help system. To quit, just press `q` and you'll be returned
-to the VyOS command prompt.
-
-To monitor interface traffic, issue the :code:`monitor interfaces <type> <name>
-traffic` command, replacing `<type>` and `<name>` with your desired interface
-type and name, respectively. This command invokes the familiar tshark_ utility
-and the following options are available:
-
-.. code-block:: none
-
-  vyos@vyos:~$ monitor interfaces ethernet eth0 traffic
-  Possible completions:
-    <Enter>       Execute the current command
-    detail        Monitor detailed traffic for the specified ethernet interface
-    filter        Monitor filtered traffic for the specified ethernet interface
-    save          Save monitored traffic to a file
-    unlimited     Monitor traffic for the specified ethernet interface
-
-To quit monitoring, press `Ctrl-c` and you'll be returned to the VyOS command
-prompt. The `detail` keyword provides verbose output of the traffic seen on
-the monitored interface. The `filter` keyword accepts valid `PCAP filter
-expressions`_, enclosed in single or double quotes (e.g. "port 25" or "port 161
-and udp"). The `save` keyword allows you to save the traffic dump to a file.
-The `unlimited` keyword is used to specify that an unlimited number of packets
-can be captured (by default, 1,000 packets are captured and you're returned to
-the VyOS command prompt).
-
-Interface Bandwith
-^^^^^^^^^^^^^^^^^^
-
-to take a quick view on the used bandwith of an interface use the ``monitor bandwith`` command
-
-.. code-block:: none
-
-  vyos@vyos:~$ monitor bandwidth interface eth0
-
-show the following:
-
-.. code-block:: none
-  
-   eth0                                                                                                          bmon 3.5
-  Interfaces                     │ RX bps       pps     %│ TX bps       pps     %
-   >eth0                         │    141B        2      │    272B        1
-  ───────────────────────────────┴───────────────────────┴────────────────────────────────────────────────────────────────
-         B                      (RX Bytes/second)
-    198.00 .|....|.....................................................
-    165.00 .|....|.....................................................
-    132.00 ||..|.|.....................................................
-     99.00 ||..|.|.....................................................
-     66.00 |||||||.....................................................
-     33.00 |||||||.....................................................
-           1   5   10   15   20   25   30   35   40   45   50   55   60
-       KiB                      (TX Bytes/second)
-      3.67 ......|.....................................................
-      3.06 ......|.....................................................
-      2.45 ......|.....................................................
-      1.84 ......|.....................................................
-      1.22 ......|.....................................................
-      0.61 :::::||.....................................................
-           1   5   10   15   20   25   30   35   40   45   50   55   60
-  
-  ───────────────────────────────────────── Press d to enable detailed statistics ────────────────────────────────────────
-  ─────────────────────────────────────── Press i to enable additional information ───────────────────────────────────────
-   Wed Apr  3 14:46:59 2019                                                                              Press ? for help
-
-| Press ``d`` for more detailed informations or ``i`` for additional information.
-| To exit press ``q`` and than ``y``
-
-Interface performance
-^^^^^^^^^^^^^^^^^^^^^
-
-To take a look on the network bandwith between two nodes, the ``monitor bandwidth-test`` command is used to run iperf.
-
-.. code-block:: none
-
-  vyos@vyos:~$ monitor bandwidth-test
-  Possible completions:
-    accept        Wait for bandwidth test connections (port TCP/5001)
-    initiate      Initiate a bandwidth test
-
-| The ``accept`` command open a listen iperf server on TCP Port 5001
-| The ``initiate`` command conncet to this server.
-
-.. code-block:: none
-
-  vyos@vyos:~$ monitor bandwidth-test initiate
-  Possible completions:
-    <hostname>    Initiate a bandwidth test to specified host (port TCP/5001)
-    <x.x.x.x>
-    <h:h:h:h:h:h:h:h>
-
-
-Monitor command
-^^^^^^^^^^^^^^^
-
-The ``monitor command`` command allows you to repeatedly run a command to view a continuously refreshed output.
-The command is run and output every 2 seconds, allowing you to monitor the output continuously without having to re-run the command. This can be useful to follow routing adjacency formation.
-
-.. code-block:: none
-
-  vyos@router:~$ monitor command "show interfaces"
-
-Will clear the screen and show you the output of ``show interfaces`` every 2 seconds.
-
-.. code-block:: none
-
-  Every 2.0s: /opt/vyatta/bin/vyatta-op-cmd-wrapper s...  Sun Mar 26 02:49:46 2019
-
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             192.168.1.1/24                    u/u
-  eth0.5           198.51.100.4/24                   u/u  WAN
-  lo               127.0.0.1/8                       u/u
-                   ::1/128
-  vti0             172.32.254.2/30                   u/u
-  vti1             172.32.254.9/30                   u/u
-
-Clear Command
--------------
-
-Sometimes you need to clear counters or statistics to troubleshoot better.
-
-To do this use the ``clear`` command in Operational mode.
-
-to clear the console output
-
-.. code-block:: none
-
-  vyos@vyos:~$ clear console
-
-to clear interface counters
-
-.. code-block:: none
-
-  # clear all interfaces
-  vyos@vyos:~$ clear interface ethernet counters  
-  # clear specific interface
-  vyos@vyos:~$ clear interface ehternet eth0 counters
-
-The command follow the same logic as the ``set`` command in configuration mode.
-
-.. code-block:: none
-
-  # clear all counters of a interface type
-  vyos@vyos:~$ clear interface <interface_type> counters
-  # clear counter of a interface in interface_type
-  vyos@vyos:~$ clear interface <interface_type> <interace_name> counters
-  
-
-to clear counters on firewall rulesets or single rules
-
-.. code-block:: none
-
-  vyos@vyos:~$ clear firewall name <ipv4 ruleset name> counters
-  vyos@vyos:~$ clear firewall name <ipv4 ruleset name> rule <rule#> counters
-
-  vyos@vyos:~$ clear firewall ipv6-name <ipv6 ruleset name> counters
-  vyos@vyos:~$ clear firewall ipv6-name <ipv6 ruleset name> rule <rule#> counters
-
-
-Basic System Information
-------------------------
-
-.. _boot-steps:
-
-Boot steps
-^^^^^^^^^^
-
-VyOS 1.2.0+ uses `Debian Jessie`_ as the base Linux operating system.
-Jessie was the first version of Debian that uses `systemd`_ as the default init system.
-
-These are the boot steps for VyOS 1.2.0+
-
-1. The BIOS loads Grub (or isolinux for the Live CD)
-2. Grub then starts the Linux boot and loads the Linux Kernel ``/boot/vmlinuz``
-3. Kernel Launches Systemd ``/lib/systemd/systemd``
-4. Systemd loads the VyOS service file ``/lib/systemd/system/vyos-router.service``
-5. The service file launches the VyOS router init script ``/usr/libexec/vyos/init/vyos-router`` - this is part of the `vyatta-cfg`_ Debian package
-
-  1. Starts FRR_ - successor to `GNU Zebra`_ and `Quagga`_
-
-  2. Initialises the boot configuration file - copies over ``config.boot.default`` if there is no configuration
-  3. Runs the configuration migration, if the configuration is for an older version of VyOS
-  4. Runs The pre-config script, if there is one ``/config/scripts/vyos-preconfig-bootup.script``
-  5. If the config file was upgraded, runs any post upgrade scripts ``/config/scripts/post-upgrade.d``
-  6. Starts **rl-system** and **firewall**
-  7. Mounts the ``/boot`` partition
-  8. The boot configuration file is then applied by ``/opt/vyatta/sbin/vyatta-boot-config-loader /opt/vyatta/etc/config/config.boot``
-  
-    1. The config loader script writes log entries to ``/var/log/vyatta-config-loader.log``
-  
-  10. Runs ``telinit q`` to tell the init system to reload ``/etc/inittab``
-  11. Finally it runs the post-config script ``/config/scripts/vyos-postconfig-bootup.script``
-
-.. _Quagga: http://www.quagga.net/
-.. _`GNU Zebra`: https://www.gnu.org/software/zebra/
-.. _FRR: https://frrouting.org/
-.. _vyatta-cfg: https://github.com/vyos/vyatta-cfg
-.. _systemd: _https://freedesktop.org/wiki/Software/systemd/
-.. _`Debian Jessie`: https://www.debian.org/releases/jessie/
-.. _mtr: http://www.bitwizard.nl/mtr/
-.. _tshark: https://www.wireshark.org/docs/man-pages/tshark.html
-.. _`PCAP filter expressions`: http://www.tcpdump.org/manpages/pcap-filter.7.html
diff --git a/docs/appendix/vyos-on-baremetal.rst b/docs/appendix/vyos-on-baremetal.rst
deleted file mode 100644
index 14ba2adf..00000000
--- a/docs/appendix/vyos-on-baremetal.rst
+++ /dev/null
@@ -1,380 +0,0 @@
-.. _vyosonbaremetal:
-
-Running on Bare Metal
-#####################
-
-Intel Atom C3000
-****************
-
-I opted to get one of the new Intel Atom C3000 CPUs to spawn VyOS on it.
-Running VyOS on an UEFI only device is supported as of VyOS release 1.2.
-
-Shopping Cart
--------------
-
-* 1x Supermicro CSE-505-203B (19" 1U chassis, inkl. 200W PSU)
-* 1x Supermicro MCP-260-00085-0B (I/O Shield for A2SDi-2C-HLN4F)
-* 1x Supermicro A2SDi-2C-HLN4F (Intel Atom C3338, 2C/2T, 4MB cache, Quad LAN with
-  Intel C3000 SoC 1GbE)
-* 1x Crucial CT4G4DFS824A (4GB DDR4 RAM 2400 MT/s, PC4-19200)
-* 1x SanDisk Ultra Fit 32GB (USB-A 3.0 SDCZ43-032G-G46 mass storage for OS)
-* 1x Supermicro MCP-320-81302-0B (optional FAN tray)
-
-Optional (10GE)
----------------
-If you wan't to get additional ethernet ports or even 10GE connectivity
-the following optional parts will be required:
-
-* 1x Supermicro RSC-RR1U-E8 (Riser Card)
-* 1x Supermicro MCP-120-00063-0N (Riser Card Bracket)
-
-Latest VyOS rolling releases boot without any problem on this board. You also
-receive a nice IPMI interface realized with an ASPEED AST2400 BMC (no information
-about `OpenBMC <https://www.openbmc.org/>`_ so far on this motherboard).
-
-Pictures
---------
-
-.. figure:: /_static/images/1u_vyos_back.jpg
-   :scale: 25 %
-   :alt: CSE-505-203B Back
-
-.. figure:: /_static/images/1u_vyos_front.jpg
-   :scale: 25 %
-   :alt: CSE-505-203B Front
-
-.. figure:: /_static/images/1u_vyos_front_open_1.jpg
-   :scale: 25 %
-   :alt: CSE-505-203B Open 1
-
-.. figure:: /_static/images/1u_vyos_front_open_2.jpg
-   :scale: 25 %
-   :alt: CSE-505-203B Open 2
-
-.. figure:: /_static/images/1u_vyos_front_open_3.jpg
-   :scale: 25 %
-   :alt: CSE-505-203B Open 3
-
-.. figure:: /_static/images/1u_vyos_front_10ge_open_1.jpg
-   :scale: 25 %
-   :alt: CSE-505-203B w/ 10GE Open 1
-
-.. figure:: /_static/images/1u_vyos_front_10ge_open_2.jpg
-   :scale: 25 %
-   :alt: CSE-505-203B w/ 10GE Open 2
-
-.. figure:: /_static/images/1u_vyos_front_10ge_open_3.jpg
-   :scale: 25 %
-   :alt: CSE-505-203B w/ 10GE Open 3
-
-.. figure:: /_static/images/1u_vyos_front_10ge_open_4.jpg
-   :scale: 25 %
-   :alt: CSE-505-203B w/ 10GE Open
-
-
-PC Engines APU4
-***************
-
-As this platform seems to be quiet common in terms of noise, cost, power and
-performance it makes sense to write a small installation manual.
-
-This guide was developed using an APU4C4 board with the following specs:
-
-* AMD Embedded G series GX-412TC, 1 GHz quad Jaguar core with 64 bit and AES-NI
-  support, 32K data + 32K instruction cache per core, shared 2MB L2 cache.
-* 4 GB DDR3-1333 DRAM, with optional ECC support
-* About 6 to 10W of 12V DC power depending on CPU load
-* 2 miniPCI express (one with SIM socket for 3G modem).
-* 4 Gigabit Ethernet channels using Intel i211AT NICs
-
-The board can be powered via 12V from the front or via a 5V onboard connector.
-
-Shopping Cart
--------------
-
-* 1x apu4c4 = 4 i211AT LAN / AMD GX-412TC CPU / 4 GB DRAM / dual SIM
-* 1x Kingston SUV500MS/120G
-* 1x VARIA Group Item 326745 19" dual rack rack for APU4
-* 1x Compex WLE900VX (Optional mini PCIe WiFi module)
-
-The 19" enclosure can accomodate up to two APU4 boards - there is a single and
-dual front cover.
-
-.. note:: Compex WLE900VX is only supported in mPCIe slot 1.
-
-VyOS 1.2 (crux)
----------------
-
-Depending on the VyOS versions you intend to install there is a difference in
-the serial port settings (T1327_).
-
-Create a bootable USB pendrive using e.g. Rufus_ on a Windows machine.
-
-Connect serial port to a PC through null modem cable (RXD / TXD crossed over).
-Set terminal emulator to 115200 8N1.
-
-.. code-block:: none
-
-  PC Engines apu4
-  coreboot build 20171130
-  BIOS version v4.6.4
-  4080 MB ECC DRAM
-  SeaBIOS (version rel-1.11.0.1-0-g90da88d)
-
-  Press F10 key now for boot menu:
-
-  Select boot device:
-
-  1. ata0-0: KINGSTON SUV500MS120G ATA-11 Hard-Disk (111 GiBytes)
-  2. USB MSC Drive Generic Flash Disk 8.07
-  3. Payload [memtest]
-  4. Payload [setup]
-
-Now boot from the ``USB MSC Drive Generic Flash Disk 8.07`` media by pressing
-``2``, the VyOS boot menu will appear, just wait 10 seconds or press ``Enter``
-to continue.
-
-.. code-block:: none
-
-  lqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqk
-  x                      VyOS - Boot Menu                      x
-  tqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqu
-  x Live (amd64-vyos)                                          x
-  x Live (amd64-vyos failsafe)                                 x
-  x                                                            x
-  mqqqqqqPress ENAutomatic boot in 10 seconds...nu entryqqqqqqqj
-
-The image will be loaded and the last lines you will get will be:
-
-.. code-block:: none
-
-  Loading /live/vmlinuz... ok
-  Loading /live/initrd.img...
-
-The Kernel will now spin up using a different console setting. Set terminal
-emulator to 9600 8N1 and after a while your console will show:
-
-.. code-block:: none
-
-  Loading /live/vmlinuz... ok
-  Loading /live/initrd.img...
-  Welcome to VyOS - vyos ttyS0
-
-  vyos login:
-
-You can now proceed with a regular image installation as described in
-:ref:`installation`.
-
-As the APU board itself still used a serial setting of 115200 8N1 it is strongly
-recommended that you change the VyOS serial interface settings after your first
-successful boot.
-
-Use the following command to adjust the :ref:`serial-console` settings:
-
-.. code-block:: none
-
-  set system console device ttyS0 speed 115200
-
-.. note:: Once you ``commit`` the above changes access to the serial interface
-   is lost until you set your terminal emulator to 115200 8N1 again.
-
-.. code-block:: none
-
-  vyos@vyos# show system console
-   device ttyS0 {
-     speed 115200
-   }
-
-VyOS 1.2 (rolling)
-------------------
-
-Installing the rolling release on an APU2 board does not require any change
-on the serial console from your host side as T1327_ was successfully
-implemented.
-
-Simply proceed with a regular image installation as described in :ref:`installation`.
-
-Pictures
---------
-
-.. note:: Both device types operate without any moving parts and emit zero noise.
-
-Rack Mount
-^^^^^^^^^^
-
-.. figure:: /_static/images/apu4c4_rack_1.jpg
-   :scale: 25 %
-   :alt: APU4C4 rack closed
-
-.. figure:: /_static/images/apu4c4_rack_2.jpg
-   :scale: 25 %
-   :alt: APU4C4 rack front
-
-.. figure:: /_static/images/apu4c4_rack_3.jpg
-   :scale: 25 %
-   :alt: APU4C4 rack module #1
-
-.. figure:: /_static/images/apu4c4_rack_4.jpg
-   :scale: 25 %
-   :alt: APU4C4 rack module #2
-
-.. figure:: /_static/images/apu4c4_rack_5.jpg
-   :scale: 25 %
-   :alt: APU4C4 rack module #3 with PSU
-
-
-Desktop
-^^^^^^^
-
-.. figure:: /_static/images/apu4c4_desk_1.jpg
-   :scale: 25 %
-   :alt: APU4C4 desktop closed
-
-.. figure:: /_static/images/apu4c4_desk_2.jpg
-   :scale: 25 %
-   :alt: APU4C4 desktop closed
-
-.. figure:: /_static/images/apu4c4_desk_3.jpg
-   :scale: 25 %
-   :alt: APU4C4 desktop back
-
-.. figure:: /_static/images/apu4c4_desk_4.jpg
-   :scale: 25 %
-   :alt: APU4C4 desktop back
-
-.. _Rufus: https://rufus.ie/
-.. _T1327: https://phabricator.vyos.net/T1327
-
-
-Qotom Q355G4
-************
-
-The install on this Q355G4 box is pretty much plug and play. The port numbering
-the OS does might differ from the labels on the outside, but the UEFI firmware
-has a port blink test built in with MAC adresses so you can very quickly identify
-which is which. MAC labels are on the inside as well, and this test can be done
-from VyOS or plain Linux too. Default settings in the UEFI will make it boot,
-but depending on your installation wishes (i.e. storage type, boot type, console
-type) you might want to adjust them. This Qotom company seems to be the real
-OEM/ODM for many other relabelling companies like Protectli.
-
-Hardware
---------
-
-There are a number of other options, but they all seem to be close to Intel
-reference designs, with added features like more serial ports, more network
-interfaces and the likes. Because they don't deviate too much from standard
-designs all the hardware is well-supported by mainline. It accepts one LPDDR3
-SO-DIMM, but chances are that if you need more than that, you'll also want
-something even beefier than an i5. There are options for antenna holes, and SIM
-slots, so you could in theory add an LTE/Cell modem (not tested so far).
-
-The chassis is a U-shaped alu extrusion with removable I/O plates and removable
-bottom plate. Cooling is completely passive with a heatsink on the SoC with
-internal and external fins, a flat interface surface, thermal pad on top of that,
-which then directly attaches to the chassis, which has fins as well. It comes
-with mounting hardware and rubber feet, so you could place it like a desktop
-model or mount it on a VESA mount, or even wall mount it with the provided
-mounting plate. The closing plate doubles as internal 2.5" mounting place for
-an HDD or SSD, and comes supplied with a small SATA cable and SATA power cable.
-
-Power supply is a 12VDC barrel jack, and included switching power supply, which
-is why SATA power regulation is on-board. Internally it has a NUC-board-style
-on-board 12V input header as well, the molex locking style.
-
-There are WDT options and auto-boot on power enable, which is great for remote
-setups. Firmware is reasonably secure (no backdoors found, BootGuard is enabled
-in enforcement mode, which is good but also means no coreboot option), yet has
-most options available to configure (so it's not locked out like most firmwares
-are).
-
-An external RS232 serial port is available, internally a GPIO header as well.
-It does have Realtek based audio on board for some reason, but you can disable
-that. Booting works on both USB2 and USB3 ports. Switching between serial BIOS
-mode and HDMI BIOS mode depends on what is connected at startup; it goes into
-serial mode if you disconnect HDMI and plug in serial, in all other cases it's
-HDMI mode.
-
-Partaker i5
-***********
-
-.. figure:: ../_static/images/600px-Partaker-i5.jpg
-
-I believe this is actually the same hardware as the Protectli. I purchased it
-from `Amazon <https://www.amazon.com/gp/product/B073F9GHKL/>`_ in June 2018.
-It came pre-loaded with pfSense.
-
-`Manufacturer product page <http://www.inctel.com.cn/product/detail/338.html>`_.
-
-Installation
-------------
-
-* Write VyOS ISO to USB drive of some sort
-* Plug in VGA, power, USB keyboard, and USB drive
-* Press "SW" button on the front (this is the power button; I don't know what
-  "SW" is supposed to mean).
-* Begin rapidly pressing delete on the keyboard. The boot prompt is very quick,
-  but with a few tries you should be able to get into the BIOS.
-* Chipset > South Bridge > USB Configuration: set XHCI to Disabled and USB 2.0
-  (EHCI) to Enabled. Without doing this, the USB drive won't boot.
-* Boot to the VyOS installer and install as usual.
-
-Warning the interface labels on my device are backwards; the left-most "LAN4"
-port is eth0 and the right-most "LAN1" port is eth3.
-
-Acrosser AND-J190N1
-*******************
-
-.. figure:: ../_static/images/480px-Acrosser_ANDJ190N1_Front.jpg
-
-.. figure:: ../_static/images/480px-Acrosser_ANDJ190N1_Back.jpg
-
-11/22/2016. This microbox network appliance was build to create OpenVPN bridges.
-It can saturate a 100Mbps link.
-
-It is a small (serial console only) PC with 6 Gb LAN
-http://www.acrosser.com/upload/AND-J190_J180N1-2.pdf
-
-You may have to add your own RAM and HDD/SSD. There is no VGA connector. But
-Acrosser provides a DB25 adapter for the VGA header on the motherboard (not used).
-
-BIOS Settings:
---------------
-
-First thing you want to do is getting a more user friendly console to configure
-BIOS. Default VT100 brings a lot of issues. Configure VT100+ instead.
-
-For practical issues change speed from 115200 to 9600. 9600 is the default speed
-at which both linux kernel and VyOS will reconfigure the serial port when loading.
-
-Connect to serial (115200bps). Power on the appliance and press Del in the console
-when requested to enter BIOS settings.
-
-Advanced > Serial Port Console Redirection > Console Redirection Settings:
-
-* Terminal Type : VT100+
-* Bits per second : 9600
-
-Save, reboot and change serial speed to 9600 on your client.
-
-Some options have to be changed for VyOS to boot correctly. With XHCI enabled
-the installer can’t access the USB key. Enable EHCI instead.
-
-Reboot into BIOS, Chipset > South Bridge > USB Configuration:
-
-* Disable XHCI
-* Enable USB 2.0 (EHCI) Support
-
-Install VyOS:
--------------
-
-Create a VyOS bootable USB key. I used the 64-bit ISO (VyOS 1.1.7) and `LinuxLive
-USB Creator <http://www.linuxliveusb.com/>`_.
-
-I'm not sure if it helps the process but I changed default option to live-serial
-(line “default xxxx”) on the USB key under syslinux/syslinux.cfg.
-
-I connected the key to one black USB port on the back and powered on. The first
-VyOS screen has some readability issues. Press :kbd:`Enter` to continue.
-
-Then VyOS should boot and you can perform the ``install image``
diff --git a/docs/appendix/vyos-on-gns3.rst b/docs/appendix/vyos-on-gns3.rst
deleted file mode 100644
index f17715b2..00000000
--- a/docs/appendix/vyos-on-gns3.rst
+++ /dev/null
@@ -1,175 +0,0 @@
-.. _vyos-on-gns3:
-
-VyOS on GNS3
-############
-
-Sometimes you may want to test VyOS in a lab environment.
-`GNS3 <http://www.gns3.com>`__ is a network emulation software you
-might use for it.
-
-This guide will provide the necessary steps for installing
-and setting up VyOS on GNS3.
-
-Requirements
-------------
-
-The following items are required:
-
-* A VyOS installation image (.iso file).
-  `Here <https://docs.vyos.io/en/latest/install.html#download>`__ you
-  can find how to get it.
-
-* A working GNS3 installation. For further information see the
-  `GNS3 documentation <https://docs.gns3.com/>`__.
-
-.. _vm_setup:
-
-VM setup
---------
-
-First, a virtual machine (VM) for the VyOS installation must be created
-in GNS3.
-
-Go to the GNS3 **File** menu, click **New template** and choose select
-**Manually create a new Template**.
-
-.. figure:: /_static/images/gns3-01.png
-
-Select **Quemu VMs** and then click on the ``New`` button.
-
-.. figure:: /_static/images/gns3-02.png
-
-Write a name for your VM, for instance "VyOS", and click ``Next``.
-
-.. figure:: /_static/images/gns3-03.png
-
-Select **qemu-system-x86_64** as Quemu binary, then **512MB** of RAM
-and click ``Next``.
-
-.. figure:: /_static/images/gns3-04.png
-
-Select **telnet** as your console type and click ``Next``.
-
-.. figure:: /_static/images/gns3-05.png
-
-Select **New image** for the base disk image of your VM and click
-``Create``.
-
-.. figure:: /_static/images/gns3-06.png
-
-Use the defaults in the **Binary and format** window and click
-``Next``.
-
-.. figure:: /_static/images/gns3-07.png
-
-Use the defaults in the **Qcow2 options** window and click ``Next``.
-
-.. figure:: /_static/images/gns3-08.png
-
-Set the disk size to 2000 MiB, and click ``Finish`` to end the **Quemu
-image creator**.
-
-.. figure:: /_static/images/gns3-09.png
-
-Click ``Finish`` to end the **New QEMU VM template** wizard.
-
-.. figure:: /_static/images/gns3-10.png
-
-Now the VM settings have to be edited.
-
-Being again at the **Preferences** window, having **Qemu VMs**
-selected and having our new VM selected, click the ``Edit`` button.
-
-.. figure:: /_static/images/gns3-11.png
-
-In the **General settings** tab of your **QEMU VM template
-configuration**, do the following:
-
-* Click on the ``Browse...`` button to choose the **Symbol** you want to
-  have representing your VM.
-* In **Category** select in which group you want to find your VM.
-* Set the **Boot priority** to **CD/DVD-ROM**.
-
-.. figure:: /_static/images/gns3-12.png
-
-At the **HDD** tab, change the Disk interface to **sata** to speed up
-the boot process.
-
-.. figure:: /_static/images/gns3-13.png
-
-At the **CD/DVD** tab click on ``Browse...`` and locate the VyOS image
-you want to install.
-
-.. figure:: /_static/images/gns3-14.png
-
-.. note:: You probably will want to accept to copy the .iso file to your
-   default image directory when you are asked.
-
-In the **Network** tab,  set **0** as the number of adapters, set the
-**Name format** to **eth{0}** and the **Type** to **Paravirtualized
-Network I/O (virtio-net-pci)**.
-
-.. figure:: /_static/images/gns3-15.png
-
-In the **Advanced** tab, unmark the checkbox **Use as a linked base
-VM** and click ``OK``, which will save and close the **QEMU VM template
-configuration** window.
-
-.. figure:: /_static/images/gns3-16.png
-
-At the general **Preferences** window, click ``OK`` to save and close.
-
-.. figure:: /_static/images/gns3-17.png
-
-
-.. _vyos_installation:
-
-VyOS installation
------------------
-
-* Create a new project.
-* Drag the newly created VyOS VM into it.
-* Start the VM.
-* Open a console.
-  The console should show the system booting. It will ask for the login
-  credentials, you are at the VyOS live system.
-* `Install VyOS <https://docs.vyos.io/en/latest/install.html#install>`__
-  as normal (that is, using the ``install image`` command).
-
-* After a successful installation, shutdown the VM with the ``poweroff``
-  command.
-
-* **Delete the VM** from the GNS3 project.
-
-The *VyOS-hda.qcow2* file now contains a working VyOS image and can be
-used as a template. But it still needs some fixes before we can deploy
-VyOS in our labs.
-
-.. _vyos_vm_configuration:
-
-VyOS VM configuration
----------------------
-
-To turn the template into a working VyOS machine, further steps are
-necessary as outlined below:
-
-**General settings** tab: Set the boot priority to **HDD**
-
-.. figure:: /_static/images/gns3-20.png
-  
-**CD/DVD** tab: Unmount the installation image file by clearing the
-**Image** entry field.
-
-.. figure:: /_static/images/gns3-21.png
-
-Set the number of required network adapters, for example **4**.
-
-.. figure:: /_static/images/gns3-215.png
-
-**Advanced** settings tab: Mark the checkbox **Use as a linked
-base VM** and click ``OK`` to save the changes.
-
-.. figure:: /_static/images/gns3-22.png
-
-The VyOS VM is now ready to be deployed.
-
diff --git a/docs/appendix/vyos-on-vmware.rst b/docs/appendix/vyos-on-vmware.rst
deleted file mode 100644
index 6feb95ba..00000000
--- a/docs/appendix/vyos-on-vmware.rst
+++ /dev/null
@@ -1,32 +0,0 @@
-.. _vyosonvmware:
-
-Running on VMWare ESXi
-######################
-
-ESXi 5.5 or later
-*****************
-
-.ova files are available for supporting users, and a VyOS can also be stood up using a generic Linux instance, and attaching the bootable ISO file and installing from the ISO 
-using the normal process around `install image`.
-
-.. NOTE:: There have been previous documented issues with GRE/IPSEC tunneling using the E1000 adapter on the VyOS guest, and use of the VMXNET3 has been advised.
-
-Memory Contention Considerations
---------------------------------
-When the underlying ESXi host is approaching ~92% memory utilisation it will start the balloon process in s a 'soft' state to start reclaiming memory from guest operating systems. 
-This causes an artifical pressure using the vmmemctl driver on memory usage on the virtual guest. As VyOS by default does not have a swap file, this vmmemctl pressure is unable to
-force processes to move in memory data to the paging file, and blindly consumes memory forcing the virtual guest into a low memory state with no way to escape. The balloon can expand to 65% of 
-guest allocated memory, so a VyOS guest running >35% of memory usage, can encounter an out of memory situation, and trigger the kernel oom_kill process. At this point a weighted 
-lottery favouring memory hungry processes will be run with the unlucky winner being terminated by the kernel.
-
-It is advised that VyOS routers are configured in a resource group with adequate memory reservations so that ballooning is not inflicted on virtual VyOS guests.
-
-
-
-
-
-References
-----------
-
-https://muralidba.blogspot.com/2018/03/how-does-linux-out-of-memory-oom-killer.html
-
diff --git a/docs/automation/command-scripting.rst b/docs/automation/command-scripting.rst
new file mode 100644
index 00000000..98e97d3c
--- /dev/null
+++ b/docs/automation/command-scripting.rst
@@ -0,0 +1,126 @@
+.. _commandscripting:
+
+
+Command scripting
+=================
+
+VyOS supports executing configuration and operational commands non-interactively from shell scripts.
+
+To include VyOS-specific functions and aliases you need to ``source /opt/vyatta/etc/functions/script-template`` files at the top of your script.
+
+.. code-block:: none
+
+  #!/bin/vbash
+  source /opt/vyatta/etc/functions/script-template
+
+  exit
+
+Run configuration commands
+--------------------------
+
+Configuration commands are executed just like from a normal config session.
+
+For example, if you want to disable a BGP peer on VRRP transition to backup:
+
+.. code-block:: none
+
+  #!/bin/vbash
+  source /opt/vyatta/etc/functions/script-template
+
+  configure
+
+  set protocols bgp 65536 neighbor 192.168.2.1 shutdown
+
+  commit
+
+  exit
+
+
+Run operational commands
+------------------------
+
+Unlike a normal configuration sessions, all operational commands must be prepended with ``run``, even if you haven't created a session with configure.
+
+.. code-block:: none
+
+  #!/bin/vbash
+  source /opt/vyatta/etc/functions/script-template
+
+  run show interfaces
+
+  exit
+
+Other script language
+---------------------
+
+If you want to script the configs in a language other than bash you can have your script output commands and then source them in a bash script.
+
+Here is a simple example:
+
+.. code-block:: python
+
+  #!/usr/bin/env python
+  print "delete firewall group address-group somehosts"
+  print "set firewall group address-group somehosts address '1.1.1.1'"
+  print "set firewall group address-group somehosts address '1.1.1.2'"
+
+
+.. code-block:: none
+
+  #!/bin/vbash
+  source /opt/vyatta/etc/functions/script-template
+  
+  configure 
+  source <(/config/scripts/setfirewallgroup.py)
+  commit
+
+
+Executing Configuration Scripts
+-------------------------------
+
+There is a pitfall when working with configuration scripts. It is tempting to call configuration scripts with "sudo" (i.e., temporary root permissions), because that's the common way on most Linux platforms to call system commands.
+
+On VyOS this will cause the following problem: After modifying the configuration via script like this once, it is not possible to manually modify the config anymore:
+
+.. code-block:: none
+
+  sudo ./myscript.sh # Modifies config
+  configure
+  set ... # Any configuration parameter
+
+| This will result in the following error message: ``Set failed``
+| If this happens, a reboot is required to be able to edit the config manually again.
+
+To avoid these problems, the proper way is to call a script with the ``vyattacfg`` group, e.g., by using the ``sg`` (switch group) command:
+
+.. code-block:: none
+
+  sg vyattacfg -c ./myscript.sh
+
+
+To make sure that a script is not accidentally called without the ``vyattacfg`` group, the script can be safeguarded like this:
+
+.. code-block:: none
+
+  if [ "$(id -g -n)" != 'vyattacfg' ] ; then
+      exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@"
+  fi
+
+Postconfig on boot
+------------------
+
+The ``/config/scripts/vyos-postconfig-bootup.script`` script is called on boot after the VyOS configuration is fully applied.
+
+Any modifications done to work around unfixed bugs and implement enhancements which are not complete in the VyOS system can be placed here.
+
+The default file looks like this:
+
+.. code-block:: none
+
+  #!/bin/sh
+  # This script is executed at boot time after VyOS configuration is fully applied.
+  # Any modifications required to work around unfixed bugs
+  # or use services not available through the VyOS CLI system can be placed here.
+
+.. hint::
+  For configuration/upgrade management issues, modification of this script should be the last option. Always try to find solutions based on CLI commands first.
diff --git a/docs/automation/index.rst b/docs/automation/index.rst
new file mode 100644
index 00000000..e07dfecc
--- /dev/null
+++ b/docs/automation/index.rst
@@ -0,0 +1,15 @@
+###############
+VyOS Automation
+###############
+
+
+  * Ansible
+  * Saltstack
+  * HTTP-API
+  * startup scripts
+
+
+.. toctree::
+   :maxdepth: 1
+
+   command-scripting
\ No newline at end of file
diff --git a/docs/changelog/1.2.1.rst b/docs/changelog/1.2.1.rst
new file mode 100644
index 00000000..4f22dd0a
--- /dev/null
+++ b/docs/changelog/1.2.1.rst
@@ -0,0 +1,52 @@
+1.2.1
+=====
+
+VyOS 1.2.1 is a maintenance release made in April 2019.
+
+Resolved issues
+---------------
+
+* Package updates: kernel 4.19.32, open-vm-tools 10.3, latest Intel NIC drivers
+* :vytask:`T1326` The kernel now includes drivers for various USB serial
+  adapters, which allows people to add a serial console to a machine without
+  onboard RS232, or connect to something else from the router
+* The collection of network card firmware is now much more extensive
+* :vytask:`T1271` VRRP now correctly uses a virtual rather than physical MAC
+  addresses in the RFC-compliant mode
+* :vytask:`T1330` DHCP WPAD URL option works correctly again
+* :vytask:`T1312` Many to many NAT rules now can use source/destination and
+  translation networks of non-matching size. If 1:1 network bits translation is
+  desired, it's now users responsibility to check if prefix length matches.
+* :vytask:`T1290` IPv6 network prefix translation is fixed
+* :vytask:`T1308` Non-alphanumeric characters such as ``>`` can now be safely
+  used in PPPoE passwords
+* :vytask:`T1305` ``show | commands`` no longer fails when a config section ends
+  with a leaf node such as ``timezone`` in ``show system | commands``
+* :vytask:`T1235` ``show | commands`` correctly works in config mode now
+* :vytask:`T1298` VTI is now compatible with the DHCP-interface IPsec option
+* :vytask:`T1277` ``show dhcp server statistics`` command was broken in latest
+  Crux
+* :vytask:`T1261` An issue with TFTP server refusing to listen on addresses
+  other than loopback was fixed
+* :vytask:`T1224` Template issue that might cause UDP broadcast relay fail to
+  start is fixed
+* :vytask:`T1067` VXLAN value validation is improved
+* :vytask:`T1211` Blank hostnames in DHCP updates no longer can crash DNS
+  forwarding
+* :vytask:`T1322` Correct configuration is now generated for DHCPv6 relays with
+  more than one upstream interface
+* :vytask:`T1234` ``relay-agents-packets`` option works correctly now
+* :vytask:`T1231` Dynamic DNS data is now cleaned on configuration change
+* :vytask:`T1282` Remote Syslog can now use a fully qualified domain name
+* :vytask:`T1279` ACPI power off works again
+* :vytask:`T1247` Negation in WAN load balancing rules works again
+* :vytask:`T1218` FRR staticd now starts on boot correctly
+* :vytask:`T1296` The installer now correctly detects SD card devices
+* :vytask:`T1225` Wireguard peers can be disabled now
+* :vytask:`T1217` The issue with Wireguard interfaces impossible to delete
+  is fixed
+* :vytask:`T1160` Unintended IPv6 access is fixed in SNMP configuration
+* :vytask:`T1060` It's now possible to exclude hosts from the transparent
+  web proxy
+* :vytask:`T484` An issue with rules impossible to delete from the zone-based
+  firewall is fixed
\ No newline at end of file
diff --git a/docs/changelog/1.2.2.rst b/docs/changelog/1.2.2.rst
new file mode 100644
index 00000000..17ba941f
--- /dev/null
+++ b/docs/changelog/1.2.2.rst
@@ -0,0 +1,46 @@
+1.2.2
+=====
+
+1.2.2 is a maintenance release made in July 2019.
+
+New features
+------------
+
+* Options for per-interface MSS clamping.
+* BGP extended next-hop capability
+* Relaxed BGP multipath option
+* Internal and external options for "remote-as" (accept any AS as long as it's
+  the same to this router or different, respectively)
+* "Unnumbered" (interface-based) BGP peers
+* BGP no-prepend option
+* Additive BGP community option
+* OSPFv3 network type option
+* Custom arguments for VRRP scripts
+* A script for querying values from config files
+
+Resolved issues
+---------------
+
+* Linux kernel 4.19.54, including a fix for the TCP SACK vulnerability
+* :vytask:`T1371` VRRP health-check scripts now can use arguments
+* :vytask:`T1497` DNS server addresses coming from a DHCP server are now
+  correctly propagated to resolv.conf
+* :vytask:`T1469` Domain-specific name servers in DNS forwarding are now used
+  for recursive queries
+* :vytask:`T1433` ``run show dhcpv6 server leases`` now display leases correctly
+* :vytask:`T1461` Deleting ``firewall options`` node no longer causes errors
+* :vytask:`T1458` Correct hostname is sent to remote syslog again
+* :vytask:`T1438` Board serial number from DMI is correctly displayed in
+  ``show version``
+* :vytask:`T1358`, :vytask:`T1355`, :vytask:`T1294` Multiple corrections in
+  remote syslog config
+* :vytask:`T1255` Fixed missing newline in ``/etc/hosts``
+* :vytask:`T1174` ``system domain-name`` is correctly included in
+  ``/etc/resolv.conf``
+* :vytask:`T1465` Fixed priority inversion in ``interfaces vti vtiX ip``
+  settings
+* :vytask:`T1446` Fixed errors when installing with RAID1 on UEFI machines
+* :vytask:`T1387` Fixed an error on disabling an interfaces that has no address
+* :vytask:`T1367` Fixed deleting VLAN interface with non-default MTU
+* :vytask:`T1505` vyos.config ``return_effective_values()`` function now
+  correctly returns a list rather than a string
\ No newline at end of file
diff --git a/docs/changelog/1.2.3.rst b/docs/changelog/1.2.3.rst
new file mode 100644
index 00000000..653beec1
--- /dev/null
+++ b/docs/changelog/1.2.3.rst
@@ -0,0 +1,62 @@
+1.2.3
+=====
+
+1.2.3 is a maintenance and feature backport release made in September 2019.
+
+New features
+------------
+
+* HTTP API
+* :vytask:`T1524` "set service dns forwarding allow-from <IPv4 net|IPv6 net>"
+  option for limiting queries to specific client networks
+* :vytask:`T1503` Functions for checking if a commit is in progress
+* :vytask:`T1543` "set system contig-mangement commit-archive source-address"
+  option
+* :vytask:`T1554` Intel NIC drivers now support receive side scaling and
+  multiqueue
+
+Resolved issues
+---------------
+
+* :vytask:`T1209` OSPF max-metric values over 100 no longer causes commit
+  errors
+* :vytask:`T1333` Fixes issue with DNS forwarding not performing recursive
+  lookups on domain specific forwarders
+* :vytask:`T1362` Special characters in VRRP passwords are handled correctly
+* :vytask:`T1377` BGP weight is applied properly
+* :vytask:`T1420` Fixed permission for log files
+* :vytask:`T1425` Wireguard interfaces now support /31 addresses
+* :vytask:`T1428` Wireguard correctly handles firewall marks
+* :vytask:`T1439` DHCPv6 static mappings now work correctly
+* :vytask:`T1450` Flood ping commands now works correctly
+* :vytask:`T1460` Op mode "show firewall" commands now support counters longer
+  than 8 digits (T1460)
+* :vytask:`T1465` Fixed priority inversion in VTI commands
+* :vytask:`T1468` Fixed remote-as check in the BGP route-reflector-client option
+* :vytask:`T1472` It's now possible to re-create VRRP groups with RFC
+  compatibility mode enabled
+* :vytask:`T1527` Fixed a typo in DHCPv6 server help strings
+* :vytask:`T1529` Unnumbered BGP peers now support VLAN interfaces
+* :vytask:`T1530` Fixed "set system syslog global archive file" command
+* :vytask:`T1531` Multiple fixes in cluster configuration scripts
+* :vytask:`T1537` Fixed missing help text for "service dns"
+* :vytask:`T1541` Fixed input validation in DHCPv6 relay options
+* :vytask:`T1551` It's now possible to create a QinQ interface and a firewall
+  assigned to it in one commit
+* :vytask:`T1559` URL filtering now uses correct rule database path and works
+  again
+* :vytask:`T1579` "show log vpn ipsec" command works again
+* :vytask:`T1576` "show arp interface <intf>" command works again
+* :vytask:`T1605` Fixed regression in L2TP/IPsec server
+* :vytask:`T1613` Netflow/sFlow captures IPv6 traffic correctly
+* :vytask:`T1616` "renew dhcpv6" command now works from op mode
+* :vytask:`T1642` BGP remove-private-as option iBGP vs eBGP check works
+  correctly now
+* :vytask:`T1540`, :vytask:`T1360`, :vytask:`T1264`, :vytask:`T1623` Multiple
+  improvements in name servers and hosts configuration handling
+
+Internals
+---------
+
+``/etc/resolv.conf`` and ``/etc/hosts`` files are now managed by the
+*vyos-hostsd* service that listens on a ZMQ socket for update messages.
\ No newline at end of file
diff --git a/docs/changelog/1.2.4.rst b/docs/changelog/1.2.4.rst
new file mode 100644
index 00000000..3e228880
--- /dev/null
+++ b/docs/changelog/1.2.4.rst
@@ -0,0 +1,77 @@
+1.2.4
+=====
+
+1.2.4 is a maintenance release made in December 2019.
+
+Resolved issues
+---------------
+
+* :vytask:`T258` Can not configure wan load-balancing on vyos-1.2
+* :vytask:`T818` SNMP v3 - remove required engineid from user node
+* :vytask:`T1030` Upgrade ddclient from 3.8.2 to 3.9.
+  (support Cloudflare API v4)
+* :vytask:`T1183` BFD Support via FRR
+* :vytask:`T1299` Allow SNMPd to be extended with custom scripts
+* :vytask:`T1351` accel-pppoe adding CIDR based IP pool option
+* :vytask:`T1391` In route-map set community additive
+* :vytask:`T1394` syslog systemd and host_name.py race condition
+* :vytask:`T1401` Copying files with the FTP protocol fails if the passwor
+  contains special characters
+* :vytask:`T1421` OpenVPN client push-route stopped working, needs added quotes
+  to fix
+* :vytask:`T1430` Add options for custom DHCP client-id and hostname
+* :vytask:`T1447` Python subprocess called without import in host_name.py
+* :vytask:`T1470` improve output of "show dhcpv6 server leases"
+* :vytask:`T1485` Enable 'AdvIntervalOpt' option in for radvd.conf
+* :vytask:`T1496` Separate rolling release and LTS kernel builds
+* :vytask:`T1560` "set load-balancing wan rule 0" causes segfault and prevent
+  load balancing from starting
+* :vytask:`T1568` strip-private command improvement for additional masking o
+  IPv6 and MAC address
+* :vytask:`T1578` completion offers "show table", but show table does not exist
+* :vytask:`T1593` Support ip6gre
+* :vytask:`T1597` /usr/sbin/rsyslogd after deleting "system syslog"
+* :vytask:`T1638` vyos-hostsd not setting system domain name
+* :vytask:`T1678` hostfile-update missing line feed
+* :vytask:`T1694` NTPd: Do not listen on all interfaces by default
+* :vytask:`T1701` Delete domain-name and domain-search won't work
+* :vytask:`T1705` High CPU usage by bgpd when snmp is active
+* :vytask:`T1707` DHCP static mapping and exclude address not working
+* :vytask:`T1708` Update Rolling Release Kernel to 4.19.76
+* :vytask:`T1709` Update WireGuard to 0.0.20190913
+* :vytask:`T1716` Update Intel NIC drivers to recent versions
+* :vytask:`T1726` Update Linux Firmware binaries to a more recen
+  version 2019-03-14 -> 2019-10-07
+* :vytask:`T1728` Update Linux Kernel to 4.19.79
+* :vytask:`T1737` SNMP tab completion missing
+* :vytask:`T1738` Copy SNMP configuration from node to node raises exception
+* :vytask:`T1740` Broken OSPFv2 virtual-link authentication
+* :vytask:`T1742` NHRP unable to commit.
+* :vytask:`T1745` dhcp-server commit fails with "DHCP range stop address 
+  must be greater or equal to the range start address y!" when static mapping
+  has same IP as range stop
+* :vytask:`T1749` numeric validator doesn't support multiple ranges
+* :vytask:`T1769` Remove complex SNMPv3 Transport Security Model (TSM)
+* :vytask:`T1772` <regex> constraints in XML are partially broken
+* :vytask:`T1778` Kilobits/Megabits difference in configuration Vyos/FRR
+* :vytask:`T1780` Adding ipsec ike closeaction
+* :vytask:`T1786` disable-dhcp-nameservers is missed in current host_name.p
+  implementation
+* :vytask:`T1788` Intel QAT (QuickAssist Technology ) implementation
+* :vytask:`T1792` Update WireGuard to Debian release 0.0.20191012-1
+* :vytask:`T1800` Update Linux Kernel to v4.19.84
+* :vytask:`T1809` Wireless: SSID scan does not work in AP mode
+* :vytask:`T1811` Upgrade from 1.1.8: Config file migratio
+  failed: module=l2tp
+* :vytask:`T1812` DHCP: hostnames of clients not resolving afte
+  update v1.2.3 -> 1.2-rolling
+* :vytask:`T1819` Reboot kills SNMPv3 configuration
+* :vytask:`T1822` Priority inversion wireless interface dhcpv6
+* :vytask:`T1825` Improve DHCP configuration error message
+* :vytask:`T1836` import-conf-mode-commands in vyos-1x/scripts fails
+  to create an xml
+* :vytask:`T1839` LLDP shows "VyOS unknown" instead of "VyOS"
+* :vytask:`T1841` PPP ipv6-up.d direcotry missing
+* :vytask:`T1893` igmp-proxy: Do not allow adding unknown interface
+* :vytask:`T1903` Implementation udev predefined interface naming
+* :vytask:`T1904` update eth1 and eth2 link files for the vep4600
\ No newline at end of file
diff --git a/docs/changelog/1.2.5.rst b/docs/changelog/1.2.5.rst
new file mode 100644
index 00000000..6eabc6cf
--- /dev/null
+++ b/docs/changelog/1.2.5.rst
@@ -0,0 +1,70 @@
+1.2.5
+=====
+
+1.2.5 is a maintenance release made in April 2020.
+
+Resolved issues
+---------------
+
+* :vytask:`1020` OSPF Stops distributing default route after a while
+* :vytask:`1228` pppoe default-route force option not working (Rel 1.2.0-rc11)
+* :vytask:`1301` bgp peer-groups don't work when "no-ipv4-unicast" is enabled.
+* :vytask:`1341` Adding rate-limiter for pppoe server users
+* :vytask:`1376` Incorrect DHCP lease counting
+* :vytask:`1392` Large firewall rulesets cause the system to lose configuration
+  and crash at startup
+* :vytask:`1416` 2 dhcp server run in failover mode can't sync hostname with
+  each other
+* :vytask:`1452` accel-pppoe - add vendor option to shaper
+* :vytask:`1490` BGP configuration (is lost|not applied) when updating
+  1.1.8 -> 1.2.1
+* :vytask:`1780` Adding ipsec ike closeaction
+* :vytask:`1803` Unbind NTP while it's not requested...
+* :vytask:`1821` "authentication mode radius" has no effect for PPPoE server
+* :vytask:`1827` Increase default gc_thresh
+* :vytask:`1828` Missing completion helper for "set system syslog host
+  192.0.2.1 facility all protocol"
+* :vytask:`1832` radvd adding feature DNSSL branch.example.com example.com to
+  existing package
+* :vytask:`1837` PPPoE unrecognized option 'replacedefaultroute'
+* :vytask:`1851` wireguard - changing the pubkey on an existing peer seems to
+  destroy the running config.
+* :vytask:`1858` l2tp: Delete depricated outside-nexthop and add gateway-address
+* :vytask:`1864` Lower IPSec DPD timeout lower limit from 10s -> 2s
+* :vytask:`1879` Extend Dynamic DNS XML definition value help strings and
+  validators
+* :vytask:`1881` Execute permissions are removed from custom SNMP scripts at
+  commit time
+* :vytask:`1884` Keeping VRRP transition-script native behaviour and adding
+  stop-script
+* :vytask:`1891` Router announcements broken on boot
+* :vytask:`1900` Enable SNMP for VRRP.
+* :vytask:`1902` Add redistribute non main table in bgp
+* :vytask:`1909` Incorrect behaviour of static routes with overlapping networks
+* :vytask:`1913` "system ipv6 blacklist" command has no effect
+* :vytask:`1914` IPv6 multipath hash policy does not apply
+* :vytask:`1917` Update WireGuard to Debian release 0.0.20191219-1
+* :vytask:`1934` Change default hostname when deploy from OVA without params.
+* :vytask:`1935` NIC identification and usage problem in Hyper-V environments
+* :vytask:`1936` pppoe-server CLI control features
+* :vytask:`1964` SNMP Script-extensions allows names with spaces, but commit
+  fails
+* :vytask:`1967` BGP parameter "enforce-first-as" does not work anymore
+* :vytask:`1970` Correct adding interfaces on boot
+* :vytask:`1971` Missing modules in initrd.img for PXE boot
+* :vytask:`1998` Update FRR to 7.3
+* :vytask:`2001` Error when router reboot
+* :vytask:`2032` Monitor bandwidth bits
+* :vytask:`2059` Set source-validation on bond vif don't work
+* :vytask:`2066` PPPoE interface can be created multiple times - last wins
+* :vytask:`2069` PPPoE-client does not works with service-name option
+* :vytask:`2077` ISO build from crux branch is failing
+* :vytask:`2079` Update Linux Kernel to v4.19.106
+* :vytask:`2087` Add maxfail 0 option to pppoe configuration.
+* :vytask:`2100` BGP route adverisement wih checks rib
+* :vytask:`2120` "reset vpn ipsec-peer" doesn't work with named peers
+* :vytask:`2197` Cant add vif-s interface into a bridge
+* :vytask:`2228` WireGuard does not allow ports < 1024 to be used
+* :vytask:`2252` HTTP API add system image can return '504 Gateway Time-out'
+* :vytask:`2272` Set system flow-accounting disable-imt has syntax error
+* :vytask:`2276` PPPoE server vulnerability
\ No newline at end of file
diff --git a/docs/changelog/1.2.6.rst b/docs/changelog/1.2.6.rst
new file mode 100644
index 00000000..9c048f58
--- /dev/null
+++ b/docs/changelog/1.2.6.rst
@@ -0,0 +1,106 @@
+1.2.6-S1
+========
+
+1.2.6-S1 is a security release release made in September 2020.
+
+Resolved issues
+---------------
+
+VyOS 1.2.6 release was found to be suspectible to CVE-2020-10995. It's a low-
+impact vulnerability in the PowerDNS recursor that allows an attacker to cause
+performance degradation via a specially crafted authoritative DNS server reply.
+
+* :vytask:`2899` remote syslog server migration error on update
+
+1.2.6
+=====
+
+1.2.6 is a maintenance release made in September 2020.
+
+Resolved issues
+---------------
+
+* :vytask:`103` DHCP server prepends shared network name to hostnames
+* :vytask:`125` Missing PPPoE interfaces in l2tp configuration
+* :vytask:`1194` cronjob is being setup even if not saved
+* :vytask:`1205` module pcspkr missing
+* :vytask:`1219` Redundant active-active configuration, asymmetric routing and
+  conntrack-sync cache
+* :vytask:`1220` Show transceiver information from plugin modules, e.g SFP+,
+  QSFP
+* :vytask:`1221` BGP - Default route injection is not processed by the specific
+  route-map
+* :vytask:`1241` Remove of policy route throws CLI error
+* :vytask:`1291` Under certain conditions the VTI will stay forever down
+* :vytask:`1463` Missing command `show ip bgp scan` appears in command
+  completion
+* :vytask:`1575` `show snmp mib ifmib` crashes with IndexError
+* :vytask:`1699` Default net.ipv6.route.max_size 32768 is too low
+* :vytask:`1729` PIM (Protocol Independent Multicast) implementation
+* :vytask:`1901` Semicolon in values is interpreted as a part of the shell
+  command by validators
+* :vytask:`1934` Change default hostname when deploy from OVA without params.
+* :vytask:`1938` syslog doesn't start automatically
+* :vytask:`1949` Multihop IPv6 BFD is unconfigurable
+* :vytask:`1953` DDNS service name validation rejects valid service names
+* :vytask:`1956` PPPoE server: support PADO-delay
+* :vytask:`1973` Allow route-map to match on BGP local preference value
+* :vytask:`1974` Allow route-map to set administrative distance
+* :vytask:`1982` Increase rotation for atop.acct
+* :vytask:`1983` Expose route-map when BGP routes are programmed in to FIB
+* :vytask:`1985` pppoe: Enable ipv6 modules without configured ipv6 pools
+* :vytask:`2000` strongSwan does not install routes to table 220 in certain
+  cases
+* :vytask:`2021` OSPFv3 doesn't support decimal area syntax
+* :vytask:`2062` Wrong dhcp-server static route subnet bytes
+* :vytask:`2091` swanctl.conf file is not generated properly is more than one
+  IPsec profile is used
+* :vytask:`2131` Improve syslog remote host CLI definition
+* :vytask:`2224` Update Linux Kernel to v4.19.114
+* :vytask:`2286` IPoE server vulnerability
+* :vytask:`2303` Unable to delete the image version that came from OVA
+* :vytask:`2305` Add release name to "show version" command
+* :vytask:`2311` Statically configured name servers may not take precedence
+  over ones from DHCP
+* :vytask:`2327` Unable to create syslog server entry with different port
+* :vytask:`2332` Backport node option for a syslog server
+* :vytask:`2342` Bridge l2tpv3 + ethX errors
+* :vytask:`2344` PPPoE server client static IP assignment silently fails
+* :vytask:`2385` salt-minion: improve completion helpers
+* :vytask:`2389` BGP community-list unknown command
+* :vytask:`2398` op-mode "dhcp client leases interface" completion helper
+  misses interfaces
+* :vytask:`2402` Live ISO should warn when configuring that changes won't
+  persist
+* :vytask:`2443` NHRP: Add debugging information to syslog
+* :vytask:`2448` `monitor protocol bgp` subcommands fail with 'command
+  incomplete'
+* :vytask:`2458` Update FRR to 7.3.1
+* :vytask:`2476` Bond member description change leads to network outage
+* :vytask:`2478` login radius: use NAS-IP-Address if defined source address
+* :vytask:`2482` Update PowerDNS recursor to 4.3.1 for CVE-2020-10995
+* :vytask:`2517` vyos-container: link_filter: No such file or directory
+* :vytask:`2526` Wake-On-Lan CLI implementation
+* :vytask:`2528` "update dns dynamic" throws FileNotFoundError excepton
+* :vytask:`2536` "show log dns forwarding" still refers to dnsmasq
+* :vytask:`2538` Update Intel NIC drivers to recent release (preparation for
+  Kernel >=5.4)
+* :vytask:`2545` Show physical device offloading capabilities for specified
+  ethernet interface
+* :vytask:`2563` Wrong interface binding for Dell VEP 1445
+* :vytask:`2605` SNMP service is not disabled by default
+* :vytask:`2625` Provide generic Library for package builds
+* :vytask:`2686` FRR: BGP: large-community configuration is not applied
+  properly after upgrading FRR to 7.3.x series
+* :vytask:`2701` `vpn ipsec pfs enable` doesn't work with IKE groups
+* :vytask:`2728` Protocol option ignored for IPSec peers in transport mode
+* :vytask:`2734` WireGuard: fwmark CLI definition is inconsistent
+* :vytask:`2757` "show system image version" contains additional new-line
+  character breaking output
+* :vytask:`2797` Update Linux Kernel to v4.19.139
+* :vytask:`2822` Update Linux Kernel to v4.19.141
+* :vytask:`2829` PPPoE server: mppe setting is implemented as node instead of
+  leafNode
+* :vytask:`2831` Update Linux Kernel to v4.19.142
+* :vytask:`2852` rename dynamic dns interface breaks ddclient.cache permissions
+* :vytask:`2853` Intel QAT acceleration does not work
\ No newline at end of file
diff --git a/docs/changelog/index.rst b/docs/changelog/index.rst
new file mode 100644
index 00000000..ae964145
--- /dev/null
+++ b/docs/changelog/index.rst
@@ -0,0 +1,18 @@
+.. _release-notes:
+
+
+#########
+Changelog
+#########
+
+
+.. toctree::
+   :maxdepth: 1
+   :includehidden:
+
+   1.2.6
+   1.2.5
+   1.2.4
+   1.2.3
+   1.2.2
+   1.2.1
diff --git a/docs/cli.rst b/docs/cli.rst
index 89030ddc..d5f00a45 100644
--- a/docs/cli.rst
+++ b/docs/cli.rst
@@ -1,9 +1,14 @@
 .. _cli:
 
-Command-Line Interface
-======================
+######################
+Command Line Interface
+######################
+
+The VyOS :abbr:`CLI (Command-Line Interface)` comprises an operational and a
+configuration mode.
 
-The VyOS CLI comprises an :ref:`commandtree_operationmode` and a  :ref:`commandtree_configmode`.
+Operational Mode
+################
 
 Operational mode allows for commands to perform operational system tasks and
 view system and service status, while configuration mode allows for the
@@ -67,6 +72,9 @@ When viewing in page mode the following commands are available:
  * **[left-arrow]** and **[right-arrow]** can be used to scroll left or right
    in the event that the output has lines which exceed the terminal size.
 
+Configuration Mode
+##################
+
 To enter configuration mode use the `configure` command:
 
 .. code-block:: none
@@ -85,3 +93,732 @@ To enter configuration mode use the `configure` command:
 
 See the configuration section of this document for more information on
 configuration mode.
+
+
+.. _configuration-overview:
+
+
+######################
+Configuration Overview
+######################
+
+VyOS makes use of a unified configuration file for the entire system's
+configuration: ``/config/config.boot``. This allows easy template
+creation, backup, and replication of system configuration. A system can
+thus also be easily cloned by simply copying the required configuration
+files.
+
+Terminology
+###########
+
+A VyOS system has three major types of configurations:
+
+* **Active** or **running configuration** is the system configuration
+  that is loaded  and currently active (used by VyOS). Any change in
+  the configuration will have to be committed to belong to the
+  active/running configuration.
+
+* **Working configuration** is the one that is currently being modified
+  in configuration mode. Changes made to the working configuration do
+  not go into effect until the changes are committed with the
+  :cfgcmd:`commit` command. At which time the working configuration will
+  become the active or running configuration.
+
+* **Saved configuration** is the one saved to a file using the
+  :cfgcmd:`save` command. It allows you to keep safe a configuration for
+  future uses. There can be multiple configuration files. The default or
+  "boot" configuration is saved and loaded from the file
+  ``/config/config.boot``.
+
+Seeing and navigating the configuration
+#######################################
+
+.. opcmd:: show configuration
+
+   View the current active configuration, also known as the running
+   configuration, from the operational mode.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show configuration
+     interfaces {
+         ethernet eth0 {
+             address dhcp
+             hw-id 00:53:00:00:aa:01
+         }
+         loopback lo {
+         }
+     }
+     service {
+         ssh {
+             port 22
+         }
+     }
+     system {
+         config-management {
+             commit-revisions 20
+         }
+         console {
+             device ttyS0 {
+                 speed 9600
+             }
+         }
+         login {
+             user vyos {
+                 authentication {
+                     encrypted-password ****************
+                 }
+                 level admin
+             }
+         }
+         ntp {
+             server 0.pool.ntp.org {
+             }
+             server 1.pool.ntp.org {
+             }
+             server 2.pool.ntp.org {
+             }
+         }
+         syslog {
+             global {
+                 facility all {
+                     level notice
+                 }
+                 facility protocols {
+                     level debug
+                 }
+             }
+         }
+     }
+
+By default, the configuration is displayed in a hierarchy like the above
+example, this is only one of the possible ways to display the
+configuration. When the configuration is generated and the device is
+configured, changes are added through a collection of :cfgcmd:`set` and
+:cfgcmd:`delete` commands.
+
+.. opcmd:: show configuration commands
+
+   Get a collection of all the set commands required which led to the
+   running configuration.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show configuration commands
+     set interfaces ethernet eth0 address 'dhcp'
+     set interfaces ethernet eth0 hw-id '00:53:dd:44:3b:0f'
+     set interfaces loopback 'lo'
+     set service ssh port '22'
+     set system config-management commit-revisions '20'
+     set system console device ttyS0 speed '9600'
+     set system login user vyos authentication encrypted-password '$6$Vt68...QzF0'
+     set system login user vyos level 'admin'
+     set system ntp server '0.pool.ntp.org'
+     set system ntp server '1.pool.ntp.org'
+     set system ntp server '2.pool.ntp.org'
+     set system syslog global facility all level 'notice'
+     set system syslog global facility protocols level 'debug'
+
+Both these ``show`` commands should be executed when in operational
+mode, they do not work directly in configuration mode. There is a
+special way on how to `run_opmode_from_config_mode`_
+
+.. hint:: Use the ``show configuration commands | strip-private``
+   command when you want to hide private data. You may want to do so if
+   you want to share your configuration on the `forum`_.
+
+.. _`forum`: https://forum.vyos.io
+
+
+The config mode
+===============
+
+When entering the configuration mode you are navigating inside a tree
+structure, to enter configuration mode enter the command
+:opcmd:`configure` when in operational mode.
+
+.. code-block:: none
+
+  vyos@vyos$ configure
+  [edit]
+  vyos@vyos#
+
+
+.. note:: When going into configuration mode, prompt changes from
+   ``$`` to ``#``.
+
+
+All commands executed here are relative to the configuration level you
+have entered. You can do everything from the top level, but commands
+will be quite lengthy when manually typing them.
+
+The current hierarchy level can be changed by the :cfgcmd:`edit`
+command.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# edit interfaces ethernet eth0
+
+  [edit interfaces ethernet eth0]
+  vyos@vyos#
+
+You are now in a sublevel relative to ``interfaces ethernet eth0``, all
+commands executed from this point on are relative to this sublevel. Use
+eithe the :cfgcmd:`top` or :cfgcmd:`exit` command to go back to the top
+of the hierarchy. You can also use the :cfgcmd:`up` command to move only
+one level up at a time.
+
+.. cfgcmd:: show
+
+The :cfgcmd:`show` command within configuration mode will show the
+working configuration indicating line changes with ``+`` for additions,
+``>`` for replacements and ``-`` for deletions.
+
+**Example:**
+
+.. code-block:: none
+
+ vyos@vyos:~$ configure
+ [edit]
+ vyos@vyos# show interfaces
+  ethernet eth0 {
+      description MY_OLD_DESCRIPTION
+      disable
+      hw-id 00:53:dd:44:3b:03
+  }
+  loopback lo {
+  }
+ [edit]
+ vyos@vyos# set interfaces ethernet eth0 address dhcp
+ [edit]
+ vyos@vyos# set interfaces ethernet eth0 description MY_NEW_DESCRIPTION
+ [edit]
+ vyos@vyos# delete interfaces ethernet eth0 disable
+ [edit]
+ vyos@vyos# show interfaces
+  ethernet eth0 {
+ +    address dhcp
+ >    description MY_NEW_DESCRIPTION
+ -    disable
+      hw-id 00:53:dd:44:3b:03
+  }
+  loopback lo {
+  }
+
+It is also possible to display all `set` commands within configuration
+mode using :cfgcmd:`show | commands`
+
+.. code-block:: none
+
+  vyos@vyos# show interfaces ethernet eth0 | commands
+  set address dhcp
+  set hw-id 00:53:ad:44:3b:03
+
+These commands are also relative to the level you are inside and only 
+relevant configuration blocks will be displayed when entering a
+sub-level.
+
+.. code-block:: none
+
+  [edit interfaces ethernet eth0]
+  vyos@vyos# show
+   address dhcp
+   hw-id 00:53:ad:44:3b:03
+
+Exiting from the configuration mode is done via the :cfgcmd:`exit`
+command from the top level, executing :cfgcmd:`exit` from within a
+sub-level takes you back to the top level.
+
+.. code-block:: none
+
+  [edit interfaces ethernet eth0]
+  vyos@vyos# exit
+  [edit]
+  vyos@vyos# exit
+  Warning: configuration changes have not been saved.
+
+
+Editing the configuration
+#########################
+
+The configuration can be edited by the use of :cfgcmd:`set` and
+:cfgcmd:`delete` commands from within configuration mode.
+
+.. cfgcmd:: set
+
+   Use this command to set the value of a parameter or to create a new
+   element.
+
+Configuration commands are flattened from the tree into 'one-liner'
+commands shown in :opcmd:`show configuration commands` from operation
+mode. Commands are relative to the level where they are executed and all
+redundant information from the current level is removed from the command
+entered.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# set interface ethernet eth0 address 192.0.2.100/24
+
+
+.. code-block:: none
+
+  [edit interfaces ethernet eth0]
+  vyos@vyos# set address 203.0.113.6/24
+
+
+These two commands above are essentially the same, just executed from
+different levels in the hierarchy.
+
+.. cfgcmd:: delete
+
+   To delete a configuration entry use the :cfgcmd:`delete` command,
+   this also deletes all sub-levels under the current level you've
+   specified in the :cfgcmd:`delete` command. Deleting an entry will
+   also result in the element reverting back to its default value if one
+   exists.
+
+   .. code-block:: none
+
+     [edit interfaces ethernet eth0]
+     vyos@vyos# delete address 192.0.2.100/24
+
+.. cfgcmd:: commit
+
+  Any change you do on the configuration, will not take effect until
+  committed using the :cfgcmd:`commit` command in configuration mode.
+
+  .. code-block:: none
+
+    vyos@vyos# commit
+    [edit]
+    vyos@vyos# exit
+    Warning: configuration changes have not been saved.
+    vyos@vyos:~$
+
+.. _save:
+
+.. cfgcmd:: save
+
+   Use this command to preserve configuration changes upon reboot. By
+   default it is stored at */config/config.boot*. In the case you want
+   to store the configuration file somewhere else, you can add a local
+   path, an SCP address, an FTP address or a TFTP address. 
+
+   .. code-block:: none
+
+     vyos@vyos# save
+     Saving configuration to '/config/config.boot'...
+     Done
+
+   .. code-block:: none
+
+     vyos@vyos# save [tab]
+     Possible completions:
+       <Enter>       Save to system config file
+       <file>        Save to file on local machine
+       scp://<user>:<passwd>@<host>/<file> Save to file on remote machine
+       ftp://<user>:<passwd>@<host>/<file> Save to file on remote machine
+       tftp://<host>/<file>      Save to file on remote machine
+     vyos@vyos# save tftp://192.168.0.100/vyos-test.config.boot
+     Saving configuration to 'tftp://192.168.0.100/vyos-test.config.boot'...
+     ######################################################################## 100.0%
+     Done
+
+.. cfgcmd:: exit [discard]
+
+   Configuration mode can not be exited while uncommitted changes exist.
+   To exit configuration mode without applying changes, the
+   :cfgcmd:`exit discard` command must be used.
+
+   All changes in the working config will thus be lost.
+
+   .. code-block:: none
+
+     vyos@vyos# exit
+     Cannot exit: configuration modified.
+     Use 'exit discard' to discard the changes and exit.
+     [edit]
+     vyos@vyos# exit discard
+
+
+.. cfgcmd:: commit-confirm <minutes>
+
+   Use this command to temporarily commit your changes and set the
+   number of minutes available for validation. ``confirm`` must
+   be entered within those minutes, otherwise the system will reboot
+   into the previous configuration. The default value is 10 minutes.
+
+
+   What if you are doing something dangerous? Suppose you want to setup
+   a firewall, and you are not sure there are no mistakes that will lock
+   you out of your system. You can use confirmed commit. If you issue
+   the ``commit-confirm`` command, your changes will be commited, and if
+   you don't issue issue the ``confirm`` command in 10 minutes, your
+   system will reboot into previous config revision.
+
+   .. code-block:: none
+   
+      vyos@router# set interfaces ethernet eth0 firewall local name FromWorld
+      vyos@router# commit-confirm 
+      commit confirm will be automatically reboot in 10 minutes unless confirmed
+      Proceed? [confirm]y
+      [edit]
+      vyos@router# confirm 
+      [edit]
+
+
+   .. note:: A reboot because you did not enter ``confirm`` will not
+      take you necessarily to the *saved configuration*, but to the
+      point before the unfortunate commit.
+
+
+.. cfgcmd:: copy
+
+   Copy a configuration element.
+
+   You can copy and remove configuration subtrees. Suppose you set up a
+   firewall ruleset ``FromWorld`` with one rule that allows traffic from
+   specific subnet. Now you want to setup a similar rule, but for
+   different subnet. Change your edit level to
+   ``firewall name FromWorld`` and use ``copy rule 10 to rule 20``, then
+   modify rule 20.
+
+
+   .. code-block:: none
+   
+      vyos@router# show firewall name FromWorld 
+       default-action drop
+       rule 10 {
+           action accept
+           source {
+               address 203.0.113.0/24
+           }
+       }
+      [edit]
+      vyos@router# edit firewall name FromWorld 
+      [edit firewall name FromWorld]
+      vyos@router# copy rule 10 to rule 20
+      [edit firewall name FromWorld]
+      vyos@router# set rule 20 source address 198.51.100.0/24
+      [edit firewall name FromWorld]
+      vyos@router# commit
+      [edit firewall name FromWorld]
+
+
+.. cfgcmd:: rename
+
+   Rename a configuration element.
+
+   You can also rename config subtrees:
+
+   .. code-block:: none
+   
+      vyos@router# rename rule 10 to rule 5
+      [edit firewall name FromWorld]
+      vyos@router# commit
+      [edit firewall name FromWorld]
+
+   Note that ``show`` command respects your edit level and from this
+   level you can view the modified firewall ruleset with just ``show``
+   with no parameters.
+
+   .. code-block:: none
+   
+      vyos@router# show 
+       default-action drop
+       rule 5 {
+           action accept
+           source {
+               address 203.0.113.0/24
+           }
+       }
+       rule 20 {
+           action accept
+           source {
+               address 198.51.100.0/24
+           }
+       }
+
+
+.. cfgcmd:: comment <config node> "comment text"
+
+   Add comment as an annotation to a configuration node.
+
+   The ``comment`` command allows you to insert a comment above the
+   ``<config node>`` configuration section. When shown, comments are
+   enclosed with ``/*`` and ``*/`` as open/close delimiters. Comments
+   need to be commited, just like other config changes.
+
+   To remove an existing comment from your current configuration,
+   specify an empty string enclosed in double quote marks (``""``) as
+   the comment text.
+
+   Example:
+
+   .. code-block:: none
+
+     vyos@vyos# comment firewall all-ping "Yes I know this VyOS is cool"
+     vyos@vyos# commit
+     vyos@vyos# show
+      firewall {
+          /* Yes I know this VyOS is cool */
+          all-ping enable
+          broadcast-ping disable
+          ...
+      }
+
+   .. note:: An important thing to note is that since the comment is
+      added on top of the section, it will not appear if the ``show
+      <section>`` command is used. With the above example, the
+      ``show firewall`` command would return starting after the 
+      ``firewall {`` line, hiding the comment.
+
+
+.. _run_opmode_from_config_mode:
+
+Access opmode from config mode
+##############################
+
+When inside configuration mode you are not directly able to execute
+operational commands.
+
+.. cfgcmd:: run
+
+  Access to these commands are possible through the use of the
+  ``run [command]`` command. From this command you will have access to
+  everything accessible from operational mode.
+
+  Command completion and syntax help with ``?`` and ``[tab]`` will also
+  work.
+
+  .. code-block:: none
+
+    [edit]
+    vyos@vyos# run show interfaces
+    Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+    Interface        IP Address                        S/L  Description
+    ---------        ----------                        ---  -----------
+    eth0             0.0.0.0/0                         u/u
+
+Managing configurations
+#######################
+
+VyOS comes with an integrated versioning system for the system
+configuration. It automatically maintains a backup of every previous
+configuration which has been committed to the system. The configurations
+are versioned locally for rollback but they can also be stored on a
+remote host for archiving/backup reasons.
+
+Local Archive
+=============
+
+Revisions are stored on disk. You can view, compare and rollback them to
+any previous revisions if something goes wrong.
+
+.. opcmd:: show system commit
+
+   View all existing revisions on the local system.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show system commit
+     0   2015-03-30 08:53:03 by vyos via cli
+     1   2015-03-30 08:52:20 by vyos via cli
+     2   2015-03-26 21:26:01 by root via boot-config-loader
+     3   2015-03-26 20:43:18 by root via boot-config-loader
+     4   2015-03-25 11:06:14 by root via boot-config-loader
+     5   2015-03-25 01:04:28 by root via boot-config-loader
+     6   2015-03-25 00:16:47 by vyos via cli
+     7   2015-03-24 23:43:45 by root via boot-config-loader
+
+
+.. cfgcmd:: set system config-management commit-revisions <N>
+
+   You can specify the number of revisions stored on disk. N can be in
+   the range of 0 - 65535. When the number of revisions exceeds the
+   configured value, the oldest revision is removed. The default setting
+   for this value is to store 100 revisions locally.
+
+
+Compare configurations
+======================
+
+VyOS lets you compare different configurations.
+
+.. cfgcmd:: compare <saved | N> <M>
+
+   Use this command to spot what the differences are between different
+   configurations.
+
+   .. code-block:: none
+
+     vyos@vyos# compare [tab]
+     Possible completions:
+       <Enter>	Compare working & active configurations
+       saved		Compare working & saved configurations
+       <N>		Compare working with revision N
+       <N> <M>	Compare revision N with M
+       Revisions:
+         0	   2013-12-17 20:01:37 root by boot-config-loader
+         1	   2013-12-13 15:59:31 root by boot-config-loader
+         2	   2013-12-12 21:56:22 vyos by cli
+         3	   2013-12-12 21:55:11 vyos by cli
+         4	   2013-12-12 21:27:54 vyos by cli
+         5	   2013-12-12 21:23:29 vyos by cli
+         6	   2013-12-12 21:13:59 root by boot-config-loader
+         7	   2013-12-12 16:25:19 vyos by cli
+         8	   2013-12-12 15:44:36 vyos by cli
+         9	   2013-12-12 15:42:07 root by boot-config-loader
+         10   2013-12-12 15:42:06 root by init
+
+   The command :cfgcmd:`compare` allows you to compare different type of
+   configurations. It also lets you compare different revisions through
+   the :cfgcmd:`compare N M` command, where N and M are revision
+   numbers. The output will describe how the configuration N is when
+   compared to M indicating with a plus sign (``+``) the additional
+   parts N has when compared to M, and indicating with a minus sign
+   (``-``) the lacking parts N misses when compared to M.
+
+   .. code-block:: none
+
+     vyos@vyos# compare 0 6
+     [edit interfaces]
+     +dummy dum1 {
+     +    address 10.189.0.1/31
+     +}
+     [edit interfaces ethernet eth0]
+     +vif 99 {
+     +    address 10.199.0.1/31
+     +}
+     -vif 900 {
+     -    address 192.0.2.4/24
+     -}
+
+
+.. opcmd:: show system commit diff <number>
+
+   Show commit revision difference.
+
+
+The command above also lets you see the difference between two commits.
+By default the difference with the running config is shown.
+
+.. code-block:: none
+
+   vyos@router# run show system commit diff 4
+   [edit system]
+   +ipv6 {
+   +    disable-forwarding
+   +}
+
+This means four commits ago we did ``set system ipv6 disable-forwarding``.
+
+
+Rollback Changes
+================
+
+You can rollback configuration changes using the rollback command. This
+will apply the selected revision and trigger a system reboot.
+
+.. cfgcmd:: rollback <N>
+
+   Rollback to revision N (currently requires reboot)
+
+   .. code-block:: none
+
+     vyos@vyos# compare 1
+     [edit system]
+     >host-name vyos-1
+     [edit]
+
+     vyos@vyos# rollback 1
+     Proceed with reboot? [confirm][y]
+     Broadcast message from root@vyos-1 (pts/0) (Tue Dec 17 21:07:45 2013):
+     The system is going down for reboot NOW!
+
+Remote Archive
+==============
+
+VyOS can upload the configuration to a remote location after each call
+to :cfgcmd:`commit`. You will have to set the commit-archive location.
+TFTP, FTP, SCP and SFTP servers are supported. Every time a
+:cfgcmd:`commit` is successfull the ``config.boot`` file will be copied
+to the defined destination(s). The filename used on the remote host will
+be ``config.boot-hostname.YYYYMMDD_HHMMSS``. 
+
+.. cfgcmd:: set system config-management commit-archive location <URI>
+
+   Specify remote location of commit archive as any of the below
+   :abbr:`URI (Uniform Resource Identifier)`
+
+   * ``scp://<user>:<passwd>@<host>/<dir>``
+   * ``sftp://<user>:<passwd>@<host>/<dir>``
+   * ``ftp://<user>:<passwd>@<host>/<dir>``
+   * ``tftp://<host>/<dir>``
+
+.. note:: The number of revisions don't affect the commit-archive.
+
+.. note:: You may find VyOS not allowing the secure connection because
+   it cannot verify the legitimacy of the remote server. You can use
+   the workaround below to quickly add the remote host's SSH
+   fingerprint to your ``~/.ssh/known_hosts`` file:
+
+   .. code-block:: none
+
+     vyos@vyos# ssh-keyscan <host> >> ~/.ssh/known_hosts
+
+Saving and loading manually
+===========================
+
+You can use the ``save`` and ``load`` commands if you want to manually
+manage specific configuration files.
+
+When using the save_ command, you can add a specific location where
+to store your configuration file. And, when needed it, you will be able
+to load it with the ``load`` command:
+
+.. cfgcmd:: load <URI>
+
+   Use this command to load a configuration which will replace the
+   running configuration. Define the location of the configuration file
+   to be loaded. You can use a path to a local file, an SCP address, an
+   SFTP address, an FTP address, an HTTP address, an HTTPS address or a
+   TFTP address.
+
+  .. code-block:: none
+
+     vyos@vyos# load 
+     Possible completions:
+       <Enter>				        Load from system config file
+       <file>			        	Load from file on local machine
+       scp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
+       sftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
+       ftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
+       http://<host>/<file>			Load from file on remote machine
+       https://<host>/<file>			Load from file on remote machine
+       tftp://<host>/<file>			Load from file on remote machine
+     
+
+
+Restore Default
+===============
+
+In the case you want to completely delete your configuration and restore
+the default one, you can enter the following command in configuration
+mode:
+
+.. code-block:: none
+
+  load /opt/vyatta/etc/config.boot.default
+
+You will be asked if you want to continue. If you accept, you will have
+to use :cfgcmd:`commit` if you want to make the changes active.
+
+Then you may want to :cfgcmd:`save` in order to delete the saved
+configuration too.
+
+.. note:: If you are remotely connected, you will lose your connection.
+   You may want to copy first the config, edit it to ensure
+   connectivity, and load the edited config.
diff --git a/docs/commandscripting.rst b/docs/commandscripting.rst
deleted file mode 100644
index 98e97d3c..00000000
--- a/docs/commandscripting.rst
+++ /dev/null
@@ -1,126 +0,0 @@
-.. _commandscripting:
-
-
-Command scripting
-=================
-
-VyOS supports executing configuration and operational commands non-interactively from shell scripts.
-
-To include VyOS-specific functions and aliases you need to ``source /opt/vyatta/etc/functions/script-template`` files at the top of your script.
-
-.. code-block:: none
-
-  #!/bin/vbash
-  source /opt/vyatta/etc/functions/script-template
-
-  exit
-
-Run configuration commands
---------------------------
-
-Configuration commands are executed just like from a normal config session.
-
-For example, if you want to disable a BGP peer on VRRP transition to backup:
-
-.. code-block:: none
-
-  #!/bin/vbash
-  source /opt/vyatta/etc/functions/script-template
-
-  configure
-
-  set protocols bgp 65536 neighbor 192.168.2.1 shutdown
-
-  commit
-
-  exit
-
-
-Run operational commands
-------------------------
-
-Unlike a normal configuration sessions, all operational commands must be prepended with ``run``, even if you haven't created a session with configure.
-
-.. code-block:: none
-
-  #!/bin/vbash
-  source /opt/vyatta/etc/functions/script-template
-
-  run show interfaces
-
-  exit
-
-Other script language
----------------------
-
-If you want to script the configs in a language other than bash you can have your script output commands and then source them in a bash script.
-
-Here is a simple example:
-
-.. code-block:: python
-
-  #!/usr/bin/env python
-  print "delete firewall group address-group somehosts"
-  print "set firewall group address-group somehosts address '1.1.1.1'"
-  print "set firewall group address-group somehosts address '1.1.1.2'"
-
-
-.. code-block:: none
-
-  #!/bin/vbash
-  source /opt/vyatta/etc/functions/script-template
-  
-  configure 
-  source <(/config/scripts/setfirewallgroup.py)
-  commit
-
-
-Executing Configuration Scripts
--------------------------------
-
-There is a pitfall when working with configuration scripts. It is tempting to call configuration scripts with "sudo" (i.e., temporary root permissions), because that's the common way on most Linux platforms to call system commands.
-
-On VyOS this will cause the following problem: After modifying the configuration via script like this once, it is not possible to manually modify the config anymore:
-
-.. code-block:: none
-
-  sudo ./myscript.sh # Modifies config
-  configure
-  set ... # Any configuration parameter
-
-| This will result in the following error message: ``Set failed``
-| If this happens, a reboot is required to be able to edit the config manually again.
-
-To avoid these problems, the proper way is to call a script with the ``vyattacfg`` group, e.g., by using the ``sg`` (switch group) command:
-
-.. code-block:: none
-
-  sg vyattacfg -c ./myscript.sh
-
-
-To make sure that a script is not accidentally called without the ``vyattacfg`` group, the script can be safeguarded like this:
-
-.. code-block:: none
-
-  if [ "$(id -g -n)" != 'vyattacfg' ] ; then
-      exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@"
-  fi
-
-Postconfig on boot
-------------------
-
-The ``/config/scripts/vyos-postconfig-bootup.script`` script is called on boot after the VyOS configuration is fully applied.
-
-Any modifications done to work around unfixed bugs and implement enhancements which are not complete in the VyOS system can be placed here.
-
-The default file looks like this:
-
-.. code-block:: none
-
-  #!/bin/sh
-  # This script is executed at boot time after VyOS configuration is fully applied.
-  # Any modifications required to work around unfixed bugs
-  # or use services not available through the VyOS CLI system can be placed here.
-
-.. hint::
-  For configuration/upgrade management issues, modification of this script should be the last option. Always try to find solutions based on CLI commands first.
diff --git a/docs/commandtree/configmode.rst b/docs/commandtree/configmode.rst
new file mode 100644
index 00000000..d4148c22
--- /dev/null
+++ b/docs/commandtree/configmode.rst
@@ -0,0 +1,524 @@
+.. _commandtree_configmode:
+
+Configuration mode
+------------------
+
+.. code-block:: none
+
+  confirm           Confirm prior commit-confirm
+  comment           Add comment to this configuration element
+  commit            Commit the current set of changes
+  commit-confirm    Commit the current set of changes with 'confirm' required
+  compare           Compare configuration revisions
+  copy              Copy a configuration element
+  delete            Delete a configuration element
+  discard           Discard uncommitted changes
+  edit              Edit a sub-element
+  exit              Exit from this configuration level
+  load              Load configuration from a file and replace running configuration
+  loadkey           Load user SSH key from a file
+  merge             Load configuration from a file and merge running configuration
+  rename            Rename a configuration element
+  rollback          Rollback to a prior config revision (requires reboot)
+  run               Run an operational-mode command
+  save              Save configuration to a file
+  set               Set the value of a parameter or create a new element
+  show              Show the configuration (default values may be suppressed)
+
+
+Confirm
+^^^^^^^
+
+The ``confirm`` command confirms the prior ``commit-confirm``.
+
+Comment
+^^^^^^^
+
+The ``comment`` commands allow you to insert a comment above the current configuration section.
+The command cannot be used at the top of the configuration hierarchy, only on subsections. Comments needs to be commited, just like other config changes.
+
+To add a comment to a section, while being already at the proper section level:
+
+.. code-block:: none
+
+  [edit <section>]
+  vyos@vyos# comment "Type Comment Here"
+
+To add a comment directly to a section, from the top or a higher section:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# comment <section> "Type Comment Here"
+
+To remove a comment, add a blank comment to overwrite:
+
+.. code-block:: none
+
+  [edit <section>]
+  vyos@vyos# comment ""
+
+Examples
+********
+
+To add a comment to the "interfaces" section:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# edit interfaces
+  [edit interfaces]
+  vyos@vyos# comment "Here is a comment"
+  [edit interfaces]
+  vyos@vyos# commit
+
+The comment would then appear like this:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# show
+   /* Here is a comment */
+    interfaces {
+        ethernet eth0 {
+    [...]
+
+
+An important thing to note is that since the comment is added on top of the section, it will not appear if the ``show <section>`` command is used. With the above example, the ``show interfaces`` command would return starting after the "interfaces {" line, hiding the comment:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# show interfaces
+   ethernet eth0 {
+  [...]
+
+
+To add a comment to the interfaces section from the top:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# comment interfaces "test"
+
+
+The comment can be added to any node that already exists, even if it's multiple levels lower:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# comment interfaces ethernet eth0 vif 222 address "Far down comment"
+
+
+Commit
+^^^^^^
+
+The ``commit`` command commits the proposed changes to the configuration file.
+Every changes done in the configuration session is only applied when the configuration is committed. To view the changes that will be applied, use the show command.
+To discard the changes without committing, use the ``discard`` command. The ``commit`` command doesn't save the configuration, you need to manually use the ``save`` command.
+
+The confirm keyword can be added, see ``commit-confirm``. A comment can be entered, it will appear in the commit log.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# commit
+  Possible completions:
+    <Enter>       Commit working configuration
+    comment       Comment for commit log
+
+Commit-confirm
+^^^^^^^^^^^^^^
+
+The ``commit-confirm`` command commits the proposed changes to the configuration file and starts a timer.
+If the ``confirm`` command is not entered before the timer expiration, the configuration will be rolled back and VyOS will reboot.
+The default timer value is 10 minutes, but a custom value can be entered.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# commit-confirm
+  Possible completions:
+    <Enter>       Commit, rollback/reboot in 10 minutes if no confirm
+    <N>           Commit, rollback/reboot in N minutes if no confirm
+    comment       Comment for commit log
+
+
+Compare
+^^^^^^^
+
+VyOS maintains backups of previous configurations. To compare configuration revisions in configuration mode, use the compare command:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# compare
+  Possible completions:
+    <Enter>	Compare working & active configurations
+    saved		Compare working & saved configurations
+    <N>		Compare working with revision N
+    <N> <M>	Compare revision N with M
+  
+    Revisions:
+      0	2019-03-20 20:57:22 root by boot-config-loader
+      1	2019-03-15 20:00:04 root by boot-config-loader
+      2	2019-03-05 01:58:39 vyos by cli
+      3	2019-03-05 01:54:59 vyos by cli
+      4	2019-03-05 01:53:08 vyos by cli
+      5	2019-03-05 01:52:21 vyos by cli
+      6	2019-02-24 21:01:24 root by boot-config-loader
+      7	2019-02-21 22:00:12 vyos by cli
+      8	2019-02-21 21:56:49 vyos by cli
+
+
+Copy
+^^^^
+
+The ``copy`` command allows you to copy a configuration object.
+
+Copy the configuration entrys from a firewall name WAN rule 1 to rule 2.
+
+.. code-block:: none
+
+  [edit firewall name WAN]
+  vyos@vyos# show
+   rule 1 {
+       action accept
+       source {
+           address 10.1.0.0/24
+       }
+   }
+  [edit firewall name WAN]
+  vyos@vyos# copy rule 1 to rule 2
+  [edit firewall name WAN]
+  vyos@vyos# show
+   rule 1 {
+       action accept
+       source {
+           address 10.1.0.0/24
+       }
+   }
+  +rule 2 {
+  +    action accept
+  +    source {
+  +        address 10.1.0.0/24
+  +    }
+  +}
+
+Delete
+^^^^^^
+
+The ``delte`` command is to delete a configuration entry.
+
+This Example delete the hole ``service tftp-server`` section.
+
+.. code-block:: none
+
+  delete service tftp-server
+
+Discard
+^^^^^^^
+
+The ``discard`` command removes all pending configuration changes.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# discard
+  
+    Changes have been discarded
+
+Edit
+^^^^
+
+The ``edit`` command allows you to navigate down into the configuration tree.
+To get back to an upper level, use the ``up`` command or use the ``top`` command to get back to the upper most level.
+The ``[edit]`` text displays where the user is located in the configuration tree.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# edit interfaces
+  [edit interfaces]
+  vyos@vyos# edit ethernet eth0
+  [edit interfaces ethernet eth0]
+
+Exit
+^^^^
+
+The ``exit`` command exits the current configuration mode. If the current configuration level isn't the top-most, then the configuration level is put back to the top-most level.
+If the configuration level is at the top-most level, then it exits the configuration mode and returns to operational mode.
+The ``exit`` command cannot be used if uncommitted changes exists in the configuration file. To exit with uncommitted changes, you either need to use the ``exit discard`` command or you need to commit the changes before exiting.
+The ``exit`` command doesn't save the configuration, only the ``save`` command does. A warning will be given when exiting with unsaved changes. Using the ``exit`` command in operational mode will logout the session.
+
+
+Exiting from a configuration level:
+
+
+.. code-block:: none
+
+  [edit interfaces ethernet eth0]
+  vyos@vyos# exit
+  [edit]
+  vyos@vyos#
+
+Exiting from configuration mode:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# exit
+  exit
+  vyos@vyos:~$
+
+Exiting from operational mode:
+
+.. code-block:: none
+
+  vyos@vyos:~$ exit
+  logout
+
+Error message when trying to exit with uncommitted changes:
+
+.. code-block:: none
+
+  vyos@vyos# exit
+  Cannot exit: configuration modified.
+  Use 'exit discard' to discard the changes and exit.
+  [edit]
+  vyos@vyos#
+
+
+Warning message when exiting with unsaved changes:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# exit
+  Warning: configuration changes have not been saved.
+  exit
+  vyos@vyos:~$
+
+Load
+^^^^
+
+The ``load`` command load a configuration from a local or remote file. You have to be use ``commit`` to make the change active
+
+.. code-block:: none
+
+  <Enter>				Load from system config file
+  <file>				Load from file on local machine
+  scp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
+  sftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
+  ftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
+  http://<host>/<file>			Load from file on remote machine
+  https://<host>/<file>			Load from file on remote machine
+  tftp://<host>/<file>			Load from file on remote machine
+
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# load
+  Loading configuration from '/config/config.boot'...
+
+  Load complete.  Use 'commit' to make changes active.
+
+
+Loadkey
+^^^^^^^^
+
+Copies the content of a public key to the ~/.ssh/authorized_keys file.
+
+.. code-block:: none
+
+  loadkey <username> [tab]
+
+  <file>                      Load from file on local machine
+  scp://<user>@<host>/<file>  Load from file on remote machine
+  sftp://<user>@<host>/<file> Load from file on remote machine
+  ftp://<user>@<host>/<file>  Load from file on remote machine
+  http://<host>/<file>        Load from file on remote machine
+  tftp://<host>/<file>        Load from file on remote machine
+
+Merge
+^^^^^
+
+The ``merge`` command merge the config from a local or remote file with the running config.
+
+In the example below exist a ``default-firewall.config`` file with some common firewall rules you saved earlier.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# show firewall
+  Configuration under specified path is empty
+  [edit]
+  vyos@vyos# merge default-firewall.config
+  Loading configuration from '/config/default-firewall.config'...
+
+  Merge complete.  Use 'commit' to make changes active.
+  [edit]
+  vyos@vyos#
+
+  vyos@vyos# show firewall
+  +all-ping enable
+  +broadcast-ping disable
+  +config-trap disable
+  +ipv6-receive-redirects disable
+  +ipv6-src-route disable
+  +ip-src-route disable
+  +log-martians enable
+  +name WAN {
+  +    default-action drop
+  +    rule 1 {
+  +        action accept
+  +        source {
+  +            address 10.1.0.0/24
+  +        }
+  +    }
+  +    rule 2 {
+  +        action accept
+  +        source {
+  +            address 10.1.0.0/24
+  +        }
+  ......
+
+
+Rename
+^^^^^^
+
+The ``rename`` command allows you to rename or move a configuration object.
+
+See here how to move the configuration entrys from vlanid 3 to 2
+
+.. code-block:: none
+
+  [edit interfaces ethernet eth1]
+  vyos@vyos# show
+   duplex auto
+   hw-id 08:00:27:81:c6:59
+   smp-affinity auto
+   speed auto
+   vif 3 {
+       address 10.4.4.4/32
+   }
+  [edit interfaces ethernet eth1]
+  vyos@vyos# rename vif 3 to vif 2
+  [edit interfaces ethernet eth1]
+  vyos@vyos# show
+   duplex auto
+   hw-id 08:00:27:81:c6:59
+   smp-affinity auto
+   speed auto
+  +vif 2 {
+  +    address 10.4.4.4/32
+  +}
+  -vif 3 {
+  -    address 10.4.4.4/32
+  -}
+  [edit interfaces ethernet eth1]
+  vyos@vyos#
+
+
+Rollback
+^^^^^^^^
+
+You can ``rollback`` configuration using the rollback command, however this command will currently trigger a system reboot.
+Use the compare command to verify the configuration you want to rollback to.
+
+.. code-block:: none
+
+  vyos@vyos# compare 1
+  [edit system]
+  >host-name vyos-1
+  [edit]
+  vyos@vyos# rollback 1
+  Proceed with reboot? [confirm][y]
+  
+  Broadcast message from root@vyos-1 (pts/0) (Tue Dec 17 21:07:45 2018):
+  
+  The system is going down for reboot NOW!
+  [edit]
+  vyos@vyos#
+
+Run
+^^^
+
+The ``run`` command allows you to execute any operational mode commands without exiting the configuration session.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# run show interfaces
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             10.1.1.1/24                        u/u
+
+
+Save
+^^^^
+
+The ``save`` command saves the current configuration to non-volatile storage. VyOS also supports saving and loading configuration remotely using SCP, FTP, or TFTP.
+
+.. code-block:: none
+
+  <Enter>				Save to system config file
+  <file>				Save to file on local machine
+  scp://<user>:<passwd>@<host>/<file>	Save to file on remote machine
+  sftp://<user>:<passwd>@<host>/<file>	Save to file on remote machine
+  ftp://<user>:<passwd>@<host>/<file>	Save to file on remote machine
+  tftp://<host>/<file>			Save to file on remote machine
+
+Set
+^^^
+
+The ``set`` command create all configuration entrys
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# set protocols static route 0.0.0.0/0 next-hop 192.168.1.1
+
+Show
+^^^^
+
+The ``show`` command in the configuration mode displays the configuration and show uncommitted changes.
+
+Show the hole config, the address and description of eth1 is moving to vlan 2 if you commit the changes.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# show
+   interfaces {
+       dummy dum0 {
+           address 10.3.3.3/24
+       }
+       ethernet eth0 {
+           address dhcp
+           duplex auto
+           hw-id 08:00:27:2b:c0:0b
+           smp-affinity auto
+           speed auto
+       }
+       ethernet eth1 {
+  -        address 10.1.1.1/32
+  -        description "MGMT Interface"
+           duplex auto
+           hw-id 08:00:27:81:c6:59
+           smp-affinity auto
+           speed auto
+  +        vif 2 {
+  +            address 10.1.1.1/32
+  +            description "MGMT Interface"
+  +        }
+       }
+       loopback lo {
+       }
+   }
+   service {
+       ssh {
+           port 22
+  ......
\ No newline at end of file
diff --git a/docs/commandtree/index.rst b/docs/commandtree/index.rst
new file mode 100644
index 00000000..c3bca008
--- /dev/null
+++ b/docs/commandtree/index.rst
@@ -0,0 +1,17 @@
+.. _commandtree:
+
+Command tree
+============
+
+See the the full Command tree in Operational mode and Configuration mode
+
+
+
+.. toctree::
+   :maxdepth: 2
+   :hidden:
+
+
+   operationmode
+   configmode
+
diff --git a/docs/commandtree/operationmode.rst b/docs/commandtree/operationmode.rst
new file mode 100644
index 00000000..8092f248
--- /dev/null
+++ b/docs/commandtree/operationmode.rst
@@ -0,0 +1,444 @@
+.. _commandtree_operationmode:
+
+Operational mode
+----------------
+
+Operational mode allows for commands to perform operational system tasks and view system and service status.
+After this is the first view after the login.
+Please see :ref:`cli` for navigation in the CLI
+
+
+.. code-block:: none
+
+
+  vyos@vyos:~$ [tab]
+  Possible completions:
+    add               Add an object to a service
+    clear             Clear system information
+    clone             Clone an object
+    configure         Enter configure mode
+    connect           Establish a connection
+    copy              Copy an object
+    delete            Delete an object
+    disconnect        Take down a connection
+    force             Force an operation
+    format            Format a device
+    generate          Generate an object
+    install           Install a new system
+    monitor           Monitor system information
+    ping              Send IPv4 or IPv6 ICMP (Internet Control Message Protocol) echo requests
+    poweroff          Poweroff the system
+    reboot            Reboot the system
+    release           Release specified variable
+    rename            Rename an object
+    renew             Renew specified variable
+    reset             Reset a service
+    restart           Restart a service
+    set               Set operational options
+    show              Show system information
+    telnet            Telnet to a node
+    traceroute        Track network path to node
+    update            Update data for a service
+
+
+Add
+^^^
+
+.. code-block:: none
+
+ raid         Add a RAID set element
+ system       Add an item to a system facility
+
+Clear
+^^^^^
+
+.. code-block:: none
+
+  console            Clear screen
+  firewall           Clear firewall statistics
+  flow-accounting    Clear flow accounting
+  interfaces         Clear interface information
+  ip                 Clear Internet Protocol (IP) statistics or status
+  ipv6               Clear Internet Protocol (IPv6) statistics or status
+  nat                Clear network address translation (NAT) tables
+  policy             Clear policy statistics
+
+
+Clone
+^^^^^
+The ``clone`` command allows you to clone a configuration from a system image to another one, or from the running config to another system image.
+To clone the running config to a system image:
+
+.. code-block:: none
+
+  clone system config <system-image> from running
+
+To clone from system image A to system image B:
+
+.. code-block:: none
+
+  clone system config <system-image-B> from <system-image-A>
+
+
+Configure
+^^^^^^^^^
+
+The ``configure`` command allows you to enter configuration mode.
+
+.. code-block:: none
+
+  vyos@vyos:~$ configure
+  [edit]
+  vyos@vyos#
+
+
+Connect
+^^^^^^^
+
+The ``connect`` command allows you to bring up a connection oriented interface, like a pppoe interface.
+
+.. code-block:: none
+
+  connect interface <interface>
+
+Copy
+^^^^
+
+The ``copy`` command allows you to copy a file to your running config or over images.
+
+It can look like this example:
+
+.. code-block:: none
+
+  vyos@vyos:~$  copy file [tab]
+  Possible completions:
+    http://<user>:<passwd>@<host>/<file>
+                  Copy files from specified source
+    scp://<user>:<passwd>@<host>/<file>
+    ftp://<user>:<passwd>@<host>/<file>
+    tftp://<host>/<file>
+    1.2.0://config/
+    1.2.0-rolling+201902251818://config/
+    1.2.0-rolling+201902201040://config/
+    1.2.0-rolling+201902080337://config/
+    1.2.0-H4://config/
+    running://config/
+
+
+To copy from file A to file B:
+
+.. code-block:: none
+
+  copy <file A> to <file B>
+
+
+Delete
+^^^^^^
+
+.. code-block:: none
+
+  conntrack     Delete Conntrack entries
+  file          Delete files in a particular image
+  log           Delete a log file
+  raid          Remove a RAID set element
+  system        Delete system objects
+
+
+Disconnect
+^^^^^^^^^^
+
+The ``disconnect`` command allows you to take down a connection oriented interface, like a pppoe interface.
+
+.. code-block:: none
+
+  disconnect interface <interface>
+
+Force
+^^^^^
+
+.. code-block:: none
+
+  arp           Send gratuitous ARP request or reply
+  cluster       Force a cluster state transition
+
+
+Format
+^^^^^^
+
+The ``format`` command allows you to format a disk the same way as another one.
+
+.. code-block:: none
+
+  format disk <target> like <source>
+
+Generate
+^^^^^^^^
+
+.. code-block:: none
+
+  openvpn       OpenVPN key generation tool
+  ssh-server-key
+                Regenerate the host SSH keys and restart the SSH server
+  tech-support  Generate tech-support archive
+  vpn           VPN key generation utility
+  wireguard     wireguard key generation utility
+
+Install
+^^^^^^^
+
+The ``install`` command allows you to install the system image on the disk.
+
+.. code-block:: none
+
+  install image
+
+
+Monitor
+^^^^^^^
+
+``monitor`` can be used to continually view what is happening on the router.
+
+.. code-block:: none
+
+  bandwidth     Monitor interface bandwidth in real time
+  bandwidth-test
+                Initiate or wait for bandwidth test
+  cluster       Monitor clustering service
+  command       Monitor an operational mode command (refreshes every 2 seconds)
+  conntrack-sync
+                Monitor conntrack-sync
+  content-inspection
+                Monitor Content-Inspection
+  dhcp          Monitor Dynamic Host Control Protocol (DHCP)
+  dns           Monitor a Domain Name Service (DNS) daemon
+  firewall      Monitor Firewall
+  https         Monitor the Secure Hypertext Transfer Protocol (HTTPS) service
+  lldp          Monitor Link Layer Discovery Protocol (LLDP) daemon
+  log           Monitor last lines of messages file
+  nat           Monitor network address translation (NAT)
+  openvpn       Monitor OpenVPN
+  protocol      Monitor routing protocols
+  snmp          Monitor Simple Network Management Protocol (SNMP) daemon
+  stop-all      Stop all current background monitoring processes
+  traceroute    Monitor the path to a destination in realtime
+  traffic       Monitor traffic dumps
+  vpn           Monitor VPN
+  vrrp          Monitor Virtual Router Redundancy Protocol (VRRP)
+  webproxy      Monitor Webproxy service
+
+
+Ping
+^^^^
+
+The ``ping`` command allows you to send an ICMP-EchoRequest packet and display the ICMP-EchoReply received.
+
+.. code-block:: none
+
+  <hostname>    Send Internet Control Message Protocol (ICMP) echo request
+  <x.x.x.x>
+  <h:h:h:h:h:h:h:h>
+
+
+Poweroff
+^^^^^^^^
+
+The ``poweroff`` command allows you to properly shut down the VyOS instance. Without any modifier, the command is executed immediately.
+
+.. code-block:: none
+
+  <Enter>       Execute the current command
+  at            Poweroff at a specific time
+  cancel        Cancel a pending poweroff
+  in            Poweroff in X minutes
+  now           Poweroff the system without confirmation
+
+Reboot
+^^^^^^
+The ``reboot`` command allows you to properly restart the VyOS instance. Without any modifier, the command is executed immediately.
+
+.. code-block:: none
+
+  <Enter>       Execute the current command
+  at            Poweroff at a specific time
+  cancel        Cancel a pending poweroff
+  in            Poweroff in X minutes
+  now           Poweroff the system without confirmation
+
+Release
+^^^^^^^
+
+The ``release`` command allows you to release a DHCP or DHCPv6 lease.
+
+.. code-block:: none
+
+  vyos@vyos:~$ release dhcp interface <int>
+  vyos@vyos:~$ release dhcpv6 interface <int>
+
+
+Rename
+^^^^^^
+
+The ``rename`` command allows you to rename a system image.
+
+.. code-block:: none
+
+ rename system image <currentname> <newname>
+
+
+Renew
+^^^^^
+
+The ``renew`` command allows you to renew a DHCP or DHCPv6 lease.
+
+.. code-block:: none
+
+  vyos@vyos:~$ renew dhcp interface <int>
+  vyos@vyos:~$ renew dhcpv6 interface <int>
+
+Reset
+^^^^^
+
+.. code-block:: none
+
+  conntrack     Reset all currently tracked connections
+  conntrack-sync
+                Reset connection syncing parameters
+  dns           Reset a DNS service state
+  firewall      reset a firewall group
+  ip            Reset Internet Protocol (IP) parameters
+  ipv6          Reset Internet Protocol version 6 (IPv6) parameters
+  nhrp          Clear/Purge NHRP entries
+  openvpn       Reset OpenVPN
+  terminal      Reset terminal
+  vpn           Reset Virtual Private Network (VPN) information
+
+Restart
+^^^^^^^
+
+.. code-block:: none
+
+  cluster       Restart cluster node
+  conntrack-sync
+                Restart connection tracking synchronization service
+  dhcp          Restart DHCP processes
+  dhcpv6        Restart DHCPv6 processes
+  dns           Restart a DNS service
+  flow-accounting
+                Restart flow-accounting service
+  https         Restart https server
+  vpn           Restart IPsec VPN
+  vrrp          Restart the VRRP (Virtual Router Redundancy Protocol) process
+  wan-load-balance
+                Restart WAN load balancing
+  webproxy      Restart webproxy service
+
+Set
+^^^
+
+.. code-block:: none
+
+  <OPTION>      Bash builtin set command
+  console       Control console behaviors
+  date          Set system date and time
+  system        Set system operational parameters
+  terminal      Control terminal behaviors
+
+Show
+^^^^
+
+.. code-block:: none
+
+  arp           Show Address Resolution Protocol (ARP) information
+  bridge        Show bridging information
+  cluster       Show clustering information
+  configuration Show available saved configurations
+  conntrack     Show conntrack entries in the conntrack table
+  conntrack-sync
+                Show connection syncing information
+  date          Show system time and date
+  dhcp          Show DHCP (Dynamic Host Configuration Protocol) information
+  dhcpv6        Show DHCPv6 (IPv6 Dynamic Host Configuration Protocol) information
+  disk          Show status of disk device
+  dns           Show DNS information
+  file          Show files for a particular image
+  firewall      Show firewall information
+  flow-accounting
+                Show flow accounting statistics
+  hardware      Show system hardware details
+  history       show command history
+  host          Show host information
+  incoming      Show ethernet input-policy information
+  interfaces    Show network interface information
+  ip            Show IPv4 routing information
+  ipv6          Show IPv6 routing information
+  license       Show VyOS license information
+  lldp          Show lldp
+  log           Show contents of current master log file
+  login         Show current login credentials
+  monitoring    Show currently monitored services
+  nat           Show Network Address Translation (NAT) information
+  nhrp          Show NHRP info
+  ntp           Show peer status of NTP daemon
+  openvpn       Show OpenVPN information
+  policy        Show policy information
+  poweroff      Show scheduled poweroff
+  pppoe-server  show pppoe-server status
+  queueing      Show ethernet queueing information
+  raid          Show statis of RAID set
+  reboot        Show scheduled reboot
+  remote-config Show remote side config
+  route-map     Show route-map information
+  snmp          Show status of SNMP on localhost
+  system        Show system information
+  system-integrity
+                checks the integrity of the system
+  table         Show routing table
+  tech-support  Show consolidated tech-support report (private information removed)
+  users         Show user information
+  version       Show system version information
+  vpn           Show Virtual Private Network (VPN) information
+  vrrp          Show VRRP (Virtual Router Redundancy Protocol) information
+  wan-load-balance
+                Show Wide Area Network (WAN) load-balancing information
+  webproxy      Show webproxy information
+  wireguard     Show wireguard properties
+  zone-policy   Show summary of zone policy for a specific zone
+
+Telnet
+^^^^^^
+In the past the ``telnet`` command allowed you to connect remotely to another device using the telnet protocol.
+Telnet is unencrypted and should not use anymore. But its nice to test if an TCP Port to a host is open.
+
+
+.. code-block:: none
+
+  vyos@vyos:~$ telnet 192.168.1.3 443
+  Trying 192.168.1.3...
+  telnet: Unable to connect to remote host: Network is unreachable
+
+  vyos@vyos:~$ telnet 192.168.1.4 443
+  Trying 192.168.1.4...
+  Connected to 192.168.1.4.
+  Escape character is '^]'.
+
+Traceroute
+^^^^^^^^^^
+
+The ``traceroute`` command allows you to trace the path taken to a particular device.
+
+.. code-block:: none
+
+  <hostname>    Track network path to specified node
+  <x.x.x.x>
+  <h:h:h:h:h:h:h:h>
+  ipv4          Track network path to <hostname|IPv4 address>
+  ipv6          Track network path to <hostname|IPv6 address>
+
+
+Update
+^^^^^^
+
+.. code-block:: none
+
+  dns           Update DNS information
+  webproxy      Update webproxy
\ No newline at end of file
diff --git a/docs/conf.py b/docs/conf.py
index 97f31360..37af7af5 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -20,7 +20,7 @@ sys.path.append(os.path.abspath("./_ext"))
 # -- Project information -----------------------------------------------------
 
 project = u'VyOS'
-copyright = u'2020, VyOS maintainers and contributors'
+copyright = u'2021, VyOS maintainers and contributors'
 author = u'VyOS maintainers and contributors'
 
 # The short X.Y version
diff --git a/docs/configexamples/azure-vpn-bgp.rst b/docs/configexamples/azure-vpn-bgp.rst
new file mode 100644
index 00000000..57f82396
--- /dev/null
+++ b/docs/configexamples/azure-vpn-bgp.rst
@@ -0,0 +1,128 @@
+.. _examples-azure-vpn-bgp:
+
+Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
+------------------------------------------------------------
+
+This guide shows an example of a route-based IKEv2 site-to-site VPN to
+Azure using VTI and BGP for dynamic routing updates.
+
+Prerequisites
+^^^^^^^^^^^^^
+
+- A pair of Azure VNet Gateways deployed in active-passive
+  configuration with BGP enabled.
+
+- A local network gateway deployed in Azure representing
+  the Vyos device, matching the below Vyos settings except for
+  address space, which only requires the Vyos private IP, in
+  this example 10.10.0.5/32
+
+- A connection resource deployed in Azure linking the
+  Azure VNet gateway and the local network gateway representing
+  the Vyos device.
+
+Example
+^^^^^^^
+
++---------------------------------------+---------------------+
+| WAN Interface                         | eth0                |
++---------------------------------------+---------------------+
+| On-premises address space             | 10.10.0.0/16        |
++---------------------------------------+---------------------+
+| Azure address space                   |  10.0.0.0/16        |
++---------------------------------------+---------------------+
+| Vyos public IP                        | 198.51.100.3        |
++---------------------------------------+---------------------+
+| Vyos private IP                       | 10.10.0.5           |
++---------------------------------------+---------------------+
+| Azure VNet Gateway public IP          |  203.0.113.2        |
++---------------------------------------+---------------------+
+| Azure VNet Gateway BGP IP             |  10.0.0.4           |
++---------------------------------------+---------------------+
+| Pre-shared key                        | ch00s3-4-s3cur3-psk |
++---------------------------------------+---------------------+
+| Vyos ASN                              | 64499               |
++---------------------------------------+---------------------+
+| Azure ASN                             | 65540               |
++---------------------------------------+---------------------+
+
+Vyos configuration
+^^^^^^^^^^^^^^^^^^
+
+- Configure the IKE and ESP settings to match a subset
+  of those supported by Azure:
+
+.. code-block:: none
+
+  set vpn ipsec esp-group AZURE compression 'disable'
+  set vpn ipsec esp-group AZURE lifetime '3600'
+  set vpn ipsec esp-group AZURE mode 'tunnel'
+  set vpn ipsec esp-group AZURE pfs 'dh-group2'
+  set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
+
+  set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
+  set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
+  set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
+  set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
+  set vpn ipsec ike-group AZURE key-exchange 'ikev2'
+  set vpn ipsec ike-group AZURE lifetime '28800'
+  set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
+  set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
+
+- Enable IPsec on eth0
+
+.. code-block:: none
+
+  set vpn ipsec ipsec-interfaces interface 'eth0'
+
+- Configure a VTI with a dummy IP address
+
+.. code-block:: none
+
+  set interfaces vti vti1 address '10.10.1.5/32'
+  set interfaces vti vti1 description 'Azure Tunnel'
+
+- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
+
+.. code-block:: none
+
+  set firewall options interface vti1 adjust-mss 1350
+
+- Configure the VPN tunnel
+
+.. code-block:: none
+
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
+  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
+  set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
+  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
+  set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
+  set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
+  set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
+
+- **Important**: Add an interface route to reach Azure's BGP listener
+
+.. code-block:: none
+
+  set protocols static interface-route 10.0.0.4/32 next-hop-interface vti1
+
+- Configure your BGP settings
+
+.. code-block:: none
+
+  set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
+  set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
+  set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
+  set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
+
+- **Important**: Disable connected check \
+
+.. code-block:: none
+
+  set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check
diff --git a/docs/configexamples/azure-vpn-dual-bgp.rst b/docs/configexamples/azure-vpn-dual-bgp.rst
new file mode 100644
index 00000000..cbe9a4d9
--- /dev/null
+++ b/docs/configexamples/azure-vpn-dual-bgp.rst
@@ -0,0 +1,155 @@
+.. _examples-azure-vpn-dual-bgp:
+
+Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
+----------------------------------------------------------------------
+
+This guide shows an example of a redundant (active-active) route-based IKEv2
+site-to-site VPN to Azure using VTI
+and BGP for dynamic routing updates.
+
+Prerequisites
+^^^^^^^^^^^^^
+
+- A pair of Azure VNet Gateways deployed in active-passive
+  configuration with BGP enabled.
+
+- A local network gateway deployed in Azure representing
+  the Vyos device, matching the below Vyos settings except for
+  address space, which only requires the Vyos private IP, in
+  this example 10.10.0.5/32
+
+- A connection resource deployed in Azure linking the
+  Azure VNet gateway and the local network gateway representing
+  the Vyos device.
+
+Example
+^^^^^^^
+
++---------------------------------------+---------------------+
+| WAN Interface                         | eth0                |
++---------------------------------------+---------------------+
+| On-premises address space             | 10.10.0.0/16        |
++---------------------------------------+---------------------+
+| Azure address space                   |  10.0.0.0/16        |
++---------------------------------------+---------------------+
+| Vyos public IP                        | 198.51.100.3        |
++---------------------------------------+---------------------+
+| Vyos private IP                       | 10.10.0.5           |
++---------------------------------------+---------------------+
+| Azure VNet Gateway 1 public IP        |  203.0.113.2        |
++---------------------------------------+---------------------+
+| Azure VNet Gateway 2 public IP        |  203.0.113.3        |
++---------------------------------------+---------------------+
+| Azure VNet Gateway BGP IP             |  10.0.0.4,10.0.0.5  |
++---------------------------------------+---------------------+
+| Pre-shared key                        | ch00s3-4-s3cur3-psk |
++---------------------------------------+---------------------+
+| Vyos ASN                              | 64499               |
++---------------------------------------+---------------------+
+| Azure ASN                             | 65540               |
++---------------------------------------+---------------------+
+
+Vyos configuration
+^^^^^^^^^^^^^^^^^^
+
+- Configure the IKE and ESP settings to match a subset
+  of those supported by Azure:
+
+.. code-block:: none
+
+  set vpn ipsec esp-group AZURE compression 'disable'
+  set vpn ipsec esp-group AZURE lifetime '3600'
+  set vpn ipsec esp-group AZURE mode 'tunnel'
+  set vpn ipsec esp-group AZURE pfs 'dh-group2'
+  set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
+
+  set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
+  set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
+  set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
+  set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
+  set vpn ipsec ike-group AZURE key-exchange 'ikev2'
+  set vpn ipsec ike-group AZURE lifetime '28800'
+  set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
+  set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
+
+- Enable IPsec on eth0
+
+.. code-block:: none
+
+  set vpn ipsec ipsec-interfaces interface 'eth0'
+
+- Configure two VTIs with a dummy IP address each
+
+.. code-block:: none
+
+  set interfaces vti vti1 address '10.10.1.5/32'
+  set interfaces vti vti1 description 'Azure Primary Tunnel'
+
+  set interfaces vti vti2 address '10.10.1.6/32'
+  set interfaces vti vti2 description 'Azure Secondary Tunnel'
+
+- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
+
+.. code-block:: none
+
+  set firewall options interface vti1 adjust-mss 1350
+  set firewall options interface vti2 adjust-mss 1350
+
+- Configure the VPN tunnels
+
+.. code-block:: none
+
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
+  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
+  set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
+  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
+  set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
+  set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
+  set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
+
+  set vpn ipsec site-to-site peer 203.0.113.3 authentication id '198.51.100.3'
+  set vpn ipsec site-to-site peer 203.0.113.3 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 203.0.113.3 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
+  set vpn ipsec site-to-site peer 203.0.113.3 authentication remote-id '203.0.113.3'
+  set vpn ipsec site-to-site peer 203.0.113.3 connection-type 'respond'
+  set vpn ipsec site-to-site peer 203.0.113.3 description 'AZURE SECONDARY TUNNEL'
+  set vpn ipsec site-to-site peer 203.0.113.3 ike-group 'AZURE'
+  set vpn ipsec site-to-site peer 203.0.113.3 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 203.0.113.3 local-address '10.10.0.5'
+  set vpn ipsec site-to-site peer 203.0.113.3 vti bind 'vti2'
+  set vpn ipsec site-to-site peer 203.0.113.3 vti esp-group 'AZURE'
+
+- **Important**: Add an interface route to reach both Azure's BGP listeners
+
+.. code-block:: none
+
+  set protocols static interface-route 10.0.0.4/32 next-hop-interface vti1
+  set protocols static interface-route 10.0.0.5/32 next-hop-interface vti2
+
+- Configure your BGP settings
+
+.. code-block:: none
+
+  set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
+  set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
+  set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
+  set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
+
+  set protocols bgp 64499 neighbor 10.0.0.5 remote-as '65540'
+  set protocols bgp 64499 neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound'
+  set protocols bgp 64499 neighbor 10.0.0.5 timers holdtime '30'
+  set protocols bgp 64499 neighbor 10.0.0.5 timers keepalive '10'
+
+- **Important**: Disable connected check, otherwise the routes learned
+  from Azure will not be imported into the routing table.
+
+.. code-block:: none
+
+  set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check
+  set protocols bgp 64499 neighbor 10.0.0.5 disable-connected-check
diff --git a/docs/configexamples/bgp-ipv6-unnumbered.rst b/docs/configexamples/bgp-ipv6-unnumbered.rst
new file mode 100644
index 00000000..283dcd45
--- /dev/null
+++ b/docs/configexamples/bgp-ipv6-unnumbered.rst
@@ -0,0 +1,171 @@
+.. _examples-bgp-ipv6-unnumbered:
+
+VyOS BGP ipv6 unnumbered with extended nexthop
+----------------------------------------------
+
+General infomration can be found in the :ref:`routing-bgp` chapter.
+
+Configuration
+^^^^^^^^^^^^^
+
+- Router A:
+
+.. code-block:: none
+
+  set protocols bgp 65020 address-family ipv4-unicast redistribute connected
+  set protocols bgp 65020 address-family ipv6-unicast redistribute connected
+  set protocols bgp 65020 neighbor eth1 interface v6only
+  set protocols bgp 65020 neighbor eth1 interface v6only peer-group 'fabric'
+  set protocols bgp 65020 neighbor eth2 interface v6only
+  set protocols bgp 65020 neighbor eth2 interface v6only peer-group 'fabric'
+  set protocols bgp 65020 parameters bestpath as-path multipath-relax
+  set protocols bgp 65020 parameters bestpath compare-routerid
+  set protocols bgp 65020 parameters default no-ipv4-unicast
+  set protocols bgp 65020 parameters router-id '192.168.0.1'
+  set protocols bgp 65020 peer-group fabric address-family ipv4-unicast
+  set protocols bgp 65020 peer-group fabric address-family ipv6-unicast
+  set protocols bgp 65020 peer-group fabric capability extended-nexthop
+  set protocols bgp 65020 peer-group fabric remote-as 'external'
+
+- Router B:
+
+.. code-block:: none
+
+  set protocols bgp 65021 address-family ipv4-unicast redistribute connected
+  set protocols bgp 65021 address-family ipv6-unicast redistribute connected
+  set protocols bgp 65021 neighbor eth1 interface v6only
+  set protocols bgp 65021 neighbor eth1 interface v6only peer-group 'fabric'
+  set protocols bgp 65021 neighbor eth2 interface v6only
+  set protocols bgp 65021 neighbor eth2 interface v6only peer-group 'fabric'
+  set protocols bgp 65021 parameters bestpath as-path multipath-relax
+  set protocols bgp 65021 parameters bestpath compare-routerid
+  set protocols bgp 65021 parameters default no-ipv4-unicast
+  set protocols bgp 65021 parameters router-id '192.168.0.2'
+  set protocols bgp 65021 peer-group fabric address-family ipv4-unicast
+  set protocols bgp 65021 peer-group fabric address-family ipv6-unicast
+  set protocols bgp 65021 peer-group fabric capability extended-nexthop
+  set protocols bgp 65021 peer-group fabric remote-as 'external'
+
+Results
+^^^^^^^^^^^^^
+
+- Router A:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             62.104.XXX.XXX/24                 u/u
+  eth1             -                                 u/u
+  eth2             -                                 u/u
+  lo               127.0.0.1/8                       u/u
+                   192.168.0.1/32
+                   ::1/128
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip route
+  Codes: K - kernel route, C - connected, S - static, R - RIP,
+         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+         F - PBR, f - OpenFabric,
+         > - selected route, * - FIB route
+
+  S>* 0.0.0.0/0 [210/0] via 62.104.XXX.XXX, eth0, 03:21:53
+  C>* 62.104.56.0/24 is directly connected, eth0, 03:21:53
+  C>* 192.168.0.1/32 is directly connected, lo, 03:21:56
+  B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07
+    *                       via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07
+
+.. code-block:: none
+
+  vyos@vyos:~$ ping 192.168.0.2
+  PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
+  64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms
+  64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms
+  64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms
+  64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms
+  64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms
+
+  --- 192.168.0.2 ping statistics ---
+  5 packets transmitted, 5 received, 0% packet loss, time 4086ms
+  rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip bgp summary
+
+  IPv4 Unicast Summary:
+  BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0
+  BGP table version 4
+  RIB entries 5, using 800 bytes of memory
+  Peers 2, using 41 KiB of memory
+  Peer groups 1, using 64 bytes of memory
+
+  Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
+  eth1            4      65021      13      13        0    0    0 00:05:33            2
+  eth2            4      65021      13      14        0    0    0 00:05:29            2
+
+  Total number of neighbors 2
+
+- Router B:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             62.104.XXX.XXX/24                 u/u
+  eth1             -                                 u/u
+  eth2             -                                 u/u
+  lo               127.0.0.1/8                       u/u
+                   192.168.0.2/32
+                   ::1/128
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip route
+  Codes: K - kernel route, C - connected, S - static, R - RIP,
+         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+         F - PBR, f - OpenFabric,
+         > - selected route, * - FIB route
+
+  S>* 0.0.0.0/0 [210/0] via 62.104.XXX.XXX, eth0, 00:44:08
+  C>* 62.104.56.0/24 is directly connected, eth0, 00:44:09
+  B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18
+    *                       via fe80::a00:27ff:fe93:e142, eth2, 00:06:18
+  C>* 192.168.0.2/32 is directly connected, lo, 00:44:11
+
+.. code-block:: none
+
+  vyos@vyos:~$ ping 192.168.0.1
+  PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
+  64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms
+  64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms
+  64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms
+  64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms
+
+  --- 192.168.0.1 ping statistics ---
+  4 packets transmitted, 4 received, 0% packet loss, time 3051ms
+  rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip bgp summary
+  IPv4 Unicast Summary:
+  BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0
+  BGP table version 4
+  RIB entries 5, using 800 bytes of memory
+  Peers 2, using 41 KiB of memory
+  Peer groups 1, using 64 bytes of memory
+
+  Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
+  eth1            4      65020      14      14        0    0    0 00:06:40            2
+  eth2            4      65020      14      14        0    0    0 00:06:37            2
+
+  Total number of neighbors 2
+
diff --git a/docs/configexamples/dhcp-relay-through-gre-bridge.rst b/docs/configexamples/dhcp-relay-through-gre-bridge.rst
new file mode 100644
index 00000000..f94eb67f
--- /dev/null
+++ b/docs/configexamples/dhcp-relay-through-gre-bridge.rst
@@ -0,0 +1,77 @@
+.. _examples-dhcp-relay-through-gre-bridge:
+
+
+DHCP Relay through GRE-Bridge
+-----------------------------
+
+Diagram
+^^^^^^^
+
+.. image:: /_static/images/dhcp-relay-through-gre-bridge.png
+   :width: 80%
+   :align: center
+   :alt: Network Topology Diagram
+
+Configuration
+^^^^^^^^^^^^^
+
+DHCP Server
+"""""""""""
+
+.. code-block:: none
+
+   set interfaces ethernet eth0 address '10.0.2.1/24'
+   set interfaces loopback lo address '3.3.3.3/24'
+   set interfaces tunnel tun100 address '172.16.0.2/30'
+   set interfaces tunnel tun100 encapsulation 'gre-bridge'
+   set interfaces tunnel tun100 local-ip '10.0.2.1'
+   set interfaces tunnel tun100 remote-ip '192.168.0.1'
+   set protocols ospf area 0 network '3.3.3.0/24'
+   set protocols ospf area 0 network '10.0.2.0/24'
+   set protocols ospf parameters router-id '3.3.3.3'
+   set protocols static interface-route 10.0.1.2/32 next-hop-interface tun100
+   set service dhcp-server shared-network-name asdf authoritative
+   set service dhcp-server shared-network-name asdf subnet 3.3.3.0/24 range 0 start '3.3.3.30'
+   set service dhcp-server shared-network-name asdf subnet 3.3.3.0/24 range 0 stop '3.3.3.40'
+   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 default-router '10.0.1.2'
+   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 range 0 start '10.0.1.200'
+   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 range 0 stop '10.0.1.210'
+   set service dhcp-server shared-network-name asdf subnet 10.2.1.0/24 range 0 start '10.2.1.222'
+   set service dhcp-server shared-network-name asdf subnet 10.2.1.0/24 range 0 stop '10.2.1.233'
+   set service dhcp-server shared-network-name asdf subnet 172.16.0.0/30 range 0 start '172.16.0.1'
+   set service dhcp-server shared-network-name asdf subnet 172.16.0.0/30 range 0 stop '172.16.0.2'
+   
+
+In-Between Router
+"""""""""""""""""
+
+.. code-block:: none
+
+   set interfaces ethernet eth0 address '192.168.0.2/24'
+   set interfaces ethernet eth1 address '10.0.2.2/24'
+   set protocols ospf area 0 network '192.168.0.0/24'
+   set protocols ospf area 0 network '10.0.2.0/24'
+   set protocols ospf parameters router-id '192.168.0.2'
+   
+
+DHCP Relay
+""""""""""
+
+.. code-block:: none
+
+   set interfaces ethernet eth0 address '10.0.1.2/24'
+   set interfaces ethernet eth1 address '192.168.0.1/24'
+   set interfaces loopback lo address '1.1.1.1'
+   set interfaces tunnel tun100 address '172.16.0.1/30'
+   set interfaces tunnel tun100 encapsulation 'gre-bridge'
+   set interfaces tunnel tun100 local-ip '192.168.0.1'
+   set interfaces tunnel tun100 remote-ip '10.0.2.1'
+   set protocols ospf area 0 network '10.0.1.0/24'
+   set protocols ospf area 0 network '192.168.0.0/24'
+   set protocols ospf area 0 network '1.1.1.0/24'
+   set protocols ospf parameters router-id '1.1.1.1'
+   set protocols static interface-route 3.3.3.3/32 next-hop-interface tun100
+   set service dhcp-relay interface 'eth0'
+   set service dhcp-relay interface 'tun100'
+   set service dhcp-relay server '3.3.3.3'
+   
diff --git a/docs/configexamples/dmvpn.rst b/docs/configexamples/dmvpn.rst
new file mode 100644
index 00000000..30ca8e86
--- /dev/null
+++ b/docs/configexamples/dmvpn.rst
@@ -0,0 +1,106 @@
+
+.. _examples-dmvpn:
+
+VyOS DMVPN Hub
+--------------
+
+General infomration can be found in the :ref:`vpn-dmvpn` chapter.
+
+Configuration
+^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  set interfaces tunnel tun100 address '172.16.253.134/29'
+  set interfaces tunnel tun100 encapsulation 'gre'
+  set interfaces tunnel tun100 local-ip '11.22.33.44'
+  set interfaces tunnel tun100 multicast 'enable'
+  set interfaces tunnel tun100 parameters ip key '1'
+
+  set protocols nhrp tunnel tun100 cisco-authentication '<nhrp secret key>'
+  set protocols nhrp tunnel tun100 holding-time '300'
+  set protocols nhrp tunnel tun100 multicast 'dynamic'
+  set protocols nhrp tunnel tun100 redirect
+  set protocols nhrp tunnel tun100 shortcut
+
+  set vpn ipsec esp-group ESP-HUB compression 'disable'
+  set vpn ipsec esp-group ESP-HUB lifetime '1800'
+  set vpn ipsec esp-group ESP-HUB mode 'tunnel'
+  set vpn ipsec esp-group ESP-HUB pfs 'dh-group2'
+  set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+  set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des'
+  set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5'
+  set vpn ipsec ike-group IKE-HUB ikev2-reauth 'no'
+  set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+  set vpn ipsec ike-group IKE-HUB lifetime '3600'
+  set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+  set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+  set vpn ipsec ike-group IKE-HUB proposal 2 dh-group '2'
+  set vpn ipsec ike-group IKE-HUB proposal 2 encryption 'aes128'
+  set vpn ipsec ike-group IKE-HUB proposal 2 hash 'sha1'
+  set vpn ipsec ipsec-interfaces interface 'eth0'
+
+  set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+  set vpn ipsec profile NHRPVPN authentication pre-shared-secret '<secretkey>'
+  set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
+  set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+  set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+
+Cisco IOS Spoke
+^^^^^^^^^^^^^^^
+
+This example is verified with a Cisco 2811 platform running IOS 15.1(4)M9 and
+VyOS 1.1.7 (helium) up to VyOS 1.2 (Crux).
+
+.. code-block:: none
+
+  Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 15.1(4)M9, RELEASE SOFTWARE (fc3)
+  Technical Support: http://www.cisco.com/techsupport
+  Copyright (c) 1986-2014 by Cisco Systems, Inc.
+  Compiled Fri 12-Sep-14 10:45 by prod_rel_team
+
+  ROM: System Bootstrap, Version 12.3(8r)T7, RELEASE SOFTWARE (fc1)
+
+Use this configuration on your Cisco device:
+
+.. code-block:: none
+
+  crypto pki token default removal timeout 0
+  crypto keyring DMVPN
+    pre-shared-key address 1.2.3.4 key <secretkey>
+  !
+  crypto isakmp policy 10
+   encr aes 256
+   authentication pre-share
+   group 2
+  !
+  crypto isakmp invalid-spi-recovery
+  crypto isakmp keepalive 30 30 periodic
+  crypto isakmp profile DMVPN
+     keyring DMVPN
+     match identity address 11.22.33.44 255.255.255.255
+  !
+  crypto ipsec transform-set DMVPN-AES256 esp-aes 256 esp-sha-hmac
+   mode transport
+  !
+  crypto ipsec profile DMVPN
+   set security-association idle-time 720
+   set transform-set DMVPN-AES256
+   set isakmp-profile DMVPN
+  !
+  interface Tunnel10
+   description Tunnel to DMVPN HUB
+   ip address 172.16.253.129 255.255.255.248
+   no ip redirects
+   ip nhrp authentication <nhrp secret key>
+   ip nhrp map multicast 11.22.33.44
+   ip nhrp map 172.16.253.134 11.22.33.44
+   ip nhrp network-id 1
+   ip nhrp holdtime 600
+   ip nhrp nhs 172.16.253.134
+   ip nhrp registration timeout 75
+   tunnel source Dialer1
+   tunnel mode gre multipoint
+   tunnel key 1
diff --git a/docs/configexamples/index.rst b/docs/configexamples/index.rst
new file mode 100644
index 00000000..073bc125
--- /dev/null
+++ b/docs/configexamples/index.rst
@@ -0,0 +1,19 @@
+.. _examples:
+
+Configuration Blueprints
+========================
+
+This chapter contains various configuration examples:
+
+.. toctree::
+   :maxdepth: 2
+
+   dhcp-relay-through-gre-bridge
+   zone-policy
+   bgp-ipv6-unnumbered
+   ospf-unnumbered
+   azure-vpn-bgp
+   azure-vpn-dual-bgp
+   tunnelbroker-ipv6
+   wan-load-balancing
+   dmvpn
diff --git a/docs/configexamples/ospf-unnumbered.rst b/docs/configexamples/ospf-unnumbered.rst
new file mode 100644
index 00000000..84fc691e
--- /dev/null
+++ b/docs/configexamples/ospf-unnumbered.rst
@@ -0,0 +1,125 @@
+.. _examples-ospf-unnumbered:
+
+VyOS OSPF unnumbered with ecmp
+----------------------------------------------
+
+General infomration can be found in the :ref:`routing-ospf` chapter.
+
+Configuration
+^^^^^^^^^^^^^
+
+- Router A:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address '10.0.0.1/24'
+  set interfaces ethernet eth1 address '192.168.0.1/32'
+  set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+  set interfaces ethernet eth1 ip ospf network 'point-to-point'
+  set interfaces ethernet eth2 address '192.168.0.1/32'
+  set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+  set interfaces ethernet eth2 ip ospf network 'point-to-point'
+  set interfaces loopback lo address '192.168.0.1/32'
+  set protocols ospf area 0.0.0.0 authentication 'md5'
+  set protocols ospf area 0.0.0.0 network '192.168.0.1/32'
+  set protocols ospf parameters router-id '192.168.0.1'
+  set protocols ospf redistribute connected
+
+- Router B:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address '10.0.0.2/24'
+  set interfaces ethernet eth1 address '192.168.0.2/32'
+  set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+  set interfaces ethernet eth1 ip ospf network 'point-to-point'
+  set interfaces ethernet eth2 address '192.168.0.2/32'
+  set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+  set interfaces ethernet eth2 ip ospf network 'point-to-point'
+  set interfaces loopback lo address '192.168.0.2/32'
+  set protocols ospf area 0.0.0.0 authentication 'md5'
+  set protocols ospf area 0.0.0.0 network '192.168.0.2/32'
+  set protocols ospf parameters router-id '192.168.0.2'
+  set protocols ospf redistribute connected
+
+
+Results
+^^^^^^^^^^^^^
+
+- Router A:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces 
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             10.0.0.1/24                       u/u  
+  eth1             192.168.0.1/32                    u/u  
+  eth2             192.168.0.1/32                    u/u  
+  lo               127.0.0.1/8                       u/u  
+                   192.168.0.1/32
+                   ::1/128
+  vyos@vyos:~$ 
+
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip route 
+  Codes: K - kernel route, C - connected, S - static, R - RIP,
+         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+         F - PBR, f - OpenFabric,
+         > - selected route, * - FIB route, q - queued route, r - rejected route
+  
+  S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
+  O   10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21
+                              via 192.168.0.2, eth2 onlink, 00:13:21
+  C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
+  O   192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53
+  C * 192.168.0.1/32 is directly connected, eth2, 00:56:31
+  C * 192.168.0.1/32 is directly connected, eth1, 00:56:31
+  C>* 192.168.0.1/32 is directly connected, lo, 00:57:36
+  O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03
+    *                        via 192.168.0.2, eth2 onlink, 00:29:03
+  vyos@vyos:~$ 
+
+
+- Router B:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces 
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             10.0.0.2/24                       u/u  
+  eth1             192.168.0.2/32                    u/u  
+  eth2             192.168.0.2/32                    u/u  
+  lo               127.0.0.1/8                       u/u  
+                   192.168.0.2/32
+                   ::1/128
+  vyos@vyos:~$ 
+
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip route 
+  Codes: K - kernel route, C - connected, S - static, R - RIP,
+         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+         F - PBR, f - OpenFabric,
+         > - selected route, * - FIB route, q - queued route, r - rejected route
+  
+  S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
+  O   10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21
+                              via 192.168.0.1, eth2 onlink, 00:13:21
+  C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
+  O   192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53
+  C * 192.168.0.2/32 is directly connected, eth2, 00:56:31
+  C * 192.168.0.2/32 is directly connected, eth1, 00:56:31
+  C>* 192.168.0.2/32 is directly connected, lo, 00:57:36
+  O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03
+    *                        via 192.168.0.1, eth2 onlink, 00:29:03
+  vyos@vyos:~$ 
+
diff --git a/docs/configexamples/tunnelbroker-ipv6.rst b/docs/configexamples/tunnelbroker-ipv6.rst
new file mode 100644
index 00000000..ca3921ec
--- /dev/null
+++ b/docs/configexamples/tunnelbroker-ipv6.rst
@@ -0,0 +1,151 @@
+.. _examples-tunnelbroker-ipv6:
+
+VyOS Tunnelbroker.net IPv6
+--------------------------
+
+This guides walks through the setup of `Tunnelbroker.net <https://www.tunnelbroker.net/>`_ for an IPv6 Tunnel.  
+
+Prerequisites
+^^^^^^^^^^^^^
+
+- A public IP address.  This does not necessarily need to be static, but you will need to update the tunnel endpoint when/if your IP address changes, which can be done with a script and a scheduled task.
+- An account at `Tunnelbroker.net <https://www.tunnelbroker.net/>`_.
+- Requested a "Regular Tunnel".  You want to choose a location that is closest to your physical location for the best response time.
+
+Setting up the initial tunnel
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+- Set up the initial IPv6 tunnel. Replace the field below from the fields on the `Tunnelbroker.net <https://www.tunnelbroker.net/>`_ tunnel information page.
+
+.. code-block:: none
+
+    conf
+    set interfaces tunnel tun0 address Client_IPv6_from_Tunnelbroker    # This will be your VyOS install's public IPv6 address
+    set interfaces tunnel tun0 description 'HE.NET IPv6 Tunnel'
+    set interfaces tunnel tun0 encapsulation 'sit'
+    set interfaces tunnel tun0 local-ip Client_IPv4_from_Tunnelbroker   # This is your public IP
+    set interfaces tunnel tun0 mtu '1472'
+    set interfaces tunnel tun0 multicast 'disable'
+    set interfaces tunnel tun0 remote-ip Server_IPv4_from_Tunnelbroker  # This is the IP of the Tunnelbroker server
+    set protocols static interface-route6 ::/0 next-hop-interface tun0  # Tell all traffic to go over this tunnel
+    commit
+
+- If your WAN connection is over PPPoE, you may need to set the MTU on the above tunnel lower than 1472.
+
+- At this point you should be able to ping an IPv6 address. Try pinging Google:
+
+.. code-block:: none
+
+   ping6 -c2 2001:4860:4860::8888
+
+   64 bytes from 2001:4860:4860::8888: icmp_seq=1 ttl=57 time=21.7 ms
+   64 bytes from 2001:4860:4860::8888: icmp_seq=2 ttl=57 time=21.1 ms
+
+   --- 2001:4860:4860::8888 ping statistics ---
+   2 packets transmitted, 2 received, 0% packet loss, time 1001ms
+   rtt min/avg/max/mdev = 21.193/21.459/21.726/0.304 ms
+
+- Assuming the pings are successful, you need to add some DNS servers. Some options:
+
+.. code-block:: none
+
+   set system name-server 2001:4860:4860::8888  # Google
+   set system name-server 2001:4860:4860::8844  # Google
+   set system name-server 2606:4700:4700::1111  # Cloudflare
+   set system name-server 2606:4700:4700::1001  # Cloudflare
+   commit
+
+- You should now be able to ping something by IPv6 DNS name:
+
+.. code-block:: none
+
+   # ping6 -c2 one.one.one.one
+   PING one.one.one.one(one.one.one.one) 56 data bytes
+   64 bytes from one.one.one.one: icmp_seq=1 ttl=58 time=16.8 ms
+   64 bytes from one.one.one.one: icmp_seq=2 ttl=58 time=17.4 ms
+
+   --- one.one.one.one ping statistics ---
+   2 packets transmitted, 2 received, 0% packet loss, time 1001ms
+   rtt min/avg/max/mdev = 16.880/17.153/17.426/0.273 ms
+
+-  Assuming everything works, you can proceed to client configuration
+
+LAN Configuration
+^^^^^^^^^^^^^^^^^
+
+At this point your VyOS install should have full IPv6, but now your LAN devices need access.
+
+With Tunnelbroker.net, you have two options:
+
+- Routed /64. This is the default assignment.  In IPv6-land, it's good for a single "LAN", and is somewhat equivalent to a /24.  Example: `2001:470:xxxx:xxxx::/64`
+- Routed /48. This is something you can request by clicking the "Assign /48" link in the Tunnelbroker.net tunnel config.  It allows you to have up to 65k LANs. Example: `2001:470:xxxx::/48` 
+
+Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64.  So if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore the assigned /64, and request the /48 and use that.  
+
+Single LAN Setup
+^^^^^^^^^^^^^^^^
+
+Single LAN setup where eth1 is your LAN interface.  Use the /64 (all the xxxx should be replaced with the information from your `Routed /64` tunnel):
+
+.. code-block:: none
+
+   set interfaces ethernet eth1 address '2001:470:xxxx:xxxx::1/64'    
+   set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8888'
+   set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8844'
+   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:xxxx::/64 autonomous-flag 'true'
+   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:xxxx::/64 on-link-flag 'true'
+   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:xxxx::/64 valid-lifetime '2592000'
+
+
+- This accomplishes a few things:
+
+  - Sets your LAN interface's IP address
+  - Enables router advertisements.  This is an IPv6 alternative for DHCP (though DHCPv6 can still be used). With RAs, Your devices will automatically find the information they need for routing and DNS. 
+
+Multiple LAN/DMZ Setup
+^^^^^^^^^^^^^^^^^^^^^^
+
+In this, you use the `Routed /48` information. This allows you to assign a different /64 to every interface, LAN, or even device.  Or you could break your network into smaller chunks like /56 or /60.
+
+The format of these addresses:
+
+- `2001:470:xxxx::/48`: The whole subnet.  xxxx should come from Tunnelbroker.
+- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN
+- `2001:470:xxxx:2::/64`: Another subnet
+- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet.
+
+In the above examples, 1,2,ffff are all chosen by you.  You can use 1-ffff (1-65535). 
+
+So, when your LAN is eth1, your DMZ is eth2, your cameras live on eth3, etc:
+
+.. code-block:: none
+
+   set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64'
+   set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8888'
+   set interfaces ethernet eth1 ipv6 router-advert name-server '2001:4860:4860::8844'
+   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:1::/64 autonomous-flag 'true'
+   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:1::/64 on-link-flag 'true'
+   set interfaces ethernet eth1 ipv6 router-advert prefix 2001:470:xxxx:1::/64 valid-lifetime '2592000'
+
+   set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64'
+   set interfaces ethernet eth2 ipv6 router-advert name-server '2001:4860:4860::8888'
+   set interfaces ethernet eth2 ipv6 router-advert name-server '2001:4860:4860::8844'
+   set interfaces ethernet eth2 ipv6 router-advert prefix 2001:470:xxxx:2::/64 autonomous-flag 'true'
+   set interfaces ethernet eth2 ipv6 router-advert prefix 2001:470:xxxx:2::/64 on-link-flag 'true'
+   set interfaces ethernet eth2 ipv6 router-advert prefix 2001:470:xxxx:2::/64 valid-lifetime '2592000'
+
+   set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64'
+   set interfaces ethernet eth3 ipv6 router-advert name-server '2001:4860:4860::8888'
+   set interfaces ethernet eth3 ipv6 router-advert name-server '2001:4860:4860::8844'
+   set interfaces ethernet eth3 ipv6 router-advert prefix 2001:470:xxxx:3::/64 autonomous-flag 'true'
+   set interfaces ethernet eth3 ipv6 router-advert prefix 2001:470:xxxx:3::/64 on-link-flag 'true'
+   set interfaces ethernet eth3 ipv6 router-advert prefix 2001:470:xxxx:3::/64 valid-lifetime '2592000'
+
+Firewall
+^^^^^^^^
+
+Finally, don't forget the :ref:`firewall`.  The usage is identical, except for instead of `set firewall name NAME`, you would use `set firewall ipv6-name NAME`. 
+
+Similarly, to attach the firewall, you would use `set interfaces ethernet eth0 firewall in ipv6-name` or `set zone-policy zone LOCAL from WAN firewall ipv6-name`
+
+
diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst
new file mode 100644
index 00000000..7093defe
--- /dev/null
+++ b/docs/configexamples/wan-load-balancing.rst
@@ -0,0 +1,170 @@
+.. _wan-load-balancing:
+
+WAN Load Balancer examples
+==========================
+
+
+Example 1: Distributing load evenly
+-----------------------------------
+
+The setup used in this example is shown in the following diagram:
+
+.. image:: /_static/images/Wan_load_balancing1.png
+   :width: 80%
+   :align: center
+   :alt: Network Topology Diagram
+
+
+Overview
+^^^^^^^^
+ * All traffic coming in trough eth2 is balanced between eth0 and eth1
+   on the router.
+ * Pings will be sent to four targets for health testing (33.44.55.66,
+   44.55.66.77, 55.66.77.88 and 66.77.88.99).
+ * All outgoing packets are assigned the source address of the assigned
+   interface (SNAT).
+ * eth0 is set to be removed from the load balancer's interface pool
+   after 5 ping failures, eth1 will be removed after 4 ping failures.
+
+Create static routes to ping targets
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+Create static routes through the two ISPs towards the ping targets and
+commit the changes:
+
+.. code-block:: none
+
+   set protocols static route 33.44.55.66/32 next-hop 11.22.33.1
+   set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 
+   set protocols static route 55.66.77.88/32 next-hop 22.33.44.1
+   set protocols static route 66.77.88.99/32 next-hop 22.33.44.1
+
+Configure the load balancer
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+Configure the WAN load balancer with the parameters described above:
+
+.. code-block:: none
+
+   set load-balancing wan interface-health eth0 failure-count 5
+   set load-balancing wan interface-health eth0 nexthop 11.22.33.1
+   set load-balancing wan interface-health eth0 test 10 type ping
+   set load-balancing wan interface-health eth0 test 10 target 33.44.55.66
+   set load-balancing wan interface-health eth0 test 20 type ping
+   set load-balancing wan interface-health eth0 test 20 target 44.55.66.77
+   set load-balancing wan interface-health eth1 failure-count 4
+   set load-balancing wan interface-health eth1 nexthop 22.33.44.1
+   set load-balancing wan interface-health eth1 test 10 type ping
+   set load-balancing wan interface-health eth1 test 10 target 55.66.77.88
+   set load-balancing wan interface-health eth1 test 20 type ping
+   set load-balancing wan interface-health eth1 test 20 target 66.77.88.99
+   set load-balancing wan rule 10 inbound-interface eth2
+   set load-balancing wan rule 10 interface eth0
+   set load-balancing wan rule 10 interface eth1
+
+Example 2: Failover based on interface weights
+----------------------------------------------
+
+This examples uses the failover mode.
+
+Overview
+^^^^^^^^
+In this example eth0 is the primary interface and eth1 is the secondary
+interface to provide simple failover functionality. If eth0 fails, eth1
+takes over.
+
+Create interface weight based configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+The configuration steps are the same as in the previous example, except
+rule 10 so we keep the configuration, remove rule 10 and add a new rule
+for the failover mode:
+
+.. code-block:: none
+
+   delete load-balancing wan rule 10
+   set load-balancing wan rule 10 failover
+   set load-balancing wan rule 10 inbound-interface eth2
+   set load-balancing wan rule 10 interface eth0 weight 10
+   set load-balancing wan rule 10 interface eth1 weight 1
+
+Example 3: Failover based on rule order
+---------------------------------------
+
+The previous example used the failover command to send traffic thorugh
+eth1 if eth0 fails. In this example failover functionality is provided
+by rule order.
+
+Overview
+^^^^^^^^
+Two rules will be created, the first rule directs traffic coming in
+from eth2 to eth0 and the second rule directs the traffic to eth1. If
+eth0 fails the first rule is bypassed and the second rule matches,
+directing traffic to eth1.
+
+Create rule order based configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+We keep the configurtation from the previous example, delete rule 10
+and create the two new rules as described:
+
+.. code-block:: none
+
+   delete load-balancing wan rule 10
+   set load-balancing wan rule 10 inbound-interface eth2
+   set load-balancing wan rule 10 interface eth0
+   set load-balancing wan rule 20 inbound-interface eth2
+   set load-balancing wan rule 20 interface eth1
+
+Example 4: Failover based on rule order - priority traffic
+----------------------------------------------------------
+
+A rule order for prioritising traffic is useful in scenarios where the
+secondary link has a lower speed and should only carry high priority
+traffic. It is assumed for this example that eth1 is connected to a
+slower connection than eth0 and should prioritise VoIP traffic.
+
+Overview
+^^^^^^^^
+A rule order for prioritising traffic is useful in scenarios where the
+secondary link has a lower speed and should only carry high priority
+traffic. It is assumed for this example that eth1 is connected to a
+slower connection than eth0 and should prioritise VoIP traffic. 
+
+Create rule order based configuration with low speed secondary link
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+We keep the configuration from the previous example, delete rule 20 and
+create a new rule as described: 
+
+.. code-block:: none
+
+   delete load-balancing wan rule 20
+   set load-balancing wan rule 20 inbound-interface eth2
+   set load-balancing wan rule 20 interface eth1
+   set load-balancing wan rule 20 destination port sip
+   set load-balancing wan rule 20 protocol tcp
+   set protocols static route 0.0.0.0/0 next-hop 11.22.33.1
+
+Example 5: Exclude traffic from load balancing
+----------------------------------------------
+
+In this example two LAN interfaces exist in different subnets instead
+of one like in the previous examples:
+
+.. image:: /_static/images/Wan_load_balancing_exclude1.png                      
+   :width: 80%                                                          
+   :align: center                                                       
+   :alt: Network Topology Diagram 
+
+Adding a rule for the second interface
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Based on the previous example, another rule for traffic from the second
+interface eth3 can be added to the load balancer. However, traffic meant
+to flow between the LAN subnets will be sent to eth0 and eth1 as well.
+To prevent this, another rule is required. This rule excludes traffic
+between the local subnets from the load balancer. It also excludes
+locally-sources packets (required for web caching with load balancing).
+eth+ is used as an alias that refers to all ethernet interfaces:
+
+.. code-block:: none
+
+   set load-balancing wan rule 5 exclude
+   set load-balancing wan rule 5 inbound-interface eth+
+   set load-balancing wan rule 5 destination address 10.0.0.0/8
diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst
new file mode 100644
index 00000000..7a25d063
--- /dev/null
+++ b/docs/configexamples/zone-policy.rst
@@ -0,0 +1,379 @@
+.. _examples-zone-policy:
+
+Zone-Policy example
+-------------------
+
+Native IPv4 and IPv6
+^^^^^^^^^^^^^^^^^^^^
+
+We have three networks.
+
+.. code-block:: none
+
+  WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64
+  LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64
+  DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64
+
+
+This specific example is for a router on a stick, but is very easily adapted
+for however many NICs you have.
+
+[http://imgur.com/Alz1J.png Topology Image]
+
+The VyOS interface is assigned the .1/:1 address of their respective networks.
+WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30.
+
+It will look something like this:
+
+.. code-block:: none
+
+  interfaces {
+      ethernet eth0 {
+          duplex auto
+          hw-id 00:0c:29:6e:2a:92
+          smp_affinity auto
+          speed auto
+          vif 10 {
+              address 172.16.10.1/24
+              address 2001:db8:0:9999::1/64
+          }
+          vif 20 {
+              address 192.168.100.1/24
+              address 2001:db8:0:AAAA::1/64
+          }
+          vif 30 {
+              address 192.168.200.1/24
+              address 2001:db8:0:BBBB::1/64
+          }
+      }
+      loopback lo {
+      }
+  }
+
+
+Zones Basics
+^^^^^^^^^^^^
+
+Each interface is assigned to a zone. The interface can be physical or virtual
+such as tunnels (VPN, pptp, gre, etc) and are treated exactly the same.
+
+Traffic flows from zone A to zone B. That flow is what I refer to as a
+zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations.
+
+Ruleset are created per zone-pair-direction.
+
+I name rule sets to indicate which zone-pair-direction they represent. eg.
+ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN.
+
+In VyOS, you have to have unique Ruleset names. In the event of overlap, I
+add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This allows for
+each auto-completion and uniqueness.
+
+In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is the
+firewall itself.
+
+If your computer is on the LAN and you need to SSH into your VyOS box, you
+would need a rule to allow it in the LAN-Local ruleset. If you want to access
+a webpage from your VyOS box, you need a rule to allow it in the Local-LAN
+ruleset.
+
+In rules, it is good to keep them named consistently. As the number of rules
+you have grows, the more consistency you have, the easier your life will be.
+
+.. code-block:: none
+
+  Rule 1 - State Established, Related
+  Rule 2 - State Invalid
+  Rule 100 - ICMP
+  Rule 200 - Web
+  Rule 300 - FTP
+  Rule 400 - NTP
+  Rule 500 - SMTP
+  Rule 600 - DNS
+  Rule 700 - DHCP
+  Rule 800 - SSH
+  Rule 900 - IMAPS
+
+The first two rules are to deal with the idiosyncrasies of VyOS and iptables.
+
+Zones and Rulesets both have a default action statement. When using
+Zone-Policies, the default action is set by the zone-policy statement and is
+represented by rule 10000.
+
+It is good practice to log both accepted and denied traffic. It can save you
+significant headaches when trying to troubleshoot a connectivity issue.
+
+To add logging to the default rule, do:
+
+.. code-block:: none
+
+  set firewall name <ruleSet> enable-default-log
+
+
+By default, iptables does not allow traffic for established session to return,
+so you must explicitly allow this. I do this by adding two rules to every
+ruleset. 1 allows established and related state packets through and rule 2
+drops and logs invalid state packets. We place the established/related rule at
+the top because the vast majority of traffic on a network is established and
+the invalid rule to prevent invalid state packets from mistakenly being matched
+against other rules. Having the most matched rule listed first reduces CPU load
+in high volume environments. Note: I have filed a bug to have this added as a
+default action as well.
+
+''It is important to note, that you do not want to add logging to the
+established state rule as you will be logging both the inbound and outbound
+packets for each session instead of just the initiation of the session.
+Your logs will be massive in a very short period of time.''
+
+In VyOS you must have the interfaces created before you can apply it to the
+zone and the rulesets must be created prior to applying it to a zone-policy.
+
+I create/configure the interfaces first. Build out the rulesets for each
+zone-pair-direction which includes at least the three state rules. Then I setup
+the zone-policies.
+
+Zones do not allow for a default action of accept; either drop or reject.
+It is important to remember this because if you apply an interface to a zone
+and commit, any active connections will be dropped. Specifically, if you are
+SSH’d into VyOS and add local or the interface you are connecting through to a
+zone and do not have rulesets in place to allow SSH and established sessions,
+you will not be able to connect.
+
+The following are the rules that were created for this example
+(may not be complete), both in IPv4 and IPv6. If there is no IP specified,
+then the source/destination address is not explicit.
+
+.. code-block:: none
+
+  WAN – DMZ:192.168.200.200 – tcp/80
+  WAN – DMZ:192.168.200.200 – tcp/443
+  WAN – DMZ:192.168.200.200 – tcp/25
+  WAN – DMZ:192.168.200.200 – tcp/53
+  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/80
+  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/443
+  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/25
+  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/53
+
+  DMZ - Local - tcp/53
+  DMZ - Local - tcp/123
+  DMZ - Local - tcp/67,68
+
+  LAN - Local - tcp/53
+  LAN - Local - tcp/123
+  LAN - Local - tcp/67,68
+  LAN:192.168.100.10 - Local - tcp/22
+  LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22
+
+  LAN - WAN - tcp/80
+  LAN - WAN - tcp/443
+  LAN - WAN - tcp/22
+  LAN - WAN - tcp/20,21
+
+  DMZ - WAN - tcp/80
+  DMZ - WAN - tcp/443
+  DMZ - WAN - tcp/22
+  DMZ - WAN - tcp/20,21
+  DMZ - WAN - tcp/53
+  DMZ - WAN - udp/53
+
+  Local - WAN - tcp/80
+  Local - WAN - tcp/443
+  Local - WAN - tcp/20,21
+
+  Local - DMZ - tcp/25
+  Local - DMZ - tcp/67,68
+  Local - DMZ - tcp/53
+  Local - DMZ - udp/53
+
+  Local - LAN - tcp/67,68
+
+  LAN - DMZ - tcp/80
+  LAN - DMZ - tcp/443
+  LAN - DMZ - tcp/993
+  LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22
+  LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22
+
+Since we have 4 zones, we need to setup the following rulesets.
+
+.. code-block:: none
+
+  Lan-wan
+  Lan-local
+  Lan-dmz
+  Wan-lan
+  Wan-local
+  Wan-dmz
+  Local-lan
+  Local-wan
+  Local-dmz
+  Dmz-lan
+  Dmz-wan
+  Dmz-local
+
+Even if the two zones will never communicate, it is a good idea to create the
+zone-pair-direction rulesets and set enable-default-log. This will allow you to
+log attempts to access the networks. Without it, you will never see the
+connection attempts.
+
+This is an example of the three base rules.
+
+.. code-block:: none
+
+  name wan-lan {
+    default-action drop
+    enable-default-log
+    rule 1 {
+      action accept
+      state {
+        established enable
+        related enable
+      }
+    }
+    rule 2 {
+      action drop
+      log enable
+      state {
+        invalid enable
+      }
+    }
+  }
+
+
+Here is an example of an IPv6 DMZ-WAN ruleset.
+
+.. code-block:: none
+
+  ipv6-name dmz-wan-6 {
+    default-action drop
+    enable-default-log
+    rule 1 {
+      action accept
+      state {
+        established enable
+        related enable
+      }
+    }
+    rule 2 {
+      action drop
+      log enable
+      state {
+        invalid enable
+    }
+    rule 100 {
+      action accept
+      log enable
+      protocol ipv6-icmp
+    }
+    rule 200 {
+      action accept
+      destination {
+        port 80,443
+      }
+      log enable
+      protocol tcp
+    }
+    rule 300 {
+      action accept
+      destination {
+        port 20,21
+      }
+      log enable
+      protocol tcp
+    }
+    rule 500 {
+      action accept
+      destination {
+        port 25
+      }
+      log enable
+      protocol tcp
+      source {
+        address 2001:db8:0:BBBB::200
+      }
+    }
+    rule 600 {
+      action accept
+      destination {
+        port 53
+      }
+      log enable
+      protocol tcp_udp
+      source {
+        address 2001:db8:0:BBBB::200
+      }
+    }
+    rule 800 {
+      action accept
+      destination {
+      port 22
+      }
+      log enable
+      protocol tcp
+    }
+  }
+
+Once you have all of your rulesets built, then you need to create your
+zone-policy.
+
+Start by setting the interface and default action for each zone.
+
+.. code-block:: none
+
+  set zone-policy zone dmz default-action drop
+  set zone-policy zone dmz interface eth0.30
+
+In this case, we are setting the v6 ruleset that represents traffic sourced
+from the LAN, destined for the DMZ.
+Because the zone-policy firewall syntax is a little awkward, I keep it straight
+by thinking of it backwards.
+
+ set zone-policy zone dmz from lan firewall ipv6-name lan-dmz-6
+
+dmz-lan policy is lan-dmz. You can get a rhythm to it when you build out a bunch at one time.
+
+In the end, you will end up with something like this config. I took out everything but the Firewall, Interfaces, and zone-policy sections. It is long enough as is.
+== IPv6 Tunnel ==
+
+If you are using a IPv6 tunnel from HE.net or someone else, the basis is the same except you have two WAN interface. One for v4 and one for v6.
+
+You would have 5 zones instead of just 4 and you would configure your v6 ruleset between your tunnel interface and your LAN/DMZ zones instead of to the WAN.
+
+LAN, WAN, DMZ, local and TUN (tunnel)
+
+v6 pairs would be:
+
+.. code-block:: none
+
+  lan-tun
+  lan-local
+  lan-dmz
+  tun-lan
+  tun-local
+  tun-dmz
+  local-lan
+  local-tun
+  local-dmz
+  dmz-lan
+  dmz-tun
+  dmz-local
+
+Notice, none go to WAN since WAN wouldn't have a v6 address on it.
+
+You would have to add a couple of rules on your wan-local ruleset to allow protocol 41 in.
+
+Something like:
+
+.. code-block:: none
+
+  rule 400 {
+    action accept
+    destination {
+      address 172.16.10.1
+    }
+    log enable
+    protocol 41
+    source {
+      address ip.of.tunnel.broker
+    }
+  }
+
diff --git a/docs/configuration-overview.rst b/docs/configuration-overview.rst
deleted file mode 100644
index 71bfc360..00000000
--- a/docs/configuration-overview.rst
+++ /dev/null
@@ -1,730 +0,0 @@
-.. _configuration-overview:
-
-######################
-Configuration Overview
-######################
-
-VyOS makes use of a unified configuration file for the entire system's
-configuration: ``/config/config.boot``. This allows easy template
-creation, backup, and replication of system configuration. A system can
-thus also be easily cloned by simply copying the required configuration
-files.
-
-Terminology
-===========
-live
-A VyOS system has three major types of configurations:
-
-* **Active** or **running configuration** is the system configuration
-  that is loaded  and currently active (used by VyOS). Any change in
-  the configuration will have to be committed to belong to the
-  active/running configuration.
-
-* **Working configuration** is the one that is currently being modified
-  in configuration mode. Changes made to the working configuration do
-  not go into effect until the changes are committed with the
-  :cfgcmd:`commit` command. At which time the working configuration will
-  become the active or running configuration.
-
-* **Saved configuration** is the one saved to a file using the
-  :cfgcmd:`save` command. It allows you to keep safe a configuration for
-  future uses. There can be multiple configuration files. The default or
-  "boot" configuration is saved and loaded from the file
-  ``/config/config.boot``.
-
-Seeing and navigating the configuration
-=======================================
-
-.. opcmd:: show configuration
-
-   View the current active configuration, also known as the running
-   configuration, from the operational mode.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show configuration
-     interfaces {
-         ethernet eth0 {
-             address dhcp
-             hw-id 00:53:00:00:aa:01
-         }
-         loopback lo {
-         }
-     }
-     service {
-         ssh {
-             port 22
-         }
-     }
-     system {
-         config-management {
-             commit-revisions 20
-         }
-         console {
-             device ttyS0 {
-                 speed 9600
-             }
-         }
-         login {
-             user vyos {
-                 authentication {
-                     encrypted-password ****************
-                 }
-                 level admin
-             }
-         }
-         ntp {
-             server 0.pool.ntp.org {
-             }
-             server 1.pool.ntp.org {
-             }
-             server 2.pool.ntp.org {
-             }
-         }
-         syslog {
-             global {
-                 facility all {
-                     level notice
-                 }
-                 facility protocols {
-                     level debug
-                 }
-             }
-         }
-     }
-
-By default, the configuration is displayed in a hierarchy like the above
-example, this is only one of the possible ways to display the
-configuration. When the configuration is generated and the device is
-configured, changes are added through a collection of :cfgcmd:`set` and
-:cfgcmd:`delete` commands.
-
-.. opcmd:: show configuration commands
-
-   Get a collection of all the set commands required which led to the
-   running configuration.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show configuration commands
-     set interfaces ethernet eth0 address 'dhcp'
-     set interfaces ethernet eth0 hw-id '00:53:dd:44:3b:0f'
-     set interfaces loopback 'lo'
-     set service ssh port '22'
-     set system config-management commit-revisions '20'
-     set system console device ttyS0 speed '9600'
-     set system login user vyos authentication encrypted-password '$6$Vt68...QzF0'
-     set system login user vyos level 'admin'
-     set system ntp server '0.pool.ntp.org'
-     set system ntp server '1.pool.ntp.org'
-     set system ntp server '2.pool.ntp.org'
-     set system syslog global facility all level 'notice'
-     set system syslog global facility protocols level 'debug'
-
-Both these ``show`` commands should be executed when in operational
-mode, they do not work directly in configuration mode. There is a
-special way on how to :ref:`run_opmode_from_config_mode`.
-
-.. hint:: Use the ``show configuration commands | strip-private``
-   command when you want to hide private data. You may want to do so if
-   you want to share your configuration on the `forum`_.
-
-.. _`forum`: https://forum.vyos.io
-
-
-The config mode
----------------
-
-When entering the configuration mode you are navigating inside a tree
-structure, to enter configuration mode enter the command
-:opcmd:`configure` when in operational mode.
-
-.. code-block:: none
-
-  vyos@vyos$ configure
-  [edit]
-  vyos@vyos#
-
-
-.. note:: When going into configuration mode, prompt changes from
-   ``$`` to ``#``.
-
-
-All commands executed here are relative to the configuration level you
-have entered. You can do everything from the top level, but commands
-will be quite lengthy when manually typing them.
-
-The current hierarchy level can be changed by the :cfgcmd:`edit`
-command.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# edit interfaces ethernet eth0
-
-  [edit interfaces ethernet eth0]
-  vyos@vyos#
-
-You are now in a sublevel relative to ``interfaces ethernet eth0``, all
-commands executed from this point on are relative to this sublevel. Use
-eithe the :cfgcmd:`top` or :cfgcmd:`exit` command to go back to the top
-of the hierarchy. You can also use the :cfgcmd:`up` command to move only
-one level up at a time.
-
-.. cfgcmd:: show
-
-The :cfgcmd:`show` command within configuration mode will show the
-working configuration indicating line changes with ``+`` for additions,
-``>`` for replacements and ``-`` for deletions.
-
-**Example:**
-
-.. code-block:: none
-
- vyos@vyos:~$ configure
- [edit]
- vyos@vyos# show interfaces
-  ethernet eth0 {
-      description MY_OLD_DESCRIPTION
-      disable
-      hw-id 00:53:dd:44:3b:03
-  }
-  loopback lo {
-  }
- [edit]
- vyos@vyos# set interfaces ethernet eth0 address dhcp
- [edit]
- vyos@vyos# set interfaces ethernet eth0 description MY_NEW_DESCRIPTION
- [edit]
- vyos@vyos# delete interfaces ethernet eth0 disable
- [edit]
- vyos@vyos# show interfaces
-  ethernet eth0 {
- +    address dhcp
- >    description MY_NEW_DESCRIPTION
- -    disable
-      hw-id 00:53:dd:44:3b:03
-  }
-  loopback lo {
-  }
-
-It is also possible to display all `set` commands within configuration
-mode using :cfgcmd:`show | commands`
-
-.. code-block:: none
-
-  vyos@vyos# show interfaces ethernet eth0 | commands
-  set address dhcp
-  set hw-id 00:53:ad:44:3b:03
-
-These commands are also relative to the level you are inside and only 
-relevant configuration blocks will be displayed when entering a
-sub-level.
-
-.. code-block:: none
-
-  [edit interfaces ethernet eth0]
-  vyos@vyos# show
-   address dhcp
-   hw-id 00:53:ad:44:3b:03
-
-Exiting from the configuration mode is done via the :cfgcmd:`exit`
-command from the top level, executing :cfgcmd:`exit` from within a
-sub-level takes you back to the top level.
-
-.. code-block:: none
-
-  [edit interfaces ethernet eth0]
-  vyos@vyos# exit
-  [edit]
-  vyos@vyos# exit
-  Warning: configuration changes have not been saved.
-
-
-Editing the configuration
-=========================
-
-The configuration can be edited by the use of :cfgcmd:`set` and
-:cfgcmd:`delete` commands from within configuration mode.
-
-.. cfgcmd:: set
-
-   Use this command to set the value of a parameter or to create a new
-   element.
-
-Configuration commands are flattened from the tree into 'one-liner'
-commands shown in :opcmd:`show configuration commands` from operation
-mode. Commands are relative to the level where they are executed and all
-redundant information from the current level is removed from the command
-entered.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# set interface ethernet eth0 address 192.0.2.100/24
-
-
-.. code-block:: none
-
-  [edit interfaces ethernet eth0]
-  vyos@vyos# set address 203.0.113.6/24
-
-
-These two commands above are essentially the same, just executed from
-different levels in the hierarchy.
-
-.. cfgcmd:: delete
-
-   To delete a configuration entry use the :cfgcmd:`delete` command,
-   this also deletes all sub-levels under the current level you've
-   specified in the :cfgcmd:`delete` command. Deleting an entry will
-   also result in the element reverting back to its default value if one
-   exists.
-
-   .. code-block:: none
-
-     [edit interfaces ethernet eth0]
-     vyos@vyos# delete address 192.0.2.100/24
-
-.. cfgcmd:: commit
-
-  Any change you do on the configuration, will not take effect until
-  committed using the :cfgcmd:`commit` command in configuration mode.
-
-  .. code-block:: none
-
-    vyos@vyos# commit
-    [edit]
-    vyos@vyos# exit
-    Warning: configuration changes have not been saved.
-    vyos@vyos:~$
-
-.. _save:
-
-.. cfgcmd:: save
-
-   Use this command to preserve configuration changes upon reboot. By
-   default it is stored at */config/config.boot*. In the case you want
-   to store the configuration file somewhere else, you can add a local
-   path, an SCP address, an FTP address or a TFTP address. 
-
-   .. code-block:: none
-
-     vyos@vyos# save
-     Saving configuration to '/config/config.boot'...
-     Done
-
-   .. code-block:: none
-
-     vyos@vyos# save [tab]
-     Possible completions:
-       <Enter>       Save to system config file
-       <file>        Save to file on local machine
-       scp://<user>:<passwd>@<host>/<file> Save to file on remote machine
-       ftp://<user>:<passwd>@<host>/<file> Save to file on remote machine
-       tftp://<host>/<file>      Save to file on remote machine
-     vyos@vyos# save tftp://192.168.0.100/vyos-test.config.boot
-     Saving configuration to 'tftp://192.168.0.100/vyos-test.config.boot'...
-     ######################################################################## 100.0%
-     Done
-
-.. cfgcmd:: exit [discard]
-
-   Configuration mode can not be exited while uncommitted changes exist.
-   To exit configuration mode without applying changes, the
-   :cfgcmd:`exit discard` command must be used.
-
-   All changes in the working config will thus be lost.
-
-   .. code-block:: none
-
-     vyos@vyos# exit
-     Cannot exit: configuration modified.
-     Use 'exit discard' to discard the changes and exit.
-     [edit]
-     vyos@vyos# exit discard
-
-
-.. cfgcmd:: commit-confirm <minutes>
-
-   Use this command to temporarily commit your changes and set the
-   number of minutes available for validation. ``confirm`` must
-   be entered within those minutes, otherwise the system will reboot
-   into the previous configuration. The default value is 10 minutes.
-
-
-   What if you are doing something dangerous? Suppose you want to setup
-   a firewall, and you are not sure there are no mistakes that will lock
-   you out of your system. You can use confirmed commit. If you issue
-   the ``commit-confirm`` command, your changes will be commited, and if
-   you don't issue issue the ``confirm`` command in 10 minutes, your
-   system will reboot into previous config revision.
-
-   .. code-block:: none
-   
-      vyos@router# set interfaces ethernet eth0 firewall local name FromWorld
-      vyos@router# commit-confirm 
-      commit confirm will be automatically reboot in 10 minutes unless confirmed
-      Proceed? [confirm]y
-      [edit]
-      vyos@router# confirm 
-      [edit]
-
-
-   .. note:: A reboot because you did not enter ``confirm`` will not
-      take you necessarily to the *saved configuration*, but to the
-      point before the unfortunate commit.
-
-
-.. cfgcmd:: copy
-
-   Copy a configuration element.
-
-   You can copy and remove configuration subtrees. Suppose you set up a
-   firewall ruleset ``FromWorld`` with one rule that allows traffic from
-   specific subnet. Now you want to setup a similar rule, but for
-   different subnet. Change your edit level to
-   ``firewall name FromWorld`` and use ``copy rule 10 to rule 20``, then
-   modify rule 20.
-
-
-   .. code-block:: none
-   
-      vyos@router# show firewall name FromWorld 
-       default-action drop
-       rule 10 {
-           action accept
-           source {
-               address 203.0.113.0/24
-           }
-       }
-      [edit]
-      vyos@router# edit firewall name FromWorld 
-      [edit firewall name FromWorld]
-      vyos@router# copy rule 10 to rule 20
-      [edit firewall name FromWorld]
-      vyos@router# set rule 20 source address 198.51.100.0/24
-      [edit firewall name FromWorld]
-      vyos@router# commit
-      [edit firewall name FromWorld]
-
-
-.. cfgcmd:: rename
-
-   Rename a configuration element.
-
-   You can also rename config subtrees:
-
-   .. code-block:: none
-   
-      vyos@router# rename rule 10 to rule 5
-      [edit firewall name FromWorld]
-      vyos@router# commit
-      [edit firewall name FromWorld]
-
-   Note that ``show`` command respects your edit level and from this
-   level you can view the modified firewall ruleset with just ``show``
-   with no parameters.
-
-   .. code-block:: none
-   
-      vyos@router# show 
-       default-action drop
-       rule 5 {
-           action accept
-           source {
-               address 203.0.113.0/24
-           }
-       }
-       rule 20 {
-           action accept
-           source {
-               address 198.51.100.0/24
-           }
-       }
-
-
-.. cfgcmd:: comment <config node> "comment text"
-
-   Add comment as an annotation to a configuration node.
-
-   The ``comment`` command allows you to insert a comment above the
-   ``<config node>`` configuration section. When shown, comments are
-   enclosed with ``/*`` and ``*/`` as open/close delimiters. Comments
-   need to be commited, just like other config changes.
-
-   To remove an existing comment from your current configuration,
-   specify an empty string enclosed in double quote marks (``""``) as
-   the comment text.
-
-   Example:
-
-   .. code-block:: none
-
-     vyos@vyos# comment firewall all-ping "Yes I know this VyOS is cool"
-     vyos@vyos# commit
-     vyos@vyos# show
-      firewall {
-          /* Yes I know this VyOS is cool */
-          all-ping enable
-          broadcast-ping disable
-          ...
-      }
-
-   .. note:: An important thing to note is that since the comment is
-      added on top of the section, it will not appear if the ``show
-      <section>`` command is used. With the above example, the `show
-      firewall` command would return starting after the ``firewall
-      {`` line, hiding the comment.
-
-
-
-
-   
-
-.. _run_opmode_from_config_mode:
-
-Access opmode from config mode
-==============================
-
-When inside configuration mode you are not directly able to execute
-operational commands.
-
-.. cfgcmd:: run
-
-  Access to these commands are possible through the use of the
-  ``run [command]`` command. From this command you will have access to
-  everything accessible from operational mode.
-
-  Command completion and syntax help with ``?`` and ``[tab]`` will also
-  work.
-
-  .. code-block:: none
-
-    [edit]
-    vyos@vyos# run show interfaces
-    Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-    Interface        IP Address                        S/L  Description
-    ---------        ----------                        ---  -----------
-    eth0             0.0.0.0/0                         u/u
-
-Managing configurations
-=======================
-
-VyOS comes with an integrated versioning system for the system
-configuration. It automatically maintains a backup of every previous
-configuration which has been committed to the system. The configurations
-are versioned locally for rollback but they can also be stored on a
-remote host for archiving/backup reasons.
-
-Local Archive
--------------
-
-Revisions are stored on disk. You can view, compare and rollback them to
-any previous revisions if something goes wrong.
-
-.. opcmd:: show system commit
-
-   View all existing revisions on the local system.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show system commit
-     0   2015-03-30 08:53:03 by vyos via cli
-     1   2015-03-30 08:52:20 by vyos via cli
-     2   2015-03-26 21:26:01 by root via boot-config-loader
-     3   2015-03-26 20:43:18 by root via boot-config-loader
-     4   2015-03-25 11:06:14 by root via boot-config-loader
-     5   2015-03-25 01:04:28 by root via boot-config-loader
-     6   2015-03-25 00:16:47 by vyos via cli
-     7   2015-03-24 23:43:45 by root via boot-config-loader
-
-
-.. cfgcmd:: set system config-management commit-revisions <N>
-
-   You can specify the number of revisions stored on disk. N can be in
-   the range of 0 - 65535. When the number of revisions exceeds the
-   configured value, the oldest revision is removed. The default setting
-   for this value is to store 100 revisions locally.
-
-
-Compare configurations
-----------------------
-
-VyOS lets you compare different configurations.
-
-.. cfgcmd:: compare <saved | N> <M>
-
-   Use this command to spot what the differences are between different
-   configurations.
-
-   .. code-block:: none
-
-     vyos@vyos# compare [tab]
-     Possible completions:
-       <Enter>	Compare working & active configurations
-       saved		Compare working & saved configurations
-       <N>		Compare working with revision N
-       <N> <M>	Compare revision N with M
-       Revisions:
-         0	   2013-12-17 20:01:37 root by boot-config-loader
-         1	   2013-12-13 15:59:31 root by boot-config-loader
-         2	   2013-12-12 21:56:22 vyos by cli
-         3	   2013-12-12 21:55:11 vyos by cli
-         4	   2013-12-12 21:27:54 vyos by cli
-         5	   2013-12-12 21:23:29 vyos by cli
-         6	   2013-12-12 21:13:59 root by boot-config-loader
-         7	   2013-12-12 16:25:19 vyos by cli
-         8	   2013-12-12 15:44:36 vyos by cli
-         9	   2013-12-12 15:42:07 root by boot-config-loader
-         10   2013-12-12 15:42:06 root by init
-
-   The command :cfgcmd:`compare` allows you to compare different type of
-   configurations. It also lets you compare different revisions through
-   the :cfgcmd:`compare N M` command, where N and M are revision
-   numbers. The output will describe how the configuration N is when
-   compared to M indicating with a plus sign (``+``) the additional
-   parts N has when compared to M, and indicating with a minus sign
-   (``-``) the lacking parts N misses when compared to M.
-
-   .. code-block:: none
-
-     vyos@vyos# compare 0 6
-     [edit interfaces]
-     +dummy dum1 {
-     +    address 10.189.0.1/31
-     +}
-     [edit interfaces ethernet eth0]
-     +vif 99 {
-     +    address 10.199.0.1/31
-     +}
-     -vif 900 {
-     -    address 192.0.2.4/24
-     -}
-
-
-.. opcmd:: show system commit diff <number>
-
-   Show commit revision difference.
-
-
-The command above also lets you see the difference between two commits.
-By default the difference with the running config is shown.
-
-.. code-block:: none
-
-   vyos@router# run show system commit diff 4
-   [edit system]
-   +ipv6 {
-   +    disable-forwarding
-   +}
-
-This means four commits ago we did ``set system ipv6 disable-forwarding``.
-
-
-Rollback Changes
-----------------
-
-You can rollback configuration changes using the rollback command. This
-will apply the selected revision and trigger a system reboot.
-
-.. cfgcmd:: rollback <N>
-
-   Rollback to revision N (currently requires reboot)
-
-   .. code-block:: none
-
-     vyos@vyos# compare 1
-     [edit system]
-     >host-name vyos-1
-     [edit]
-
-     vyos@vyos# rollback 1
-     Proceed with reboot? [confirm][y]
-     Broadcast message from root@vyos-1 (pts/0) (Tue Dec 17 21:07:45 2013):
-     The system is going down for reboot NOW!
-
-Remote Archive
---------------
-
-VyOS can upload the configuration to a remote location after each call
-to :cfgcmd:`commit`. You will have to set the commit-archive location.
-TFTP, FTP, SCP and SFTP servers are supported. Every time a
-:cfgcmd:`commit` is successfull the ``config.boot`` file will be copied
-to the defined destination(s). The filename used on the remote host will
-be ``config.boot-hostname.YYYYMMDD_HHMMSS``. 
-
-.. cfgcmd:: set system config-management commit-archive location <URI>
-
-   Specify remote location of commit archive as any of the below
-   :abbr:`URI (Uniform Resource Identifier)`
-
-   * ``scp://<user>:<passwd>@<host>/<dir>``
-   * ``sftp://<user>:<passwd>@<host>/<dir>``
-   * ``ftp://<user>:<passwd>@<host>/<dir>``
-   * ``tftp://<host>/<dir>``
-
-.. note:: The number of revisions don't affect the commit-archive.
-
-.. note:: You may find VyOS not allowing the secure connection because
-   it cannot verify the legitimacy of the remote server. You can use
-   the workaround below to quickly add the remote host's SSH
-   fingerprint to your ``~/.ssh/known_hosts`` file:
-
-   .. code-block:: none
-
-     vyos@vyos# ssh-keyscan <host> >> ~/.ssh/known_hosts
-
-Saving and loading manually
----------------------------
-
-You can use the ``save`` and ``load`` commands if you want to manually
-manage specific configuration files.
-
-When using the save_ command, you can add a specific location where
-to store your configuration file. And, when needed it, you will be able
-to load it with the ``load`` command:
-
-.. cfgcmd:: load <URI>
-
-   Use this command to load a configuration which will replace the
-   running configuration. Define the location of the configuration file
-   to be loaded. You can use a path to a local file, an SCP address, an
-   SFTP address, an FTP address, an HTTP address, an HTTPS address or a
-   TFTP address.
-
-  .. code-block:: none
-
-     vyos@vyos# load 
-     Possible completions:
-       <Enter>				        Load from system config file
-       <file>			        	Load from file on local machine
-       scp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
-       sftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
-       ftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
-       http://<host>/<file>			Load from file on remote machine
-       https://<host>/<file>			Load from file on remote machine
-       tftp://<host>/<file>			Load from file on remote machine
-     
-
-
-Restore Default
----------------
-
-In the case you want to completely delete your configuration and restore
-the default one, you can enter the following command in configuration
-mode:
-
-.. code-block:: none
-
-  load /opt/vyatta/etc/config.boot.default
-
-You will be asked if you want to continue. If you accept, you will have
-to use :cfgcmd:`commit` if you want to make the changes active.
-
-Then you may want to :cfgcmd:`save` in order to delete the saved
-configuration too.
-
-.. note:: If you are remotely connected, you will lose your connection.
-   You may want to copy first the config, edit it to ensure
-   connectivity, and load the edited config.
diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst
new file mode 100644
index 00000000..ed255916
--- /dev/null
+++ b/docs/configuration/firewall/index.rst
@@ -0,0 +1,258 @@
+.. _firewall:
+
+Firewall
+========
+
+VyOS makes use of Linux `netfilter <http://netfilter.org/>`_ for packet filtering.
+
+The firewall supports the creation of groups for ports, addresses, and networks
+(implemented using netfilter ipset) and the option of interface or zone based
+firewall policy.
+
+**Important note on usage of terms:** The firewall makes use of the terms
+`in`, `out`, and `local` for firewall policy. Users experienced with netfilter
+often confuse `in` to be a reference to the `INPUT` chain, and `out` the
+`OUTPUT` chain from netfilter. This is not the case. These instead indicate the
+use of the `FORWARD` chain and either the input or output interface. The
+`INPUT` chain, which is used for local traffic to the OS, is a reference to
+as `local` with respect to its input interface.
+
+Groups
+------
+
+Firewall groups represent collections of IP addresses, networks, or ports. Once
+created, a group can be referenced by firewall rules as either a source or
+destination. Members can be added or removed from a group without changes to
+or the need to reload individual firewall rules.
+
+.. note:: Groups can also be referenced by NAT configuration.
+
+While **network groups** accept IP networks in CIDR notation, specific IP addresses
+can be added as a 32-bit prefix. If you foresee the need to add a mix of
+addresses and networks, the network group is recommended.
+
+Here is an example of a network group for the IP networks that make up the
+internal network:
+
+.. code-block:: none
+
+  set firewall group network-group NET-INSIDE network 192.168.0.0/24
+  set firewall group network-group NET-INSIDE network 192.168.1.0/24
+
+Groups need to have unique names. Even though some contain IPv4 addresses and others contain IPv6 addresses, they still need to have unique names, so you may want to append "-v4" or "-v6" to your group names.
+
+.. code-block:: none
+
+  set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24
+  set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64
+
+
+A **port group** represents only port numbers, not the protocol. Port groups can
+be referenced for either TCP or UDP. It is recommended that TCP and UDP groups
+are created separately to avoid accidentally filtering unnecessary ports.
+Ranges of ports can be specified by using `-`.
+
+Here is an example of a port group a server:
+
+.. code-block:: none
+
+  set firewall group port-group PORT-TCP-SERVER1 port 80
+  set firewall group port-group PORT-TCP-SERVER1 port 443
+  set firewall group port-group PORT-TCP-SERVER1 port 5000-5010
+
+Rule-Sets
+---------
+
+A rule-set is a named collection of firewall rules that can be applied to an
+interface or zone. Each rule is numbered, has an action to apply if the rule
+is matched, and the ability to specify the criteria to match.
+
+Example of a rule-set to filter traffic to the internal network:
+
+.. code-block:: none
+
+  set firewall name INSIDE-OUT default-action drop
+  set firewall name INSIDE-OUT rule 1010 action accept
+  set firewall name INSIDE-OUT rule 1010 state established enable
+  set firewall name INSIDE-OUT rule 1010 state related enable
+  set firewall name INSIDE-OUT rule 1020 action drop
+  set firewall name INSIDE-OUT rule 1020 state invalid enable
+
+Applying a Rule-Set to an Interface
+-----------------------------------
+
+Once a rule-set is created, it can be applied to an interface.
+
+.. note:: Only one rule-set can be applied to each interface for `in`, `out`,
+   or `local` traffic for each protocol (IPv4 and IPv6).
+
+.. code-block:: none
+
+  set interfaces ethernet eth1 firewall out name INSIDE-OUT
+
+.. _routing-mss-clamp:
+
+TCP-MSS Clamping
+----------------
+
+As Internet wide PMTU discovery rarely works, we sometimes need to clamp
+our TCP MSS value to a specific value. This is a field in the TCP
+Options part of a SYN packet. By setting the MSS value, you are telling
+the remote side unequivocally 'do not try to send me packets bigger than
+this value'.
+
+Starting with VyOS 1.2 there is a firewall option to clamp your TCP MSS
+value for IPv4 and IPv6.
+
+
+.. note:: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting
+   in 1452 bytes on a 1492 byte MTU.
+
+
+IPv4
+^^^^
+
+.. cfgcmd:: set firewall options interface <interface> adjust-mss <number-of-bytes>
+
+   Use this command to set the maximum segment size for IPv4 transit
+   packets on a specific interface (500-1460 bytes).
+
+
+Example
+"""""""
+
+Clamp outgoing MSS value in a TCP SYN packet to `1452` for `pppoe0` and
+`1372`
+for your WireGuard `wg02` tunnel.
+
+.. code-block:: none
+
+  set firewall options interface pppoe0 adjust-mss '1452'
+  set firewall options interface wg02 adjust-mss '1372'
+
+IPv6
+^^^^^
+
+.. cfgcmd:: set firewall options interface <interface> adjust-mss6 <number-of-bytes>
+
+   Use this command to set the maximum segment size for IPv6 transit
+   packets on a specific interface (1280-1492 bytes).
+
+
+Example
+"""""""
+
+Clamp outgoing MSS value in a TCP SYN packet to `1280` for both `pppoe0` and
+`wg02` interface.
+
+.. code-block:: none
+
+  set firewall options interface pppoe0 adjust-mss6 '1280'
+  set firewall options interface wg02 adjust-mss6 '1280'
+
+
+
+.. hint:: When doing your byte calculations, you might find useful this
+   `Visual packet size calculator <https://baturin.org/tools/encapcalc/>`_.
+
+
+Applying a Rule-Set to a Zone
+-----------------------------
+
+A named rule-set can also be applied to a zone relationship (note, zones must
+first be created):
+
+.. code-block:: none
+
+  set zone-policy zone INSIDE from OUTSIDE firewall name INSIDE-OUT
+
+How VyOS replies when being pinged
+----------------------------------
+
+By default, when VyOS receives an ICMP echo request packet destined for itself, it will answer with an ICMP echo reply, unless you avoid it through its firewall.
+
+With the firewall you can set rules to accept, drop or reject ICMP in, out or local traffic. You can also use the general **firewall all-ping** command. This command affects only to LOCAL (packets destined for your VyOS system), not to IN or OUT traffic.
+
+.. note:: **firewall all-ping** affects only to LOCAL and it always behaves in the most restrictive way
+
+.. code-block:: none
+
+  set firewall all-ping enable
+
+When the command above is set, VyOS will answer every ICMP echo request addressed to itself, but that will only happen if no other rule is applied droping or rejecting local echo requests. In case of conflict, VyOS will not answer ICMP echo requests.
+
+.. code-block:: none
+
+  set firewall all-ping disable
+
+When the comand above is set, VyOS will answer no ICMP echo request addressed to itself at all, no matter where it comes from or whether more specific rules are being applied to accept them.
+
+Example Partial Config
+----------------------
+
+.. code-block:: none
+
+  firewall {
+     all-ping enable
+     broadcast-ping disable
+     config-trap disable
+     group {
+         network-group BAD-NETWORKS {
+             network 198.51.100.0/24
+             network 203.0.113.0/24
+         }
+         network-group GOOD-NETWORKS {
+             network 192.0.2.0/24
+         }
+         port-group BAD-PORTS {
+             port 65535
+         }
+     }
+     name FROM-INTERNET {
+         default-action accept
+         description "From the Internet"
+         rule 10 {
+             action accept
+             description "Authorized Networks"
+             protocol all
+             source {
+                 group {
+                     network-group GOOD-NETWORKS
+                 }
+             }
+         }
+         rule 11 {
+             action drop
+             description "Bad Networks"
+             protocol all
+             source {
+                 group {
+                     network-group BAD-NETWORKS
+                 }
+             }
+         }
+         rule 30 {
+             action drop
+             description "BAD PORTS"
+             destination {
+                 group {
+                     port-group BAD-PORTS
+                 }
+             }
+             log enable
+             protocol all
+         }
+     }
+  }
+  interfaces {
+     ethernet eth1 {
+         address dhcp
+         description OUTSIDE
+         duplex auto
+         firewall {
+             in {
+                 name FROM-INTERNET
+             }
+         }
+     }
+  }
diff --git a/docs/configuration/highavailability/index.rst b/docs/configuration/highavailability/index.rst
new file mode 100644
index 00000000..81cc2d44
--- /dev/null
+++ b/docs/configuration/highavailability/index.rst
@@ -0,0 +1,158 @@
+.. _high-availability:
+
+High availability
+=================
+
+VRRP (Virtual Redundancy Protocol) provides active/backup redundancy for routers. 
+Every VRRP router has a physical IP/IPv6 address, and a virtual address.
+On startup, routers elect the master, and the router with the highest priority becomes the master and assigns the virtual address to its interface.
+All routers with lower priorities become backup routers. The master then starts sending keepalive packets to notify other routers that it's available.
+If the master fails and stops sending keepalive packets, the router with the next highest priority becomes the new master and takes over the virtual address.
+
+VRRP keepalive packets use multicast, and VRRP setups are limited to a single datalink layer segment.
+You can setup multiple VRRP groups (also called virtual routers). Virtual routers are identified by a VRID (Virtual Router IDentifier).
+If you setup multiple groups on the same interface, their VRIDs must be unique, but it's possible (even if not recommended for readability reasons) to use duplicate VRIDs on different interfaces.
+
+Basic setup
+-----------
+
+VRRP groups are created with the ``set high-availability vrrp group $GROUP_NAME`` commands.
+The required parameters are interface, vrid, and virtual-address.
+
+minimal config
+
+.. code-block:: none
+
+  set high-availability vrrp group Foo vrid 10
+  set high-availability vrrp group Foo interface eth0
+  set high-availability vrrp group Foo virtual-address 192.0.2.1/24
+
+You can verify your VRRP group status with the operational mode ``run show vrrp`` command:
+
+.. code-block:: none
+
+  vyos@vyos# run show vrrp 
+  Name        Interface      VRID  State    Last Transition
+  ----------  -----------  ------  -------  -----------------
+  Foo         eth1             10  MASTER   2s
+
+IPv6 support
+------------
+
+The ``virtual-address`` parameter can be either an IPv4 or IPv6 address, but you cannot mix IPv4 and IPv6 in the same group, and will need to create groups with different VRIDs specially for IPv4 and IPv6.
+
+Disabling a VRRP group
+----------------------
+
+You can disable a VRRP group with ``disable`` option:
+
+.. code-block:: none
+
+  set high-availability vrrp group Foo disable
+
+A disabled group will be removed from the VRRP process and your router will not participate in VRRP for that VRID. It will disappear from operational mode commands output, rather than enter the backup state.
+
+Setting VRRP group priority
+---------------------------
+
+VRRP priority can be set with ``priority`` option:
+
+.. code-block:: none
+
+  set high-availability vrrp group Foo priority 200
+
+The priority must be an integer number from 1 to 255. Higher priority value increases router's precedence in the master elections.
+
+Sync groups
+-----------
+
+A sync group allows VRRP groups to transition together.  
+
+.. code-block:: none
+
+    edit high-availability
+    set sync-group MAIN member VLAN9
+    set sync-group MAIN member VLAN20
+
+In the following example, when VLAN9 transitions, VLAN20 will also transition:
+
+.. code-block:: none
+
+    vrrp {
+        group VLAN9 {
+            interface eth0.9
+            virtual-address 10.9.1.1/24
+            priority 200
+            vrid 9
+        }
+        group VLAN20 {
+            interface eth0.20
+            priority 200
+            virtual-address 10.20.20.1/24
+            vrid 20
+        }
+        sync-group MAIN {
+            member VLAN20
+            member VLAN9
+        }
+    }
+
+
+.. warning:: All items in a sync group should be similarly configured.  If one VRRP group is set to a different premption delay or priority, it would result in an endless transition loop.
+
+
+Preemption
+----------
+
+VRRP can use two modes: preemptive and non-preemptive. In the preemptive mode, if a router with a higher priority fails and then comes back, routers with lower priority will give up their master status. In non-preemptive mode, the newly elected master will keep the master status and the virtual address indefinitely.
+
+By default VRRP uses preemption. You can disable it with the "no-preempt" option:
+
+.. code-block:: none
+
+  set high-availability vrrp group Foo no-preempt
+
+You can also configure the time interval for preemption with the "preempt-delay" option. For example, to set the higher priority router to take over in 180 seconds, use:
+
+.. code-block:: none
+
+  set high-availability vrrp group Foo preempt-delay 180
+
+Unicast VRRP
+------------
+
+By default VRRP uses multicast packets. If your network does not support multicast for whatever reason, you can make VRRP use unicast communication instead.
+
+.. code-block:: none
+
+  set high-availability vrrp group Foo peer-address 192.0.2.10
+  set high-availability vrrp group Foo hello-source-address 192.0.2.15
+
+Scripting
+---------
+
+VRRP functionality can be extended with scripts. VyOS supports two kinds of scripts: health check scripts and transition scripts. Health check scripts execute custom checks in addition to the master router reachability.
+Transition scripts are executed when VRRP state changes from master to backup or fault and vice versa and can be used to enable or disable certain services, for example.
+
+Health check scripts
+^^^^^^^^^^^^^^^^^^^^
+
+This setup will make the VRRP process execute the ``/config/scripts/vrrp-check.sh script`` every 60 seconds, and transition the group to the fault state if it fails (i.e. exits with non-zero status) three times:
+
+.. code-block:: none
+
+  set high-availability vrrp group Foo health-check script /config/scripts/vrrp-check.sh
+  set high-availability vrrp group Foo health-check interval 60
+  set high-availability vrrp group Foo health-check failure-count 3
+
+Transition scripts
+^^^^^^^^^^^^^^^^^^
+
+Transition scripts can help you implement various fixups, such as starting and stopping services, or even modifying the VyOS config on VRRP transition.
+This setup will make the VRRP process execute the ``/config/scripts/vrrp-fail.sh`` with argument ``Foo`` when VRRP fails, and the ``/config/scripts/vrrp-master.sh`` when the router becomes the master:
+
+.. code-block:: none
+
+  set high-availability vrrp group Foo transition-script backup "/config/scripts/vrrp-fail.sh Foo"
+  set high-availability vrrp group Foo transition-script fault "/config/scripts/vrrp-fail.sh Foo"
+  set high-availability vrrp group Foo transition-script master "/config/scripts/vrrp-master.sh Foo"
diff --git a/docs/configuration/index.rst b/docs/configuration/index.rst
new file mode 100644
index 00000000..ee2c6354
--- /dev/null
+++ b/docs/configuration/index.rst
@@ -0,0 +1,22 @@
+###################
+Configuration Guide
+###################
+
+The following structure respresent the cli structure.
+
+.. toctree::
+   :maxdepth: 1
+   :includehidden:
+
+   firewall/index
+   highavailability/index
+   interfaces/index
+   loadbalancing/index
+   nat/index
+   policy/index
+   protocols/index
+   service/index
+   system/index
+   trafficpolicy/index
+   vpn/index
+   zonepolicy/index
\ No newline at end of file
diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst
new file mode 100644
index 00000000..76c8714a
--- /dev/null
+++ b/docs/configuration/interfaces/bonding.rst
@@ -0,0 +1,75 @@
+Bonding
+-------
+
+You can combine (aggregate) 2 or more physical interfaces into a single
+logical one. It's called bonding, or LAG, or ether-channel, or port-channel.
+
+Create interface bondX, where X is just a number:
+
+.. code-block:: none
+
+  set interfaces bonding bond0 description 'my-sw1 int 23 and 24'
+
+You are able to choose a hash policy:
+
+.. code-block:: none
+
+  vyos@vyos# set interfaces bonding bond0 hash-policy
+  Possible completions:
+    layer2       use MAC addresses to generate the hash (802.3ad)
+    layer2+3     combine MAC address and IP address to make hash
+    layer3+4     combine IP address and port to make hash
+
+For example:
+
+.. code-block:: none
+
+  set interfaces bonding bond0 hash-policy 'layer2'
+
+You may want to set IEEE 802.3ad Dynamic link aggregation (802.3ad) AKA LACP
+(don't forget to setup it on the other end of these links):
+
+.. code-block:: none
+
+ set interfaces bonding bond0 mode '802.3ad'
+
+or some other modes:
+
+.. code-block:: none
+
+  vyos@vyos# set interfaces bonding bond0 mode
+  Possible completions:
+    802.3ad      IEEE 802.3ad Dynamic link aggregation (Default)
+    active-backup
+                 Fault tolerant: only one slave in the bond is active
+    broadcast    Fault tolerant: transmits everything on all slave interfaces
+    round-robin  Load balance: transmit packets in sequential order
+    transmit-load-balance
+                 Load balance: adapts based on transmit load and speed
+    adaptive-load-balance
+                 Load balance: adapts based on transmit and receive plus ARP
+    xor-hash     Load balance: distribute based on MAC address
+
+Now bond some physical interfaces into bond0:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 bond-group 'bond0'
+  set interfaces ethernet eth0 description 'member of bond0'
+  set interfaces ethernet eth1 bond-group 'bond0'
+  set interfaces ethernet eth1 description 'member of bond0'
+
+After a commit you may treat bond0 as almost a physical interface (you can't
+change its` duplex, for example) and assign IPs or VIFs on it.
+
+You may check the result:
+
+.. code-block:: none
+
+  vyos@vyos# run sh interfaces bonding
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  bond0            -                                 u/u  my-sw1 int 23 and 24
+  bond0.10         192.168.0.1/24                    u/u  office-net
+  bond0.100        10.10.10.1/24                     u/u  management-net
diff --git a/docs/configuration/interfaces/bridge.rst b/docs/configuration/interfaces/bridge.rst
new file mode 100644
index 00000000..30ece53d
--- /dev/null
+++ b/docs/configuration/interfaces/bridge.rst
@@ -0,0 +1,104 @@
+Bridging
+--------
+
+Interfaces in VyOS can be bridged together to provide software switching of
+Layer-2 traffic.
+
+A bridge is created when a bridge interface is defined. In the example below
+we will be creating a bridge for VLAN 100 and assigning a VIF to the bridge.
+
+.. code-block:: none
+
+  set interfaces bridge 'br100'
+  set interfaces ethernet eth1 vif 100 bridge-group bridge br100
+    
+Interfaces assigned to a bridge-group do not have address configuration. An IP
+address can be assigned to the bridge interface itself, however, like any
+normal interface.
+
+.. code-block:: none
+
+  set interfaces bridge br100 address '192.168.100.1/24'
+  set interfaces bridge br100 address '2001:db8:100::1/64'
+
+Example Result:
+
+.. code-block:: none
+
+  bridge br100 {
+      address 192.168.100.1/24
+      address 2001:db8:100::1/64
+  }
+  [...]
+  ethernet eth1 {
+  [...]
+      vif 100 {
+          bridge-group {
+              bridge br100
+          }
+      }
+  }
+
+In addition to normal IP interface configuration, bridge interfaces support
+Spanning-Tree Protocol. STP is disabled by default.
+
+.. note:: Please use caution when introducing spanning-tree protocol on a
+   network as it may result in topology changes.
+
+To enable spanning-tree use the
+`set interfaces bridge <name> stp true` command:
+
+.. code-block:: none
+
+  set interfaces bridge br100 stp true
+
+STP `priority`, `forwarding-delay`, `hello-time`, and `max-age` can be
+configured for the bridge-group. The MAC aging time can also be configured
+using the `aging` directive.
+
+For member interfaces, the bridge-group `priority` and `cost` can be
+configured.
+
+The `show bridge` operational command can be used to display configured
+bridges:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show bridge
+  bridge name     bridge id               STP enabled     interfaces
+  br100           0000.000c29443b19       yes             eth1.100
+
+If spanning-tree is enabled, the `show bridge <name> spanning-tree` command
+can be used to show STP configuration:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show bridge br100 spanning-tree
+  br100
+   bridge id              0000.000c29443b19
+   designated root        0000.000c29443b19
+   root port                 0                    path cost                  0
+   max age                  20.00                 bridge max age            20.00
+   hello time                2.00                 bridge hello time          2.00
+   forward delay            15.00                 bridge forward delay      15.00
+   ageing time             300.00
+   hello timer               0.47                 tcn timer                  0.00
+   topology change timer     0.00                 gc timer                  64.63
+   flags
+
+  eth1.100 (1)
+   port id                8001                    state                forwarding
+   designated root        0000.000c29443b19       path cost                  4
+   designated bridge      0000.000c29443b19       message age timer          0.00
+   designated port        8001                    forward delay timer        0.00
+   designated cost           0                    hold timer                 0.00
+   flags
+
+The MAC address-table for a bridge can be displayed using the
+`show bridge <name> macs` command:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show bridge br100 macs
+  port no mac addr                is local?       ageing timer
+    1     00:0c:29:44:3b:19       yes                0.00
diff --git a/docs/configuration/interfaces/dummy.rst b/docs/configuration/interfaces/dummy.rst
new file mode 100644
index 00000000..dea4c387
--- /dev/null
+++ b/docs/configuration/interfaces/dummy.rst
@@ -0,0 +1,21 @@
+.. _dummy-interface:
+
+Dummy Interfaces
+----------------
+
+Dummy interfaces — much like the loopback, except you can have as many as you want.
+Dummy interfaces can be used as interfaces that always stay up (in the same fashion to loopbacks in IOS), or for testing purposes.
+
+Configuration commands:
+
+.. code-block:: none
+
+    interfaces
+        dummy <dum[0-999]>
+        + address           IP address
+        description         Description
+        disable             Disable interface
+        > ip                IPv4 routing parameters
+        > ipv6              IPv6 routing parameters
+        redirect            Incoming packet redirection destination
+        > traffic-policy    Traffic-policy for interface
\ No newline at end of file
diff --git a/docs/configuration/interfaces/ethernet.rst b/docs/configuration/interfaces/ethernet.rst
new file mode 100644
index 00000000..18530c8a
--- /dev/null
+++ b/docs/configuration/interfaces/ethernet.rst
@@ -0,0 +1,263 @@
+
+Ethernet Interfaces
+-------------------
+.. _interfaces-ethernet:
+
+Ethernet interfaces allow for the configuration of speed, duplex, and hw-id
+(MAC address). Below is an example configuration:
+
+.. code-block:: none
+
+  set interfaces ethernet eth1 address '192.168.0.1/24'
+  set interfaces ethernet eth1 address '2001:db8:1::ffff/64'
+  set interfaces ethernet eth1 description 'INSIDE'
+  set interfaces ethernet eth1 duplex 'auto'
+  set interfaces ethernet eth1 speed 'auto'
+
+Resulting in:
+
+.. code-block:: none
+
+  ethernet eth1 {
+      address 192.168.0.1/24
+      address 2001:db8:1::ffff/64
+      description INSIDE
+      duplex auto
+      hw-id 00:0c:29:44:3b:19
+      smp_affinity auto
+      speed auto
+  }
+
+In addition, Ethernet interfaces provide the extended operational commands:
+
+* `show interfaces ethernet <name> physical`
+* `show interfaces ethernet <name> statistics` 
+
+Statistics available are driver dependent.
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces ethernet eth0 physical
+  Settings for eth0:
+          Supported ports: [ TP ]
+          Supported link modes:   10baseT/Half 10baseT/Full
+                                  100baseT/Half 100baseT/Full
+                                  1000baseT/Full
+          Supports auto-negotiation: Yes
+          Advertised link modes:  10baseT/Half 10baseT/Full
+                                  100baseT/Half 100baseT/Full
+                                  1000baseT/Full
+          Advertised pause frame use: No
+          Advertised auto-negotiation: Yes
+          Speed: 1000Mb/s
+          Duplex: Full
+          Port: Twisted Pair
+          PHYAD: 0
+          Transceiver: internal
+          Auto-negotiation: on
+          MDI-X: Unknown
+          Supports Wake-on: d
+          Wake-on: d
+          Current message level: 0x00000007 (7)
+          Link detected: yes
+  driver: e1000
+  version: 7.3.21-k8-NAPI
+  firmware-version:
+  bus-info: 0000:02:01.0
+
+  vyos@vyos:~$ show interfaces ethernet eth0 statistics
+  NIC statistics:
+       rx_packets: 3530
+       tx_packets: 2179
+  [...]
+
+VLAN Sub-Interfaces (802.1Q)
+----------------------------
+.. _interfaces-vlan:
+
+802.1Q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The
+term used for this is `vif`. Configuration of a tagged sub-interface is
+accomplished using the configuration command
+`set interfaces ethernet <name> vif <vlan-id>`.
+
+.. code-block:: none
+
+  set interfaces ethernet eth1 vif 100 description 'VLAN 100'
+  set interfaces ethernet eth1 vif 100 address '192.168.100.1/24'
+  set interfaces ethernet eth1 vif 100 address '2001:db8:100::1/64'
+
+Resulting in:
+
+.. code-block:: none
+
+  ethernet eth1 {
+      address 192.168.100.1/24
+      address 2001:db8:100::1/64
+      description INSIDE
+      duplex auto
+      hw-id 00:0c:29:44:3b:19
+      smp_affinity auto
+      speed auto
+      vif 100 {
+          address 192.168.100.1/24
+          description "VLAN 100"
+      }
+  }
+
+VLAN interfaces are shown as `<name>.<vlan-id>`, e.g. `eth1.100`:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             172.16.51.129/24                  u/u  OUTSIDE
+  eth1             192.168.0.1/24                    u/u  INSIDE
+  eth1.100         192.168.100.1/24                  u/u  VLAN 100
+  lo               127.0.0.1/8                       u/u
+                   ::1/128
+
+
+
+.. _interfaces-qinq:
+
+QinQ
+----
+
+QinQ (802.1ad_) — allows multiple VLAN tags to be inserted into a single frame.
+
+QinQ can be used to tunnel vlans in a vlan.
+
+**vif-s** and **vif-c** stand for the ethertype tags that get set:
+
+The inner tag is the tag which is closest to the payload portion of the frame; it is officially called C-TAG (Customer tag, with ethertype 0x8100).
+The outer tag is the one closer/closest to the Ethernet header; its name is S-TAG (Service tag, ethertype 0x88a8).
+
+Configuration commands:
+
+.. code-block:: none
+
+  interfaces
+      ethernet <eth[0-999]>
+          address <ipv4>
+          address <ipv6>
+          description <txt>
+          disable
+          ip
+              <usual IP options>
+          ipv6
+              <usual IPv6 options>
+          vif-s <[0-4096]>
+              address <ipv4>
+              address <ipv6>
+              description <txt>
+              disable
+              ip
+                  <usual IP options>
+              ipv6
+                  <usual IPv6 options>
+              vif-c <[0-4096]>
+                  address <ipv4>
+                  address <ipv6>
+                  description <txt>
+                  disable
+                  ip
+                      <usual IP options>
+                  ipv6
+                      <usual IPv6 options>
+
+
+Example:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 vif-s 333
+  set interfaces ethernet eth0 vif-s 333 address 192.0.2.10/32
+  set interfaces ethernet eth0 vif-s 333 vif-c 777
+  set interfaces ethernet eth0 vif-s 333 vif-c 777 address 10.10.10.10/24
+
+.. _802.1ad: https://en.wikipedia.org/wiki/IEEE_802.1ad
+
+.. _pppoe:
+
+
+PPPoE
+=====
+
+There are two main ways to setup VyOS to connect over a PPPoE internet connection. This is due to most ISPs (Internet Service Providers) providing a DSL modem that is also a wireless router.
+
+**First Method:** (Common for Homes)
+
+In this method, the DSL Modem/Router connects to the ISP for you with your credentials preprogrammed into the device.  This gives you an RFC1918_ address, such as 192.168.1.0/24 by default.
+
+For a simple home network using just the ISP's equipment, this is usually desirable.  But if you want to run VyOS as your firewall and router, this will result in having a double NAT and firewall setup. This results in a few extra layers of complexity, particularly if you use some NAT or tunnel features.
+
+**Second Method:** (Common for Businesses)
+
+In order to have full control and make use of multiple static public IP addresses, your VyOS will have to initiate the PPPoE connection and control it.
+In order for this method to work, you will have to figure out how to make your DSL Modem/Router switch into a Bridged Mode so it only acts as a DSL Transceiver device to connect between the Ethernet link of your VyOS and the phone cable.
+Once your DSL Transceiver is in Bridge Mode, you should get no IP address from it.
+Please make sure you connect to the Ethernet Port 1 if your DSL Transeiver has a switch, as some of them only work this way.
+Once you have an Ethernet device connected, i.e. eth0, then you can configure it to open the PPPoE session for you and your DSL Transceiver (Modem/Router) just acts to translate your messages in a way that vDSL/aDSL understands.
+
+**Here is an example configuration:**
+
+.. code-block:: none
+
+  set interface ethernet eth0 description "DSL Modem"
+  set interface ethernet eth0 duplex auto
+  set interface ethernet eth0 smp_affinity auto
+  set interface ethernet eth0 speed auto
+  set interface ethernet eth0 pppoe 0 default-route auto
+  set interface ethernet eth0 pppoe 0 mtu 1492
+  set interface ethernet eth0 pppoe 0 name-server auto
+  set interface ethernet eth0 pppoe 0 user-id <PPPoE Username>
+  set interface ethernet eth0 pppoe 0 password <PPPoE Password>
+
+
+* You should add a firewall to your configuration above as well by assigning it to the pppoe0 itself as shown here:
+
+.. code-block:: none
+
+  set interface ethernet eth0 pppoe 0 firewall in name NET-IN
+  set interface ethernet eth0 pppoe 0 firewall local name NET-LOCAL
+  set interface ethernet eth0 pppoe 0 firewall out name NET-OUT
+
+* You need your PPPoE credentials from your DSL ISP in order to configure this. The usual username is in the form of name@host.net but may vary depending on ISP.
+* The largest MTU size you can use with DSL is 1492 due to PPPoE overhead. If you are switching from a DHCP based ISP like cable then be aware that things like VPN links may need to have their MTU sizes adjusted to work within this limit.
+* With the ``default-route`` option set to ``auto``, VyOS will only add the Default Gateway you receive from your DSL ISP to the routing table if you have no other WAN connections. If you wish to use a Dual WAN connection, change the ``default-route`` option to ``force``.
+
+Handling and troubleshooting
+----------------------------
+
+You can test connecting and disconnecting with the below commands:
+
+.. code-block:: none
+
+  disconnect interface 0
+  connect interface 0
+
+
+You can check the PPPoE connection logs with the following:
+
+This command shows the current statistics, status and some of the settings (i.e. MTU) for the current connection on pppoe0.
+
+.. code-block:: none
+
+  show interfaces pppoe 0
+
+This command shows the entire log for the PPPoE connection starting with the oldest data. Scroll down with the <space> key to reach the end where the current data is.
+
+.. code-block:: none
+
+  show interfaces pppoe 0 log
+
+
+This command shows the same log as without the 'tail' option but only starts with the last few lines and continues to show added lines until you exit with ``Ctrl + x``
+
+.. code-block:: none
+
+  show interfaces pppoe 0 log tail
+
+.. _RFC1918: https://tools.ietf.org/html/rfc1918
diff --git a/docs/configuration/interfaces/index.rst b/docs/configuration/interfaces/index.rst
new file mode 100644
index 00000000..e22c8708
--- /dev/null
+++ b/docs/configuration/interfaces/index.rst
@@ -0,0 +1,199 @@
+##########
+Interfaces
+##########
+
+
+.. toctree::
+   :maxdepth: 1
+   :includehidden:
+
+   bonding
+   bridge
+   dummy
+   ethernet
+   l2tpv3
+   openvpn
+   tunnel
+   vxlan
+   wireguard
+   wireless
+
+
+.. _interfaces-addresses:
+
+Interface Addresses
+-------------------
+
+Each interface can be configured with a description and address. Interface
+addresses might be:
+
+* Static IPv4 `address 172.16.51.129/24`
+* Static IPv6 `address 2001:db8:1::ffff/64`
+* DHCP IPv4 `address dhcp`
+* DHCP IPv6 `address dhcpv6`
+
+An interface description is assigned using the following command:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 description 'OUTSIDE'
+
+IPv4
+^^^^
+
+Static Address
+**************
+
+This method is supported on all interfaces, apart from OpenVPN that uses
+different syntax and wireless modems that are always autoconfigured through
+PPP.
+
+The command is `set interfaces $type $name address $address`. Examples:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address 192.0.2.1/24
+  set interfaces tunnel tun0 address 10.0.0.1/30
+  set interfaces bridge br0 address 203.0.113.45/26
+  set interfaces ethernet eth0 vif 30 address 192.0.30.254/24
+
+DHCP
+****
+
+This method is supported on all physical interfaces, and those that are
+directly connected to a physical interface (ethernet, VLAN, bridge, bond,
+pseudo-ethernet, wireless).
+
+The command is `set interfaces $type $name address dhcp`. Examples:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 vif 90 address dhcp
+  set interfaces bridge br0 address dhcp
+
+IPv6
+^^^^
+
+Static Address
+**************
+
+This method is supported on all interfaces, apart from OpenVPN that uses
+different syntax and wireless modems that are always autoconfigured through
+PPP. Static IPv6 addresses are supported on all interfaces
+except :ref:`interfaces-tunnel`.
+
+The command is `set interfaces $type $name address $address`. Examples:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address 2001:db8:100::ffff/64
+  set interfaces tunnel tun0 address 2001:db8::1/64
+  set interfaces bridge br0 address  2001:db8:200::1/64
+  set interfaces ethernet eth0 vif 30 address 2001:db8:3::ffff/64
+
+DHCP
+****
+
+This method is supported on all physical interfaces, and those that are
+directly connected to a physical interface (ethernet, VLAN, bridge, bond,
+pseudo-ethernet, wireless).
+
+The command is `set interfaces $type $name address dhcpv6`. Examples:
+
+.. code-block:: none
+
+  set interfaces bonding bond1 address dhcpv6
+  set interfaces bridge br0 vif 56 address dhcpv6
+
+Autoconfiguration (SLAAC)
+*************************
+
+SLAAC is specified in RFC4862_. This method is supported on all physical
+interfaces, and those that are directly connected to a physical interface
+(ethernet, VLAN, bridge, bond, pseudo-ethernet, wireless).
+
+The command is `set interfaces $type $name ipv6 address autoconf`. Examples:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 vif 90 ipv6 address autoconf
+  set interfaces bridge br0 ipv6 address autoconf
+
+.. note:: This method automatically disables IPv6 traffic forwarding on the
+   interface in question.
+
+EUI-64
+******
+
+EUI-64 (64-Bit Extended Unique Identifier) as specified in RFC4291_. IPv6
+addresses in /64 networks can be automatically generated from the prefix and
+MAC address, if you specify the prefix.
+
+The command is `set interfaces $type $name ipv6 address eui64 $prefix`.
+Examples:
+
+.. code-block:: none
+
+  set interfaces bridge br0 ipv6 address eui64 2001:db8:beef::/64
+  set interfaces pseudo-ethernet peth0 ipv6 address eui64 2001:db8:aa::/64
+
+
+Router Advertisements
+*********************
+
+Router advertisements are described in `RFC4861 section 4.2`_. They are part of what is known as SLAAC (Stateless Address Autoconfiguration). 
+
+To enable or disable, use:
+
+.. code-block:: none
+
+  set interfaces <interface> ipv6 router-advert send-advert <true or false>
+
+
+To set the options described in "Router Advertisement Message Format":
+
+.. code-block:: none
+
+  vyos@vyos#  set interfaces <interface> ipv6 router-advert
+  Possible completions:
+    cur-hop-limit         Value to be placed in the "Current Hop Limit" field in RAs
+    default-lifetime      Value to be placed in "Router Lifetime" field in RAs
+    default-preference    Default router preference
+    link-mtu              Value of link MTU to place in RAs
+    managed-flag          Value for "managed address configuration" flag in RAs
+    max-interval          Maximum interval between unsolicited multicast RAs
+    min-interval          Minimum interval between unsolicited multicast RAs
+  +  name-server          IPv6 address of a Recursive DNS Server
+    other-config-flag     Value to be placed in the "other configuration" flag in RAs
+  +> prefix               IPv6 prefix to be advertised in Router Advertisements (RAs)
+    reachable-time        Value to be placed in "Reachable Time" field in RAs
+    retrans-timer         Value to place in "Retrans Timer" field in RAs.
+    send-advert           Enable/disable sending RAs
+
+
+**Prefix Information**
+
+Prefix information is described in `RFC4861 section 4.6.2`_
+
+.. code-block:: none
+
+  vyos@vyos# set interfaces <interface> ipv6 router-advert prefix <h:h:h:h:h:h:h:h/x>
+  Possible completions:
+    autonomous-flag       Whether prefix can be used for address auto-configuration
+    on-link-flag          Flag that prefix can be used for on-link determination
+    preferred-lifetime    Time in seconds that the prefix will remain preferred
+    valid-lifetime        Time in seconds that the prefix will remain valid
+
+**Receiving Router Advertisements**
+
+To receive and accept RAs on an interface, you need to enable it with the following configuration command
+
+.. code-block:: none
+
+  vyos@vyos# set system sysctl custom net.ipv6.conf.<interface name>.accept_ra value 2
+
+
+.. _`RFC4861 section 4.6.2`: https://tools.ietf.org/html/rfc4861#section-4.6.2
+.. _`RFC4861 section 4.2`: https://tools.ietf.org/html/rfc4861#section-4.2
+.. _RFC4862: https://tools.ietf.org/html/rfc4862
+.. _RFC4291: http://tools.ietf.org/html/rfc4291#section-2.5.1
diff --git a/docs/configuration/interfaces/l2tpv3.rst b/docs/configuration/interfaces/l2tpv3.rst
new file mode 100644
index 00000000..4514412d
--- /dev/null
+++ b/docs/configuration/interfaces/l2tpv3.rst
@@ -0,0 +1,119 @@
+.. _l2tpv3-interface:
+
+L2TPv3 Interfaces
+-----------------
+
+L2TPv3 is a pseudowire protocol, you can read more about here `Wikipedia L2TPv3`_ or `RFC3921`_
+
+L2TPv3 can transport any traffic including ethernet frames. L2TPv2 is limited to PPP.
+
+
+L2TPv3 over IP
+^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  # show interfaces l2tpv3 
+  l2tpv3 l2tpeth10 {
+      address 192.168.37.1/27
+      encapsulation ip
+      local-ip 192.0.2.1
+      peer-session-id 100
+      peer-tunnel-id 200
+      remote-ip 203.0.113.24
+      session-id 100
+      tunnel-id 200
+  }
+
+Inverse configuration has to be applied to the remote side.
+
+L2TPv3 over UDP
+^^^^^^^^^^^^^^^
+
+UDP mode works better with NAT:
+
+* Set local-ip to your local IP (LAN).
+* Add a forwarding rule matching UDP port on your internet router.
+
+.. code-block:: none
+
+  # show interfaces l2tpv3 
+  l2tpv3 l2tpeth10 {
+      address 192.168.37.1/27
+      destination-port 9001
+      encapsulation udp
+      local-ip 192.0.2.1
+      peer-session-id 100
+      peer-tunnel-id 200
+      remote-ip 203.0.113.24
+      session-id 100
+      source-port 9000
+      tunnel-id 200
+  }
+
+To create more than one tunnel, use distinct UDP ports.
+
+
+L2TPv3 over IPSec, L2 VPN (bridge)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+This is the LAN extension use case. The eth0 port of the distant VPN peers will be directly connected like if there was a switch between them.
+
+IPSec:
+
+.. code-block:: none
+
+  set vpn ipsec ipsec-interfaces <VPN-interface>
+  set vpn ipsec esp-group test-ESP-1 compression 'disable'
+  set vpn ipsec esp-group test-ESP-1 lifetime '3600'
+  set vpn ipsec esp-group test-ESP-1 mode 'transport'
+  set vpn ipsec esp-group test-ESP-1 pfs 'enable'
+  set vpn ipsec esp-group test-ESP-1 proposal 1 encryption 'aes128'
+  set vpn ipsec esp-group test-ESP-1 proposal 1 hash 'sha1'
+  set vpn ipsec ike-group test-IKE-1 ikev2-reauth 'no'
+  set vpn ipsec ike-group test-IKE-1 key-exchange 'ikev1'
+  set vpn ipsec ike-group test-IKE-1 lifetime '3600'
+  set vpn ipsec ike-group test-IKE-1 proposal 1 dh-group '5'
+  set vpn ipsec ike-group test-IKE-1 proposal 1 encryption 'aes128'
+  set vpn ipsec ike-group test-IKE-1 proposal 1 hash 'sha1'
+  set vpn ipsec site-to-site peer <peer-ip> authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer <peer-ip> authentication pre-shared-secret <pre-shared-key>
+  set vpn ipsec site-to-site peer <peer-ip> connection-type 'initiate'
+  set vpn ipsec site-to-site peer <peer-ip> ike-group 'test-IKE-1'
+  set vpn ipsec site-to-site peer <peer-ip> ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer <peer-ip> local-address <local-ip>
+  set vpn ipsec site-to-site peer <peer-ip> tunnel 1 allow-nat-networks 'disable'
+  set vpn ipsec site-to-site peer <peer-ip> tunnel 1 allow-public-networks 'disable'
+  set vpn ipsec site-to-site peer <peer-ip> tunnel 1 esp-group 'test-ESP-1'
+  set vpn ipsec site-to-site peer <peer-ip> tunnel 1 protocol 'l2tp'
+
+Bridge:
+
+.. code-block:: none
+
+  set interfaces bridge br0 description 'L2 VPN Bridge'
+  # remote side in this example:
+  # set interfaces bridge br0 address '172.16.30.18/30'
+  set interfaces bridge br0 address '172.16.30.17/30'
+  set interfaces ethernet eth0 bridge-group bridge 'br0'
+  set interfaces ethernet eth0 description 'L2 VPN Physical port'
+
+L2TPv3:
+
+.. code-block:: none
+
+  set interfaces l2tpv3 l2tpeth0 bridge-group bridge 'br0'
+  set interfaces l2tpv3 l2tpeth0 description 'L2 VPN Tunnel'
+  set interfaces l2tpv3 l2tpeth0 destination-port '5000'
+  set interfaces l2tpv3 l2tpeth0 encapsulation 'ip'
+  set interfaces l2tpv3 l2tpeth0 local-ip <local-ip>
+  set interfaces l2tpv3 l2tpeth0 mtu '1500'
+  set interfaces l2tpv3 l2tpeth0 peer-session-id '110'
+  set interfaces l2tpv3 l2tpeth0 peer-tunnel-id '10'
+  set interfaces l2tpv3 l2tpeth0 remote-ip <peer-ip>
+  set interfaces l2tpv3 l2tpeth0 session-id '110'
+  set interfaces l2tpv3 l2tpeth0 source-port '5000'
+  set interfaces l2tpv3 l2tpeth0 tunnel-id '10'
+
+.. _`Wikipedia L2TPv3`: http://en.wikipedia.org/wiki/L2TPv3
+.. _`RFC3921`: https://tools.ietf.org/html/rfc3931
\ No newline at end of file
diff --git a/docs/configuration/interfaces/openvpn.rst b/docs/configuration/interfaces/openvpn.rst
new file mode 100644
index 00000000..b2559c95
--- /dev/null
+++ b/docs/configuration/interfaces/openvpn.rst
@@ -0,0 +1,468 @@
+.. _openvpn:
+
+#######
+OpenVPN
+#######
+
+Traditionally hardware routers implement IPsec exclusively due to relative
+ease of implementing it in hardware and insufficient CPU power for doing
+encryption in software. Since VyOS is a software router, this is less of a
+concern. OpenVPN has been widely used on UNIX platform for a long time and is
+a popular option for remote access VPN, though it's also capable of
+site-to-site connections.
+
+Advantages of OpenVPN are:
+
+* It uses a single TCP or UDP connection and does not rely on packet source
+  addresses, so it will work even through a double NAT: perfect for public
+  hotspots and such
+
+* It's easy to setup and offers very flexible split tunneling
+
+* There's a variety of client GUI frontends for any platform
+
+Disadvantages are:
+
+* It's slower than IPsec due to higher protocol overhead and the fact it runs
+  in user mode while IPsec, on Linux, is in kernel mode
+
+* None of the operating systems have client software installed by default
+
+In the VyOS CLI, a key point often overlooked is that rather than being
+configured using the `set vpn` stanza, OpenVPN is configured as a network
+interface using `set interfaces openvpn`.
+
+OpenVPN Site-To-Site
+####################
+
+While many are aware of OpenVPN as a Client VPN solution, it is often
+overlooked as a site-to-site VPN solution due to lack of support for this mode
+in many router platforms.
+
+Site-to-site mode supports x.509 but doesn't require it and can also work with
+static keys, which is simpler in many cases. In this example, we'll configure
+a simple site-to-site OpenVPN tunnel using a 2048-bit pre-shared key.
+
+First, one one of the systems generate the key using the operational command
+``generate openvpn key <filename>``. This will generate a key with the name
+provided in the `/config/auth/` directory. Once generated, you will need to
+copy this key to the remote router.
+
+In our example, we used the filename `openvpn-1.key` which we will reference
+in our configuration.
+
+* The public IP address of the local side of the VPN will be 198.51.100.10
+* The remote will be 203.0.113.11
+* The tunnel will use 10.255.1.1 for the local IP and 10.255.1.2 for the remote.
+* OpenVPN allows for either TCP or UDP. UDP will provide the lowest latency,
+  while TCP will work better for lossy connections; generally UDP is preferred
+  when possible.
+* The official port for OpenVPN is 1194, which we reserve for client VPN; we
+  will use 1195 for site-to-site VPN.
+* The `persistent-tunnel` directive will allow us to configure tunnel-related
+  attributes, such as firewall policy as we would on any normal network
+  interface.
+* If known, the IP of the remote router can be configured using the
+  `remote-host` directive; if unknown, it can be omitted. We will assume a
+  dynamic IP for our remote router.
+
+Local Configuration:
+
+.. code-block:: none
+
+  set interfaces openvpn vtun1 mode site-to-site
+  set interfaces openvpn vtun1 protocol udp
+  set interfaces openvpn vtun1 persistent-tunnel
+  set interfaces openvpn vtun1 local-host '198.51.100.10'
+  set interfaces openvpn vtun1 local-port '1195'
+  set interfaces openvpn vtun1 remote-port '1195'
+  set interfaces openvpn vtun1 shared-secret-key-file '/config/auth/openvpn-1.key'
+  set interfaces openvpn vtun1 local-address '10.255.1.1'
+  set interfaces openvpn vtun1 remote-address '10.255.1.2'
+
+Remote Configuration:
+
+.. code-block:: none
+
+  set interfaces openvpn vtun1 mode site-to-site
+  set interfaces openvpn vtun1 protocol udp
+  set interfaces openvpn vtun1 persistent-tunnel
+  set interfaces openvpn vtun1 remote-host '198.51.100.10'
+  set interfaces openvpn vtun1 local-port '1195'
+  set interfaces openvpn vtun1 remote-port '1195'
+  set interfaces openvpn vtun1 shared-secret-key-file '/config/auth/openvpn-1.key'
+  set interfaces openvpn vtun1 local-address '10.255.1.2'
+  set interfaces openvpn vtun1 remote-address '10.255.1.1'
+
+The configurations above will default to using 128-bit Blowfish in CBC mode
+for encryption and SHA-1 for HMAC authentication. These are both considered
+weak, but a number of other encryption and hashing algorithms are available:
+
+For Encryption:
+
+.. code-block:: none
+
+  vyos@vyos# set interfaces openvpn vtun1 encryption
+  Possible completions:
+    des          DES algorithm
+    3des         DES algorithm with triple encryption
+    bf128        Blowfish algorithm with 128-bit key
+    bf256        Blowfish algorithm with 256-bit key
+    aes128       AES algorithm with 128-bit key
+    aes192       AES algorithm with 192-bit key
+    aes256       AES algorithm with 256-bit key
+
+For Hashing:
+
+.. code-block:: none
+
+  vyos@vyos# set interfaces openvpn vtun1 hash
+  Possible completions:
+    md5          MD5 algorithm
+    sha1         SHA-1 algorithm
+    sha256       SHA-256 algorithm
+    sha512       SHA-512 algorithm
+
+If you change the default encryption and hashing algorithms, be sure that the
+local and remote ends have matching configurations, otherwise the tunnel will
+not come up.
+
+Static routes can be configured referencing the tunnel interface; for example,
+the local router will use a network of 10.0.0.0/16, while the remote has a
+network of 10.1.0.0/16:
+
+Local Configuration:
+
+.. code-block:: none
+
+  set protocols static interface-route 10.1.0.0/16 next-hop-interface vtun1
+
+Remote Configuration:
+
+.. code-block:: none
+
+  set protocols static interface-route 10.0.0.0/16 next-hop-interface vtun1
+
+Firewall policy can also be applied to the tunnel interface for `local`, `in`,
+and `out` directions and function identically to ethernet interfaces.
+
+If making use of multiple tunnels, OpenVPN must have a way to distinguish
+between different tunnels aside from the pre-shared-key. This is either by
+referencing IP address or port number. One option is to dedicate a public IP
+to each tunnel. Another option is to dedicate a port number to each tunnel
+(e.g. 1195,1196,1197...).
+
+OpenVPN status can be verified using the `show openvpn` operational commands.
+See the built-in help for a complete list of options.
+
+OpenVPN Server
+##############
+
+Multi-client server is the most popular OpenVPN mode on routers. It always uses
+x.509 authentication and therefore requires a PKI setup. This guide assumes you
+have already setup a PKI and have a CA certificate, a server certificate and
+key, a certificate revocation list, a Diffie-Hellman key exchange parameters
+file. You do not need client certificates and keys for the server setup.
+
+In this example we will use the most complicated case: a setup where each
+client is a router that has its own subnet (think HQ and branch offices), since
+simpler setups are subsets of it.
+
+Suppose you want to use 10.23.1.0/24 network for client tunnel endpoints and
+all client subnets belong to 10.23.0.0/20. All clients need access to the
+192.168.0.0/16 network.
+
+First we need to specify the basic settings. 1194/UDP is the default. The
+`persistent-tunnel` option is recommended, it prevents the TUN/TAP device from
+closing on connection resets or daemon reloads.
+
+
+.. note:: Using **openvpn-option -reneg-sec** can be tricky. This option is used to renegotiate data channel after n seconds. When used at both server and client, the lower value will trigger the renegotiation. If you set it to 0 on one side of the connection (to disable it), the chosen value on the other side will determine when the renegotiation will occur.
+
+
+.. code-block:: none
+
+  set interfaces openvpn vtun10 mode server
+  set interfaces openvpn vtun10 local-port 1194
+  set interfaces openvpn vtun10 persistent-tunnel
+  set interfaces openvpn vtun10 protocol udp
+
+Then we need to specify the location of the cryptographic materials. Suppose
+you keep the files in `/config/auth/openvpn`
+
+.. code-block:: none
+
+  set interfaces openvpn vtun10 tls ca-cert-file /config/auth/openvpn/ca.crt
+  set interfaces openvpn vtun10 tls cert-file /config/auth/openvpn/server.crt
+  set interfaces openvpn vtun10 tls key-file /config/auth/openvpn/server.key
+  set interfaces openvpn vtun10 tls crl-file /config/auth/openvpn/crl.pem
+  set interfaces openvpn vtun10 tls dh-file /config/auth/openvpn/dh2048.pem
+
+Now we need to specify the server network settings. In all cases we need to
+specify the subnet for client tunnel endpoints. Since we want clients to access
+a specific network behind out router, we will use a push-route option for
+installing that route on clients.
+
+.. code-block:: none
+
+  set interfaces openvpn vtun10 server push-route 192.168.0.0/16
+  set interfaces openvpn vtun10 server subnet 10.23.1.0/24
+
+Since it's a HQ and branch offices setup, we will want all clients to have
+fixed addresses and we will route traffic to specific subnets through them. We
+need configuration for each client to achieve this.
+
+.. note:: Clients are identified by the CN field of their x.509 certificates,
+   in this example the CN is ``client0``:
+
+.. code-block:: none
+
+  set interfaces openvpn vtun10 server client client0 ip 10.23.1.10
+  set interfaces openvpn vtun10 server client client0 subnet 10.23.2.0/25
+
+OpenVPN **will not** automatically create routes in the kernel for client
+subnets when they connect and will only use client-subnet association
+internally, so we need to create a route to the 10.23.0.0/20 network ourselves:
+
+.. code-block:: none
+
+  set protocols static interface-route 10.23.0.0/20 next-hop-interface vtun10
+
+
+Client Authentication
+=====================
+
+OpenLDAP
+--------
+
+Enterprise installations usually ship a kind of directory service which is used
+to have a single password store for all employees. VyOS and OpenVPN support using
+LDAP/AD as single user backend.
+
+Authentication is done by using the ``openvpn-auth-ldap.so`` plugin which is
+shipped with every VyOS installation. A dedicated configuration file is required.
+It is best practise to store it in ``/config`` to survive image updates
+
+.. code-block:: none
+
+  set interfaces openvpn vtun0 openvpn-option "--plugin /usr/lib/openvpn/openvpn-auth-ldap.so /config/auth/ldap-auth.config"
+
+The required config file may look like:
+
+.. code-block:: none
+
+  <LDAP>
+  # LDAP server URL
+  URL             ldap://ldap.example.com
+  # Bind DN (If your LDAP server doesn't support anonymous binds)
+  BindDN          cn=LDAPUser,dc=example,dc=com
+  # Bind Password password
+  Password        S3cr3t
+  # Network timeout (in seconds)
+  Timeout         15
+  </LDAP>
+
+  <Authorization>
+  # Base DN
+  BaseDN          "ou=people,dc=example,dc=com"
+  # User Search Filter
+  SearchFilter    "(&(uid=%u)(objectClass=shadowAccount))"
+  # Require Group Membership - allow all users
+  RequireGroup    false
+  </Authorization>
+
+Active Directory
+----------------
+
+Despite the fact that AD is a superset of LDAP
+
+.. code-block:: none
+
+  <LDAP>
+    # LDAP server URL
+    URL ldap://dc01.example.com
+    # Bind DN (If your LDAP server doesn’t support anonymous binds)
+    BindDN CN=LDAPUser,DC=example,DC=com
+    # Bind Password
+    Password mysecretpassword
+    # Network timeout (in seconds)
+    Timeout  15
+    # Enable Start TLS
+    TLSEnable no
+    # Follow LDAP Referrals (anonymously)
+    FollowReferrals no
+  </LDAP>
+
+  <Authorization>
+    # Base DN
+    BaseDN        "DC=example,DC=com"
+    # User Search Filter, user must be a member of the VPN AD group
+    SearchFilter  "(&(sAMAccountName=%u)(memberOf=CN=VPN,OU=Groups,DC=example,DC=com))"
+    # Require Group Membership
+    RequireGroup    false # already handled by SearchFilter
+    <Group>
+      BaseDN        "OU=Groups,DC=example,DC=com"
+      SearchFilter  "(|(cn=VPN))"
+      MemberAttribute  memberOf
+    </Group>
+  </Authorization>
+
+If you only want to check if the user account is enabled and can authenticate
+(against the primary group) the following snipped is sufficient:
+
+.. code-block:: none
+
+  <LDAP>
+    URL ldap://dc01.example.com
+    BindDN CN=SA_OPENVPN,OU=ServiceAccounts,DC=example,DC=com
+    Password ThisIsTopSecret
+    Timeout  15
+    TLSEnable no
+    FollowReferrals no
+  </LDAP>
+
+  <Authorization>
+    BaseDN          "DC=example,DC=com"
+    SearchFilter    "sAMAccountName=%u"
+    RequireGroup    false
+  </Authorization>
+
+A complete LDAP auth OpenVPN configuration could look like the following example:
+
+.. code-block:: none
+
+  vyos@vyos# show interfaces openvpn
+   openvpn vtun0 {
+       mode server
+       openvpn-option "--tun-mtu 1500 --fragment 1300 --mssfix"
+       openvpn-option "--plugin /usr/lib/openvpn/openvpn-auth-ldap.so /config/auth/ldap-auth.config"
+       openvpn-option "--push redirect-gateway"
+       openvpn-option --duplicate-cn
+       openvpn-option --client-cert-not-required
+       openvpn-option --comp-lzo
+       openvpn-option --persist-key
+       openvpn-option --persist-tun
+       server {
+           domain-name example.com
+           max-connections 5
+           name-server 1.1.1.1
+           name-server 9.9.9.9
+           subnet 172.18.100.128/29
+       }
+       tls {
+           ca-cert-file /config/auth/ca.crt
+           cert-file /config/auth/server.crt
+           dh-file /config/auth/dh1024.pem
+           key-file /config/auth/server.key
+       }
+   }
+
+OpenVPN Client
+##############
+
+VyOS can not only act as an OpenVPN site-to-site or Server for multiple clients.
+You can indeed also configure any VyOS OpenVPN interface as an OpenVPN client
+connecting to a VyOS OpenVPN server or any other OpenVPN server.
+
+Given the following example we have one VyOS router acting as OpenVPN server
+and another VyOS router acting as OpenVPN client. The Server also pushes a
+static client IP address to the OpenVPN client. Remember, clients are identified
+using their CN attribute in the SSL certificate.
+
+
+Server
+======
+
+.. code-block:: none
+
+  set interfaces openvpn vtun10 encryption 'aes256'
+  set interfaces openvpn vtun10 hash 'sha512'
+  set interfaces openvpn vtun10 local-host '172.18.201.10'
+  set interfaces openvpn vtun10 local-port '1194'
+  set interfaces openvpn vtun10 mode 'server'
+  set interfaces openvpn vtun10 persistent-tunnel
+  set interfaces openvpn vtun10 protocol 'udp'
+  set interfaces openvpn vtun10 server client client1 ip '10.10.0.10'
+  set interfaces openvpn vtun10 server domain-name 'vyos.net'
+  set interfaces openvpn vtun10 server max-connections '250'
+  set interfaces openvpn vtun10 server name-server '172.16.254.30'
+  set interfaces openvpn vtun10 server subnet '10.10.0.0/24'
+  set interfaces openvpn vtun10 server topology 'subnet'
+  set interfaces openvpn vtun10 tls ca-cert-file '/config/auth/ca.crt'
+  set interfaces openvpn vtun10 tls cert-file '/config/auth/server.crt'
+  set interfaces openvpn vtun10 tls dh-file '/config/auth/dh.pem'
+  set interfaces openvpn vtun10 tls key-file '/config/auth/server.key'
+  set interfaces openvpn vtun10 use-lzo-compression
+
+Client
+======
+
+.. code-block:: none
+
+  set interfaces openvpn vtun10 encryption 'aes256'
+  set interfaces openvpn vtun10 hash 'sha512'
+  set interfaces openvpn vtun10 mode 'client'
+  set interfaces openvpn vtun10 persistent-tunnel
+  set interfaces openvpn vtun10 protocol 'udp'
+  set interfaces openvpn vtun10 remote-host '172.18.201.10'
+  set interfaces openvpn vtun10 remote-port '1194'
+  set interfaces openvpn vtun10 tls ca-cert-file '/config/auth/ca.crt'
+  set interfaces openvpn vtun10 tls cert-file '/config/auth/client1.crt'
+  set interfaces openvpn vtun10 tls key-file '/config/auth/client1.key'
+  set interfaces openvpn vtun10 use-lzo-compression
+
+Options
+-------
+
+We do not have CLI nodes for every single OpenVPN options. If an option is
+missing, a feature request should be opened at https://phabricator.vyos.net so
+all users can benefit from it.
+
+If you are a hacker or want to try on your own we support passing raw OpenVPN
+options to OpenVPN.
+
+.. code-block:: none
+
+  set interfaces openvpn vtun10 openvpn-option 'persistent-key'
+
+Will add `persistent-key` at the end of the generated OpenVPN configuration.
+Please use this only as last resort - things might break and OpenVPN won't start
+if you pass invalid options/syntax.
+
+Troubleshooting
+###############
+
+VyOS provides some operational commands on OpenVPN.
+
+Check status
+============
+
+The following commands let you check tunnel status.
+
+.. opcmd:: show openvpn client status
+
+   Use this command to check the tunnel status for OpenVPN client.
+
+.. opcmd:: show openvpn server status
+
+   Use this command to check the tunnel status for OpenVPN server.
+
+.. opcmd:: show openvpn site-to-site status
+
+   Use this command to check the tunnel status for OpenVPN site-to-site.
+
+
+Reset OpenVPN
+=============
+
+The following commands let you reset OpenVPN.
+
+.. opcmd:: reset openvpn client <text>
+
+   Use this command to reset specified OpenVPN client.
+
+.. opcmd:: reset openvpn interface <interface>
+
+   Uset this command to reset the OpenVPN process on a specific interface.
+
+
diff --git a/docs/configuration/interfaces/tunnel.rst b/docs/configuration/interfaces/tunnel.rst
new file mode 100644
index 00000000..43c217a0
--- /dev/null
+++ b/docs/configuration/interfaces/tunnel.rst
@@ -0,0 +1,237 @@
+.. _interfaces-tunnel:
+
+Tunnel Interfaces
+=================
+
+This article touches on 'classic' IP tunneling protocols.
+
+GRE is often seen as a one size fits all solution when it comes to classic IP tunneling protocols, and for a good reason.
+However, there are more specialized options, and many of them are supported by VyOS. There are also rather obscure GRE options that can be useful.
+
+All those protocols are grouped under 'interfaces tunnel' in VyOS. Let's take a closer look at the protocols and options currently supported by VyOS.
+
+IPIP
+----
+
+This is one of the simplest types of tunnels, as defined by RFC2003_.
+It takes an IPv4 packet and sends it as a payload of another IPv4 packet. For this reason, there are no other configuration options for this kind of tunnel.
+
+An example:
+
+.. code-block:: none
+
+  set interfaces tunnel tun0 encapsulation ipip
+  set interfaces tunnel tun0 local-ip 192.0.2.10
+  set interfaces tunnel tun0 remote-ip 203.0.113.20
+  set interfaces tunnel tun0 address 192.168.100.200
+
+IP6IP6
+------
+
+This is the IPv6 counterpart of IPIP. I'm not aware of an RFC that defines this encapsulation specifically, but it's a natural specific case of IPv6 encapsulation mechanisms described in RFC2473_.
+
+It's not likely that anyone will need it any time soon, but it does exist.
+
+An example:
+
+.. code-block:: none
+
+  set interfaces tunnel tun0 encapsulation ipip
+  set interfaces tunnel tun0 local-ip 2001:db8:aa::1/64
+  set interfaces tunnel tun0 remote-ip 2001:db8:aa::2/64
+  set interfaces tunnel tun0 address 2001:db8:bb::1/64
+
+IPIP6
+-----
+
+In the future this is expected to be a very useful protocol (though there are `other proposals`_).
+
+As the name implies, it's IPv4 encapsulated in IPv6, as simple as that.
+
+An example:
+
+.. code-block:: none
+
+  set interfaces tunnel tun0 encapsulation ipip6
+  set interfaces tunnel tun0 local-ip 2001:db8:aa::1/64
+  set interfaces tunnel tun0 remote-ip 2001:db8:aa::2/64
+  set interfaces tunnel tun0 address 192.168.70.80
+
+6in4 (SIT)
+----------
+
+
+6in4 uses tunneling to encapsulate IPv6 traffic over IPv4 links as defined in RFC4213_.
+The 6in4 traffic is sent over IPv4 inside IPv4 packets whose IP headers have the IP protocol number set to 41.
+This protocol number is specifically designated for IPv6 encapsulation, the IPv4 packet header is immediately followed by the IPv6 packet being carried.
+The encapsulation overhead is the size of the IPv4 header of 20 bytes, therefore with an MTU of 1500 bytes, IPv6 packets of 1480 bytes can be sent without fragmentation. This tunneling technique is frequently used by IPv6 tunnel brokers like `Hurricane Electric`_. 
+
+An example:
+
+.. code-block:: none
+
+  set interfaces tunnel tun0 encapsulation sit
+  set interfaces tunnel tun0 local-ip 192.0.2.10
+  set interfaces tunnel tun0 remote-ip 192.0.2.20
+  set interfaces tunnel tun0 address 2001:db8:bb::1/64
+
+A full example of a Tunnelbroker.net config can be found at :ref:`here <examples-tunnelbroker-ipv6>`.
+
+Generic Routing Encapsulation (GRE)
+-----------------------------------
+
+A GRE tunnel operates at layer 3 of the OSI model and is repsented by IP protocol 47.  The 
+main benefit of a GRE tunnel is that you are able to route traffic across disparate networks.  
+GRE also supports multicast traffic and supports routing protocols that leverage multicast to 
+form neighbor adjacencies.
+
+Configuration
+^^^^^^^^^^^^^
+
+A basic configuration requires a tunnel source (local-ip), a tunnel destination (remote-ip), 
+an encapsulation type (gre), and an address (ipv4/ipv6).  Below is a configuration example 
+taken from a VyOS router and a Cisco IOS router.  The main difference between these two 
+configurations is that VyOS requires you explicitly configure the encapsulation type.  
+The Cisco router defaults to 'gre ip' otherwise it would have to be configured as well.
+
+**VyOS Router:**
+
+.. code-block:: none
+
+  set interfaces tunnel tun100 address '10.0.0.1/30'
+  set interfaces tunnel tun100 encapsulation 'gre'
+  set interfaces tunnel tun100 local-ip '198.51.100.2'
+  set interfaces tunnel tun100 remote-ip '203.0.113.10'
+
+**Cisco IOS Router:**
+
+.. code-block:: none
+
+  interface Tunnel100
+  ip address 10.0.0.2 255.255.255.252
+  tunnel source 203.0.113.10
+  tunnel destination 198.51.100.2
+
+
+Tunnel keys
+^^^^^^^^^^^
+
+GRE is also the only classic protocol that allows creating multiple tunnels with the same source and destination due to its support for tunnel keys. Despite its name, this feature has nothing to do with security: it's simply an identifier that allows routers to tell one tunnel from another.
+
+An example:
+
+.. code-block:: none
+
+   set interfaces tunnel tun0 local-ip 192.0.2.10
+   set interfaces tunnel tun0 remote-ip 192.0.2.20
+   set interfaces tunnel tun0 address 10.40.50.60/24
+   set interfaces tunnel tun0 parameters ip key 10
+  
+.. code-block:: none
+
+   set interfaces tunnel tun0 local-ip 192.0.2.10
+   set interfaces tunnel tun0 remote-ip 192.0.2.20
+   set interfaces tunnel tun0 address 172.16.17.18/24
+   set interfaces tunnel tun0 parameters ip key 20
+   
+  
+GRE-Bridge
+^^^^^^^^^^
+While normal GRE is for layer 3, GRE-Bridge is for layer 2. GRE-Bridge can encapsulate Ethernet frames, thus it can be bridged with other interfaces to create datalink layer segments that span multiple remote sites.
+
+Layer 2 GRE example:
+
+.. code-block:: none
+
+   set interfaces bridge br0
+   set interfaces tunnel tun0 encapsulation gre-bridge
+   set interfaces tunnel tun0 local-ip 192.0.2.10
+   set interfaces tunnel tun0 remote-ip 192.0.2.20
+   set interfaces tunnel tun0 parameters ip bridge-group bridge br0
+   set interfaces ethernet eth1 bridge-group br0
+   
+As you can see, the bridge-group option for tunnels is in a rather unusual place, different from all other interfaces.
+
+
+Troubleshooting
+^^^^^^^^^^^^^^^
+
+GRE is a well defined standard that is common in most networks.  While not inherently difficult 
+to configure there are a couple of things to keep in mind to make sure the configuration performs 
+as expected.  A common cause for GRE tunnels to fail to come up correctly include ACL or Firewall 
+configurations that are discarding IP protocol 47 or blocking your source/desintation traffic.
+
+**1. Confirm IP connectivity between tunnel local-ip and remote-ip:**
+
+.. code-block:: none
+
+  vyos@vyos:~$ ping 203.0.113.10 interface 198.51.100.2 count 4
+  PING 203.0.113.10 (203.0.113.10) from 198.51.100.2 : 56(84) bytes of data.
+  64 bytes from 203.0.113.10: icmp_seq=1 ttl=254 time=0.807 ms
+  64 bytes from 203.0.113.10: icmp_seq=2 ttl=254 time=1.50 ms
+  64 bytes from 203.0.113.10: icmp_seq=3 ttl=254 time=0.624 ms
+  64 bytes from 203.0.113.10: icmp_seq=4 ttl=254 time=1.41 ms
+
+  --- 203.0.113.10 ping statistics ---
+  4 packets transmitted, 4 received, 0% packet loss, time 3007ms
+  rtt min/avg/max/mdev = 0.624/1.087/1.509/0.381 ms
+
+**2. Confirm the link type has been set to GRE:**
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces tunnel tun100
+  tun100@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1476 qdisc noqueue state UNKNOWN group default qlen 1000
+    link/gre 198.51.100.2 peer 203.0.113.10
+    inet 10.0.0.1/30 brd 10.0.0.3 scope global tun100
+       valid_lft forever preferred_lft forever
+    inet6 fe80::5efe:c612:2/64 scope link
+       valid_lft forever preferred_lft forever
+
+    RX:  bytes    packets     errors    dropped    overrun      mcast
+          2183         27          0          0          0          0
+    TX:  bytes    packets     errors    dropped    carrier collisions
+           836          9          0          0          0          0
+
+**3. Confirm IP connectivity across the tunnel:**
+
+.. code-block:: none
+
+  vyos@vyos:~$ ping 10.0.0.2 interface 10.0.0.1 count 4
+  PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 : 56(84) bytes of data.
+  64 bytes from 10.0.0.2: icmp_seq=1 ttl=255 time=1.05 ms
+  64 bytes from 10.0.0.2: icmp_seq=2 ttl=255 time=1.88 ms
+  64 bytes from 10.0.0.2: icmp_seq=3 ttl=255 time=1.98 ms
+  64 bytes from 10.0.0.2: icmp_seq=4 ttl=255 time=1.98 ms
+
+  --- 10.0.0.2 ping statistics ---
+  4 packets transmitted, 4 received, 0% packet loss, time 3008ms
+  rtt min/avg/max/mdev = 1.055/1.729/1.989/0.395 ms
+
+Virtual Tunnel Interface (VTI)
+------------------------------
+
+Set Virtual Tunnel Interface
+
+.. code-block:: none
+
+  set interfaces vti vti0 address 192.168.2.249/30
+  set interfaces vti vti0 address 2001:db8:2::249/64
+
+Results in:
+
+.. code-block:: none
+
+  vyos@vyos# show interfaces vti
+  vti vti0 {
+      address 192.168.2.249/30
+      address 2001:db8:2::249/64
+      description "Description"
+  }
+
+
+.. _RFC2003: https://tools.ietf.org/html/rfc2003
+.. _RFC2473: https://tools.ietf.org/html/rfc2473
+.. _`other proposals`: https://www.isc.org/downloads/aftr
+.. _RFC4213: https://tools.ietf.org/html/rfc4213
+.. _`Hurricane Electric`: https://tunnelbroker.net/
diff --git a/docs/configuration/interfaces/vxlan.rst b/docs/configuration/interfaces/vxlan.rst
new file mode 100644
index 00000000..e3eb5c43
--- /dev/null
+++ b/docs/configuration/interfaces/vxlan.rst
@@ -0,0 +1,305 @@
+VXLAN
+-----
+
+VXLAN is an overlaying Ethernet over IP protocol.
+It is described in RFC7348_.
+
+If configuring VXLAN in a VyOS virtual machine, ensure that MAC spoofing
+(Hyper-V) or Forged Transmits (ESX) are permitted, otherwise forwarded frames
+may be blocked by the hypervisor.
+
+Multicast VXLAN
+^^^^^^^^^^^^^^^^
+
+Example Topology:
+
+PC4 - Leaf2 - Spine1 - Leaf3 - PC5
+
+PC4 has IP 10.0.0.4/24 and PC5 has IP 10.0.0.5/24, so they believe they are in
+the same broadcast domain.
+
+Let's assume PC4 on Leaf2 wants to ping PC5 on Leaf3. Instead of setting Leaf3
+as our remote end manually, Leaf2 encapsulates the packet into a UDP-packet and
+sends it to its designated multicast-address via Spine1. When Spine1 receives
+this packet it forwards it to all other Leafs who has joined the same
+multicast-group, in this case Leaf3. When Leaf3 receives the packet it forwards
+it, while at the same time learning that PC4 is reachable behind Leaf2, because
+the encapsulated packet had Leaf2's IP-address set as source IP.
+
+PC5 receives the ping echo, responds with an echo reply that Leaf3 receives and
+this time forwards to Leaf2's unicast address directly because it learned the
+location of PC4 above. When Leaf2 receives the echo reply from PC5 it sees that
+it came from Leaf3 and so remembers that PC5 is reachable via Leaf3.
+
+Thanks to this discovery, any subsequent traffic between PC4 and PC5 will not
+be using the multicast-address between the Leafs as they both know behind which
+Leaf the PCs are connected. This saves traffic as less multicast packets sent
+reduces the load on the network, which improves scalability when more Leafs are
+added.
+
+For optimal scalability Multicast shouldn't be used at all, but instead use BGP
+to signal all connected devices between leafs. Unfortunately, VyOS does not yet
+support this.
+
+Configuration commands
+^^^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  interfaces
+    vxlan <vxlan[0-16777215]>
+      address          # IP address of the VXLAN interface
+      bridge-group     # Configure a L2 bridge-group
+      description      # Description
+      group <ipv4>     # IPv4 Multicast group address (required)
+      ip               # IPv4 routing options
+      ipv6             # IPv6 routing options
+      link <dev>       # IP interface for underlay of this vxlan overlay (optional)
+      mtu              # MTU
+      policy           # Policy routing options
+      remote           # Remote address of the VXLAN tunnel, used for PTP instead of multicast
+      vni <1-16777215> # Virtual Network Identifier (required)
+
+Configuration Example
+^^^^^^^^^^^^^^^^^^^^^
+
+The setup is this:
+
+Leaf2 - Spine1 - Leaf3
+
+Spine1 is a Cisco IOS router running version 15.4, Leaf2 and Leaf3 is each a
+VyOS router running 1.2.
+
+This topology was built using GNS3.
+
+Topology:
+
+.. code-block:: none
+
+  Spine1:
+  fa0/2 towards Leaf2, IP-address: 10.1.2.1/24
+  fa0/3 towards Leaf3, IP-address: 10.1.3.1/24
+
+  Leaf2:
+  Eth0 towards Spine1, IP-address: 10.1.2.2/24
+  Eth1 towards a vlan-aware switch
+
+  Leaf3:
+  Eth0 towards Spine1, IP-address 10.1.3.3/24
+  Eth1 towards a vlan-aware switch
+
+Spine1 Configuration:
+
+.. code-block:: none
+
+  conf t
+  ip multicast-routing
+  !
+  interface fastethernet0/2
+   ip address 10.1.2.1 255.255.255.0
+   ip pim sparse-dense-mode
+  !
+  interface fastethernet0/3
+   ip address 10.1.3.1 255.255.255.0
+   ip pim sparse-dense-mode
+  !
+  router ospf 1
+   network 10.0.0.0 0.255.255.255 area 0
+
+Multicast-routing is required for the leafs to forward traffic between each
+other in a more scalable way. This also requires PIM to be enabled towards the
+Leafs so that the Spine can learn what multicast groups each Leaf expect traffic
+from.
+
+Leaf2 configuration:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address '10.1.2.2/24'
+  set protocols ospf area 0 network '10.0.0.0/8'
+
+  ! Our first vxlan interface
+  set interfaces bridge br241 address '172.16.241.1/24'
+  set interfaces ethernet eth1 vif 241 bridge-group bridge 'br241'
+  set interfaces vxlan vxlan241 bridge-group bridge 'br241'
+  set interfaces vxlan vxlan241 group '239.0.0.241'
+  set interfaces vxlan vxlan241 link 'eth0'
+  set interfaces vxlan vxlan241 vni '241'
+
+  ! Our seconds vxlan interface
+  set interfaces bridge br242 address '172.16.242.1/24'
+  set interfaces ethernet eth1 vif 242 bridge-group bridge 'br242'
+  set interfaces vxlan vxlan242 bridge-group bridge 'br242'
+  set interfaces vxlan vxlan242 group '239.0.0.242'
+  set interfaces vxlan vxlan242 link 'eth0'
+  set interfaces vxlan vxlan242 vni '242'
+
+Leaf3 configuration:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address '10.1.3.3/24'
+  set protocols ospf area 0 network '10.0.0.0/8'
+
+  ! Our first vxlan interface
+  set interfaces bridge br241 address '172.16.241.1/24'
+  set interfaces ethernet eth1 vif 241 bridge-group bridge 'br241'
+  set interfaces vxlan vxlan241 bridge-group bridge 'br241'
+  set interfaces vxlan vxlan241 group '239.0.0.241'
+  set interfaces vxlan vxlan241 link 'eth0'
+  set interfaces vxlan vxlan241 vni '241'
+
+  ! Our seconds vxlan interface
+  set interfaces bridge br242 address '172.16.242.1/24'
+  set interfaces ethernet eth1 vif 242 bridge-group bridge 'br242'
+  set interfaces vxlan vxlan242 bridge-group bridge 'br242'
+  set interfaces vxlan vxlan242 group '239.0.0.242'
+  set interfaces vxlan vxlan242 link 'eth0'
+  set interfaces vxlan vxlan242 vni '242'
+
+As you can see, Leaf2 and Leaf3 configuration is almost identical. There are
+lots of commands above, I'll try to into more detail below, command
+descriptions are placed under the command boxes:
+
+.. code-block:: none
+
+  set interfaces bridge br241 address '172.16.241.1/24'
+
+This commands creates a bridge that is used to bind traffic on eth1 vlan 241
+with the vxlan241-interface. The IP-address is not required. It may however be
+used as a default gateway for each Leaf which allows devices on the vlan to
+reach other subnets. This requires that the subnets are redistributed by OSPF
+so that the Spine will learn how to reach it. To do this you need to change the
+OSPF network from '10.0.0.0/8' to '0.0.0.0/0' to allow 172.16/12-networks to be
+advertised.
+
+.. code-block:: none
+
+  set interfaces ethernet eth1 vif 241 bridge-group bridge 'br241'
+  set interfaces vxlan vxlan241 bridge-group bridge 'br241'
+
+Binds eth1 vif 241 and vxlan241 to each other by putting them in the same
+bridge-group. Internal VyOS requirement.
+
+.. code-block:: none
+
+  set interfaces vxlan vxlan241 group '239.0.0.241'
+
+The multicast-group used by all Leafs for this vlan extension. Has to be the
+same on all Leafs that has this interface.
+
+.. code-block:: none
+
+  set interfaces vxlan vxlan241 link 'eth0'
+
+Sets the interface to listen for multicast packets on. Could be a loopback, not
+yet tested.
+
+.. code-block:: none
+
+  set interfaces vxlan vxlan241 vni '241'
+
+Sets the unique id for this vxlan-interface. Not sure how it correlates with
+multicast-address.
+
+.. code-block:: none
+
+  set interfaces vxlan vxlan241 remote-port 12345
+
+The destination port used for creating a VXLAN interface in Linux defaults to
+its pre-standard value of 8472 to preserve backwards compatibility. A
+configuration directive to support a user-specified destination port to override
+that behavior is available using the above command.
+
+Older Examples
+^^^^^^^^^^^^^^
+
+Example for bridging normal L2 segment and vxlan overlay network, and using a
+vxlan interface as routing interface.
+
+.. code-block:: none
+
+  interfaces {
+       bridge br0 {
+       }
+       ethernet eth0 {
+           address dhcp
+       }
+       loopback lo {
+       }
+       vxlan vxlan0 {
+           bridge-group {
+               bridge br0
+           }
+           group 239.0.0.1
+           vni 0
+       }
+       vxlan vxlan1 {
+           address 192.168.0.1/24
+           link eth0
+           group 239.0.0.1
+           vni 1
+       }
+  }
+
+Here is a working configuration that creates a VXLAN between two routers. Each
+router has a VLAN interface (26) facing the client devices and a VLAN interface
+(30) that connects it to the other routers. With this configuration, traffic
+can flow between both routers' VLAN 26, but can't escape since there is no L3
+gateway. You can add an IP to a bridge-group to create a gateway.
+
+.. code-block:: none
+
+  interfaces {
+       bridge br0 {
+       }
+       ethernet eth0 {
+           duplex auto
+           smp-affinity auto
+           speed auto
+           vif 26 {
+               bridge-group {
+                   bridge br0
+               }
+           }
+           vif 30 {
+               address 10.7.50.6/24
+           }
+       }
+       loopback lo {
+       }
+       vxlan vxlan0 {
+           bridge-group {
+               bridge br0
+           }
+           group 239.0.0.241
+           vni 241
+       }
+  }
+
+Unicast VXLAN
+^^^^^^^^^^^^^
+
+Alternative to multicast, the remote IPv4 address of the VXLAN tunnel can set directly.
+Let's change the Multicast example from above:
+
+
+.. code-block:: none
+
+  # leaf2 and leaf3
+  delete interfaces vxlan vxlan241 group '239.0.0.241'
+  delete interfaces vxlan vxlan241 link 'eth0'
+
+  # leaf2
+  set interface vxlan vxlan241 remote 10.1.3.3
+
+  # leaf3
+  set interface vxlan vxlan241 remote 10.1.2.2
+
+The default port udp is set to 8472. 
+It can be changed with ``set interface vxlan <vxlanN> remote-port <port>``
+
+
+.. target-notes::
+
+.. _RFC7348: https://datatracker.ietf.org/doc/rfc7348/
diff --git a/docs/configuration/interfaces/wireguard.rst b/docs/configuration/interfaces/wireguard.rst
new file mode 100644
index 00000000..a7241613
--- /dev/null
+++ b/docs/configuration/interfaces/wireguard.rst
@@ -0,0 +1,148 @@
+.. _wireguard:
+
+WireGuard VPN Interface
+-----------------------
+
+WireGuard is an extremely simple yet fast and modern VPN that utilizes
+state-of-the-art cryptography. See https://www.wireguard.com for more
+information.
+
+Configuration
+^^^^^^^^^^^^^
+
+Wireguard requires the generation of a keypair, a private key which will decrypt
+incoming traffic and a public key, which the peer(s) will use to encrypt traffic.
+
+Generate a keypair
+~~~~~~~~~~~~~~~~~~
+
+Generate the keypair, which creates a public and private part and stores it
+within VyOS.
+It will be used per default on any configured wireguard interface, even if
+multiple interfaces are being configured.
+
+.. code-block:: none
+
+  wg01:~$ configure
+  wg01# run generate wireguard keypair
+
+The public key is being shared with your peer(s), your peer will encrypt all
+traffic to your system using this public key.
+
+.. code-block:: none
+
+  wg01# run show wireguard pubkey
+  u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk=
+
+Wireguard Interface configuration
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The next step is to configure your local side as well as the policy based
+trusted destination addresses. If you only initiate a connection, the listen
+port and endpoint is optional, if you however act as a server and endpoints
+initiate the connections to your system, you need to define a port your clients
+can connect to, otherwise it's randomly chosen and may make it difficult with
+firewall rules, since the port may be a different one when you reboot your
+system.
+
+You will also need the public key of your peer as well as the network(s) you
+want to tunnel (allowed-ips) to configure a wireguard tunnel. The public key
+below is always the public key from your peer, not your local one.
+
+**local side**
+
+.. code-block:: none
+
+  set interfaces wireguard wg01 address '10.1.0.1/24'
+  set interfaces wireguard wg01 description 'VPN-to-wg02'
+  set interfaces wireguard wg01 peer to-wg02 allowed-ips '10.2.0.0/24'
+  set interfaces wireguard wg01 peer to-wg02 endpoint '192.168.0.142:12345'
+  set interfaces wireguard wg01 peer to-wg02 pubkey 'XMrlPykaxhdAAiSjhtPlvi30NVkvLQliQuKP7AI7CyI='
+  set interfaces wireguard wg01 port '12345'
+  set protocols static interface-route 10.2.0.0/24 next-hop-interface wg01
+
+.. note:: The `endpoint` must be an IP and not a fully qualified domain name (FQDN). Using a FQDN will result in unexpected behavior.
+
+The last step is to define an interface route for 10.2.0.0/24 to get through
+the wireguard interface `wg01`. Multiple IPs or networks can be defined and
+routed, the last check is allowed-ips which either prevents or allows the
+traffic.
+
+**remote side**
+
+.. code-block:: none
+
+  set interfaces wireguard wg01 address '10.2.0.1/24'
+  set interfaces wireguard wg01 description 'VPN-to-wg01'
+  set interfaces wireguard wg01 peer to-wg02 allowed-ips '10.1.0.0/24'
+  set interfaces wireguard wg01 peer to-wg02 endpoint '192.168.0.124:12345'
+  set interfaces wireguard wg01 peer to-wg02 pubkey 'u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk='
+  set interfaces wireguard wg01 port '12345'
+  set protocols static interface-route 10.1.0.0/24 next-hop-interface wg01
+
+Assure that your firewall rules allow the traffic, in which case you have a
+working VPN using wireguard.
+
+.. code-block:: none
+
+  wg01# ping 10.2.0.1
+  PING 10.2.0.1 (10.2.0.1) 56(84) bytes of data.
+  64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=1.16 ms
+  64 bytes from 10.2.0.1: icmp_seq=2 ttl=64 time=1.77 ms
+
+  wg02# ping 10.1.0.1
+  PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
+  64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=4.40 ms
+  64 bytes from 10.1.0.1: icmp_seq=2 ttl=64 time=1.02 ms
+
+An additional layer of symmetric-key crypto can be used on top of the
+asymmetric crypto, which is optional.
+
+.. code-block:: none
+
+  wg01# run generate wireguard preshared-key
+  rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc=
+
+Copy the key, as it is not stored on the local file system. Make sure you
+distribute that key in a safe manner, it's a symmetric key, so only you and
+your peer should have knowledge of its content.
+
+.. code-block:: none
+
+  wg01# set interfaces wireguard wg01 peer to-wg02 preshared-key 'rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc='
+  wg02# set interfaces wireguard wg01 peer to-wg01 preshared-key 'rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc='
+
+Operational commands
+^^^^^^^^^^^^^^^^^^^^
+
+**Show interface status**
+
+.. code-block:: none
+
+  vyos@wg01# run show interfaces wireguard wg01
+
+  interface: wg01
+  public key: xHvgSJC8RTClfvjc0oX6OALxU6GGLapjthjw7x82CSw=
+  private key: (hidden)
+  listening port: 12345
+
+  peer: 9Ek3R30mG6Vk+GHsENtPF0b9Ul+ftxx4dDBa1bdBxX8=
+  endpoint: 192.168.0.142:12345
+  allowed ips: 10.2.0.0/24
+  latest handshake: 4 minutes, 22 seconds ago
+  transfer: 860 B received, 948 B sent
+
+**Show public key of the default key**
+
+.. code-block:: none
+
+  vyos@wg01# run show wireguard keypair pubkey default
+  FAXCPb6EbTlSH5200J5zTopt9AYXneBthAySPBLbZwM=
+
+
+**Delete wireguard keypairs**
+
+.. code-block:: none
+
+  vyos@wg01# wireguard keypair default
+
diff --git a/docs/configuration/interfaces/wireless.rst b/docs/configuration/interfaces/wireless.rst
new file mode 100644
index 00000000..a7e796e9
--- /dev/null
+++ b/docs/configuration/interfaces/wireless.rst
@@ -0,0 +1,55 @@
+Wireless Interfaces
+-------------------
+.. _interfaces-wireless:
+
+Wireless, for example WiFi 802.11 b/g/n, interfaces allow for connection to
+WiFi networks or act as an access-point.
+If your device is configurable it will appear as `wlan` in `show interfaces`.
+
+To be able to use the wireless interfaces you will first need to set a
+regulatory domain with the country code of your locaion.
+
+.. code-block:: none
+
+  set system wifi-regulatory-domain SE
+
+An example on how to set it up as an access point:
+
+.. code-block:: none
+
+  set interfaces wireless wlan0 address '192.168.99.1/24'
+  set interfaces wireless wlan0 type access-point
+  set interfaces wireless wlan0 channel 1
+  set interfaces wireless wlan0 ssid '<your ssid>'
+  set interfaces wireless wlan0 security wpa mode wpa2
+  set interfaces wireless wlan0 security wpa cipher CCMP
+  set interfaces wireless wlan0 security wpa passphrase '<your passphrase>'
+
+Resulting in
+
+.. code-block:: none
+
+  interfaces {
+    [...]
+    wireless wlan0 {
+          address 192.168.99.1/24
+          channel 1
+          mode g
+          security {
+              wpa {
+                  cipher CCMP
+                  mode wpa2
+                  passphrase "<your passphrase>"
+              }
+          }
+          ssid "<your ssid>"
+          type access-point
+      }
+  }
+  system {
+    [...]
+    wifi-regulatory-domain SE
+  }
+
+To get it to work as a access point with this configuration you will need
+to set up a DHCP server to work with that network.
diff --git a/docs/configuration/loadbalancing/index.rst b/docs/configuration/loadbalancing/index.rst
new file mode 100644
index 00000000..cae2f6a5
--- /dev/null
+++ b/docs/configuration/loadbalancing/index.rst
@@ -0,0 +1,263 @@
+.. _load-balancing:
+
+WAN load balancing
+==================
+
+Outbound traffic can be balanced between two or more outbound interfaces.
+If a path fails, traffic is balanced across the remaining healthy paths, a recovered path is automatically added back to the routing table and used by the load balancer.
+The load balancer automatically adds routes for each path to the routing table and balances traffic across the configured interfaces, determined by interface health and weight.
+
+
+In a minimal, configuration the following must be provided:
+
+ * a interface with a nexthop
+ * one rule with a LAN (inbound-interface) and the WAN (interface).
+
+lets assume we have two dhcp WAN interfaces and one LAN (eth2)
+
+.. code-block:: none
+
+    set load-balancing wan interface-health eth0 nexthop 'dhcp'
+    set load-balancing wan interface-health eth1 nexthop 'dhcp'
+    set load-balancing wan rule 1 inbound-interface 'eth2'
+    set load-balancing wan rule 1 interface eth0
+    set load-balancing wan rule 1 interface eth1
+
+Balancing Rules
+---------------
+
+Interfaces, their weight and the type of traffic to be balanced are defined in numbered balancing rule sets.
+The rule sets are executed in numerical order against outgoing packets. In case of a match the packet is sent through an interface specified in the matching rule.
+If a packet doesn't match any rule it is sent by using the system routing table. Rule numbers can't be changed.
+
+Create a load balancing rule, rule can be a number between 1 and 9999:
+
+.. code-block:: none
+
+    vyos@vyos# set load-balancing wan rule 1
+    Possible completions:
+    description             Description for this rule
+    > destination           Destination
+    exclude                 Exclude packets matching this rule from wan load balance
+    failover                Enable failover for packets matching this rule from wan load balance
+    inbound-interface       Inbound interface name (e.g., "eth0") [REQUIRED]
+    +> interface            Interface name [REQUIRED]
+    > limit                 Enable packet limit for this rule
+    per-packet-balancing    Option to match traffic per-packet instead of the default, per-flow
+    protocol                Protocol to match
+    > source                Source information
+
+Interface weight
+****************
+
+Let's expand the example from above and add a weight to the interfaces. The bandwidth from eth0 is larger than eth1.
+Per default outbound traffic is distributed randomly across available interfaces. Weights can be assigned to interfaces to influence the balancing.
+
+.. code-block:: none
+
+    set load-balancing wan rule 1 interface eth0 weight 2
+    set load-balancing wan rule 1 interface eth1 weight 1
+
+66% traffic is routed to eth0 and eth1 get 33% of traffic.
+
+Rate limit
+**********
+
+A packet rate limit can be set for a rule to apply the rule to traffic above or below a specified threshold.
+To configure the rate limiting use:
+
+.. code-block:: none
+
+    set load-balancing wan rule <rule> limit <parameter>
+
+* ``burst``: Number of packets allowed to overshoot the limit within ``period``. Default 5.
+* ``period``: Time window for rate calculation. Possible values: ``second`` (one second), ``minute`` (one minute), ``hour`` (one hour). Default is ``second``.
+* ``rate``: Number of packets. Default 5.
+* ``threshold``: ``below`` or ``above`` the specified rate limit.
+
+Flow and packet-based balancing
+*******************************
+
+Outgoing traffic is balanced in a flow-based manner. 
+A connection tracking table is used to track flows by their source address, destination address and port.
+Each flow is assigned to an interface according to the defined balancing rules and subsequent packets are sent through the same interface.
+This has the advantage that packets always arrive in order if links with different speeds are in use.
+
+Packet-based balancing can lead to a better balance across interfaces when out of order packets are no issue. Per-packet-based balancing can be set for a balancing rule with:
+
+.. code-block:: none
+
+    set load-balancing wan rule <rule> per-packet-balancing
+
+Exclude traffic
+***************
+
+To exclude traffic from load balancing, traffic matching an exclude rule is not balanced but routed through the system routing table instead:
+
+.. code-block:: none
+
+    set load-balancing wan rule <rule> exclude
+
+
+Health checks
+-------------
+
+The health of interfaces and paths assigned to the load balancer is periodically checked by sending ICMP packets (ping) to remote destinations, a TTL test or the execution of a user defined script.
+If an interface fails the health check it is removed from the load balancer's pool of interfaces. To enable health checking for an interface:
+
+.. code-block:: none
+
+    vyos@vyos# set load-balancing wan interface-health <interface>
+    Possible completions:
+    failure-count    Failure count
+    nexthop          Outbound interface nexthop address. Can be 'dhcp or ip address' [REQUIRED]
+    success-count    Success count
+    +> test          Rule number
+
+Specify nexthop on the path to destination, ``ipv4-address`` can be set to ``dhcp``
+
+.. code-block:: none
+
+    set load-balancing wan interface-health <interface> nexthop <ipv4-address>
+
+Set the number of health check failures before an interface is marked as unavailable, range for number is 1 to 10, default 1.
+Or set the number of successful health checks before an interface is added back to the interface pool, range for number is 1 to 10, default 1.
+
+.. code-block:: none
+
+    set load-balancing wan interface-health <interface> failure-count <number>
+    set load-balancing wan interface-health <interface> success-count <number>
+
+Each health check is configured in its own test, tests are numbered and processed in numeric order.
+For multi target health checking multiple tests can be defined:
+
+.. code-block:: none
+
+    vyos@vyos# set load-balancing wan interface-health eth1 test 0
+    Possible completions:
+    resp-time    Ping response time (seconds)
+    target       Health target address
+    test-script  Path to user defined script
+    ttl-limit    Ttl limit (hop count)
+    type         WLB test type
+
+* ``resp-time``: the maximum response time for ping in seconds. Range 1...30, default 5
+* ``target``: the target to be sent ICMP packets to, address can be an IPv4 address or hostname
+* ``test-script``: A user defined script must return 0 to be considered successful and non-zero to fail. Scripts are located in /config/scripts, for different locations the full path needs to be provided
+* ``ttl-limit``: For the UDP TTL limit test the hop count limit must be specified. The limit must be shorter than the path length, an ICMP time expired message is needed to be returned for a successful test. default 1
+* ``type``: Specify the type of test. type can be ping, ttl or a user defined script
+
+Source NAT rules
+----------------
+
+Per default, interfaces used in a load balancing pool replace the source IP of each outgoing packet with its own address to ensure that replies arrive on the same interface. 
+This works through automatically generated source NAT (SNAT) rules, these rules are only applied to balanced traffic. In cases where this behaviour is not desired, the automatic generation of SNAT rules can be disabled:
+
+.. code-block:: none
+
+    set load-balancing wan disable-source-nat
+
+Sticky Connections
+------------------
+Inbound connections to a WAN interface can be improperly handled when the reply is sent back to the client.
+
+.. image:: /_static/images/sticky-connections.jpg
+   :width: 80%
+   :align: center
+
+
+Upon reception of an incoming packet, when a response is sent, it might be desired to ensure that it leaves from the same interface as the inbound one.
+This can be achieved by enabling sticky connections in the load balancing:
+
+.. code-block:: none
+
+    set load-balancing wan sticky-connections inbound
+
+Failover
+--------
+
+In failover mode, one interface is set to be the primary interface and other interfaces are secondary or spare.
+Instead of balancing traffic across all healthy interfaces, only the primary interface is used and in case of failure, a secondary interface selected from the pool of available interfaces takes over.
+The primary interface is selected based on its weight and health, others become secondary interfaces.
+Secondary interfaces to take over a failed primary interface are chosen from the load balancer's interface pool, depending on their weight and health.
+Interface roles can also be selected based on rule order by including interfaces in balancing rules and ordering those rules accordingly. To put the load balancer in failover mode, create a failover rule:
+
+.. code-block:: none
+
+    set load-balancing wan rule <number> failover
+
+Because existing sessions do not automatically fail over to a new path, the session table can be flushed on each connection state change:
+
+.. code-block:: none
+
+    set load-balancing wan flush-connections
+
+.. warning::
+
+    Flushing the session table will cause other connections to fall back from flow-based to packet-based balancing until each flow is reestablished.
+
+Script execution
+----------------
+
+A script can be run when an interface state change occurs. Scripts are run from /config/scripts, for a different location specify the full path:
+
+.. code-block:: none
+
+    set load-balancing wan hook script-name
+
+Two environment variables are available:
+
+* ``WLB_INTERFACE_NAME=[interfacename]``: Interface to be monitored
+* ``WLB_INTERFACE_STATE=[ACTIVE|FAILED]``: Interface state
+
+.. warning::
+
+    Blocking call with no timeout. System will become unresponsive if script does not return!
+
+Handling and monitoring
+-----------------------
+
+
+Show WAN load balancer information including test types and targets.
+A character at the start of each line depicts the state of the test
+
+* ``+`` successful
+* ``-`` failed
+* a blank indicates that no test has been carried out
+
+.. code-block:: none
+
+    vyos@vyos:~$ show wan-load-balance
+    Interface:  eth0
+    Status:  failed
+    Last Status Change:  Tue Jun 11 20:12:19 2019
+    -Test:  ping  Target:
+        Last Interface Success:  55s
+        Last Interface Failure:  0s
+        # Interface Failure(s):  5
+
+    Interface:  eth1
+    Status:  active
+    Last Status Change:  Tue Jun 11 20:06:42 2019
+    +Test:  ping  Target:
+        Last Interface Success:  0s
+        Last Interface Failure:  6m26s
+        # Interface Failure(s):  0
+
+Show connection data of load balanced traffic:
+
+.. code-block:: none
+
+    vyos@vyos:~$ show wan-load-balance connection
+    conntrack v1.4.2 (conntrack-tools): 3 flow entries have been shown.
+    Type    State           Src                     Dst                     Packets Bytes
+    tcp     TIME_WAIT       10.1.1.13:38040         203.0.113.2:80          203.0.113.2  192.168.188.71
+    udp                     10.1.1.13:41891         198.51.100.3:53         198.51.100.3 192.168.188.71
+    udp                     10.1.1.13:55437         198.51.100.3:53         198.51.100.3 192.168.188.71
+
+Restart
+*******
+
+.. code-block:: none
+
+    restart wan-load-balance
diff --git a/docs/configuration/nat/index.rst b/docs/configuration/nat/index.rst
new file mode 100644
index 00000000..9b7b69df
--- /dev/null
+++ b/docs/configuration/nat/index.rst
@@ -0,0 +1,475 @@
+.. _nat:
+
+NAT
+===
+
+Source NAT
+----------
+
+Source NAT is typically referred to simply as NAT. To be more correct, what
+most people refer to as NAT is actually the process of **Port Address
+Translation (PAT)**, or **NAT Overload**. The process of having many internal
+host systems communicate to the Internet using a single or subset of IP
+addresses.
+
+To setup SNAT, we need to know:
+
+* The internal IP addresses we want to translate;
+* The outgoing interface to perform the translation on;
+* The external IP address to translate to.
+
+In the example used for the Quick Start configuration above, we demonstrate
+the following configuration:
+
+.. code-block:: none
+
+  set nat source rule 100 outbound-interface 'eth0'
+  set nat source rule 100 source address '192.168.0.0/24'
+  set nat source rule 100 translation address 'masquerade'
+
+Which generates the following configuration:
+
+.. code-block:: none
+
+  rule 100 {
+      outbound-interface eth0
+      source {
+          address 192.168.0.0/24
+      }
+      translation {
+          address masquerade
+      }
+  }
+
+In this example, we use **masquerade** as the translation address instead of
+an IP address. The **masquerade** target is effectively an alias to say "use
+whatever IP address is on the outgoing interface", rather than a statically
+configured IP address. This is useful if you use DHCP for your outgoing
+interface and do not know what the external address will be.
+
+When using NAT for a large number of host systems it recommended that a
+minimum of 1 IP address is used to NAT every 256 host systems. This is due to
+the limit of 65,000 port numbers available for unique translations and a
+reserving an average of 200-300 sessions per host system.
+
+Example: For an ~8,000 host network a source NAT pool of 32 IP addresses is
+recommended.
+
+A pool of addresses can be defined by using a **-** in the 
+`set nat source rule [n] translation address` statement.
+
+.. code-block:: none
+
+  set nat source rule 100 translation address '203.0.113.32-203.0.113.63'
+
+.. note:: Avoiding "leaky" NAT
+
+Linux netfilter will not NAT traffic marked as INVALID. This often confuses
+people into thinking that Linux (or specifically VyOS) has a broken NAT
+implementation because non-NATed traffic is seen leaving an external interface.
+This is actually working as intended, and a packet capture of the "leaky"
+traffic should reveal that the traffic is either an additional TCP "RST",
+"FIN,ACK", or "RST,ACK" sent by client systems after Linux netfilter considers
+the connection closed. The most common is the additional TCP RST some host
+implementations send after terminating a connection (which is implementation-
+specific).
+
+In other words, connection tracking has already observed the connection be
+closed and has transition the flow to INVALID to prevent attacks from
+attempting to reuse the connection.
+
+You can avoid the "leaky" behavior by using a firewall policy that drops
+"invalid" state packets.
+
+Having control over the matching of INVALID state traffic, e.g. the ability to
+selectively log, is an important troubleshooting tool for observing broken
+protocol behavior. For this reason, VyOS does not globally drop invalid state
+traffic, instead allowing the operator to make the determination on how the
+traffic is handled.
+
+NAT Reflection/Hairpin NAT
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. note:: Avoiding NAT breakage in the absence of split-DNS
+
+A typical problem with using NAT and hosting public servers is the ability for
+internal systems to reach an internal server using it's external IP address.
+The solution to this is usually the use of split-DNS to correctly point host
+systems to the internal address when requests are made internally. Because
+many smaller networks lack DNS infrastructure, a work-around is commonly
+deployed to facilitate the traffic by NATing the request from internal hosts
+to the source address of the internal interface on the firewall. This technique
+is commonly referred to as **NAT Reflection**, or **Hairpin NAT**.
+
+In this example, we will be using the example Quick Start configuration above
+as a starting point.
+
+To setup a NAT reflection rule, we need to create a rule to NAT connections
+from the internal network to the same internal network to use the source
+address of the internal interface.
+
+.. code-block:: none
+
+  set nat source rule 110 description 'NAT Reflection: INSIDE'
+  set nat source rule 110 destination address '192.168.0.0/24'
+  set nat source rule 110 outbound-interface 'eth1'
+  set nat source rule 110 source address '192.168.0.0/24'
+  set nat source rule 110 translation address 'masquerade'
+
+Which results in a configuration of:
+
+.. code-block:: none
+
+  rule 110 {
+      description "NAT Reflection: INSIDE"
+      destination {
+          address 192.168.0.0/24
+      }
+      outbound-interface eth1
+      source {
+          address 192.168.0.0/24
+      }
+      translation {
+          address masquerade
+      }
+  }
+
+Destination NAT
+---------------
+
+DNAT is typically referred to as a **Port Forward**. When using VyOS as a NAT
+router and firewall, a common configuration task is to redirect incoming
+traffic to a system behind the firewall.
+
+In this example, we will be using the example Quick Start configuration above
+as a starting point.
+
+To setup a destination NAT rule we need to gather:
+
+* The interface traffic will be coming in on;
+* The protocol and port we wish to forward;
+* The IP address of the internal system we wish to forward traffic to.
+
+In our example, we will be forwarding web server traffic to an internal web
+server on 192.168.0.100. HTTP traffic makes use of the TCP protocol on port 80.
+For other common port numbers, see: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
+
+Our configuration commands would be:
+
+.. code-block:: none
+
+  set nat destination rule 10 description 'Port Forward: HTTP to 192.168.0.100'
+  set nat destination rule 10 destination port '80'
+  set nat destination rule 10 inbound-interface 'eth0'
+  set nat destination rule 10 protocol 'tcp'
+  set nat destination rule 10 translation address '192.168.0.100'
+
+Which would generate the following NAT destination configuration:
+
+.. code-block:: none
+
+  nat {
+      destination {
+          rule 10 {
+              description "Port Forward: HTTP to 192.168.0.100"
+              destination {
+                  port 80
+              }
+              inbound-interface eth0
+              protocol tcp
+              translation {
+                  address 192.168.0.100
+              }
+          }
+      }
+  }
+
+.. note:: If forwarding traffic to a different port than it is arriving on,
+   you may also configure the translation port using
+   `set nat destination rule [n] translation port`.
+
+This establishes our Port Forward rule, but if we created a firewall policy it
+will likely block the traffic.
+
+It is important to note that when creating firewall rules that the DNAT
+translation occurs **before** traffic traverses the firewall. In other words,
+the destination address has already been translated to 192.168.0.100.
+
+So in our firewall policy, we want to allow traffic coming in on the outside
+interface, destined for TCP port 80 and the IP address of 192.168.0.100.
+
+.. code-block:: none
+
+  set firewall name OUTSIDE-IN rule 20 action 'accept'
+  set firewall name OUTSIDE-IN rule 20 destination address '192.168.0.100'
+  set firewall name OUTSIDE-IN rule 20 destination port '80'
+  set firewall name OUTSIDE-IN rule 20 protocol 'tcp'
+  set firewall name OUTSIDE-IN rule 20 state new 'enable'
+
+This would generate the following configuration:
+
+.. code-block:: none
+
+  rule 20 {
+      action accept
+      destination {
+          address 192.168.0.100
+          port 80
+      }
+      protocol tcp
+      state {
+          new enable
+      }
+  }
+
+.. note::
+
+  If you have configured the `INSIDE-OUT` policy, you will need to add
+  additional rules to permit inbound NAT traffic.
+
+1-to-1 NAT
+----------
+
+Another term often used for DNAT is **1-to-1 NAT**. For a 1-to-1 NAT
+configuration, both DNAT and SNAT are used to NAT all traffic from an external
+IP address to an internal IP address and vice-versa.
+
+Typically, a 1-to-1 NAT rule omits the destination port (all ports) and
+replaces the protocol with either **all** or **ip**.
+
+Then a corresponding SNAT rule is created to NAT outgoing traffic for the
+internal IP to a reserved external IP. This dedicates an external IP address
+to an internal IP address and is useful for protocols which don't have the
+notion of ports, such as GRE.
+
+1-to-1 NAT example
+------------------
+
+Here's an extract of a simple 1-to-1 NAT configuration with one internal and
+one external interface:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address '192.168.1.1/24'
+  set interfaces ethernet eth0 description 'Inside interface'
+  set interfaces ethernet eth1 address '192.0.2.30/24'
+  set interfaces ethernet eth1 description 'Outside interface'
+  set nat destination rule 2000 description '1-to-1 NAT example'
+  set nat destination rule 2000 destination address '192.0.2.30'
+  set nat destination rule 2000 inbound-interface 'eth1'
+  set nat destination rule 2000 translation address '192.168.1.10'
+  set nat source rule 2000 description '1-to-1 NAT example'
+  set nat source rule 2000 outbound-interface 'eth1'
+  set nat source rule 2000 source address '192.168.1.10'
+  set nat source rule 2000 translation address '192.0.2.30'
+
+Firewall rules are written as normal, using the internal IP address as the
+source of outbound rules and the destination of inbound rules.
+
+NPTv6 (RFC6296)
+---------------
+
+NPTv6 stands for Network Prefix Translation. It's a form of NAT for IPv6. It's
+described in RFC6296_. NPTv6 is supported in linux kernel since version 3.13.
+
+Usage
+^^^^^
+
+NPTv6 is very useful for IPv6 multihoming. It is also commonly used when the external IPv6 prefix is dynamic,
+as it prevents the need for renumbering of internal hosts when the extern prefix changes.
+
+Let's assume the following network configuration:
+
+* eth0 : LAN
+* eth1 : WAN1, with 2001:db8:e1::/48 routed towards it
+* eth2 : WAN2, with 2001:db8:e2::/48 routed towards it
+
+Regarding LAN hosts addressing, why would you choose 2001:db8:e1::/48 over
+2001:db8:e2::/48? What happens when you get a new provider with a different
+routed IPv6 subnet?
+
+The solution here is to assign to your hosts ULAs_ and to prefix-translate
+their address to the right subnet when going through your router.
+
+* LAN Subnet : fc00:dead:beef::/48
+* WAN 1 Subnet : 2001:db8:e1::/48
+* WAN 2 Subnet : 2001:db8:e2::/48
+
+* eth0 addr : fc00:dead:beef::1/48
+* eth1 addr : 2001:db8:e1::1/48
+* eth2 addr : 2001:db8:e2::1/48
+
+VyOS Support
+^^^^^^^^^^^^
+
+NPTv6 support has been added in VyOS 1.2 (Crux) and is available through
+`nat nptv6` configuration nodes.
+
+.. code-block:: none
+
+  set rule 10 source prefix 'fc00:dead:beef::/48'
+  set rule 10 outbound-interface 'eth1'
+  set rule 10 translation prefix '2001:db8:e1::/48'
+  set rule 20 source prefix 'fc00:dead:beef::/48'
+  set rule 20 outbound-interface 'eth2'
+  set rule 20 translation prefix '2001:db8:e2::/48'
+
+Resulting in the following ip6tables rules:
+
+.. code-block:: none
+
+  Chain VYOS_DNPT_HOOK (1 references)
+   pkts bytes target   prot opt in   out   source              destination
+      0     0 DNPT     all    eth1   any   anywhere            2001:db8:e1::/48  src-pfx 2001:db8:e1::/48 dst-pfx fc00:dead:beef::/48
+      0     0 DNPT     all    eth2   any   anywhere            2001:db8:e2::/48  src-pfx 2001:db8:e2::/48 dst-pfx fc00:dead:beef::/48
+      0     0 RETURN   all    any    any   anywhere            anywhere
+  Chain VYOS_SNPT_HOOK (1 references)
+   pkts bytes target   prot opt in   out   source              destination
+      0     0 SNPT     all    any    eth1  fc00:dead:beef::/48 anywhere          src-pfx fc00:dead:beef::/48 dst-pfx 2001:db8:e1::/48
+      0     0 SNPT     all    any    eth2  fc00:dead:beef::/48 anywhere          src-pfx fc00:dead:beef::/48 dst-pfx 2001:db8:e2::/48
+      0     0 RETURN   all    any    any   anywhere            anywhere
+
+
+NAT before VPN
+--------------
+
+Some application service providers (ASPs) operate a VPN gateway to provide access to their internal resources,
+and require that a connecting organisation translate all traffic to the service provider network to a source address provided by the ASP.
+
+Example Network
+^^^^^^^^^^^^^^^
+
+Here's one example of a network environment for an ASP.
+The ASP requests that all connections from this company should come from 172.29.41.89 - an address that is assigned by the ASP and not in use at the customer site.
+
+.. figure:: /_static/images/nat_before_vpn_topology.png
+   :scale: 100 %
+   :alt: NAT before VPN Topology
+
+   NAT before VPN Topology
+
+
+Configuration
+^^^^^^^^^^^^^
+
+The required configuration can be broken down into 4 major pieces:
+
+* A dummy interface for the provider-assigned IP;
+* NAT (specifically, Source NAT);
+* IPSec IKE and ESP Groups;
+* IPSec VPN tunnels.
+
+
+Dummy interface
+***************
+
+The dummy interface allows us to have an equivalent of the Cisco IOS Loopback interface - a router-internal interface we can use for IP addresses the router must know about,
+but which are not actually assigned to a real network.
+
+We only need a single step for this interface:
+
+.. code-block:: none
+
+  set interfaces dummy dum0 address '172.29.41.89/32'
+
+NAT Configuration
+*****************
+
+.. code-block:: none
+
+  set nat source rule 110 description 'Internal to ASP'
+  set nat source rule 110 destination address '172.27.1.0/24'
+  set nat source rule 110 outbound-interface 'any'
+  set nat source rule 110 source address '192.168.43.0/24'
+  set nat source rule 110 translation address '172.29.41.89'
+  set nat source rule 120 description 'Internal to ASP'
+  set nat source rule 120 destination address '10.125.0.0/16'
+  set nat source rule 120 outbound-interface 'any'
+  set nat source rule 120 source address '192.168.43.0/24'
+  set nat source rule 120 translation address '172.29.41.89'
+
+IPSec IKE and ESP
+*****************
+
+
+The ASP has documented their IPSec requirements:
+
+* IKE Phase:
+
+  * aes256 Encryption
+  * sha256 Hashes
+
+* ESP Phase:
+
+  * aes256 Encryption
+  * sha256 Hashes
+  * DH Group 14
+
+
+Additionally, we want to use VPNs only on our eth1 interface (the external interface in the image above)
+
+.. code-block:: none
+
+  set vpn ipsec ike-group my-ike ikev2-reauth 'no'
+  set vpn ipsec ike-group my-ike key-exchange 'ikev1'
+  set vpn ipsec ike-group my-ike lifetime '7800'
+  set vpn ipsec ike-group my-ike proposal 1 dh-group '14'
+  set vpn ipsec ike-group my-ike proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group my-ike proposal 1 hash 'sha256'
+
+  set vpn ipsec esp-group my-esp compression 'disable'
+  set vpn ipsec esp-group my-esp lifetime '3600'
+  set vpn ipsec esp-group my-esp mode 'tunnel'
+  set vpn ipsec esp-group my-esp pfs 'disable'
+  set vpn ipsec esp-group my-esp proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group my-esp proposal 1 hash 'sha256'
+
+  set vpn ipsec ipsec-interfaces interface 'eth1'
+
+IPSec VPN Tunnels
+*****************
+
+We'll use the IKE and ESP groups created above for this VPN. 
+Because we need access to 2 different subnets on the far side, we will need two different tunnels.
+If you changed the names of the ESP group and IKE group in the previous step, make sure you use the correct names here too.
+
+.. code-block:: none
+
+  set vpn ipsec site-to-site peer 198.51.100.243 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 198.51.100.243 authentication pre-shared-secret 'PASSWORD IS HERE'
+  set vpn ipsec site-to-site peer 198.51.100.243 connection-type 'initiate'
+  set vpn ipsec site-to-site peer 198.51.100.243 default-esp-group 'my-esp'
+  set vpn ipsec site-to-site peer 198.51.100.243 ike-group 'my-ike'
+  set vpn ipsec site-to-site peer 198.51.100.243 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 198.51.100.243 local-address '203.0.113.46'
+  set vpn ipsec site-to-site peer 198.51.100.243 tunnel 0 local prefix '172.29.41.89/32'
+  set vpn ipsec site-to-site peer 198.51.100.243 tunnel 0 remote prefix '172.27.1.0/24'
+  set vpn ipsec site-to-site peer 198.51.100.243 tunnel 1 local prefix '172.29.41.89/32'
+  set vpn ipsec site-to-site peer 198.51.100.243 tunnel 1 remote prefix '10.125.0.0/16'
+
+Testing and Validation
+^^^^^^^^^^^^^^^^^^^^^^
+
+If you've completed all the above steps you no doubt want to see if it's all working.
+
+Start by checking for IPSec SAs (Security Associations) with:
+
+.. code-block:: none
+
+  $ show vpn ipsec sa
+
+  Peer ID / IP                            Local ID / IP
+  ------------                            -------------
+  198.51.100.243                          203.0.113.46
+
+      Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
+      ------  -----  -------------  -------  ----    -----  ------  ------  -----
+      0       up     0.0/0.0        aes256   sha256  no     1647    3600    all
+      1       up     0.0/0.0        aes256   sha256  no     865     3600    all
+
+That looks good - we defined 2 tunnels and they're both up and running.
+
+
+
+.. _RFC6296: https://tools.ietf.org/html/rfc6296
+.. _ULAs: http://en.wikipedia.org/wiki/Unique_local_address
diff --git a/docs/configuration/policy/index.rst b/docs/configuration/policy/index.rst
new file mode 100644
index 00000000..ad829a55
--- /dev/null
+++ b/docs/configuration/policy/index.rst
@@ -0,0 +1,160 @@
+
+######
+Policy
+######
+
+Routing Policies could be used to tell the router (self or neighbors) what routes and their attributes needs to be put into the routing table.
+
+There could be a wide range of routing policies. Some examples are below:
+
+  * Set some metric to routes learned from a particular neighbor
+  * Set some attributes (like AS PATH or Community value) to advertised routes to neighbors
+  * Prefer a specific routing protocol routes over another routing protocol running on the same router
+
+Routing Policy Example
+~~~~~~~~~~~~~~~~~~~~~~
+
+**Policy definition:**
+
+.. code-block:: none
+
+  #Create policy
+  set policy route-map setmet rule 2 action 'permit'
+  set policy route-map setmet rule 2 set as-path-prepend '2 2 2'  
+  
+  #Apply policy to BGP
+  set protocols bgp 1 neighbor 1.1.1.2 address-family ipv4-unicast route-map import 'setmet'
+  set protocols bgp 1 neighbor 1.1.1.2 address-family ipv4-unicast soft-reconfiguration 'inbound' <<<< *** 
+  
+  *** get policy update without bouncing the neighbor
+
+**Routes learned before routing policy applied:**
+
+.. code-block:: none
+
+  vyos@vos1:~$ show ip bgp
+  BGP table version is 0, local router ID is 192.168.56.101
+  Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
+                r RIB-failure, S Stale, R Removed
+  Origin codes: i - IGP, e - EGP, ? - incomplete
+  
+     Network          Next Hop            Metric LocPrf Weight Path
+  *> 22.22.22.22/32   1.1.1.2                  1             0 2 i  < Path 
+  
+  Total number of prefixes 1
+
+**Routes learned after routing policy applied:**
+
+.. code-block:: none
+
+  vyos@vos1:~$ sho ip b
+  BGP table version is 0, local router ID is 192.168.56.101
+  Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
+                r RIB-failure, S Stale, R Removed
+  Origin codes: i - IGP, e - EGP, ? - incomplete
+  
+     Network          Next Hop            Metric LocPrf Weight Path
+  *> 22.22.22.22/32   1.1.1.2                  1             0 2 2 2 2 i < longer AS_path length
+  
+  Total number of prefixes 1
+  vyos@vos1:~$ 
+
+
+.. _routing-pbr:
+
+Policy-Based Routing (PBR)
+--------------------------
+
+VyOS supports Policy Routing, allowing traffic to be assigned to a different
+routing table. Traffic can be matched using standard 5-tuple matching (source
+address, destination address, protocol, source port, destination port).
+
+Transparent Proxy
+^^^^^^^^^^^^^^^^^
+
+The following example will show how VyOS can be used to redirect web traffic to
+an external transparent proxy:
+
+.. code-block:: none
+
+  set policy route FILTER-WEB rule 1000 destination port 80
+  set policy route FILTER-WEB rule 1000 protocol tcp
+  set policy route FILTER-WEB rule 1000 set table 100
+
+This creates a route policy called FILTER-WEB with one rule to set the routing
+table for matching traffic (TCP port 80) to table ID 100 instead of the
+default routing table.
+
+To create routing table 100 and add a new default gateway to be used by
+traffic matching our route policy:
+
+.. code-block:: none
+
+  set protocols static table 100 route 0.0.0.0/0 next-hop 10.255.0.2
+
+This can be confirmed using the show ip route table 100 operational command.
+
+Finally, to apply the policy route to ingress traffic on our LAN interface,
+we use:
+
+.. code-block:: none
+
+  set interfaces ethernet eth1 policy route FILTER-WEB
+
+
+Multiple Uplinks
+^^^^^^^^^^^^^^^^
+
+VyOS Policy-Based Routing (PBR) works by matching source IP address ranges and
+forwarding the traffic using different routing tables.
+
+Routing tables that will be used in this example are:
+
+* ``table 10`` Routing tabled used for VLAN 10 (192.168.188.0/24)
+* ``table 11`` Routing tabled used for VLAN 11 (192.168.189.0/24)
+* ``main`` Routing table used by VyOS and other interfaces not paritipating in PBR
+
+.. figure:: /_static/images/pbr_example_1.png
+   :scale: 80 %
+   :alt: PBR multiple uplinks
+
+   Policy-Based Routing with multiple ISP uplinks (source ./draw.io/pbr_example_1.drawio)
+
+Add default routes for routing ``table 10`` and ``table 11``
+
+.. code-block:: none
+
+  set protocols static table 10 route 0.0.0.0/0 next-hop 192.0.1.1
+  set protocols static table 11 route 0.0.0.0/0 next-hop 192.0.2.2
+
+Add policy route matching VLAN source addresses
+
+.. code-block:: none
+
+  set policy route PBR rule 20 set table '10'
+  set policy route PBR rule 20 description 'Route VLAN10 traffic to table 10'
+  set policy route PBR rule 20 source address '192.168.188.0/24'
+
+  set policy route PBR rule 30 set table '11'
+  set policy route PBR rule 30 description 'Route VLAN11 traffic to table 11'
+  set policy route PBR rule 30 source address '192.168.189.0/24'
+
+Apply routing policy to **inbound** direction of out VLAN interfaces
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 vif 10 policy route 'PBR'
+  set interfaces ethernet eth0 vif 11 policy route 'PBR'
+
+
+**OPTIONAL:** Exclude Inter-VLAN traffic (between VLAN10 and VLAN11) from PBR
+
+.. code-block:: none
+
+  set policy route PBR rule 10 description 'VLAN10 <-> VLAN11 shortcut'
+  set policy route PBR rule 10 destination address '192.168.188.0/24'
+  set policy route PBR rule 10 destination address '192.168.189.0/24'
+  set policy route PBR rule 10 set table 'main'
+
+.. note:: Allows the VLAN10 and VLAN20 hosts to communicate with each other using the
+   main routing table.
diff --git a/docs/configuration/protocols/bgp.rst b/docs/configuration/protocols/bgp.rst
new file mode 100644
index 00000000..f0550fd4
--- /dev/null
+++ b/docs/configuration/protocols/bgp.rst
@@ -0,0 +1,144 @@
+.. _routing-bgp:
+
+Border Gateway Protocol (BGP)
+-----------------------------
+
+IPv4
+^^^^
+
+A simple eBGP configuration:
+
+**Node 1:**
+
+.. code-block:: none
+
+  set protocols bgp 65534 neighbor 192.168.0.2 ebgp-multihop '2'
+  set protocols bgp 65534 neighbor 192.168.0.2 remote-as '65535'
+  set protocols bgp 65534 neighbor 192.168.0.2 update-source '192.168.0.1'
+  set protocols bgp 65534 address-family ipv4-unicast network '172.16.0.0/16'
+  set protocols bgp 65534 parameters router-id '192.168.0.1'
+
+**Node 2:**
+
+.. code-block:: none
+
+  set protocols bgp 65535 neighbor 192.168.0.1 ebgp-multihop '2'
+  set protocols bgp 65535 neighbor 192.168.0.1 remote-as '65534'
+  set protocols bgp 65535 neighbor 192.168.0.1 update-source '192.168.0.2'
+  set protocols bgp 65535 address-family ipv4-unicast network '172.17.0.0/16'
+  set protocols bgp 65535 parameters router-id '192.168.0.2'
+
+
+Don't forget, the CIDR declared in the network statement MUST **exist in your
+routing table (dynamic or static), the best way to make sure that is true is
+creating a static route:**
+
+**Node 1:**
+
+.. code-block:: none
+
+  set protocols static route 172.16.0.0/16 blackhole distance '254'
+
+**Node 2:**
+
+.. code-block:: none
+
+  set protocols static route 172.17.0.0/16 blackhole distance '254'
+
+
+IPv6
+^^^^
+
+A simple BGP configuration via IPv6.
+
+**Node 1:**
+
+.. code-block:: none
+
+  set protocols bgp 65534 neighbor 2001:db8::2 ebgp-multihop '2'
+  set protocols bgp 65534 neighbor 2001:db8::2 remote-as '65535'
+  set protocols bgp 65534 neighbor 2001:db8::2 update-source '2001:db8::1'
+  set protocols bgp 65534 neighbor 2001:db8::2 address-family ipv6-unicast
+  set protocols bgp 65534 address-family ipv6-unicast network '2001:db8:1::/48'
+  set protocols bgp 65534 parameters router-id '10.1.1.1'
+
+**Node 2:**
+
+.. code-block:: none
+
+  set protocols bgp 65535 neighbor 2001:db8::1 ebgp-multihop '2'
+  set protocols bgp 65535 neighbor 2001:db8::1 remote-as '65534'
+  set protocols bgp 65535 neighbor 2001:db8::1 update-source '2001:db8::2'
+  set protocols bgp 65535 neighbor 2001:db8::1 address-family ipv6-unicast
+  set protocols bgp 65535 address-family ipv6-unicast network '2001:db8:2::/48'
+  set protocols bgp 65535 parameters router-id '10.1.1.2'
+
+Don't forget, the CIDR declared in the network statement **MUST exist in your
+routing table (dynamic or static), the best way to make sure that is true is
+creating a static route:**
+
+**Node 1:**
+
+.. code-block:: none
+
+  set protocols static route6 2001:db8:1::/48 blackhole distance '254'
+
+**Node 2:**
+
+.. code-block:: none
+
+  set protocols static route6 2001:db8:2::/48 blackhole distance '254'
+
+Route Filter
+^^^^^^^^^^^^
+
+Route filter can be applied using a route-map:
+
+**Node1:**
+
+.. code-block:: none
+
+  set policy prefix-list AS65535-IN rule 10 action 'permit'
+  set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16'
+  set policy prefix-list AS65535-OUT rule 10 action 'deny'
+  set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16'
+  set policy prefix-list6 AS65535-IN rule 10 action 'permit'
+  set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48'
+  set policy prefix-list6 AS65535-OUT rule 10 action 'deny'
+  set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48'
+  set policy route-map AS65535-IN rule 10 action 'permit'
+  set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN'
+  set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN'
+  set policy route-map AS65535-IN rule 20 action 'deny'
+  set policy route-map AS65535-OUT rule 10 action 'deny'
+  set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT'
+  set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT'
+  set policy route-map AS65535-OUT rule 20 action 'permit'
+  set protocols bgp 65534 neighbor 2001:db8::2 route-map export 'AS65535-OUT'
+  set protocols bgp 65534 neighbor 2001:db8::2 route-map import 'AS65535-IN'
+
+**Node2:**
+
+.. code-block:: none
+
+  set policy prefix-list AS65534-IN rule 10 action 'permit'
+  set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16'
+  set policy prefix-list AS65534-OUT rule 10 action 'deny'
+  set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16'
+  set policy prefix-list6 AS65534-IN rule 10 action 'permit'
+  set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48'
+  set policy prefix-list6 AS65534-OUT rule 10 action 'deny'
+  set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48'
+  set policy route-map AS65534-IN rule 10 action 'permit'
+  set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN'
+  set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN'
+  set policy route-map AS65534-IN rule 20 action 'deny'
+  set policy route-map AS65534-OUT rule 10 action 'deny'
+  set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT'
+  set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT'
+  set policy route-map AS65534-OUT rule 20 action 'permit'
+  set protocols bgp 65535 neighbor 2001:db8::1 route-map export 'AS65534-OUT'
+  set protocols bgp 65535 neighbor 2001:db8::1 route-map import 'AS65534-IN'
+
+We could expand on this and also deny link local and multicast in the rule 20
+action deny.
diff --git a/docs/configuration/protocols/igmp.rst b/docs/configuration/protocols/igmp.rst
new file mode 100644
index 00000000..421c9f0f
--- /dev/null
+++ b/docs/configuration/protocols/igmp.rst
@@ -0,0 +1,246 @@
+.. _multicast:
+
+#########
+Multicast
+#########
+
+VyOS facilitates IP Multicast by supporting **PIM Sparse Mode**,
+**IGMP** and **IGMP-Proxy**.
+
+
+************
+PIM and IGMP
+************
+
+PIM (Protocol Independent Multicast) must be configured in every
+interface of every participating router. Every router must also have the
+location of the Rendevouz Point manually configured. Then,
+unidirectional shared trees rooted at the Rendevouz Point will
+automatically be built for multicast distribution. 
+
+Traffic from multicast sources will go to the Rendezvous Point, and
+receivers will pull it from a shared tree using IGMP (Internet Group
+Management Protocol).
+
+Multicast receivers will talk IGMP to their local router, so, besides
+having PIM configured in every router, IGMP must also be configured in
+any router where there could be a multicast receiver locally connected. 
+
+VyOS supports both IGMP version 2 and version 3 (which allows
+source-specific multicast).
+
+
+Example
+=======
+
+In the following example we can see a basic multicast setup:
+
+.. image:: /_static/images/multicast-basic.png
+   :width: 90%
+   :align: center
+   :alt: Network Topology Diagram
+
+
+
+**Router 1**
+
+.. code-block:: none
+
+   set interfaces ethernet eth2 address '172.16.0.2/24'
+   set interfaces ethernet eth1 address '100.64.0.1/24'
+   set protocols ospf area 0 network '172.16.0.0/24'
+   set protocols ospf area 0 network '100.64.0.0/24'
+   set protocols igmp interface eth1
+   set protocols pim interface eth1
+   set protocols pim interface eth2
+   set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'
+   
+**Router 3**
+
+.. code-block:: none
+
+   set interfaces dummy dum0 address '172.16.255.1/24'
+   set interfaces ethernet eth0 address '172.16.0.1/24'
+   set interfaces ethernet eth1 address '172.16.1.1/24'
+   set protocols ospf area 0 network '172.16.0.0/24'
+   set protocols ospf area 0 network '172.16.255.0/24'
+   set protocols ospf area 0 network '172.16.1.0/24'
+   set protocols pim interface dum0
+   set protocols pim interface eth0
+   set protocols pim interface eth1
+   set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'
+   
+**Router 2**
+
+.. code-block:: none
+
+   set interfaces ethernet eth1 address '10.0.0.1/24'
+   set interfaces ethernet eth2 address '172.16.1.2/24'
+   set protocols ospf area 0 network '10.0.0.0/24'
+   set protocols ospf area 0 network '172.16.1.0/24'
+   set protocols pim interface eth1
+   set protocols pim interface eth2
+   set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'
+   
+
+
+
+
+Basic commands
+==============
+
+These are the commands for a basic setup.
+
+.. cfgcmd:: set protocols pim interface <interface-name>
+
+   Use this command to enable PIM in the selected interface so that it
+   can communicate with PIM neighbors.
+
+
+.. cfgcmd:: set protocols pim rp address <address> group <multicast-address/mask-bits>
+
+   Use this comand to manually configure a Rendevouz Point for PIM so
+   that join messages can be sent there. Set the Rendevouz Point address
+   and the matching prefix of group ranges covered. These values must
+   be shared with every router participating in the PIM network.
+ 
+
+.. cfgcmd:: set protocols igmp interface eth1
+
+   Use this command to configure an interface with IGMP so that PIM can
+   receive IGMP reports and query on the selected interface. By defaul
+   IGMP version 3 will be used.
+
+
+
+Tuning commands
+===============
+
+You can also tune multicast with the following commands.
+
+.. cfgcmd:: set protocols pim interface <interface> dr-priority <value>
+
+   Use this PIM command in the selected interface to set the priority
+   (1-4294967295) you want to influence in the election of a node to
+   become the Designated Router for a LAN segment. The default priority
+   is 1, set a  higher value to give the router more preference in the
+   DR election process.
+
+
+.. cfgcmd:: set protocols pim int <interface> hello <seconds>
+
+   Use this command to configure the PIM hello interval in seconds
+   (1-180) for the selected interface.
+
+
+.. cfgcmd:: set protocols pim rp keep-alive-timer <seconds>
+
+   Use this PIM command to modify the the time out value (31-60000
+   seconds) for an `(S,G) <https://tools.ietf.org/html/rfc7761#section-4.1>`_
+   flow. 31 seconds is chosen for a lower bound as some hardware
+   platforms cannot see data flowing in better than 30 second chunks.
+
+
+.. cfgcmd:: set protocols igmp interface <interface> join <multicast-address> source <IP-address>
+
+   Use this command to allow the selected interface join a multicast
+   group defining the multicast address you want to join and the source
+   IP address too.
+
+
+.. cfgcmd:: set protocols igmp interface <interface query-interval <seconds>
+
+   Use this command to configure in the selected interface the IGMP
+   host query interval (1-1800) in seconds that PIM will use.
+
+
+.. cfgcmd:: set protocols igmp interface <interface query-max-response-time <deciseconds>
+
+   Use this command to configure in the selected interface the IGMP
+   query response timeout value (10-250) in deciseconds. If a report is
+   not returned in the specified time, it will be asumed the `(S,G) or
+   (*,G) state <https://tools.ietf.org/html/rfc7761#section-4.1>`_ has
+   timed out.
+
+
+.. cfgcmd:: set protocols igmp interface <interface> version <version-number> 
+
+   Use this command to define in the selected interface whether you
+   choose IGMP version 2 or 3. The default value is 3.
+
+
+
+**********
+IGMP Proxy
+**********
+
+:abbr:`IGMP (Internet Group Management Protocol)` proxy sends IGMP host
+messages on behalf of a connected client. The configuration must define
+one, and only one upstream interface, and one or more downstream
+interfaces.
+
+Configuration
+=============
+
+.. cfgcmd:: set protocols igmp-proxy interface <interface> role <upstream | downstream>
+
+   * **upstream:** The upstream network interface is the outgoing interface
+     which is responsible for communicating to available multicast data sources.
+     There can only be one upstream interface.
+
+   * **downstream:** Downstream network interfaces are the distribution
+     interfaces to the destination networks, where multicast clients can join
+     groups and receive multicast data. One or more downstream interfaces must
+     be configured.
+
+.. cfgcmd:: set protocols igmp-proxy interface <interface> alt-subnet <network>
+
+   Defines alternate sources for multicasting and IGMP data. The network address
+   must be on the following format 'a.b.c.d/n'. By default the router will
+   accept data from sources on the same network as configured on an interface.
+   If the multicast source lies on a remote network, one must define from where
+   traffic should be accepted.
+
+   This is especially useful for the upstream interface, since the source for
+   multicast traffic is often from a remote location.
+
+   This option can be supplied multiple times.
+
+.. cfgcmd:: set protocols igmp-proxy disable-quickleave
+
+   Disables quickleave mode. In this mode the daemon will not send a Leave IGMP
+   message upstream as soon as it receives a Leave message for any downstream
+   interface. The daemon will not ask for Membership reports on the downstream
+   interfaces, and if a report is received the group is not joined again
+   upstream.
+
+   If it's vital that the daemon should act exactly as a real multicast client
+   on the upstream interface, this function should be enabled.
+
+   Enabling this function increases the risk of bandwidth saturation.
+
+.. cfgcmd:: set protocols igmp-proxy disable
+
+   Disable this service.
+
+Example
+-------
+
+Interface `eth1` LAN is behind NAT. In order to subscribe `10.0.0.0/23`
+subnet multicast which is in `eth0` WAN we need to configure igmp-proxy.
+
+.. code-block:: none
+
+  set protocols igmp-proxy interface eth0 role upstream
+  set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23
+  set protocols igmp-proxy interface eth1 role downstream
+
+Operation
+=========
+
+.. opcmd:: restart igmp-proxy
+
+   Restart the IGMP proxy process.
+
+
+
diff --git a/docs/configuration/protocols/index.rst b/docs/configuration/protocols/index.rst
new file mode 100644
index 00000000..a737a026
--- /dev/null
+++ b/docs/configuration/protocols/index.rst
@@ -0,0 +1,18 @@
+.. _routing:
+
+#########
+Protocols
+#########
+
+VyOS is a "router first" network operating system. It supports static routing,
+policy routing, and dynamic routing using standard protocols (RIP, OSPF, and
+BGP).
+
+.. toctree::
+   :maxdepth: 1
+
+   bgp
+   igmp
+   ospf
+   rip
+   static
diff --git a/docs/configuration/protocols/ospf.rst b/docs/configuration/protocols/ospf.rst
new file mode 100644
index 00000000..1e70f644
--- /dev/null
+++ b/docs/configuration/protocols/ospf.rst
@@ -0,0 +1,139 @@
+.. _routing-ospf:
+
+Open Shortest Path First (OSPF)
+-------------------------------
+
+Open Shortest Path First (OSPF) is a routing protocol for Internet Protocol
+(IP) networks. It uses a link state routing (LSR) algorithm and falls into the
+group of interior gateway protocols (IGPs), operating within a single autonomous
+system (AS). It is defined as OSPF Version 2 in RFC2328_ (1998) for IPv4. Updates
+for IPv6 are specified as OSPF Version 3 in RFC5340_ (2008). OSPF supports the
+Classless Inter-Domain Routing (CIDR) addressing model.
+
+OSPF is a widely used IGP in large enterprise networks.
+
+OSPFv2 (IPv4)
+^^^^^^^^^^^^^
+
+In order to have a VyOS system exchanging routes with OSPF neighbors, you will at least need to configure the area and a network,
+
+.. code-block:: none
+
+  set protocols ospf area 0 network 192.168.0.0/24
+
+as well as the router ID.
+
+.. code-block:: none
+
+  set protocols ospf parameters router-id 10.1.1.1
+ 
+That is the minimum configuration you will need.
+
+Below you can see a typical configuration using 2 nodes, redistribute loopback address and the node 1 sending the default route:
+
+**Node 1**
+
+.. code-block:: none
+
+  set interfaces loopback lo address 10.1.1.1/32
+  set protocols ospf area 0 network 192.168.0.0/24
+  set protocols ospf default-information originate always
+  set protocols ospf default-information originate metric 10
+  set protocols ospf default-information originate metric-type 2
+  set protocols ospf log-adjacency-changes
+  set protocols ospf parameters router-id 10.1.1.1
+  set protocols ospf redistribute connected metric-type 2
+  set protocols ospf redistribute connected route-map CONNECT
+
+  set policy route-map CONNECT rule 10 action permit
+  set policy route-map CONNECT rule 10 match interface lo
+
+**Node 2**
+
+.. code-block:: none
+
+  set interfaces loopback lo address 10.2.2.2/32
+  set protocols ospf area 0 network 192.168.0.0/24
+  set protocols ospf log-adjacency-changes
+  set protocols ospf parameters router-id 10.2.2.2
+  set protocols ospf redistribute connected metric-type 2
+  set protocols ospf redistribute connected route-map CONNECT
+
+  set policy route-map CONNECT rule 10 action permit
+  set policy route-map CONNECT rule 10 match interface lo
+
+OSPFv3 (IPv6)
+^^^^^^^^^^^^^
+
+A typical configuration using 2 nodes.
+
+**Node 1:**
+
+.. code-block:: none
+
+  set protocols ospfv3 area 0.0.0.0 interface eth1
+  set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64
+  set protocols ospfv3 parameters router-id 192.168.1.1
+  set protocols ospfv3 redistribute connected
+
+**Node 2:**
+
+.. code-block:: none
+
+  set protocols ospfv3 area 0.0.0.0 interface eth1
+  set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64
+  set protocols ospfv3 parameters router-id 192.168.2.1
+  set protocols ospfv3 redistribute connected
+
+.. note:: You can not easily redistribute IPv6 routes via OSPFv3 on a WireGuard
+   interface link. This requires you to configure link-local addresses manually
+   on the WireGuard interfaces, see Phabricator task T1483_.
+
+Example configuration for WireGuard interfaces:
+
+**Node 1**
+
+.. code-block:: none
+
+  set interfaces wireguard wg01 address 'fe80::216:3eff:fe51:fd8c/64'
+  set interfaces wireguard wg01 address '192.168.0.1/24'
+  set interfaces wireguard wg01 peer ospf02 allowed-ips '::/0'
+  set interfaces wireguard wg01 peer ospf02 allowed-ips '0.0.0.0/0'
+  set interfaces wireguard wg01 peer ospf02 endpoint '10.1.1.101:12345'
+  set interfaces wireguard wg01 peer ospf02 pubkey 'ie3...='
+  set interfaces wireguard wg01 port '12345'
+  set protocols ospfv3 parameters router-id 192.168.1.1
+  set protocols ospfv3 area 0.0.0.0 interface 'wg01'
+  set protocols ospfv3 area 0.0.0.0 interface 'lo'
+
+**Node 2**
+
+.. code-block:: none
+
+  set interfaces wireguard wg01 address 'fe80::216:3eff:fe0a:7ada/64'
+  set interfaces wireguard wg01 address '192.168.0.2/24'
+  set interfaces wireguard wg01 peer ospf01 allowed-ips '::/0'
+  set interfaces wireguard wg01 peer ospf01 allowed-ips '0.0.0.0/0'
+  set interfaces wireguard wg01 peer ospf01 endpoint '10.1.1.100:12345'
+  set interfaces wireguard wg01 peer ospf01 pubkey 'NHI...='
+  set interfaces wireguard wg01 port '12345'
+  set protocols ospfv3 parameters router-id 192.168.1.2
+  set protocols ospfv3 area 0.0.0.0 interface 'wg01'
+  set protocols ospfv3 area 0.0.0.0 interface 'lo'
+
+**Status**
+
+.. code-block:: none
+
+  vyos@ospf01:~$ sh ipv6 ospfv3 neighbor
+  Neighbor ID     Pri    DeadTime    State/IfState         Duration I/F[State]
+  192.168.0.2       1    00:00:37     Full/PointToPoint    00:18:03 wg01[PointToPoint]
+
+  vyos@ospf02# run sh ipv6 ospfv3 neighbor
+  Neighbor ID     Pri    DeadTime    State/IfState         Duration I/F[State]
+  192.168.0.1       1    00:00:39     Full/PointToPoint    00:19:44 wg01[PointToPoint]
+
+.. _RFC2328: https://tools.ietf.org/html/rfc2328
+.. _RFC5340: https://tools.ietf.org/html/rfc2340
+.. _T1483: https://phabricator.vyos.net/T1483
+
diff --git a/docs/configuration/protocols/rip.rst b/docs/configuration/protocols/rip.rst
new file mode 100644
index 00000000..da00e7b1
--- /dev/null
+++ b/docs/configuration/protocols/rip.rst
@@ -0,0 +1,22 @@
+.. _routing-rip:
+
+Routing Information Protocol (RIP)
+----------------------------------
+
+Simple RIP configuration using 2 nodes and redistributing connected interfaces.
+
+**Node 1:**
+
+.. code-block:: none
+
+  set interfaces loopback address 10.1.1.1/32
+  set protocols rip network 192.168.0.0/24
+  set protocols rip redistribute connected
+
+**Node 2:**
+
+.. code-block:: none
+
+  set interfaces loopback address 10.2.2.2/32
+  set protocols rip network 192.168.0.0/24
+  set protocols rip redistribute connected
diff --git a/docs/configuration/protocols/static.rst b/docs/configuration/protocols/static.rst
new file mode 100644
index 00000000..8415981b
--- /dev/null
+++ b/docs/configuration/protocols/static.rst
@@ -0,0 +1,66 @@
+.. _routing-static:
+
+######
+Static
+######
+
+Static routes are manually configured network routes.
+
+A typical use for a static route is a static default route for systems that do
+not make use of DHCP or dynamic routing protocols:
+
+.. code-block:: none
+
+  set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 distance '1'
+
+Another common use of static routes is to blackhole (drop) traffic. In the
+example below, RFC1918_ networks are set as blackhole routes. 
+
+This prevents these networks leaking out public interfaces, but it does not prevent
+them from being used as the most specific route has the highest priority.
+
+.. code-block:: none
+
+  set protocols static route 10.0.0.0/8 blackhole distance '254'
+  set protocols static route 172.16.0.0/12 blackhole distance '254'
+  set protocols static route 192.168.0.0/16 blackhole distance '254'
+
+.. note:: Routes with a distance of 255 are effectively disabled and not
+   installed into the kernel.
+
+.. _RFC1918: https://tools.ietf.org/html/rfc1918
+
+.. _routing-arp:
+
+Address Resolution Protocol (ARP)
+---------------------------------
+
+To manipulate or display ARP_ table entries, the following commands are implemented.
+
+adding a static arp entry
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  set protocols static arp 10.1.1.100 hwaddr 08:00:27:de:23:aa
+  commit
+
+display arp table entries
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  show protocols static arp
+
+  Address                  HWtype  HWaddress           Flags Mask            Iface
+  10.1.1.1                 ether   08:00:27:de:23:2e   C                     eth1
+  10.1.1.100               ether   08:00:27:de:23:aa   CM                    eth1
+
+.. code-block:: none
+
+  show protocols static arp interface eth1
+  Address                  HWtype  HWaddress           Flags Mask            Iface
+  10.1.1.1                 ether   08:00:27:de:23:2e   C                     eth1
+  10.1.1.100               ether   08:00:27:de:23:aa   CM                    eth1
+
+.. _ARP: https://en.wikipedia.org/wiki/Address_Resolution_Protocol
diff --git a/docs/configuration/service/broadcast-relay.rst b/docs/configuration/service/broadcast-relay.rst
new file mode 100644
index 00000000..40f738e6
--- /dev/null
+++ b/docs/configuration/service/broadcast-relay.rst
@@ -0,0 +1,53 @@
+UDP broadcast relay
+-------------------
+
+Certain vendors use broadcasts to identify their equipemnt within one ethernet
+segment. Unfortunately if you split your network with multiple VLANs you loose
+the ability of identifying your equiment.
+
+This is where "UDP broadcast relay" comes into play! It will forward received
+broadcasts to other configured networks.
+
+Every UDP port which will be forward requires one unique ID. Currently we
+support 99 IDs!
+
+Example #1: To forward all broadcast packets received on `UDP port 1900` on
+`eth3`, `eth4` or `eth5` to all other interfaces in this configuration.
+
+.. code-block:: none
+
+  set service broadcast-relay id 1 description 'SONOS'
+  set service broadcast-relay id 1 interface 'eth3'
+  set service broadcast-relay id 1 interface 'eth4'
+  set service broadcast-relay id 1 interface 'eth5'
+  set service broadcast-relay id 1 port '1900'
+
+Example #2: To Forward all broadcasts packets received on `UDP port 6969` on
+`eth3` or `eth4` to the other interface in this configuration.
+
+.. code-block:: none
+
+  set service broadcast-relay id 2 description 'SONOS MGMT'
+  set service broadcast-relay id 2 interface 'eth3'
+  set service broadcast-relay id 2 interface 'eth4'
+  set service broadcast-relay id 2 port '6969'
+
+Disable Instance(s)
+^^^^^^^^^^^^^^^^^^^
+
+Each broadcast relay instance can be individually disabled without deleting the
+configured node by using the following command:
+
+.. code-block:: none
+
+  set service broadcast-relay id <n> disable
+
+In addition you can also disable the whole service without removing the
+configuration by:
+
+.. code-block:: none
+
+  set service broadcast-relay disable
+
+.. note:: You can run the UDP broadcast relay service on multiple routers
+   connected to a subnet. There is **NO** UDP broadcast relay packet storm!
diff --git a/docs/configuration/service/conntrack-sync.rst b/docs/configuration/service/conntrack-sync.rst
new file mode 100644
index 00000000..28f16d54
--- /dev/null
+++ b/docs/configuration/service/conntrack-sync.rst
@@ -0,0 +1,178 @@
+Conntrack
+---------
+
+One of the important features built on top of the Netfilter framework is
+connection tracking. Connection tracking allows the kernel to keep track of all
+logical network connections or sessions, and thereby relate all of the packets
+which may make up that connection. NAT relies on this information to translate
+all related packets in the same way, and iptables can use this information to
+act as a stateful firewall.
+
+The connection state however is completely independent of any upper-level
+state, such as TCP's or SCTP's state. Part of the reason for this is that when
+merely forwarding packets, i.e. no local delivery, the TCP engine may not
+necessarily be invoked at all. Even connectionless-mode transmissions such as
+UDP, IPsec (AH/ESP), GRE and other tunneling protocols have, at least, a pseudo
+connection state. The heuristic for such protocols is often based upon a preset
+timeout value for inactivity, after whose expiration a Netfilter connection is
+dropped.
+
+Each Netfilter connection is uniquely identified by a (layer-3 protocol, source
+address, destination address, layer-4 protocol, layer-4 key) tuple. The layer-4
+key depends on the transport protocol; for TCP/UDP it is the port numbers, for
+tunnels it can be their tunnel ID, but otherwise is just zero, as if it were
+not part of the tuple. To be able to inspect the TCP port in all cases, packets
+will be mandatorily defragmented.
+
+Configuration
+^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  # Protocols only for which local conntrack entries will be synced (tcp, udp, icmp, sctp)
+  set service conntrack-sync accept-protocol
+
+  # Queue size for listening to local conntrack events (in MB)
+  set service conntrack-sync event-listen-queue-size <int>
+
+  # Protocol for which expect entries need to be synchronized. (all, ftp, h323, nfs, sip, sqlnet)
+  set service conntrack-sync expect-sync
+
+  # Failover mechanism to use for conntrack-sync [REQUIRED]
+  set service conntrack-sync failover-mechanism
+
+  set service conntrack-sync cluster group <string>
+  set service conntrack-sync vrrp sync-group <1-255>
+
+  # IP addresses for which local conntrack entries will not be synced
+  set service conntrack-sync ignore-address ipv4 <x.x.x.x>
+
+  # Interface to use for syncing conntrack entries [REQUIRED]
+  set service conntrack-sync interface <ifname>
+
+  # Multicast group to use for syncing conntrack entries
+  set service conntrack-sync mcast-group <x.x.x.x>
+
+  # Queue size for syncing conntrack entries (in MB)
+  set service conntrack-sync sync-queue-size <size>
+
+Example
+^^^^^^^
+The next exemple is a simple configuration of conntrack-sync.
+
+
+.. figure:: /_static/images/service_conntrack_sync-schema.png
+   :scale: 60 %
+   :alt: Conntrack Sync Example
+
+   Conntrack Sync Example
+
+First of all, make sure conntrack is enabled by running
+
+.. code-block:: none
+
+  show conntrack table ipv4
+
+If the table is empty and you have a warning message, it means conntrack is not
+enabled. To enable conntrack, just create a NAT or a firewall rule.
+
+.. code-block:: none
+
+  set firewall state-policy established action accept
+
+You now should have a conntrack table
+
+.. code-block:: none
+
+  $ show conntrack table ipv4
+  TCP state codes: SS - SYN SENT, SR - SYN RECEIVED, ES - ESTABLISHED,
+                   FW - FIN WAIT, CW - CLOSE WAIT, LA - LAST ACK,
+                   TW - TIME WAIT, CL - CLOSE, LI - LISTEN
+
+  CONN ID    Source                 Destination            Protocol         TIMEOUT
+  1015736576 10.35.100.87:58172     172.31.20.12:22        tcp [6] ES       430279
+  1006235648 10.35.101.221:57483    172.31.120.21:22       tcp [6] ES       413310
+  1006237088 10.100.68.100          172.31.120.21          icmp [1]         29
+  1015734848 10.35.100.87:56282     172.31.20.12:22        tcp [6] ES       300
+  1015734272 172.31.20.12:60286     239.10.10.14:694       udp [17]         29
+  1006239392 10.35.101.221          172.31.120.21          icmp [1]         29
+
+Now configure conntrack-sync service on ``router1`` **and** ``router2``
+
+.. code-block:: none
+
+  set service conntrack-sync accept-protocol 'tcp,udp,icmp'
+  set service conntrack-sync event-listen-queue-size '8'
+  set service conntrack-sync failover-mechanism cluster group 'GROUP' # Or VRRP
+  set service conntrack-sync interface 'eth0'
+  set service conntrack-sync mcast-group '225.0.0.50'
+  set service conntrack-sync sync-queue-size '8'
+
+On the active router, you should have informations in the internal-cache of
+conntrack-sync. The same current active connections number should be shown in
+the external-cache of the standby router
+
+On active router run:
+
+
+.. code-block:: none
+
+  $ show conntrack-sync statistics
+
+  Main Table Statistics:
+
+  cache internal:
+  current active connections:               10
+  connections created:                    8517    failed:            0
+  connections updated:                     127    failed:            0
+  connections destroyed:                  8507    failed:            0
+
+  cache external:
+  current active connections:                0
+  connections created:                       0    failed:            0
+  connections updated:                       0    failed:            0
+  connections destroyed:                     0    failed:            0
+
+  traffic processed:
+                     0 Bytes                         0 Pckts
+
+  multicast traffic (active device=eth0):
+                868780 Bytes sent               224136 Bytes recv
+                 20595 Pckts sent                14034 Pckts recv
+                     0 Error send                    0 Error recv
+
+  message tracking:
+                     0 Malformed msgs                    0 Lost msgs
+
+
+
+  On standby router run:
+
+
+  $ show conntrack-sync statistics
+
+  Main Table Statistics:
+
+  cache internal:
+  current active connections:                0
+  connections created:                       0    failed:            0
+  connections updated:                       0    failed:            0
+  connections destroyed:                     0    failed:            0
+
+  cache external:
+  current active connections:               10
+  connections created:                     888    failed:            0
+  connections updated:                     134    failed:            0
+  connections destroyed:                   878    failed:            0
+
+  traffic processed:
+                     0 Bytes                         0 Pckts
+
+  multicast traffic (active device=eth0):
+                234184 Bytes sent               907504 Bytes recv
+                 14663 Pckts sent                21495 Pckts recv
+                     0 Error send                    0 Error recv
+
+  message tracking:
+                     0 Malformed msgs                    0 Lost msgs
+
diff --git a/docs/configuration/service/dhcp-relay.rst b/docs/configuration/service/dhcp-relay.rst
new file mode 100644
index 00000000..0b838442
--- /dev/null
+++ b/docs/configuration/service/dhcp-relay.rst
@@ -0,0 +1,165 @@
+
+
+DHCP Relay
+----------
+
+If you want your router to forward DHCP requests to an external DHCP server
+you can configure the system to act as a DHCP relay agent. The DHCP relay
+agent works with IPv4 and IPv6 addresses.
+
+All interfaces used for the DHCP relay must be configured. See
+https://wiki.vyos.net/wiki/Network_address_setup.
+
+DHCP relay example
+^^^^^^^^^^^^^^^^^^
+
+.. figure:: /_static/images/service_dhcp-relay01.png
+   :scale: 80 %
+   :alt: DHCP relay example
+
+   DHCP relay example
+
+In this example the interfaces used for the DHCP relay are eth1 and eth2. The
+router receives DHCP client requests on eth1 and relays them through eth2 to
+the DHCP server at 10.0.1.4.
+
+Configuration
+^^^^^^^^^^^^^
+
+Enable DHCP relay for eth1 and eth2:
+
+.. code-block:: none
+
+  set service dhcp-relay interface eth1
+  set service dhcp-relay interface eth2
+
+Set the IP address of the DHCP server:
+
+.. code-block:: none
+
+  set service dhcp-relay server 10.0.1.4
+
+The router should discard DHCP packages already containing relay agent
+information to ensure that only requests from DHCP clients are forwarded:
+
+.. code-block:: none
+
+  set service dhcp-relay relay-options relay-agents-packets discard
+
+Commit the changes and show the results:
+
+.. code-block:: none
+
+  commit
+  show service dhcp-relay
+      interface eth1
+      interface eth2
+      server 10.0.1.4
+      relay-options {
+         relay-agents-packets discard
+      }
+
+The DHCP relay agent can be restarted with:
+
+.. code-block:: none
+
+  restart dhcp relay-agent
+
+DHCPv6 relay example
+^^^^^^^^^^^^^^^^^^^^
+
+.. figure:: /_static/images/service_dhcpv6-relay01.png
+   :scale: 80 %
+   :alt: DHCPv6 relay example
+
+   DHCPv6 relay example
+
+In this example DHCPv6 requests are received by the router on eth1
+(`listening interface`) and forwarded through eth2 (`upstream interface`) to
+the external DHCPv6 server at 2001:db8:100::4.
+
+Configuration
+*************
+
+Set eth1 to be the listening interface for the DHCPv6 relay:
+
+.. code-block:: none
+
+  set service dhcpv6-relay listen-interface eth1
+
+Set eth2 to be the upstream interface and specify the IPv6 address of
+the DHCPv6 server:
+
+.. code-block:: none
+
+  set service dhcpv6-relay upstream-interface eth2 address 2001:db8:100::4
+
+Commit the changes and show results:
+
+.. code-block:: none
+
+  commit
+  show service dhcpv6-relay
+      listen-interface eth1 {
+      }
+      upstream-interface eth2 {
+         address 2001:db8:100::4
+      }
+
+Show the current status of the DHCPv6 relay agent:
+
+.. code-block:: none
+
+  show dhcpv6 relay-agent status
+
+The DHCPv6 relay agent can be restarted with:
+
+.. code-block:: none
+
+  restart dhcpv6 relay-agent
+
+Additional parameters
+^^^^^^^^^^^^^^^^^^^^^
+
+DHCP relay agent options
+************************
+
+Set the maximum hop count before packets are discarded. Range 0...255,
+default 10.
+
+* :code:`set service dhcp-relay relay-options hop-count 'count'`
+
+Set maximum size of DHCP packets including relay agent information. If a
+DHCP packet size surpasses this value it will be forwarded without appending
+relay agent information. Range 64...1400, default 576.
+
+* :code:`set service dhcp-relay relay-options max-size 'size'`
+
+Four policies for reforwarding DHCP packets exist:
+
+* **append:** The relay agent is allowed to append its own relay information
+  to a received DHCP packet, disregarding relay information already present in
+  the packet.
+
+* **discard:** Received packets which already contain relay information will
+  be discarded.
+
+* **forward:** All packets are forwarded, relay information already present
+  will be ignored.
+
+* **replace:** Relay information already present in a packet is stripped and
+  replaced with the router's own relay information set.
+
+* :code:`set service dhcp-relay relay-options relay-agents-packet 'policy'`
+
+DHCPv6 relay agent options
+**************************
+
+Set maximum hop count before packets are discarded. Default: 10.
+
+* :code:`set service dhcpv6-relay max-hop-count 'count'`
+
+If this is set the relay agent will insert the interface ID. This option is
+set automatically if more than one listening interfaces are in use.
+
+* :code:`set service dhcpv6-relay use-interface-id-option`
diff --git a/docs/configuration/service/dhcp-server.rst b/docs/configuration/service/dhcp-server.rst
new file mode 100644
index 00000000..f0d0a7e9
--- /dev/null
+++ b/docs/configuration/service/dhcp-server.rst
@@ -0,0 +1,444 @@
+
+DHCP Server
+-----------
+
+Multiple DHCP Servers can be run from a single machine. Each DHCP service is
+identified by a `shared-network-name`.
+
+DHCP Server Example
+^^^^^^^^^^^^^^^^^^^
+
+In this example, we are offering address space in the 172.16.17.0/24 network,
+which is on eth1, and pppoe0 is our connection to the internet. We are using
+the network name `dhcpexample`.
+
+Prerequisites
+^^^^^^^^^^^^^
+
+Configuring the PPPoE interface is assumed to be done already, and appears
+on `pppoe0`
+
+Interface Configuration
+^^^^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+ set interface ethernet eth1 address 172.16.17.1/24
+
+Multiple ranges can be defined and can contain holes.
+
+.. code-block:: none
+
+  set service dhcp-server shared-network-name dhcpexample authoritative
+  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 default-router 172.16.17.1
+  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 dns-server 172.16.17.1
+  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 lease 86400
+  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 range 0 start 172.16.17.100
+  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 range 0 stop 172.16.17.199
+
+
+Explanation
+^^^^^^^^^^^
+
+* :code:`set service dhcp-server shared-network-name dhcpexample authoritative`
+
+  This says that this device is the only DHCP server for this network. If other
+  devices are trying to offer DHCP leases, this machine will send 'DHCPNAK' to
+  any device trying to request an IP address that is
+  not valid for this network.
+
+* :code:`set service dhcp-server shared-network-name dhcpexample subnet
+  172.16.17.0/24 default-router 172.16.17.1`
+
+  This is a configuration parameter for the subnet, saying that as part of the
+  response, tell the client that I am the default router for this network
+
+* :code:`set service dhcp-server shared-network-name dhcpexample subnet
+  172.16.17.0/24 dns-server 172.16.17.1`
+
+  This is a configuration parameter for the subnet, saying that as part of the
+  response, tell the client that I am the DNS server for this network. If you
+  do not want to run a DNS server, you could also provide one of the public
+  DNS servers, such as google's. You can add multiple entries by repeating the
+  line.
+
+* :code:`set service dhcp-server shared-network-name dhcpexample subnet
+  172.16.17.0/24 lease 86400`
+
+  Assign the IP address to this machine for 24 hours. It is unlikely you'd need
+  to shorten this period, unless you are running a network with lots of devices
+  appearing and disappearing.
+
+
+* :code:`set service dhcp-server shared-network-name dhcpexample subnet
+  172.16.17.0/24 range 0 start 172.16.17.100`
+
+  Make a range of addresses available for clients starting from .100 [...]
+
+* :code:`set service dhcp-server shared-network-name dhcpexample subnet
+  172.16.17.0/24 range 0 stop 172.16.17.199`
+
+  [...] and ending at .199
+
+
+Failover
+^^^^^^^^
+
+VyOS provides support for DHCP failover:
+
+.. code-block:: none
+
+  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover local-address '192.168.0.1'
+  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover name 'foo'
+  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover peer-address '192.168.0.2'
+
+.. note:: `name` must be identical on both sides!
+
+The primary and secondary statements determines whether the server is
+primary or secondary
+
+.. code-block:: none
+
+  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover status 'primary'
+
+or
+
+.. code-block:: none
+
+  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover status 'secondary'
+
+.. note:: In order for the primary and the secondary DHCP server to keep
+   their lease tables in sync, they must be able to reach each other on TCP
+   port 647. If you have firewall rules in effect, adjust them accordingly.
+
+Static mappings MAC/IP
+^^^^^^^^^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 static-mapping static-mapping-01 ip-address 172.16.17.10
+  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 static-mapping static-mapping-01 mac-address ff:ff:ff:ff:ff:ff
+
+DHCP server options
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+default-router (DHCP option 003)
+  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 default-router <ROUTER-IP>`
+
+dns-server (DHCP option 006)
+  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 dns-server <DNS-SERVER-IP>`
+
+domain-name  Client domain name (DHCP option 015)
+  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 domain-name "<DOMAIN-NAME>"`
+
+domain-search (DHCP option 119)
+  This option can be given multiple times if you need multiple search domains
+  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 domain-search "<DOMAIN_NAME_1>"`
+  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 domain-search "<DOMAIN_NAME_2>"`
+
+
+
+DHCPv6 server
+-------------
+
+VyOS provides DHCPv6 server functionality which is described in this section.
+In order to use the DHCPv6 server it has to be enabled first:
+
+.. code-block:: none
+
+  set service dhcpv6-server
+
+To restart the DHCPv6 server (operational mode):
+
+.. code-block:: none
+
+  restart dhcpv6 server
+
+To show the current status of the DHCPv6 server use:
+
+.. code-block:: none
+
+  show dhcpv6 server status
+
+Show statuses of all assigned leases:
+
+.. code-block:: none
+
+  show dhcpv6 server leases
+
+DHCPv6 server options
+^^^^^^^^^^^^^^^^^^^^^
+
+DHCPv6 server preference value
+******************************
+
+Clients receiving advertise messages from multiple servers choose the server
+with the highest preference value. The range for this value is `0...255`. Set
+a preference value for the DHCPv6 server:
+
+.. code-block:: none
+
+  set service dhcpv6-server preference <preference value>
+
+Delete a preference:
+
+.. code-block:: none
+
+  set service dhcpv6-server preference
+
+Show current preference:
+
+.. code-block:: none
+
+  show service dhcpv6-server preference
+
+Specify address lease time
+**************************
+
+The default lease time for DHCPv6 leases is 24 hours. This can be changed by
+supplying a `default-time`, `maximum-time` and `minimum-time` (all values in
+seconds):
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> lease-time {default <default-time> | maximum <maximum-time> | minimum <minimum-time>}
+
+Reset the custom lease times:
+
+.. code-block:: none
+
+  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> lease-time {default | maximum | minimum}
+
+Show the current configuration:
+
+.. code-block:: none
+
+  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> lease-time {default | maximum | minimum}
+
+Specify NIS domain
+******************
+
+A Network Information (NIS) domain can be set to be used for DHCPv6 clients:
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-domain <nis-domain-name>
+
+To Delete the NIS domain:
+
+.. code-block:: none
+
+  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-domain <nis-domain-name>
+
+Show a configured NIS domain:
+
+.. code-block:: none
+
+  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-domain <nis-domain-name>
+
+Specify NIS+ domain
+*******************
+
+The procedure to specify a Network Information Service Plus (NIS+) domain is
+similar to the NIS domain one:
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-domain <nisplus-domain-name>
+
+To Delete the NIS+ domain:
+
+.. code-block:: none
+
+  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-domain <nisplus-domain-name>
+
+Show a configured NIS domain:
+
+ # show service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-domain <nisplus-domain-name>
+
+Specify NIS server address
+**************************
+
+To specify a NIS server address for DHCPv6 clients:
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-server <IPv6 address>
+
+Delete a specified NIS server address:
+
+.. code-block:: none
+
+  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-server <IPv6 address>
+
+Show specified NIS server addresses:
+
+.. code-block:: none
+
+  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-server
+
+Specify NIS+ server address
+***************************
+
+To specify a NIS+ server address for DHCPv6 clients:
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-server <IPv6 address>
+
+Delete a specified NIS+ server address:
+
+.. code-block:: none
+
+  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-server <IPv6 address>
+
+Show specified NIS+ server addresses:
+
+.. code-block:: none
+
+  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-server
+
+Specify a SIP server address for DHCPv6 clients
+***********************************************
+
+By IPv6 address
+###############
+
+
+A Session Initiation Protocol (SIP) server address can be specified
+for DHCPv6 clients:
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-address <IPv6 address>
+
+Delete a specified SIP server address:
+
+.. code-block:: none
+
+  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-address <IPv6 address>
+
+Show specified SIP server addresses:
+
+.. code-block:: none
+
+  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-address
+
+By FQDN
+#######
+
+A name for SIP server can be specified:
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-name <sip-server-name>
+
+Delete a specified SIP server name:
+
+.. code-block:: none
+
+  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-name <sip-server-name>
+
+Show specified SIP server names:
+
+.. code-block:: none
+
+  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-name
+
+Simple Network Time Protocol (SNTP) server address for DHCPv6 clients
+*********************************************************************
+
+A SNTP server address can be specified for DHCPv6 clients:
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> sntp-server-address <IPv6 address>
+
+Delete a specified SNTP server address:
+
+.. code-block:: none
+
+  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> sntp-server-address <IPv6 address>
+
+Show specified SNTP server addresses:
+
+.. code-block:: none
+
+  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> sntp-server-address
+
+DHCPv6 address pools
+^^^^^^^^^^^^^^^^^^^^
+
+DHCPv6 address pools must be configured for the system to act as a DHCPv6
+server. The following example describes a common scenario.
+
+Example 1: DHCPv6 address pool
+******************************
+
+A shared network named `NET1` serves subnet `2001:db8:100::/64` which is
+connected to `eth1`, a DNS server at `2001:db8:111::111` is used for name
+services. The range of the address pool shall be `::100` through `::199`. The
+lease time will be left at the default value which is 24 hours.
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name NET1 subnet 2001:db8:100::/64 address-range start 2001:db8:100::100 stop 2001:db8:100::199
+  set service dhcpv6-server shared-network-name NET1 subnet 2001:db8:100::/64 name-server 2001:db8:111::111
+
+Commit the changes and show the configuration:
+
+.. code-block:: none
+
+  commit
+  show service dhcpv6-server
+      shared-network-name NET1 {
+          subnet 2001:db8:100::/64 {
+             address-range {
+                start 2001:db8:100::100 {
+                   stop 2001:db8:100::199
+                }
+             }
+             name-server 2001:db8:111::111
+          }
+      }
+
+Static mappings
+^^^^^^^^^^^^^^^
+
+In order to map specific IPv6 addresses to specific hosts static mappings can
+be created. The following example explains the process.
+
+Example 1: Static IPv6 MAC-based mapping
+****************************************
+
+IPv6 address `2001:db8:100::101` shall be statically mapped to a device with
+MAC address `00:15:c5:b7:5e:23`, this host-specific mapping shall be named
+`client1`.
+
+.. note:: The MAC address identifier is defined by the last 4 byte of the
+   MAC address.
+
+.. code-block:: none
+
+  set service dhcpv6-server shared-network-name NET1 subnet 2001:db8:100::/64 static-mapping client1 ipv6-address 2001:db8:100::101
+  set service dhcpv6-server shared-network-name NET1 subnet 2001:db8:100::/64 static-mapping client1 identifier c5b75e23
+
+Commit the changes and show the configuration:
+
+.. code-block:: none
+
+  show service dhcp-server shared-network-name NET1
+     shared-network-name NET1 {
+         subnet 2001:db8:100::/64 {
+            name-server 2001:db8:111::111
+            address-range {
+                start 2001:db8:100::100 {
+                   stop 2001:db8:100::199 {
+                }
+            }
+            static-mapping client1 {
+               ipv6-address 2001:db8:100::101
+               identifier c5b75e23
+            }
+         }
+      }
diff --git a/docs/configuration/service/dns.rst b/docs/configuration/service/dns.rst
new file mode 100644
index 00000000..c83c93f9
--- /dev/null
+++ b/docs/configuration/service/dns.rst
@@ -0,0 +1,226 @@
+DNS Forwarding
+--------------
+
+Use DNS forwarding if you want your router to function as a DNS server for the
+local network. There are several options, the easiest being 'forward all
+traffic to the system DNS server(s)' (defined with set system name-server):
+
+.. code-block:: none
+
+  set service dns forwarding system
+
+Manually setting DNS servers for forwarding:
+
+.. code-block:: none
+
+  set service dns forwarding name-server 8.8.8.8
+  set service dns forwarding name-server 8.8.4.4
+
+Manually setting DNS servers with IPv6 connectivity:
+
+.. code-block:: none
+
+  set service dns forwarding name-server 2001:4860:4860::8888
+  set service dns forwarding name-server 2001:4860:4860::8844
+
+Setting a forwarding DNS server for a specific domain:
+
+.. code-block:: none
+
+  set service dns forwarding domain example.com server 192.0.2.1
+  
+Set which networks or clients are allowed to query the DNS Server. Allow from all:
+
+.. code-block:: none
+
+  set service dns forwarding allow-from 0.0.0.0/0
+
+Example 1
+^^^^^^^^^
+
+Router with two interfaces eth0 (WAN link) and eth1 (LAN). Split DNS for example.com.
+
+* DNS request for a local domain (example.com) get forwarded to 192.0.2.1
+* Other DNS requests are forwarded to Google's DNS servers.
+* The IP address for the LAN interface is 192.168.0.1.
+
+.. code-block:: none
+
+  set service dns forwarding domain example.com server 192.0.2.1
+  set service dns forwarding name-server 8.8.8.8
+  set service dns forwarding name-server 8.8.4.4
+  set service dns forwarding listen-address 192.168.0.1
+  set service dns forwarding allow-from 0.0.0.0/0
+
+Example 2
+^^^^^^^^^
+
+Same as example 1 but with additional IPv6 addresses for Google's public DNS
+servers.
+
+The IP addresses for the LAN interface are 192.168.0.1 and 2001:db8::1
+
+.. code-block:: none
+
+  set service dns forwarding domain example.com server 192.0.2.1
+  set service dns forwarding name-server 8.8.8.8
+  set service dns forwarding name-server 8.8.4.4
+  set service dns forwarding name-server 2001:4860:4860::8888
+  set service dns forwarding name-server 2001:4860:4860::8844
+  set service dns forwarding listen-address 2001:db8::1
+  set service dns forwarding listen-address 192.168.0.1 
+  set service dns forwarding allow-from 0.0.0.0/0
+
+
+Dynamic DNS
+-----------
+
+VyOS is able to update a remote DNS record when an interface gets a new IP
+address. In order to do so, VyOS includes ddclient_, a perl script written for
+this exact purpose.
+
+ddclient_ uses two methods to update a DNS record. The first one will send
+updates directly to the DNS daemon, in compliance with RFC2136_. The second
+one involves a third party service, like DynDNS.com or any other similar
+website. This method uses HTTP requests to transmit the new IP address. You
+can configure both in VyOS.
+
+VyOS CLI and RFC2136
+^^^^^^^^^^^^^^^^^^^^
+
+First, create an RFC2136_ config node :
+
+.. code-block:: none
+
+  edit service dns dynamic interface eth0 rfc2136 <confignodename>
+
+Present your RNDC key to ddclient :
+
+.. code-block:: none
+
+  set key /config/dyndns/mydnsserver.rndc.key
+
+Set the DNS server IP/FQDN :
+
+.. code-block:: none
+
+  set server dns.mydomain.com
+
+Set the NS zone to be updated :
+
+.. code-block:: none
+
+  set zone mydomain.com
+
+Set the records to be updated :
+
+.. code-block:: none
+
+  set record dyn
+  set record dyn2
+
+You can optionally set a TTL (note : default value is 600 seconds) :
+
+.. code-block:: none
+
+  set ttl 600
+
+This will generate the following ddclient config blocks:
+
+.. code-block:: none
+
+  server=dns.mydomain.com
+  protocol=nsupdate
+  password=/config/dyndns/mydnsserver.rndc.key
+  ttl=600
+  zone=mydomain.com
+  dyn
+  server=dns.mydomain.com
+  protocol=nsupdate
+  password=/config/dyndns/mydnsserver.rndc.key
+  ttl=600
+  zone=mydomain.com
+  dyn2
+
+You can also keep a different dns zone updated. Just create a new config node:
+
+.. code-block:: none
+
+  edit service dns dynamic interface eth0 rfc2136 <confignode2>
+
+VyOS CLI and HTTP dynamic DNS services
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+VyOS is also able to use any service relying on protocols supported
+by ddclient.
+
+To use such a service, you must define a login, a password, one or multiple
+hostnames, a protocol and a server.
+
+.. code-block:: none
+
+  edit service dns dynamic interface eth0 service HeNet
+  set login my-login # set password my-password
+  set host-name my-tunnel-id
+  set protocol dyndns2
+  set server ipv4.tunnelbroker.net
+
+VyOS is also shipped with a list of known services. You don't need to set the
+protocol and server value as VyOS has defaults provided for those. These are
+the services VyOS knows about:
+
+* afraid
+* changeip
+* dnspark
+* dslreports
+* dyndns
+* easydns
+* namecheap
+* noip
+* zoneedit
+
+To use DynDNS for example:
+
+.. code-block:: none
+
+  edit service dns dynamic interface eth0 service dyndns
+  set login my-login
+  set password my-password
+  set host-name my-dyndns-hostname
+
+It's possible to use multiple services :
+
+.. code-block:: none
+
+  edit service dns dynamic interface eth0 service dyndns
+  set login my-login
+  set password my-password
+  set host-name my-dyndns-hostname
+  edit service dns dynamic interface eth0 service HeNet
+  set login my-login
+  set password my-password
+  set host-name my-tunnel-id
+  set protocol dyndns2
+  set server ipv4.tunnelbroker.net
+
+ddclient behind NAT
+^^^^^^^^^^^^^^^^^^^
+
+By default, ddclient will update a dynamic dns record using the IP address
+directly attached to the interface. If your VyOS instance is behind NAT, your
+record will be updated to point to your internal IP.
+
+ddclient_ has another way to determine the WAN IP address. This is controlled
+by these two options:
+
+.. code-block:: none
+
+  set service dns dynamic interface eth0 use-web url
+  set service dns dynamic interface eth0 use-web skip
+
+ddclient_ will load the webpage at `[url]` and will try to extract an IP
+address for the response. ddclient_ will skip any address located before the
+string set in `[skip]`.
+
+
+.. include:: references.rst
diff --git a/docs/configuration/service/index.rst b/docs/configuration/service/index.rst
new file mode 100644
index 00000000..31ff4e95
--- /dev/null
+++ b/docs/configuration/service/index.rst
@@ -0,0 +1,21 @@
+#######
+Service
+#######
+
+
+.. toctree::
+   :maxdepth: 1
+   :includehidden:
+
+   broadcast-relay
+   conntrack-sync
+   dhcp-relay
+   dhcp-server
+   dns
+   lldp
+   mdns
+   pppoe-server
+   snmp
+   ssh
+   tftp-server
+   webproxy
diff --git a/docs/configuration/service/lldp.rst b/docs/configuration/service/lldp.rst
new file mode 100644
index 00000000..dccd68fa
--- /dev/null
+++ b/docs/configuration/service/lldp.rst
@@ -0,0 +1,97 @@
+LLDP
+----
+
+The Link Layer Discovery Protocol (LLDP) is a vendor-neutral
+link layer protocol in the Internet Protocol Suite used by network devices for
+advertising their identity, capabilities, and neighbors on an IEEE 802 local
+area network, principally wired Ethernet.[1] The protocol is formally referred
+to by the IEEE as Station and Media Access Control Connectivity Discovery
+specified in IEEE 802.1AB and IEEE 802.3-2012 section 6 clause 79.
+
+LLDP performs functions similar to several proprietary protocols, such as
+`Cisco Discovery Protocol`_, `Foundry Discovery Protocol`_,
+Nortel Discovery Protocol and Link Layer Topology Discovery.
+
+Information gathered
+^^^^^^^^^^^^^^^^^^^^
+
+Information gathered with LLDP is stored in the device as a management
+information database (MIB_) and can be queried with the Simple Network
+Management Protocol (SNMP_) as specified in RFC 2922. The topology of an
+LLDP-enabled network can be discovered by crawling the hosts and querying this
+database. Information that may be retrieved include:
+
+* System name and description
+* Port name and description
+* VLAN name
+* IP management address
+* System capabilities (switching, routing, etc.)
+* MAC/PHY information
+* MDI power
+* Link aggregation
+
+Configuration
+^^^^^^^^^^^^^
+
+* Enable service with:
+
+  :code:`set service lldp`
+
+Options
+*******
+
+* Configure a Define management-address:
+
+  :code:`set service lldp management-address <x.x.x.x>`
+
+* Define listening interfaces
+
+  :code:`set service lldp interface <all|interface name>`
+
+* LLDPd also implements an SNMP subagent. To Enable SNMP queries of the LLDP
+  database:
+
+  :code:`set service lldp snmp enable`
+
+* Enable optional/other protocols
+
+  :code:`set service lldp legacy-protocols cdp`
+
+  Supported legacy protocols:
+
+ * ``cdp`` - Listen for CDP for Cisco routers/switches
+ * ``edp`` - Listen for EDP for Extreme routers/switches
+ * ``fdp`` - Listen for FDP for Foundry routers/switches
+ * ``sonmp`` - Listen for SONMP for Nortel routers/switches
+
+
+Display neighbors
+^^^^^^^^^^^^^^^^^
+
+* Display with:
+
+``show lldp neighbors``
+
+Exemple:
+
+.. code-block:: none
+
+  vyos@vyos:~# show lldp neighbors
+  Capability Codes: R - Router, B - Bridge, W - Wlan r - Repeater, S - Station
+                   D - Docsis, T - Telephone, O - Other
+  Device ID                 Local  Proto  Cap   Platform             Port ID
+  ---------                 -----  -----  ---   --------             -------
+  swA309                    eth0   LLDP   ?     Cisco IOS Software,  GigE0/33
+
+
+* Options:
+
+ * ``detail`` - Show lldp neighbors detail
+ * ``interface`` - Show LLDP for specified interface
+
+Troubleshooting
+^^^^^^^^^^^^^^^
+
+Use operational command ``show log lldp`` to display logs.
+
+.. include:: references.rst
diff --git a/docs/configuration/service/mdns.rst b/docs/configuration/service/mdns.rst
new file mode 100644
index 00000000..22e824ba
--- /dev/null
+++ b/docs/configuration/service/mdns.rst
@@ -0,0 +1,30 @@
+mDNS Repeater
+-------------
+
+Starting with VyOS 1.2 a `Multicast DNS`_ (mDNS) repeater functionality is
+provided.
+
+Multicast DNS uses the 224.0.0.51 address, which is "administratively scoped"
+and does not leave the subnet. It re-broadcast mDNS packets from one interface
+to other interfaces. This enables support for e.g. Apple Airplay devices across
+multiple VLANs.
+
+To enable mDNS repeater you need to configure at least two interfaces. To re-
+broadcast all mDNS packets from `eth0` to `eth1` and vice versa run:
+
+.. code-block:: none
+
+  set service mdns repeater interface eth0
+  set service mdns repeater interface eth1
+
+mDNS repeater can be temporarily disabled without deleting the service using
+
+.. code-block:: none
+
+  set service mdns repeater disable
+
+.. note:: You can not run this in a VRRP setup, if multiple mDNS repeaters
+   are launched in a subnet you will experience the mDNS packet storm death!
+
+
+.. _`Multicast DNS`: https://en.wikipedia.org/wiki/Multicast_DNS
diff --git a/docs/configuration/service/pppoe-server.rst b/docs/configuration/service/pppoe-server.rst
new file mode 100644
index 00000000..8e37a068
--- /dev/null
+++ b/docs/configuration/service/pppoe-server.rst
@@ -0,0 +1,217 @@
+PPPoE server
+------------
+
+VyOS utilizes `accel-ppp`_ to provide PPPoE server functionality. It can be
+used with local authentication or a connected RADIUS server.
+
+.. note:: **Please be aware, due to an upstream bug, config changes/commits
+   will restart the ppp daemon and will reset existing PPPoE connections from
+   connected users, in order to become effective.**
+
+Configuration
+^^^^^^^^^^^^^
+
+The example below uses ACN as access-concentrator name, assigns an address
+from the pool 10.1.1.100-111, terminates at the local endpoint 10.1.1.1 and
+serves requests only on eth1.
+
+.. code-block:: none
+
+  set service pppoe-server access-concentrator 'ACN'
+  set service pppoe-server authentication local-users username foo password 'bar'
+  set service pppoe-server authentication mode 'local'
+  set service pppoe-server client-ip-pool start '10.1.1.100'
+  set service pppoe-server client-ip-pool stop '10.1.1.111'
+  set service pppoe-server dns-servers server-1 '10.100.100.1'
+  set service pppoe-server dns-servers server-2 '10.100.200.1'
+  set service pppoe-server interface 'eth1'
+  set service pppoe-server local-ip '10.1.1.2'
+
+
+Connections can be locally checked via the command
+
+.. code-block:: none
+
+  show pppoe-server sessions
+  ifname | username |     ip     |    calling-sid    | rate-limit  | state  |  uptime  | rx-bytes | tx-bytes 
+  -------+----------+------------+-------------------+-------------+--------+----------+----------+----------
+  ppp0   | foo      | 10.1.1.100 | 08:00:27:ba:db:15 | 20480/10240 | active | 00:00:11 | 214 B    | 76 B     
+
+
+Client IP address pools
+=======================
+
+To automatically assign the client an IP address as tunnel endpoint, a client IP pool is needed. The source can be either RADIUS or a local subnet or IP range definition.
+
+Once the local tunnel endpoint ``set service pppoe-server local-ip '10.1.1.2'`` has been defined, the client IP pool can be either defined as a range or as subnet using CIDR notation.
+If the CIDR notation is used, multiple subnets can be setup which are used sequentially.
+
+**Client IP address via IP range definition**
+
+.. code-block:: none
+
+  set service pppoe-server client-ip-pool start '10.1.1.100'
+  set service pppoe-server client-ip-pool stop '10.1.1.111'
+
+
+**Client IP subnets via CIDR notation**
+
+.. code-block:: none
+
+  set service pppoe-server client-ip-pool subnet '10.1.1.0/24'
+  set service pppoe-server client-ip-pool subnet '10.1.2.0/24'
+  set service pppoe-server client-ip-pool subnet '10.1.3.0/24'
+
+
+
+**RADIUS based IP pools (Framed-IP-Address)**
+
+To use a radius server, you need to switch to authentication mode radius and
+of course need to specify an IP for the server. You can have multiple RADIUS
+server configured, if you wish to achieve redundancy.
+
+.. code-block:: none
+
+  set service pppoe-server access-concentrator 'ACN'
+  set service pppoe-server authentication mode 'radius'
+  set service pppoe-server authentication radius-server 10.1.100.1 secret 'secret'
+  set service pppoe-server interface 'eth1'
+  set service pppoe-server local-ip '10.1.1.2'
+
+RADIUS provides the IP addresses in the example above via Framed-IP-Address.
+
+**RADIUS sessions management DM/CoA**
+
+For remotely disconnect sessions and change some authentication parameters you can configure dae-server
+
+.. code-block:: none
+
+  set service pppoe-server authentication radius-settings dae-server ip-address '10.1.1.2'
+  set service pppoe-server authentication radius-settings dae-server port '3799'
+  set service pppoe-server authentication radius-settings dae-server secret 'secret123'
+
+Example, from radius-server send command for disconnect client with username test
+
+.. code-block:: none
+
+  root@radius-server:~# echo "User-Name=test" | radclient -x 10.1.1.2:3799 disconnect secret123
+  
+You can also use another attributes for identify client for disconnect, like Framed-IP-Address, Acct-Session-Id, etc.
+Result commands appears in log
+
+.. code-block:: none
+
+  show log | match Disconnect*
+
+Example for changing rate-limit via RADIUS CoA
+
+.. code-block:: none
+
+  echo "User-Name=test,Filter-Id=5000/4000" | radclient 10.1.1.2:3799 coa secret123
+
+Filter-Id=5000/4000 (means 5000Kbit down-stream rate and 4000Kbit up-stream rate)
+If attribute Filter-Id redefined, replace it in radius coa request
+
+
+Automatic VLAN creation
+=======================
+
+VLAN's can be created by accel-ppp on the fly if via the use of the kernel module vlan_mon, which is monitoring incoming vlans and creates the necessary VLAN if required and allowed.
+VyOS supports the use of either VLAN ID's or entire ranges, both values can be defined at the same time for an interface.
+
+.. code-block:: none
+
+  set service pppoe-server interface eth3 vlan-id 100
+  set service pppoe-server interface eth3 vlan-id 200
+  set service pppoe-server interface eth3 vlan-range 500-1000
+  set service pppoe-server interface eth3 vlan-range 2000-3000
+
+
+The pppoe-server will now create these VLANs if required and once the user session has been cancelled, and the VLAN is not necessary anymore, it will remove it again.
+
+
+
+Bandwidth Shaping
+^^^^^^^^^^^^^^^^^
+
+Bandwidth rate limits can be set for local users or RADIUS based attributes.
+
+Bandwidth Shaping for local users 
+=================================
+
+The rate-limit is set in kbit/sec.
+
+.. code-block:: none
+
+  set service pppoe-server access-concentrator 'ACN'
+  set service pppoe-server authentication local-users username foo password 'bar'
+  set service pppoe-server authentication local-users username foo rate-limit download '20480'
+  set service pppoe-server authentication local-users username foo rate-limit upload '10240'
+  set service pppoe-server authentication mode 'local'
+  set service pppoe-server client-ip-pool start '10.1.1.100'
+  set service pppoe-server client-ip-pool stop '10.1.1.111'
+  set service pppoe-server dns-servers server-1 '10.100.100.1'
+  set service pppoe-server dns-servers server-2 '10.100.200.1'
+  set service pppoe-server interface 'eth1'
+  set service pppoe-server local-ip '10.1.1.2'
+
+
+Once the user is connected, the user session is using the set limits and can be displayed via 'show pppoe-server sessions'.
+
+.. code-block:: none
+
+  show pppoe-server sessions
+  ifname | username |     ip     |    calling-sid    | rate-limit  | state  |  uptime  | rx-bytes | tx-bytes
+  -------+----------+------------+-------------------+-------------+--------+----------+----------+----------
+  ppp0   | foo      | 10.1.1.100 | 08:00:27:ba:db:15 | 20480/10240 | active | 00:00:11 | 214 B    | 76 B
+
+
+RADIUS based shaper setup
+=========================
+
+The current attribute 'Filter-Id' is being used as default and can be setup within RADIUS:
+
+Filter-Id=2000/3000 (means 2000Kbit down-stream rate and 3000Kbit up-stream rate)
+
+The command below enables it, assuming the RADIUS connection has been setup and is working.
+
+.. code-block:: none
+
+  set service pppoe-server authentication radius-settings rate-limit enable
+
+Other attributes can be used, but they have to be in one of the dictionaries in /usr/share/accel-ppp/radius.
+
+
+
+Practical Configuration Examples
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Dual-stack provisioning with IPv6 PD via pppoe
+==============================================
+
+The example below covers a dual-stack configuration via pppoe-server.
+
+.. code-block:: none
+
+  set service pppoe-server authentication local-users username test password 'test'
+  set service pppoe-server authentication mode 'local'
+  set service pppoe-server client-ip-pool start '192.168.0.1'
+  set service pppoe-server client-ip-pool stop '192.168.0.10'
+  set service pppoe-server client-ipv6-pool delegate-prefix '2001:db8:8003::1/48,56'
+  set service pppoe-server client-ipv6-pool prefix '2001:db8:8002::1/48,64'
+  set service pppoe-server dns-servers server-1 '8.8.8.8'
+  set service pppoe-server dnsv6-servers server-1 '2001:4860:4860::8888'
+  set service pppoe-server interface 'eth2'
+  set service pppoe-server local-ip '10.100.100.1'
+
+
+The client, once successfully authenticated, will receive an IPv4 and an IPv6 /64 address, to terminate the pppoe endpoint on the client side and a /56 subnet for the clients internal use.
+
+.. code-block:: none
+
+  vyos@pppoe-server:~$ sh pppoe-server sessions 
+   ifname | username |     ip      |            ip6           |       ip6-dp        |    calling-sid    | rate-limit | state  |  uptime  | rx-bytes | tx-bytes 
+  --------+----------+-------------+--------------------------+---------------------+-------------------+------------+--------+----------+----------+----------
+   ppp0   | test     | 192.168.0.1 | 2001:db8:8002:0:200::/64 | 2001:db8:8003::1/56 | 08:00:27:12:42:eb |            | active | 00:00:49 | 875 B    | 2.1 KiB
+
+.. _`accel-ppp`: https://accel-ppp.org/
diff --git a/docs/configuration/service/references.rst b/docs/configuration/service/references.rst
new file mode 100644
index 00000000..bee936d7
--- /dev/null
+++ b/docs/configuration/service/references.rst
@@ -0,0 +1,15 @@
+.. _`Cisco Discovery Protocol`: https://en.wikipedia.org/wiki/Cisco_Discovery_Protocol
+.. _ddclient: http://github.com/ddclient/ddclient
+.. _`Foundry Discovery Protocol`: https://en.wikipedia.org/wiki/Foundry_Discovery_Protocol
+.. _MIB: https://en.wikipedia.org/wiki/Management_information_base
+.. _RFC2136: https://www.ietf.org/rfc/rfc2136.txt
+.. _SNMP: https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
+.. _SNMPv2: https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol#Version_2
+.. _SNMPv3: https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol#Version_3
+.. _SSH: https://en.wikipedia.org/wiki/Secure_Shell
+.. _Squid3: http://www.squid-cache.org/
+.. _Squidguard: http://www.squidguard.org/
+.. _TFTP: https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol
+.. _`arbitrary extension commands`: http://net-snmp.sourceforge.net/docs/man/snmpd.conf.html#lbAZ
+.. _`accel-ppp`: https://accel-ppp.org/
+.. _`Secure Socket Tunneling Protocol`: https://en.wikipedia.org/wiki/Secure_Socket_Tunneling_Protocol
diff --git a/docs/configuration/service/snmp.rst b/docs/configuration/service/snmp.rst
new file mode 100644
index 00000000..6418a516
--- /dev/null
+++ b/docs/configuration/service/snmp.rst
@@ -0,0 +1,245 @@
+SNMP
+----
+
+Simple Network Management Protocol (SNMP_) is an Internet Standard protocol
+for collecting and organizing information about managed devices on IP networks
+and for modifying that information to change device behavior. Devices that
+typically support SNMP include cable modems, routers, switches, servers,
+workstations, printers, and more.
+
+SNMP is widely used in network management for network monitoring. SNMP exposes
+management data in the form of variables on the managed systems organized in
+a management information base (MIB_) which describe the system status and
+configuration. These variables can then be remotely queried (and, in some
+circumstances, manipulated) by managing applications.
+
+Three significant versions of SNMP have been developed and deployed. SNMPv1 is
+the original version of the protocol. More recent versions, SNMPv2c and SNMPv3,
+feature improvements in performance, flexibility and security.
+
+SNMP is a component of the Internet Protocol Suite as defined by the Internet
+Engineering Task Force (IETF). It consists of a set of standards for network
+management, including an application layer protocol, a database schema, and a
+set of data objects.
+
+Overview and basic concepts
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+In typical uses of SNMP, one or more administrative computers called managers
+have the task of monitoring or managing a group of hosts or devices on a
+computer network. Each managed system executes a software component called an
+agent which reports information via SNMP to the manager.
+
+An SNMP-managed network consists of three key components:
+
+* Managed devices
+* Agent - software which runs on managed devices
+* Network management station (NMS) - software which runs on the manager
+
+A managed device is a network node that implements an SNMP interface that
+allows unidirectional (read-only) or bidirectional (read and write) access to
+node-specific information. Managed devices exchange node-specific information
+with the NMSs. Sometimes called network elements, the managed devices can be
+any type of device, including, but not limited to, routers, access servers,
+switches, cable modems, bridges, hubs, IP telephones, IP video cameras,
+computer hosts, and printers.
+
+An agent is a network-management software module that resides on a managed
+device. An agent has local knowledge of management information and translates
+that information to or from an SNMP-specific form.
+
+A network management station executes applications that monitor and control
+managed devices. NMSs provide the bulk of the processing and memory resources
+required for network management. One or more NMSs may exist on any managed
+network.
+
+.. figure:: /_static/images/service_snmp_communication_principles_diagram.png
+   :scale: 20 %
+   :alt: Principle of SNMP Communication
+
+   Image thankfully borrowed from
+   https://en.wikipedia.org/wiki/File:SNMP_communication_principles_diagram.PNG
+   which is under the GNU Free Documentation License
+
+.. note:: VyOS SNMP supports both IPv4 and IPv6.
+
+SNMP protocol versions
+^^^^^^^^^^^^^^^^^^^^^^
+
+VyOS itself supports SNMPv2_ (version 2) and SNMPv3_ (version 3) where the
+later is recommended because of improved security (optional authentication and
+encryption).
+
+SNMPv2
+^^^^^^
+
+SNMPv2 is the original and most commonly used version. For authorizing clients,
+SNMP uses the concept of communities. Communities may have authorization set
+to read only (this is most common) or to read and write (this option is not
+actively used in VyOS).
+
+SNMP can work synchronously or asynchronously. In synchronous communication,
+the monitoring system queries the router periodically. In asynchronous, the
+router sends notification to the "trap" (the monitoring host).
+
+SNMPv2 does not support any authentication mechanisms, other than client source
+address, so you should specify addresses of clients allowed to monitor the
+router. Note that SNMPv2 also supports no encryption and always sends data in
+plain text.
+
+Example
+*******
+
+.. code-block:: none
+
+  # Define a community
+  set service snmp community routers authorization ro
+
+  # Allow monitoring access from the entire network
+  set service snmp community routers network 192.0.2.0/24
+  set service snmp community routers network 2001::db8:ffff:eeee::/64
+
+  # Allow monitoring access from specific addresses
+  set service snmp community routers client 203.0.113.10
+  set service snmp community routers client 203.0.113.20
+
+  # Define optional router information
+  set service snmp location "UK, London"
+  set service snmp contact "admin@example.com"
+
+  # Trap target if you want asynchronous communication
+  set service snmp trap-target 203.0.113.10
+
+  # Listen only on specific IP addresses (port defaults to 161)
+  set service snmp listen-address 172.16.254.36 port 161
+  set service snmp listen-address 2001:db8::f00::1
+
+
+SNMPv3
+^^^^^^
+
+SNMPv3 (version 3 of the SNMP protocol) introduced a whole slew of new security
+related features that have been missing from the previous versions. Security
+was one of the biggest weakness of SNMP until v3. Authentication in SNMP
+Versions 1 and 2 amounts to nothing more than a password (community string)
+sent in clear text between a manager and agent. Each SNMPv3 message contains
+security parameters which are encoded as an octet string. The meaning of these
+security parameters depends on the security model being used.
+
+The securityapproach in v3 targets:
+
+* Confidentiality – Encryption of packets to prevent snooping by an
+  unauthorized source.
+
+* Integrity – Message integrity to ensure that a packet has not been tampered
+  while in transit including an optional packet replay protection mechanism.
+
+* Authentication – to verify that the message is from a valid source.
+
+Example
+*******
+
+.. code-block:: none
+
+  set service snmp v3 engineid '0x0aa0d6c6f450'
+  set service snmp v3 group defaultgroup mode 'ro'
+  set service snmp v3 group defaultgroup seclevel 'priv'
+  set service snmp v3 group defaultgroup view 'defaultview'
+  set service snmp v3 view defaultview oid '1'
+
+  set service snmp v3 user testUser1 auth plaintext-key testUserKey1
+  set service snmp v3 user testUser1 auth type 'md5'
+  set service snmp v3 user testUser1 engineid '0x0aa0d6c6f450'
+  set service snmp v3 user testUser1 group 'defaultgroup'
+  set service snmp v3 user testUser1 mode 'ro'
+  set service snmp v3 user testUser1 privacy type aes
+  set service snmp v3 user testUser1 privacy plaintext-key testUserKey1
+
+After commit the resulting configuration will look like:
+
+.. note:: SNMPv3 keys won't we stored in plaintext. On ``commit`` the keys
+   will be encrypted and the encrypted key is based on the engineid!
+
+.. code-block:: none
+
+  vyos@vyos# show service snmp
+   v3 {
+       engineid 0x0aa0d6c6f450
+       group defaultgroup {
+           mode ro
+           seclevel priv
+           view defaultview
+       }
+       user testUser1 {
+           auth {
+               encrypted-key 0x3b68d4162c2c817b8e9dfb6f08583e5d
+               type md5
+           }
+           engineid 0x0aa0d6c6f450
+           group defaultgroup
+           mode ro
+           privacy {
+               encrypted-key 0x3b68d4162c2c817b8e9dfb6f08583e5d
+               type aes
+           }
+       }
+       view defaultview {
+           oid 1 {
+           }
+       }
+   }
+
+SNMP Extensions
+^^^^^^^^^^^^^^^
+
+To extend SNMP agent functionality, custom scripts can be executed every time
+the agent is being called. This can be achieved by using ``arbitrary extension
+commands``_. The first step is to create a functional script of course, then
+upload it to your VyOS instance via the command ``scp your_script.sh
+vyos@your_router:/config/user-data``. Once the script is uploaded, it needs to
+be configured via the command below.
+
+
+.. code-block:: none
+
+  set service snmp script-extensions extension-name my-extension script your_script.sh
+  commit
+
+
+The OID ``.1.3.6.1.4.1.8072.1.3.2.3.1.1.4.116.101.115.116``, once called, will
+contain the output of the extension.
+
+.. code-block:: none
+
+  root@vyos:/home/vyos# snmpwalk -v2c  -c public 127.0.0.1 nsExtendOutput1
+  NET-SNMP-EXTEND-MIB::nsExtendOutput1Line."my-extension" = STRING: hello
+  NET-SNMP-EXTEND-MIB::nsExtendOutputFull."my-extension" = STRING: hello
+  NET-SNMP-EXTEND-MIB::nsExtendOutNumLines."my-extension" = INTEGER: 1
+  NET-SNMP-EXTEND-MIB::nsExtendResult."my-extension" = INTEGER: 0
+
+SolarWinds
+^^^^^^^^^^
+
+If you happen to use SolarWinds Orion as NMS you can also use the Device
+Templates Management. A template for VyOS can be easily imported.
+
+Create a file named ``VyOS-1.3.6.1.4.1.44641.ConfigMgmt-Commands`` using the
+following content:
+
+.. code-block:: none
+
+  <Configuration-Management Device="VyOS" SystemOID="1.3.6.1.4.1.44641">
+      <Commands>
+          <Command Name="Reset" Value="set terminal width 0${CRLF}set terminal length 0"/>
+          <Command Name="Reboot" Value="reboot${CRLF}Yes"/>
+          <Command Name="EnterConfigMode" Value="configure"/>
+          <Command Name="ExitConfigMode" Value="commit${CRLF}exit"/>
+          <Command Name="DownloadConfig" Value="show configuration commands"/>
+          <Command Name="SaveConfig" Value="commit${CRLF}save"/>
+          <Command Name="Version" Value="show version"/>
+          <Command Name="MenuBased" Value="False"/>
+          <Command Name="VirtualPrompt" Value=":~"/>
+      </Commands>
+  </Configuration-Management>
+
+.. include:: references.rst
diff --git a/docs/configuration/service/ssh.rst b/docs/configuration/service/ssh.rst
new file mode 100644
index 00000000..3af71899
--- /dev/null
+++ b/docs/configuration/service/ssh.rst
@@ -0,0 +1,150 @@
+SSH
+---
+
+Secure Shell (SSH_) is a cryptographic network protocol for operating network
+services securely over an unsecured network.[1] The standard TCP port for SSH
+is 22. The best known example application is for remote login to computer
+systems by users.
+
+SSH provides a secure channel over an unsecured network in a client-server
+architecture, connecting an SSH client application with an SSH server. Common
+applications include remote command-line login and remote command execution,
+but any network service can be secured with SSH. The protocol specification
+distinguishes between two major versions, referred to as SSH-1 and SSH-2.
+
+The most visible application of the protocol is for access to shell accounts
+on Unix-like operating systems, but it sees some limited use on Windows as
+well. In 2015, Microsoft announced that they would include native support for
+SSH in a future release.
+
+SSH was designed as a replacement for Telnet and for unsecured remote shell
+protocols such as the Berkeley rlogin, rsh, and rexec protocols.
+Those protocols send information, notably passwords, in plaintext,
+rendering them susceptible to interception and disclosure using packet
+analysis. The encryption used by SSH is intended to provide confidentiality
+and integrity of data over an unsecured network, such as the Internet.
+
+Configuration
+^^^^^^^^^^^^^
+
+Enabling SSH only requires you to add ``service ssh port NN``, where 'NN' is
+the port you want SSH to listen on. By default, SSH runs on port 22.
+
+.. code-block:: none
+
+  set service ssh port 22
+
+Options
+*******
+
+* Listening address - Specify the IPv4/IPv6 listening address for connection
+  requests. Multiple ``listen-address`` nodes can be defined.
+
+  :code:`set service ssh listen-address <address>`
+
+* Allow ``root`` login, this can be set to allow ``root`` logins on SSH
+  connections, however it is not advisable to use this setting as this bears
+  serious security risks. The default system user possesses all required
+  privileges.
+
+  :code:`set service ssh allow-root`
+
+* Allowed ciphers - A number of allowed ciphers can be specified, use multiple
+  occurrences to allow multiple ciphers.
+
+  :code:`set service ssh ciphers <cipher>`
+
+  Available ciphers:
+
+ * `3des-cbc`
+ * `aes128-cbc`
+ * `aes192-cbc`
+ * `aes256-cbc`
+ * `aes128-ctr`
+ * `aes192-ctr`
+ * `aes256-ctr`
+ * `arcfour128`
+ * `arcfour256`
+ * `arcfour`
+ * `blowfish-cbc`
+ * `cast128-cbc`
+
+* Disable password authentication - If SSH key authentication is set up,
+  password-based user authentication can be disabled. This hardens security!
+
+  :code:`set service ssh disable-password-authentication`
+
+* Disable host validation - Disable the host validation through reverse DNS
+  lookups.
+
+  :code:`set service ssh disable-host-validation`
+
+* MAC algorithms - Specifies the available MAC (message authentication code)
+  algorithms. The MAC algorithm is used in protocol version 2 for data
+  integrity protection. Multiple algorithms can be entered.
+
+  :code:`set service ssh macs <macs>`
+
+  Supported MACs:
+
+ * `hmac-md5`
+ * `hmac-md5-96`
+ * `hmac-ripemd160`
+ * `hmac-sha1`
+ * `hmac-sha1-96`
+ * `hmac-sha2-256`
+ * `hmac-sha2-512`
+ * `umac-64@openssh.com`
+ * `umac-128@openssh.com`
+ * `hmac-md5-etm@openssh.com`
+ * `hmac-md5-96-etm@openssh.com`
+ * `hmac-ripemd160-etm@openssh.com`
+ * `hmac-sha1-etm@openssh.com`
+ * `hmac-sha1-96-etm@openssh.com`
+ * `hmac-sha2-256-etm@openssh.com`
+ * `hmac-sha2-512-etm@openssh.com`
+ * `umac-64-etm@openssh.com`
+ * `umac-128-etm@openssh.com`
+
+
+Key Authentication
+##################
+
+It is highly recommended to use SSH Key authentication. By default there is
+only one user (``vyos``), and you can assign any number of keys to that user.
+You can generate a ssh key with the ``ssh-keygen`` command on your local
+machine, which will (by default) save it as ``~/.ssh/id_rsa.pub`` which is in
+three parts:
+
+ ``ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...VByBD5lKwEWB username@host.example.com``
+
+Only the type (``ssh-rsa``) and the key (``AAAB3N...``) are used. Note that
+the key will usually be several hundred characters long, and you will need to
+copy and paste it. Some terminal emulators may accidentally split this over
+several lines. Be attentive when you paste it that it only pastes as a single
+line. The third part is simply an identifier, and is for your own reference.
+
+
+**Assign SSH Key to user**
+
+Under the user (in this example, ``vyos``), add the public key and the type.
+The `identifier` is simply a string that is relevant to you.
+
+.. code-block:: none
+
+  set system login user vyos authentication public-keys 'identifier' key "AAAAB3Nz...."
+  set system login user vyos authentication public-keys 'identifier' type ssh-rsa"
+
+You can assign multiple keys to the same user by changing the identifier. In
+the following example, both Unicron and xrobau will be able to SSH into VyOS
+as the ``vyos`` user using their own keys.
+
+.. code-block:: none
+
+  set system login user vyos authentication public-keys 'Unicron' key "AAAAB3Nz...."
+  set system login user vyos authentication public-keys 'Unicron' type ssh-rsa
+  set system login user vyos authentication public-keys 'xrobau' key "AAAAQ39x...."
+  set system login user vyos authentication public-keys 'xrobau' type ssh-rsa
+
+
+
diff --git a/docs/configuration/service/tftp-server.rst b/docs/configuration/service/tftp-server.rst
new file mode 100644
index 00000000..9ce46b02
--- /dev/null
+++ b/docs/configuration/service/tftp-server.rst
@@ -0,0 +1,42 @@
+TFTP
+----
+
+Trivial File Transfer Protocol (TFTP_) is a simple lockstep File Transfer
+Protocol which allows a client to get a file from or put a file onto a remote
+host. One of its primary uses is in the early stages of nodes booting from a
+local area network. TFTP has been used for this application because it is very
+simple to implement.
+
+Example
+^^^^^^^
+
+.. code-block:: none
+
+  # If you want to enable uploads, else TFTP server will act as read-only (optional)
+  set service tftp-server allow-upload
+
+  # Directory for TFTP server content
+  set service tftp-server directory '/config/tftpboot'
+
+  # On which addresses we want to listen for incoming TFTP connections? (mandatory)
+  set service tftp-server listen-address '2001:db8:ffee::1'
+  set service tftp-server listen-address '10.10.1.1'
+
+.. note:: Choose your ``directory`` location carefully or you will loose the
+   content on image upgrades. Any directory under ``/config`` is save at this
+   will be migrated.
+
+.. note:: Configuring a listen-address is essential for the service to work.
+
+The resulting configuration will look like:
+
+.. code-block:: none
+
+  vyos@vyos# show service
+   tftp-server {
+      allow-upload
+      directory /config/tftpboot
+      listen-address 2001:db8:ffee::1
+      listen-address 10.10.1.1
+   }
+
diff --git a/docs/configuration/service/webproxy.rst b/docs/configuration/service/webproxy.rst
new file mode 100644
index 00000000..61546cda
--- /dev/null
+++ b/docs/configuration/service/webproxy.rst
@@ -0,0 +1,152 @@
+Webproxy
+--------
+
+The proxy service in VyOS is based on Squid3 and some related modules.
+
+Squid is a caching and forwarding HTTP web proxy. It has a wide variety of
+uses, including speeding up a web server by caching repeated requests,
+caching web, DNS and other computer network lookups for a group of people
+sharing network resources, and aiding security by filtering traffic. Although
+primarily used for HTTP and FTP, Squid includes limited support for several
+other protocols including Internet Gopher, SSL,[6] TLS and HTTPS. Squid does
+not support the SOCKS protocol.
+
+All examples here assumes that your inside ip address is ``192.168.0.1``.
+Replace with your own where applicable.
+
+URL Filtering is provided by Squidguard_.
+
+Configuration
+^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  # Enable proxy service
+  set service webproxy listen-address 192.168.0.1
+
+  # By default it will listen to port 3128. If you wan't something else you have to define that.
+  set service webproxy listen-address 192.168.0.1 port 2050
+
+  # By default the transparent proxy on that interface is enabled. To disable that you simply
+  set service webproxy listen-address 192.168.0.1 disable-transparent
+
+  # Block specific urls
+  set service webproxy url-filtering squidguard local-block myspace.com
+
+  # If you want to you can log these blocks
+  set service webproxy url-filtering squidguard log local-block
+
+
+Options
+*******
+
+Filtering by category
+^^^^^^^^^^^^^^^^^^^^^
+
+If you wan't to use existing blacklists you have to create/download a database
+first. Otherwise you will not be able to commit the config changes.
+
+.. code-block:: none
+
+  vyos@vyos# commit
+  [ service webproxy ]
+  Warning: no blacklists installed
+  Unknown block-category [ads] for policy [default]
+
+  [[service webproxy]] failed
+  Commit failed
+
+* Download/Update complete blacklist
+
+  :code:`update webproxy blacklists`
+
+* Download/Update partial blacklist
+
+  :code:`update webproxy blacklists category ads`
+
+  Use tab completion to get a list of categories.
+
+* To auto update the blacklist files
+
+  :code:`set service webproxy url-filtering squidguard auto-update update-hour 23`
+
+* To configure blocking add the following to the configuration
+
+  :code:`set service webproxy url-filtering squidguard block-category ads`
+
+  :code:`set service webproxy url-filtering squidguard block-category malware`
+
+Authentication
+^^^^^^^^^^^^^^
+
+The embedded Squid proxy can use LDAP to authenticate users against a company
+wide directory. The following configuration is an example of how to use Active
+Directory as authentication backend. Queries are done via LDAP.
+
+.. code-block:: none
+
+  vyos@vyos# show service webproxy
+   authentication {
+       children 5
+       credentials-ttl 60
+       ldap {
+           base-dn DC=example,DC=local
+           bind-dn CN=proxyuser,CN=Users,DC=example,DC=local
+           filter-expression (cn=%s)
+           password Qwert1234
+           server ldap.example.local
+           username-attribute cn
+       }
+       method ldap
+       realm "VyOS Webproxy"
+   }
+   cache-size 100
+   default-port 3128
+   listen-address 192.168.188.103 {
+       disable-transparent
+   }
+  
+* ``base-dn`` set the base directory for the search
+* ``bind-dn`` and ``password``: set the user, which is used for the ldap search 
+* ``filter-expression``: set the exact filter which a authorized user match in a ldap-search. In this example every User is able to authorized.
+
+You can find more about the ldap authentication `here <http://www.squid-cache.org/Versions/v3/3.2/manuals/basic_ldap_auth.html>`_
+
+Adjusting cache size
+^^^^^^^^^^^^^^^^^^^^
+
+The size of the proxy cache can be adjusted by the user.
+
+.. code-block:: none
+
+  set service webproxy cache-size
+   Possible completions:
+     <0-4294967295>
+                  Disk cache size in MB (default 100)
+     0            Disable disk caching
+     100
+
+Bypassing the webproxy
+^^^^^^^^^^^^^^^^^^^^^^
+
+Some services don't work correctly when being handled via a web proxy.
+So sometimes it is useful to bypass a transparent proxy:
+
+* To bypass the proxy for every request that is directed to a specific
+  destination:
+
+  :code:`set service webproxy whitelist destination-address 198.51.100.33`
+
+  :code:`set service webproxy whitelist destination-address 192.0.2.0/24`
+
+
+* To bypass the proxy for every request that is coming from a specific source:
+
+  :code:`set service webproxy whitelist source-address 192.168.1.2`
+
+  :code:`set service webproxy whitelist source-address 192.168.2.0/24`
+
+  (This can be useful when a called service has many and/or often changing
+  destination addresses - e.g. Netflix.)
+
+.. include:: references.rst
diff --git a/docs/configuration/system/console.rst b/docs/configuration/system/console.rst
new file mode 100644
index 00000000..730c9da1
--- /dev/null
+++ b/docs/configuration/system/console.rst
@@ -0,0 +1,17 @@
+.. _serial-console:
+
+Serial console
+==============
+
+
+
+Configuring Console
+-------------------
+
+.. code-block:: none
+
+  vyos@vyos# set system console
+  Possible completions:
+  +> device       Serial console device name
+  +> network      Network based console logging
+     powersave    Enable screen blank powersaving on VGA console
\ No newline at end of file
diff --git a/docs/configuration/system/eventhandler.rst b/docs/configuration/system/eventhandler.rst
new file mode 100644
index 00000000..4421e79c
--- /dev/null
+++ b/docs/configuration/system/eventhandler.rst
@@ -0,0 +1,48 @@
+.. _event-handler:
+
+Event Handler
+-------------
+
+Event handler allows you to execute scripts when a string that matches a regex appears in a text stream (e.g. log file).
+
+It uses "feeds" (output of commands, or a named pipes) and "policies" that define what to execute if a regex is matched.
+
+.. code-block:: none
+
+  system
+  event-handler
+      feed <name>
+      description <feed description>
+      policy <policy name>
+      source
+          preset
+          syslog # Use the syslog logs for feed
+          custom
+          command <command to execute> # E.g. "tail -f /var/log/somelogfile"
+          named-pipe <path to a names pipe>
+      policy <policy name>
+      description <policy description>
+      event <event name>
+          description <event description>
+          pattern <regex>
+          run <command to run>
+
+In this small example a script runs every time a login failed and an interface goes down
+
+.. code-block:: none
+
+  vyos@vyos# show system event-handler 
+  feed Syslog {
+      policy MyPolicy
+      source {
+          preset syslog
+      }
+  }
+  policy MyPolicy {
+      description "Test policy"
+      event BadThingsHappened {
+          pattern "authentication failure"
+          pattern "interface \.* index \d+ .* DOWN.*"
+          run /config/scripts/email-to-admin 
+      }
+  }
\ No newline at end of file
diff --git a/docs/configuration/system/flow-accounting.rst b/docs/configuration/system/flow-accounting.rst
new file mode 100644
index 00000000..9c876001
--- /dev/null
+++ b/docs/configuration/system/flow-accounting.rst
@@ -0,0 +1,81 @@
+.. _flow-accounting:
+
+NetFlow is a feature that was introduced on Cisco routers around 1996 that
+provides the ability to collect IP network traffic as it enters or exits an
+interface. By analyzing the data provided by NetFlow, a network administrator
+can determine things such as the source and destination of traffic, class of
+service, and the causes of congestion. A typical flow monitoring setup (using
+NetFlow) consists of three main components:
+
+* Flow exporter: aggregates packets into flows and exports flow records towards
+  one or more flow collectors
+* Flow collector: responsible for reception, storage and pre-processing of flow
+  data received from a flow exporter
+* Analysis application: analyzes received flow data in the context of intrusion
+  detection or traffic profiling, for example
+
+For connectionless protocols as like ICMP and UDP, a flow is considered complete
+once no more packets for this flow appear after configurable timeout.
+
+NetFlow is usually enabled on a per-interface basis to limit load on the router
+components involved in NetFlow, or to limit the amount of NetFlow records
+exported.
+
+VyOS supports flow accounting through NetFlow (version 5, 9 and 10) or sFlow.
+
+Flow Accounting
+---------------
+
+In order for flow accounting information to be collected and displayed for an
+interface, the interface must be configured for flow accounting. The following
+example shows how to configure ``eth0`` and ``bond3`` for flow accounting.
+
+.. code-block:: none
+
+  set system flow-accounting interface eth0
+  set system flow-accounting interface bond3
+
+
+NetFlow is a protocol originating from Cisco Systems. It works on level3.
+VyOS supports version 5, 9 and 10 (IPFIX - IP Flow Information Export)
+
+NetFlow v5 example:
+
+.. code-block:: none
+
+  set system flow-accounting netflow engine-id 100
+  set system flow-accounting netflow version 5
+  set system flow-accounting netflow server 192.168.2.10 port 2055
+
+Displaying Flow Accounting Information
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Once flow accounting is configured on an interfaces it provides the ability to
+display captured network traffic information for all configured interfaces.
+
+The following op-mode command shows flow accounting for eth0.
+
+.. code-block:: none
+
+  vyos@vyos:~$ show flow-accounting interface eth0
+  flow-accounting for [eth0]
+  Src Addr        Dst Addr        Sport Dport Proto    Packets      Bytes   Flows
+  0.0.0.0         192.0.2.50      811   811     udp       7733     591576       0
+  0.0.0.0         192.0.2.50      811   811     udp       7669     586558       1
+  192.0.2.200     192.0.2.51      56188 22      tcp        586      36504       1
+  192.0.2.99      192.0.2.51      61636 161     udp         46       6313       4
+  192.0.2.99      192.0.2.51      61638 161     udp         42       5364       9
+  192.0.2.99      192.0.2.51      61640 161     udp         42       5111       3
+  192.0.2.200     192.0.2.51      54702 22      tcp         86       4432       1
+  192.0.2.99      192.0.2.51      62509 161     udp         24       3540       1
+  192.0.2.99      192.0.2.51      0     0      icmp         49       2989       8
+  192.0.2.99      192.0.2.51      54667 161     udp         18       2658       1
+  192.0.2.99      192.0.2.51      54996 161     udp         18       2622       1
+  192.0.2.99      192.0.2.51      63708 161     udp         18       2622       1
+  192.0.2.99      192.0.2.51      62111 161     udp         18       2622       1
+  192.0.2.99      192.0.2.51      61646 161     udp         16       1977       4
+  192.0.2.99      192.0.2.51      56038 161     udp         10       1256       1
+  192.0.2.99      192.0.2.51      55570 161     udp          6       1146       1
+  192.0.2.99      192.0.2.51      54599 161     udp          6       1134       1
+  192.0.2.99      192.0.2.51      56304 161     udp          8       1029       1
+
diff --git a/docs/configuration/system/host-information.rst b/docs/configuration/system/host-information.rst
new file mode 100644
index 00000000..71209412
--- /dev/null
+++ b/docs/configuration/system/host-information.rst
@@ -0,0 +1,175 @@
+.. _host-information:
+
+Host Information
+----------------
+
+This section describes the system's host information and how to configure them,
+it covers the following topics:
+
+* Host name
+* Domain
+* IP address
+* Default gateway
+* Aliases
+
+Host Name
+^^^^^^^^^
+
+A hostname is the label (name) assigned to a network device (a host) on a
+network and is used to distinguish one device from another on specific networks
+or over the internet.
+
+Set a system host name:
+
+.. code-block:: none
+
+  set system host-name <hostname>
+
+.. note:: Only letters, numbers and hyphens are allowed.
+
+Show host name:
+
+.. code-block:: none
+
+  show system host-name
+
+Delete host name:
+
+.. code-block:: none
+
+  delete system host-name <hostname>
+
+Example: Set system hostname to 'RT01':
+
+.. code-block:: none
+
+  set system host-name RT01
+  commit
+  show system host-name
+    host-name RT01
+
+Domain Name
+^^^^^^^^^^^
+
+A domain name is the label (name) assigned to a computer network and is thus
+unique.
+
+Set the system's domain:
+
+.. code-block:: none
+
+  set system domain-name <domain>
+
+.. note:: Only letters, numbers, hyphens and periods are allowed.
+
+Show domain:
+
+.. code-block:: none
+
+  show system domain-name
+
+Remove domain name:
+
+.. code-block:: none
+
+  set system delete domain-name <domain>
+
+Example: Set system domain to example.com:
+
+.. code-block:: none
+
+  set system domain-name example.com
+  commit
+  show system domain-name
+    domain-name example.com
+
+Static host mappings
+^^^^^^^^^^^^^^^^^^^^
+
+How to assign IPs to interfaces is described in chapter
+:ref:`interfaces-addresses`. This section shows how to statically map a system
+IP to its host name for local (meaning on this VyOS instance) DNS resolution:
+
+.. code-block:: none
+
+  set system static-host-mapping host-name <hostname> inet <IP address>
+
+Show static mapping:
+
+.. code-block:: none
+
+  show system static-host-mapping
+
+Example: Create a static mapping between the system's hostname `RT01` and
+IP address `10.20.30.41`:
+
+.. code-block:: none
+
+  set system static-host-mapping host-name RT01 inet 10.20.30.41
+  commit
+  show system static-host-mapping
+    host-name RT01 {
+        inet 10.20.30.41
+    }
+
+Aliases
+*******
+
+One or more system aliases (static mappings) can be defined:
+
+.. code-block:: none
+
+  set system static-host-mapping host-name <hostname> alias <alias>
+
+Show aliases:
+
+.. code-block:: none
+
+  show system static-mapping
+
+Delete alias:
+
+.. code-block:: none
+
+  delete system static-host-mapping host-name <hostname> alias <alias>
+
+Example: Set alias `router1` for system with hostname `RT01`:
+
+.. code-block:: none
+
+  set system static-host-mapping host-name RT01 alias router1
+  commit
+  show system static-host-mapping
+    host-name RT01 {
+        alias router1
+        inet 10.20.30.41
+    }
+
+Default Gateway/Route
+^^^^^^^^^^^^^^^^^^^^^
+
+In the past (VyOS 1.1.8) used a gateway-address configured in the system tree
+(`set system gateway-address <IP address>`) this is no longer supported and
+existing configurations are migrated to the new CLI commands.
+
+It is replaced by inserting a static route into the routing table using:
+
+.. code-block:: none
+
+  set protocols static route 0.0.0.0/0 next-hop <gateway ip>
+
+Delete the default route from the system
+
+.. code-block:: none
+
+  delete protocols static route 0.0.0.0/0
+
+Show default route:
+
+.. code-block:: none
+
+  vyos@vyos$ show ip route 0.0.0.0
+  Routing entry for 0.0.0.0/0
+    Known via "static", distance 1, metric 0, best
+    Last update 3d00h23m ago
+    * 172.16.34.6, via eth1
diff --git a/docs/configuration/system/index.rst b/docs/configuration/system/index.rst
new file mode 100644
index 00000000..07ba2ff5
--- /dev/null
+++ b/docs/configuration/system/index.rst
@@ -0,0 +1,24 @@
+.. _system:
+
+System
+======
+
+After a basic system setup by setting up :ref:`interfaces-addresses`, VyOS
+should be ready for further configuration which is described in this chapter.
+
+
+.. toctree::
+   :maxdepth: 2
+
+   host-information
+   console
+   eventhandler
+   flow-accounting
+   login
+   ip
+   ipv6
+   name-server
+   ntp
+   syslog
+   task-scheduler
+   time-zone
\ No newline at end of file
diff --git a/docs/configuration/system/ip.rst b/docs/configuration/system/ip.rst
new file mode 100644
index 00000000..6c158de9
--- /dev/null
+++ b/docs/configuration/system/ip.rst
@@ -0,0 +1,75 @@
+.. _ip:
+
+IPv4
+====
+
+System configuration commands
+-----------------------------
+
+
+.. cfgcmd:: set system ip disable-forwarding
+
+   Use this command to disable IPv4 forwarding on all interfaces.
+
+
+.. cfgcmd:: set system ip arp table-size <number>
+
+   Use this command to define the maximum number of entries to keep in
+   the ARP cache (1024, 2048, 4096, 8192, 16384, 32768).
+
+
+.. cfgcmd:: set system ip multipath layer4-hashing
+
+   Use this command to use Layer 4 information for IPv4 ECMP hashing.
+
+
+Operational commands
+--------------------
+
+
+show commands
+^^^^^^^^^^^^^
+
+See below the different parameters available for the IPv4 **show** command:
+
+.. code-block::
+
+   vyos@vyos:~$ show ip
+   Possible completions:
+     access-list   Show all IP access-lists
+     as-path-access-list
+                   Show all as-path-access-lists
+     bgp           Show Border Gateway Protocol (BGP) information
+     community-list
+                   Show IP community-lists
+     extcommunity-list
+                   Show extended IP community-lists
+     forwarding    Show IP forwarding status
+     groups        Show IP multicast group membership
+     igmp          Show IGMP (Internet Group Management Protocol) information
+     large-community-list
+                   Show IP large-community-lists
+     multicast     Show IP multicast
+     ospf          Show IPv4 Open Shortest Path First (OSPF) routing information
+     pim           Show PIM (Protocol Independent Multicast) information
+     ports         Show IP ports in use by various system services
+     prefix-list   Show all IP prefix-lists
+     protocol      Show IP route-maps per protocol
+     rip           Show Routing Information Protocol (RIP) information
+     route         Show IP routes
+   
+
+reset commands
+^^^^^^^^^^^^^^
+
+And the different IPv4 **reset** commands available:
+
+.. code-block::
+
+   vyos@vyos:~$ reset ip 
+   Possible completions:
+     arp           Reset Address Resolution Protocol (ARP) cache
+     bgp           Clear Border Gateway Protocol (BGP) statistics or status
+     igmp          IGMP clear commands
+     multicast     IP multicast routing table
+     route         Reset IP route
diff --git a/docs/configuration/system/ipv6.rst b/docs/configuration/system/ipv6.rst
new file mode 100644
index 00000000..8b00ccf8
--- /dev/null
+++ b/docs/configuration/system/ipv6.rst
@@ -0,0 +1,202 @@
+.. _ipv6:
+
+
+IPv6
+====
+
+System configuration commands
+-----------------------------
+
+.. cfgcmd:: set system ipv6 disable
+
+   Use this command to disable assignment of IPv6 addresses on all
+   interfaces.
+
+
+.. cfgcmd:: set system ipv6 disable-forwarding
+
+   Use this command to disable IPv6 forwarding on all interfaces.
+
+
+.. cfgcmd:: set system ipv6 neighbor table-size <number>
+
+   Use this command to define the maximum number of entries to keep in
+   the Neighbor cache (1024, 2048, 4096, 8192, 16384, 32768).
+
+
+.. cfgcmd:: set system ipv6 strict-dad
+
+   Use this command to disable IPv6 operation on interface when
+   Duplicate Address Detection fails on Link-Local address.
+
+
+.. cfgcmd:: set system ipv6 multipath layer4-hashing
+
+   Use this command to user Layer 4 information for ECMP hashing.
+
+.. cfgcmd:: set system ipv6 blacklist
+
+   Use this command to prevent the IPv6 kernel module from being loaded.
+
+
+
+Operational commands
+--------------------
+
+Show commands
+^^^^^^^^^^^^^
+
+
+.. opcmd:: show ipv6 neighbors
+
+   Use this command to show IPv6 Neighbor Discovery Protocol information.
+
+
+.. opcmd:: show ipv6 groups
+
+   Use this command to show IPv6 multicast group membership.
+
+
+.. opcmd:: show ipv6 forwarding
+  
+   Use this command to show IPv6 forwarding status.
+
+.. opcmd:: show ipv6 route
+
+   Use this command to show IPv6 routes.
+
+
+   Check the many parameters available for the `show ipv6 route` command:
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show ipv6 route 
+      Possible completions:
+        <Enter>       Execute the current command
+        <X:X::X:X>    Show IPv6 routes of given address or prefix
+        <X:X::X:X/M>
+        bgp           Show IPv6 BGP routes
+        cache         Show kernel IPv6 route cache
+        connected     Show IPv6 connected routes
+        forward       Show kernel IPv6 route table
+        isis          Show IPv6 ISIS routes
+        kernel        Show IPv6 kernel routes
+        ospfv3        Show IPv6 OSPF6 routes
+        ripng         Show IPv6 RIPNG routes
+        static        Show IPv6 static routes
+        summary       Show IPv6 routes summary
+        table         Show IP routes in policy table
+      
+
+.. opcmd:: show ipv6 prefix-list
+
+   Use this command to show all IPv6 prefix lists
+
+   There are different parameters for getting prefix-list information:
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show ipv6 prefix-list 
+      Possible completions:
+        <Enter>       Execute the current command
+        <WORD>        Show specified IPv6 prefix-list
+        detail        Show detail of IPv6 prefix-lists
+        summary       Show summary of IPv6 prefix-lists
+      
+.. opcmd:: show ipv6 access-list
+
+   Use this command to show all IPv6 access lists
+
+   You can also specify which IPv6 access-list should be shown:
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show ipv6 access-list 
+      Possible completions:
+        <Enter>       Execute the current command
+        <text>        Show specified IPv6 access-list
+      
+
+
+.. opcmd:: show ipv6 bgp
+
+   Use this command to show IPv6 Border Gateway Protocol information.
+
+
+   In addition, you can specify many other parameters to get BGP
+   information:
+
+   .. code-block:: none
+   
+      vyos@vyos:~$ show ipv6 bgp 
+      Possible completions:
+        <Enter>       Execute the current command
+        <X:X::X:X>    Show BGP information for given address or prefix
+        <X:X::X:X/M>
+        community     Show routes matching the communities
+        community-list
+                      Show routes matching the community-list
+        filter-list   Show routes conforming to the filter-list
+        large-community
+                      Show routes matching the large-community-list
+        large-community-list
+        neighbors     Show detailed information on TCP and BGP neighbor connections
+        prefix-list   Show routes matching the prefix-list
+        regexp        Show routes matching the AS path regular expression
+        summary       Show summary of BGP neighbor status
+      
+      
+
+.. opcmd:: show ipv6 ospfv3
+
+   Use this command to get information about OSPFv3.
+
+   You can get more specific OSPFv3 information by using the parameters
+   shown below:
+   
+   .. code-block:: none
+   
+      vyos@vyos:~$ show ipv6 ospfv3 
+      Possible completions:
+        <Enter>       Execute the current command
+        area          Show OSPFv3 spf-tree information
+        border-routers
+                      Show OSPFv3 border-router (ABR and ASBR) information
+        database      Show OSPFv3 Link state database information
+        interface     Show OSPFv3 interface information
+        linkstate     Show OSPFv3 linkstate routing information
+        neighbor      Show OSPFv3 neighbor information
+        redistribute  Show OSPFv3 redistribute External information
+        route         Show OSPFv3 routing table information
+      
+.. opcmd:: show ipv6 ripng
+
+   Use this command to get information about the RIPNG protocol
+
+.. opcmd:: show ipv6 ripng status
+
+   Use this command to show the status of the RIPNG protocol
+
+
+
+Reset commands
+^^^^^^^^^^^^^^
+
+.. opcmd:: reset ipv6 bgp <address>
+
+   Use this command to clear Border Gateway Protocol statistics or
+   status.
+
+
+.. opcmd:: reset ipv6 neighbors <address | interface>
+
+   Use this command to reset IPv6 Neighbor Discovery Protocol cache for 
+   an address or interface.
+
+.. opcmd:: reset ipv6 route cache
+
+   Use this command to flush the kernel IPv6 route cache.
+   An address can be added to flush it only for that route. 
+
+
+
diff --git a/docs/configuration/system/login.rst b/docs/configuration/system/login.rst
new file mode 100644
index 00000000..c34e41a0
--- /dev/null
+++ b/docs/configuration/system/login.rst
@@ -0,0 +1,129 @@
+.. _systemusers:
+
+Login
+-----
+
+The default VyOS user account (`vyos`), as well as newly created user accounts,
+have all capabilities to configure the system. All accounts have sudo capabilities
+and therefore can operate as root on the system. Setting the level to admin is
+optional, all accounts on the system will have admin privileges.
+
+Both local administered and remote administered RADIUS (Remote Authentication
+Dial-In User Service) accounts are supported.
+
+Local
+^^^^^
+
+Create user account `jsmith` and the password `mypassword`.
+
+.. code-block:: none
+
+  set system login user jsmith full-name "Johan Smith"
+  set system login user jsmith authentication plaintext-password mypassword
+
+The command:
+
+.. code-block:: none
+
+  show system login
+
+will show the contents of :code:`system login` configuration node:
+
+.. code-block:: none
+
+  user jsmith {
+      authentication {
+          encrypted-password $6$0OQHjuQ8M$AYXVn7jufdfqPrSk4/XXsDBw99JBtNsETkQKDgVLptXogHA2bU9BWlvViOFPBoFxIi.iqjqrvsQdQ./cfiiPT.
+          plaintext-password ""
+      }
+      full-name "Johan Smith"
+      level admin
+  }
+
+SSH with Public Keys
+********************
+
+The following command will load the public key `dev.pub` for user `jsmith`
+
+.. code-block:: none
+
+  loadkey jsmith dev.pub
+
+.. note:: This requires uploading the `dev.pub` public key to the VyOS router
+   first. As an alternative you can also load the SSH public key directly
+   from a remote system:
+
+.. code-block:: none
+
+  loadkey jsmith scp://devuser@dev001.vyos.net/home/devuser/.ssh/dev.pub
+
+In addition SSH public keys can be fully added using the CLI. Each key can be
+given a unique identifier, `calypso` is used oin the example below to id an SSH
+key.
+
+.. code-block:: none
+
+  set system login user jsmith authentication public-keys callisto key 'AAAAB3Hso...Q=='
+  set system login user jsmith authentication public-keys callisto type 'ssh-rsa'
+
+RADIUS
+^^^^^^
+
+VyOS supports using one or more RADIUS servers as backend for user authentication.
+
+The following command sets up two servers for RADIUS authentication, one with a
+discrete timeout of `5` seconds and a discrete port of `1812` and the other using
+a default timeout and port.
+
+.. code-block:: none
+
+  set system login radius-server 192.168.1.2 secret 's3cr3t0815'
+  set system login radius-server 192.168.1.2 timeout '5'
+  set system login radius-server 192.168.1.2 port '1812'
+  set system login radius-server 192.168.1.3 secret 's3cr3t0816'
+
+This configuration results in:
+
+.. code-block:: none
+
+  show system login
+   radius-server 192.168.1.2 {
+       secret s3cr3t0815
+       timeout 5
+       port 1812
+   }
+   radius-server 192.168.1.3 {
+       secret s3cr3t0816
+   }
+
+.. note:: If you wan't to have admin users to authenticate via RADIUS it is
+   essential to sent the ``Cisco-AV-Pair shell:priv-lvl=15`` attribute. Without
+   the attribute you will only get regular, non privilegued, system users.
+
+Source Address
+**************
+
+RADIUS servers could be hardened by only allowing certain IP addresses to connect.
+As of this the source address of each RADIUS query can be configured. If this is
+not set incoming connections to the RADIUS server will use the nearest interface
+address pointing towards the RADIUS server - making it error prone on e.g. OSPF
+networks when a link fails.
+
+.. code-block:: none
+
+  set system login radius-source-address 192.168.1.254
+
+Login Banner
+^^^^^^^^^^^^
+
+You are able to set post-login or pre-login messages with the following lines:
+
+.. code-block:: none
+
+  set system login banner pre-login "UNAUTHORIZED USE OF THIS SYSTEM IS PROHIBITED\n"
+  set system login banner post-login "Welcome to VyOS"
+
+the **\\n** create a newline.
+
+
+
diff --git a/docs/configuration/system/name-server.rst b/docs/configuration/system/name-server.rst
new file mode 100644
index 00000000..70848f6d
--- /dev/null
+++ b/docs/configuration/system/name-server.rst
@@ -0,0 +1,68 @@
+.. _system-dns:
+
+##########
+System DNS
+##########
+
+
+This section describes configuring DNS on the system, namely:
+
+ * DNS name servers
+ * Domain search order
+
+
+DNS name servers
+================
+
+.. cfgcmd:: set system name-server <address>
+
+   Use this command to specify a DNS server for the system to be used
+   for DNS lookups. More than one DNS server can be added, configuring
+   one at a time. Both IPv4 and IPv6 addresses are supported.
+
+
+
+Example
+-------
+
+In this example, some *OpenNIC* servers are used, two IPv4 addresses
+and two IPv6 addresses:
+
+
+.. code-block:: none
+
+   set system name-server 176.9.37.132
+   set system name-server 195.10.195.195
+   set system name-server 2a01:4f8:161:3441::1
+   set system name-server 2a00:f826:8:2::195
+
+
+Domain search order
+===================
+
+In order for the system to use and complete unqualified host names, a
+list can be defined which will be used for domain searches.
+
+
+.. cfgcmd:: set system domain-search domain <domain>
+
+   Use this command to define domains, one at a time, so that the system
+   uses them to complete unqualified host names. Maximum: 6 entries.
+
+
+.. note:: Domain names can include letters, numbers, hyphens and periods
+   with a maximum length of 253 characters.
+
+
+Example
+-------
+
+The system is configured to attempt domain completion in the following
+order: vyos.io (first), vyos.net (second) and vyos.network (last):
+
+
+.. code-block:: none
+
+   set system domain-search domain vyos.io
+   set system domain-search domain vyos.net
+   set system domain-search domain vyos.network
diff --git a/docs/configuration/system/ntp.rst b/docs/configuration/system/ntp.rst
new file mode 100644
index 00000000..95ff0692
--- /dev/null
+++ b/docs/configuration/system/ntp.rst
@@ -0,0 +1,19 @@
+.. _ntp:
+
+NTP
+===
+
+there are 3 default NTP server set. You are able to change them.
+
+.. code-block:: none
+
+  set system ntp server 0.pool.ntp.org
+  set system ntp server 1.pool.ntp.org
+  set system ntp server 2.pool.ntp.org
+
+To set up VyOS as an NTP responder, you must specify the listen address and optionally the permitted clients.
+
+.. code-block:: none
+
+  set system ntp listen-address 192.168.199.1
+  set system ntp allow-clients address 192.168.199.0/24
diff --git a/docs/configuration/system/syslog.rst b/docs/configuration/system/syslog.rst
new file mode 100644
index 00000000..9f3e1a28
--- /dev/null
+++ b/docs/configuration/system/syslog.rst
@@ -0,0 +1,224 @@
+.. _syslog:
+
+######
+Syslog
+######
+
+Per default VyOSs has minimal syslog logging enabled which is stored and
+rotated locally. Errors will be always logged to a local file, which includes
+`local7` error messages, emergency messages will be sent to the console, too.
+
+To configure syslog, you need to switch into configuration mode.
+
+Logging
+=======
+
+Syslog supports logging to multiple targets, those targets could be a plain
+file on your VyOS installation itself, a serial console or a remote syslog
+server which is reached via :abbr:`IP (Internet Protocol)` UDP/TCP.
+
+Console
+-------
+
+.. cfgcmd:: set system syslog console facility <keyword> level <keyword>
+
+Log syslog messages to ``/dev/console``, for an explanation on
+:ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords
+see tables below.
+
+
+Custom File
+-----------
+
+.. cfgcmd:: set system syslog file <filename> facility <keyword> level <keyword>
+
+Log syslog messages to file specified via `<filename>`, for en explanation on
+:ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords see
+tables below.
+
+.. cfgcmd:: set system syslog file <filename> archive size <size>
+
+Syslog will write `<size>` kilobytes into the file specified by `<filename>`.
+After this limit has been reached, the custom file is "rotated" by logrotate
+and a new custom file is created.
+
+.. cfgcmd:: set system syslog file <filename> archive file <number>
+
+Syslog uses logrotate to rotate logiles after a number of gives bytes. We keep
+as many as `<number>` rotated file before they are deleted on the system.
+
+
+Remote Host
+-----------
+
+Logging to a remote host leaves the local logging configuration intact, it
+can be configured in parallel to a custom file or console logging. You can log
+to multiple hosts at the same time, using either TCP or UDP. The default is
+sending the messages via port 514/UDP.
+
+
+.. cfgcmd:: set system syslog host <address> facility <keyword> level <keyword>
+
+Log syslog messages to remote host specified by `<address>`. The address can be
+specified by either FQDN or IP address. For en explanation on
+:ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords see
+tables below.
+
+
+.. cfgcmd:: set system syslog host <address> facility <keyword> protocol <udp|tcp>
+
+Configure protocol used for communication to remote syslog host. This can be
+either UDP or TCP.
+
+
+Local User Account
+------------------
+
+.. cfgcmd:: set system syslog user <username> facility <keyword> level <keyword>
+
+If logging to a local user account is configured, all defined log messages are
+display on the console if the local user is logged in, if the user is not
+logged in, no messages are being displayed. For en explanation on
+:ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords see
+tables below.
+
+.. _syslog_facilities:
+
+Facilities
+==========
+
+List of facilities used by syslog. Most facilities names are self explanatory.
+Facilities local0 - local7 common usage is f.e. as network logs facilities for
+nodes and network equipment. Generally it depends on the situation how to
+classify logs and put them to facilities. See facilities more as a tool rather
+than a directive to follow.
+
+Facilities can be adjusted to meet the needs of the user:
+
++----------+----------+----------------------------------------------------+
+| Facility | Keyword  | Description                                        |
+| Code     |          |                                                    |
++==========+==========+====================================================+
+|          | all      | All facilities                                     |
++----------+----------+----------------------------------------------------+
+| 0        | kern     | Kernel messages                                    |
++----------+----------+----------------------------------------------------+
+| 1        | user     | User-level messages                                |
++----------+----------+----------------------------------------------------+
+| 2        | mail     | Mail system                                        |
++----------+----------+----------------------------------------------------+
+| 3        | daemon   | System daemons                                     |
++----------+----------+----------------------------------------------------+
+| 4        | auth     | Security/authentication messages                   |
++----------+----------+----------------------------------------------------+
+| 5        | syslog   | Messages generated internally by syslogd           |
++----------+----------+----------------------------------------------------+
+| 6        | lpr      | Line printer subsystem                             |
++----------+----------+----------------------------------------------------+
+| 7        | news     | Network news subsystem                             |
++----------+----------+----------------------------------------------------+
+| 8        | uucp     | UUCP subsystem                                     |
++----------+----------+----------------------------------------------------+
+| 9        | cron     | Clock daemon                                       |
++----------+----------+----------------------------------------------------+
+| 10       | security | Security/authentication messages                   |
++----------+----------+----------------------------------------------------+
+| 11       | ftp      | FTP daemon                                         |
++----------+----------+----------------------------------------------------+
+| 12       | ntp      | NTP subsystem                                      |
++----------+----------+----------------------------------------------------+
+| 13       | logaudit | Log audit                                          |
++----------+----------+----------------------------------------------------+
+| 14       | logalert | Log alert                                          |
++----------+----------+----------------------------------------------------+
+| 15       | clock    | clock daemon (note 2)                              |
++----------+----------+----------------------------------------------------+
+| 16       | local0   | local use 0 (local0)                               |
++----------+----------+----------------------------------------------------+
+| 17       | local1   | local use 1 (local1)                               |
++----------+----------+----------------------------------------------------+
+| 18       | local2   | local use 2 (local2)                               |
++----------+----------+----------------------------------------------------+
+| 19       | local3   | local use 3 (local3)                               |
++----------+----------+----------------------------------------------------+
+| 20       | local4   | local use 4 (local4)                               |
++----------+----------+----------------------------------------------------+
+| 21       | local5   | local use 5 (local5)                               |
++----------+----------+----------------------------------------------------+
+| 22       | local6   |  use 6 (local6)                                    |
++----------+----------+----------------------------------------------------+
+| 23       | local7   | local use 7 (local7)                               |
++----------+----------+----------------------------------------------------+
+
+.. _syslog_severity_level:
+
+Severity Level
+==============
+
++-------+---------------+---------+-------------------------------------------+
+| Value | Severity      | Keyword | Description                               |
++=======+===============+=========+===========================================+
+|       |               | all     | Log everything                            |
++-------+---------------+---------+-------------------------------------------+
+| 0     | Emergency     | emerg   | System is unusable - a panic condition    |
++-------+---------------+---------+-------------------------------------------+
+| 1     | Alert         | alert   | Action must be taken immediately - A      |
+|       |               |         | condition that should be corrected        |
+|       |               |         | immediately, such as a corrupted system   |
+|       |               |         | database.                                 |
++-------+---------------+---------+-------------------------------------------+
+| 2     | Critical      | crit    | Critical conditions - e.g. hard drive     |
+|       |               |         | errors.                                   |
++-------+---------------+---------+-------------------------------------------+
+| 3     | Error         | err     | Error conditions                          |
++-------+---------------+---------+-------------------------------------------+
+| 4     | Warning       | warning | Warning conditions                        |
++-------+---------------+---------+-------------------------------------------+
+| 5     | Notice        | notice  | Normal but significant conditions -       |
+|       |               |         | conditions that are not error conditions, |
+|       |               |         | but that may require special handling.    |
++-------+---------------+---------+-------------------------------------------+
+| 6     | Informational | info    | Informational messages                    |
++-------+---------------+---------+-------------------------------------------+
+| 7     | Debug         | debug   | Debug-level messages - Messages that      |
+|       |               |         | contain information normally of use only  |
+|       |               |         | when debugging a program.                 |
++-------+---------------+---------+-------------------------------------------+
+
+
+Display Logs
+============
+
+.. opcmd:: show log [all | authorization | cluster | conntrack-sync | ...]
+
+Display log files of given category on the console. Use tab completion to get
+a list of available categories. Thos categories could be: all, authorization,
+cluster, conntrack-sync, dhcp, directory, dns, file, firewall, https, image
+lldp, nat, openvpn, snmp, tail, vpn, vrrp
+
+If no option is specified, this defaults to `all`.
+
+.. opcmd:: show log image <name> [all | authorization | directory | file <file name> | tail <lines>]
+
+Log messages from a specified image can be displayed on the console. Details of
+allowed parameters:
+
+.. list-table::
+   :widths: 25 75
+   :header-rows: 0
+
+   * - all
+     - Display contents of all master log files of the specified image
+   * - authorization
+     - Display all authorization attempts of the specified image
+   * - directory
+     - Display list of all user-defined log files of the specified image
+   * - file <file name>
+     - Display contents of a specified user-defined log file of the specified image
+   * - tail
+     - Display last lines of the system log of the specified image
+   * - <lines>
+     - Number of lines to be displayed, default 10
+
+When no options/parameters are used, the contents of the main syslog file are
+displayed.
diff --git a/docs/configuration/system/task-scheduler.rst b/docs/configuration/system/task-scheduler.rst
new file mode 100644
index 00000000..7fe49988
--- /dev/null
+++ b/docs/configuration/system/task-scheduler.rst
@@ -0,0 +1,60 @@
+.. _task-scheduler:
+
+
+Task scheduler
+--------------
+
+| Task scheduler — allows scheduled task execution. Note that scripts excecuted this way are executed as root user - this may be dangerous.
+| Together with :ref:`commandscripting` this can be used for automating configuration.
+
+.. code-block:: none
+
+  system
+      task-scheduler
+          task <name>
+              cron-spec <UNIX cron time spec>
+              executable
+                  arguments <arguments string>
+                  path <path to executable>
+              interval
+                  <int32>[mhd]
+
+Interval
+********
+
+You are able to set the time as an time interval.
+
+.. code-block:: none
+
+  set system task-scheduler task <name> interval <value><suffix>
+
+Sets the task to execute every N minutes, hours, or days. Suffixes:
+
+ * m — minutes
+ * h — hours
+ * d — days
+
+If suffix is omitted, minutes are implied.
+
+Or set the execution time in common cron time.
+
+.. code-block:: none
+
+  set system task-scheduler task TEST crontab-spec "* * * 1 *"
+
+Example
+*******
+
+.. code-block:: none
+
+  system
+      task-scheduler
+          task mytask
+              interval 2h
+              executable
+                  path /config/scripts/mytask
+                  arguments "arg1 arg2 arg3"
+          task anothertask
+              cron-spec "* * * 1 *"
+              executable
+                  path /config/scripts/anothertask
\ No newline at end of file
diff --git a/docs/configuration/system/time-zone.rst b/docs/configuration/system/time-zone.rst
new file mode 100644
index 00000000..9e1690e8
--- /dev/null
+++ b/docs/configuration/system/time-zone.rst
@@ -0,0 +1,11 @@
+.. _timezone:
+
+Time Zone
+=========
+
+To set the system time zone type:
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# set system time-zone [time-zone]
\ No newline at end of file
diff --git a/docs/configuration/trafficpolicy/index.rst b/docs/configuration/trafficpolicy/index.rst
new file mode 100644
index 00000000..6beb660e
--- /dev/null
+++ b/docs/configuration/trafficpolicy/index.rst
@@ -0,0 +1,1197 @@
+.. _qos:
+
+##############
+Traffic Policy
+##############
+
+The generic name of Quality of Service or Traffic Control involves
+things like shaping traffic, scheduling or dropping packets, which
+are the kind of things you may want to play with when you have, for
+instance, a bandwidth bottleneck in a link and you want to somehow
+prioritize some type of traffic over another.
+
+tc_ is a powerful tool for Traffic Control found at the Linux kernel.
+However, its configuration is often considered a cumbersome task.
+Fortunately, VyOS eases the job through its CLI, while using ``tc`` as
+backend.
+
+
+How to make it work
+===================
+
+In order to have VyOS Traffic Control working you need to follow 2
+steps:
+
+ 1. **Create a traffic policy**.
+
+ 2. **Apply the traffic policy to an interface ingress or egress**.
+    
+
+But before learning to configure your policy, we will warn you
+about the different units you can use and also show you what *classes*
+are and how they work, as some policies may require you to configure
+them.
+
+
+Units
+=====
+
+When configuring your traffic policy, you will have to set data rate
+values, watch out the units you are managing, it is easy to get confused
+with the different prefixes and suffixes you can use. VyOS will always
+show you the different units you can use.
+
+Prefixes
+--------
+
+They can be **decimal** prefixes.
+
+   .. code-block:: none
+
+	kbit  (10^3)    kilobit per second
+	mbit  (10^6)    megabit per second
+	gbit  (10^9)    gigabit per second
+ 	tbit  (10^12)   terabit per second
+	
+	kbps  (8*10^3)  kilobyte per second
+	mbps  (8*10^6)  megabyte per second
+	gbps  (8*10^9)  gigabyte per second
+	tbps  (8*10^12) terabyte per second
+
+Or **binary** prefixes.
+
+   .. code-block:: none
+
+	kibit (2^10 = 1024)    kibibit per second
+	mibit (2^20 = 1024^2)  mebibit per second
+	gibit (2^30 = 1024^3)  gibibit per second
+        tbit  (2^40 = 1024^4)  tebibit per second
+
+	kibps (1024*8)	       kibibyte (KiB) per second
+	mibps (1024^2*8)       mebibyte (MiB) per second
+        gibps (1024^3*8)       gibibyte (GiB) per second
+        tibps (1024^4*8)       tebibyte (TiB) per second
+
+
+Suffixes
+--------
+
+A *bit* is written as **bit**,
+   
+   .. code-block:: none
+
+        kbit (kilobits per second)
+        mbit (megabits per second)
+        gbit (gigabits per second)
+	tbit (terabits per second)
+
+while a *byte* is written as a single **b**.
+
+   .. code-block:: none
+
+        kbps (kilobytes per second)
+        mbps (megabytes per second)
+        gbps (gigabytes per second)
+
+
+
+
+.. _classes:
+
+Classes
+=======
+
+In the :ref:`creating_a_traffic_policy` section you will see that
+some of the policies use *classes*. Those policies let you distribute
+traffic into different classes according to different parameters you can
+choose. So, a class is just a specific type of traffic you select.
+
+The ultimate goal of classifying traffic is to give each class a
+different treatment.
+
+
+Matching traffic
+----------------
+
+In order to define which traffic goes into which class, you define
+filters (that is, the matching criteria). Packets go through these matching rules
+(as in the rules of a firewall) and, if a packet matches the filter, it
+is assigned to that class.
+
+In VyOS, a class is identified by a number you can choose when
+configuring it.
+
+
+.. note:: The meaning of the Class ID is not the same for every type of
+   policy. Normally policies just need a meaningless number to identify
+   a class (Class ID), but that does not apply to every policy.
+   The the number of a class in a Priority Queue it does not only
+   identify it, it also defines its priority.
+
+
+.. code-block:: none
+
+  set traffic-policy <policy> <policy-name> class <class-ID> match <class-matching-rule-name>
+
+
+In the command above, we set the type of policy we are going to
+work with and the name we choose for it; a class (so that we can
+differentiate some traffic) and an identifiable number for that class;
+then we configure a matching rule (or filter) and a name for it.
+
+A class can have multiple match filters:
+
+.. code-block:: none
+
+  set traffic-policy shaper MY-SHAPER class 30 match HTTP
+  set traffic-policy shaper MY-SHAPER class 30 match HTTPs
+
+A match filter can contain multiple criteria and will match traffic if
+all those criteria are true.
+
+For example:
+
+.. code-block:: none
+
+  set traffic-policy shaper MY-SHAPER class 30 match HTTP ip protocol tcp
+  set traffic-policy shaper MY-SHAPER class 30 match HTTP ip source port 80
+
+This will match TCP traffic with source port 80.
+
+There are many parameters you will be able to use in order to match the
+traffic you want for a class:
+
+ - **Ethernet (protocol, destination address or source address)**
+ - **Interface name**
+ - **IPv4 (DSCP value, maximum packet length, protocol, source address,**
+   **destination address, source port, destination port or TCP flags)**
+ - **IPv6 (DSCP value, maximum payload length, protocol, source address,**
+   **destination address, source port, destination port or TCP flags)**
+ - **Firewall mark**
+ - **VLAN ID**
+
+When configuring your filter, you can use the ``Tab`` key to see the many
+different parameters you can configure.
+
+
+.. code-block:: none
+
+   vyos@vyos# set traffic-policy shaper MY-SHAPER class 30 match MY-FIRST-FILTER 
+   Possible completions:
+      description  Description for this match
+    > ether        Ethernet header match
+      interface    Interface name for this match
+    > ip           Match IP protocol header
+    > ipv6         Match IPV6 header
+      mark         Match on mark applied by firewall
+      vif          Virtual Local Area Network (VLAN) ID for this match
+ 
+ 
+
+As shown in the example above, one of the possibilities to match packets
+is based on marks done by the firewall, `that can give you a great deal of flexibility`_.
+
+You can also write a description for a filter:
+
+.. code-block:: none
+
+  set traffic-policy shaper MY-SHAPER class 30 match MY-FIRST-FILTER description "My filter description"
+
+
+
+.. note:: An IPv4 TCP filter will only match packets with an IPv4 header length of
+   20 bytes (which is the majority of IPv4 packets anyway).
+
+
+.. note:: IPv6 TCP filters will only match IPv6 packets with no header extension, see
+   https://en.wikipedia.org/wiki/IPv6_packet#Extension_headers
+
+
+Default
+-------
+
+Often you will also have to configure your *default* traffic in the same
+way you do with a class. *Default* can be considered a class as it
+behaves like that. It contains any traffic that did not match any
+of the defined classes, so it is like an open class, a class without
+matching filters.
+
+
+Class treatment
+---------------
+
+Once a class has a filter configured, you will also have to define what
+you want to do with the traffic of that class, what specific
+Traffic-Control treatment you want to give it. You will have different
+possibilities depending on the Traffic Policy you are configuring.
+
+.. code-block:: none
+
+   vyos@vyos# set traffic-policy shaper MY-SHAPER class 30 
+   Possible completions:
+      bandwidth    Bandwidth used for this class
+      burst        Burst size for this class (default: 15kb)
+      ceiling      Bandwidth limit for this class
+      codel-quantum
+                   fq-codel - Number of bytes used as 'deficit' (default 1514)
+      description  Description for this traffic class
+      flows        fq-codel - Number of flows (default 1024)
+      interval     fq-codel - Interval (milliseconds) used to measure the delay (default 100)
+   +> match        Class matching rule name
+      priority     Priority for usage of excess bandwidth
+      queue-limit  Maximum queue size (packets)
+      queue-type   Queue type for this class
+      set-dscp     Change the Differentiated Services (DiffServ) field in the IP header
+      target       fq-codel - Acceptable minimum queue delay (milliseconds)
+   
+
+For instance, with :code:`set traffic-policy shaper MY-SHAPER class 30 set-dscp EF`
+you would be modifying the DSCP field value of packets in that class to
+Expedite Forwarding.
+
+
+  DSCP values as per :rfc:`2474` and :rfc:`4595`:
+
+  +---------+------------+--------+------------------------------+
+  | Binary  | Configured |  Drop  | Description                  |
+  | value   | value      |  rate  |                              |
+  +=========+============+========+==============================+
+  | 101110  |     46     |   -    | Expedited forwarding (EF)    |
+  +---------+------------+--------+------------------------------+
+  | 000000  |     0      |   -    | Best effort traffic, default |
+  +---------+------------+--------+------------------------------+
+  | 001010  |     10     | Low    | Assured Forwarding(AF) 11    |
+  +---------+------------+--------+------------------------------+
+  | 001100  |     12     | Medium | Assured Forwarding(AF) 12    |
+  +---------+------------+--------+------------------------------+
+  | 001110  |     14     | High   | Assured Forwarding(AF) 13    |
+  +---------+------------+--------+------------------------------+
+  | 010010  |     18     | Low    | Assured Forwarding(AF) 21    |
+  +---------+------------+--------+------------------------------+
+  | 010100  |     20     | Medium | Assured Forwarding(AF) 22    |
+  +---------+------------+--------+------------------------------+
+  | 010110  |     22     | High   | Assured Forwarding(AF) 23    |
+  +---------+------------+--------+------------------------------+
+  | 011010  |     26     | Low    | Assured Forwarding(AF) 31    |
+  +---------+------------+--------+------------------------------+
+  | 011100  |     28     | Medium | Assured Forwarding(AF) 32    |
+  +---------+------------+--------+------------------------------+
+  | 011110  |     30     | High   | Assured Forwarding(AF) 33    |
+  +---------+------------+--------+------------------------------+
+  | 100010  |     34     | Low    | Assured Forwarding(AF) 41    |
+  +---------+------------+--------+------------------------------+
+  | 100100  |     36     | Medium | Assured Forwarding(AF) 42    |
+  +---------+------------+--------+------------------------------+
+  | 100110  |     38     | High   | Assured Forwarding(AF) 43    |
+  +---------+------------+--------+------------------------------+
+
+
+
+
+.. _embed:
+
+Embedding one policy into another one
+-------------------------------------
+
+Often we need to embed one policy into another one. It is possible to do
+so on classful policies, by attaching a new policy into a class. For
+instance, you might want to apply different policies to the different
+classes of a Round-Robin policy you have configured.
+
+A common example is the case of some policies which, in order to be
+effective, they need to be applied to an interface that is directly
+connected where the bottleneck is. If your router is not
+directly connected to the bottleneck, but some hop before it, you can
+emulate the bottleneck by embedding your non-shaping policy into a
+classful shaping one so that it takes effect.
+
+You can configure a policy into a class through the ``queue-type``
+setting.
+
+.. code-block:: none
+
+   set traffic-policy shaper FQ-SHAPER bandwidth 4gbit
+   set traffic-policy shaper FQ-SHAPER default bandwidth 100%
+   set traffic-policy shaper FQ-SHAPER default queue-type fq-codel
+
+As shown in the last command of the example above, the `queue-type`
+setting allows these combinations. You will be able to use it
+in many policies.
+
+.. note:: Some policies already include other embedded policies inside.
+   That is the case of Shaper_: each of its classes use fair-queue
+   unless you change it.
+
+.. _creating_a_traffic_policy:
+
+
+Creating a traffic policy
+=========================
+
+VyOS lets you control traffic in many different ways, here we will cover
+every possibility. You can configure as many policies as you want, but
+you will only be able to apply one policy per interface and direction
+(inbound or outbound).
+
+Some policies can be combined, you will be able to embed_ a different
+policy that will be applied to a class of the main policy. 
+
+.. hint:: **If you are looking for a policy for your outbound traffic**
+   but you don't know which one you need and you don't want to go
+   through every possible policy shown here, **our bet is that highly
+   likely you are looking for a** Shaper_ **policy and you want to**
+   :ref:`set its queues <embed>` **as FQ-CoDel**.
+
+Drop Tail
+---------
+
+| **Queueing discipline:** PFIFO (Packet First In First Out).
+| **Applies to:** Outbound traffic.
+
+This the simplest queue possible you can apply to your traffic. Traffic
+must go through a finite queue before it is actually sent. You must
+define how many packets that queue can contain.
+
+When a packet is to be sent, it will have to go through that queue, so
+the packet will be placed at the tail of it. When the packet completely
+goes through it, it will be dequeued emptying its place in the queue and
+being eventually handed to the NIC to be actually sent out.
+
+Despite the Drop-Tail policy does not slow down packets, if many packets
+are to be sent, they could get dropped when trying to get enqueued at
+the tail. This can happen if the queue has still not been able to
+release enough packets from its head.
+
+This is the policy that requieres the lowest resources for the same
+amount of traffic. But **very likely you do not need it as you cannot
+get much from it. Sometimes it is used just to enable logging.**
+
+.. cfgcmd:: set traffic-policy drop-tail <policy-name> queue-limit <number-of-packets>
+
+   Use this command to configure a drop-tail policy (PFIFO). Choose a
+   unique name for this policy and the size of the queue by setting the
+   number of packets it can contain (maximum 4294967295).
+
+
+Fair Queue
+----------
+
+| **Queueing discipline:** SFQ (Stochastic Fairness Queuing).
+| **Applies to:** Outbound traffic.
+
+Fair Queue is a work-conserving scheduler which schedules the
+transmission of packets based on flows, that is, it balances traffic
+distributing it through different sub-queues in order to ensure
+fairness so that each flow is able to send data in turn, preventing any
+single one from drowning out the rest.
+
+
+.. cfgcmd:: set traffic-policy fair-queue <policy-name>
+
+   Use this command to create a Fair-Queue policy and give it a name.
+   It is based on the Stochastic Fairness Queueing and can be applied to
+   outbound traffic.
+
+In order to separate traffic, Fair Queue uses a classifier based on
+source address, destination address and source port. The algorithm
+enqueues packets to hash buckets based on those tree parameters.
+Each of these buckets should represent a unique flow. Because multiple
+flows may get hashed to the same bucket, the hashing algorithm is
+perturbed at configurable intervals so that the unfairness lasts only
+for a short while. Perturbation may however cause some inadvertent
+packet reordering to occur. An advisable value could be 10 seconds.
+
+One of the uses of Fair Queue might be the mitigation of Denial of
+Service attacks.
+
+.. cfgcmd:: set traffic-policy fair-queue <policy-name> hash-interval <seconds>`
+
+   Use this command to define a Fair-Queue policy, based on the
+   Stochastic Fairness Queueing, and set the number of seconds at which
+   a new queue algorithm perturbation will occur (maximum 4294967295).
+
+When dequeuing, each hash-bucket with data is queried in a round robin
+fashion. You can configure the length of the queue.
+
+.. cfgcmd:: set traffic-policy fair-queue <policy-name> queue-limit <limit>
+
+   Use this command to define a Fair-Queue policy, based on the
+   Stochastic Fairness Queueing, and set the number of maximum packets
+   allowed to wait in the queue. Any other packet will be dropped.
+
+.. note:: Fair Queue is a non-shaping (work-conserving) policy, so it
+   will only be useful if your outgoing interface is really full. If it
+   is not, VyOS will not own the queue and Fair Queue will have no
+   effect. If there is bandwidth available on the physical link, you can
+   embed_ Fair-Queue into a classful shaping policy to make sure it owns
+   the queue.
+
+
+
+.. _FQ-CoDel:
+
+FQ-CoDel
+--------
+
+| **Queueing discipline** Fair/Flow Queue CoDel.
+| **Applies to:** Outbound Traffic.
+
+The FQ-CoDel policy distributes the traffic into 1024 FIFO queues and
+tries to provide good service between all of them. It also tries to keep
+the length of all the queues short.
+
+FQ-CoDel fights bufferbloat and reduces latency without the need of
+complex configurations. It has become the new default Queueing
+Discipline for the interfaces of some GNU/Linux distributions.
+
+It uses a stochastic model to classify incoming packets into
+different flows and is used to provide a fair share of the bandwidth to
+all the flows using the queue. Each flow is managed by the CoDel
+queuing  discipline. Reordering within a flow is avoided since Codel
+internally uses a FIFO queue.
+
+FQ-CoDel is based on a modified Deficit Round Robin (DRR_) queue
+scheduler with the CoDel Active Queue Management (AQM) algorithm
+operating on each queue.
+
+
+.. note:: FQ-Codel is a non-shaping (work-conserving) policy, so it
+   will only be useful if your outgoing interface is really full. If it
+   is not, VyOS will not own the queue and FQ-Codel will have no
+   effect. If there is bandwidth available on the physical link, you can
+   embed_ FQ-Codel into a classful shaping policy to make sure it owns
+   the queue. If you are not sure if you need to embed your FQ-CoDel
+   policy into a Shaper, do it.
+
+
+FQ-CoDel is tuned to run ok with its default parameters at 10Gbit
+speeds. It might work ok too at other speeds without configuring
+anything, but here we will explain some cases when you might want to
+tune its parameters.
+
+When running it at 1Gbit and lower, you may want to reduce the
+`queue-limit` to 1000 packets or less. In rates like 10Mbit, you may
+want to set it to 600 packets.
+
+If you are using FQ-CoDel embedded into Shaper_ and you have large rates
+(100Mbit and above), you may consider increasing `quantum` to 8000 or
+higher so that the scheduler saves CPU.
+
+On low rates (below 40Mbit) you may want to tune `quantum` down to
+something like 300 bytes.
+
+At very low rates (below 3Mbit), besides tuning `quantum` (300 keeps
+being ok) you may also want to increase `target` to something like 15ms
+and increase `interval` to something around 150 ms.
+
+
+.. cfgcmd:: set traffic-policy fq-codel <policy name> codel-quantum <bytes>
+
+   Use this command to configure an fq-codel policy, set its name and
+   the maximum number of bytes (default: 1514) to be dequeued from a
+   queue at once.
+
+.. cfgcmd:: set traffic-policy fq-codel <policy name> flows <number-of-flows>
+
+   Use this command to configure an fq-codel policy, set its name and
+   the number of sub-queues (default: 1024) into which packets are
+   classified.
+
+.. cfgcmd:: set traffic-policy fq-codel <policy name> interval <miliseconds>
+
+   Use this command to configure an fq-codel policy, set its name and
+   the time period used by the control loop of CoDel to detect when a
+   persistent queue is developing, ensuring that the measured minimum
+   delay does not become too stale (default: 100ms).
+
+.. cfgcmd:: set traffic-policy fq-codel <policy-name> queue-limit <number-of-packets>`
+
+   Use this command to configure an fq-codel policy, set its name, and
+   define a hard limit on the real queue size. When this limit is
+   reached, new packets are dropped (default: 10240 packets).
+
+.. cfgcmd:: set traffic-policy fq-codel <policy-name> target <miliseconds>`
+
+   Use this command to configure an fq-codel policy, set its name, and
+   define the acceptable minimum standing/persistent queue delay. This
+   minimum delay is identified by tracking the local minimum queue delay
+   that packets experience (default: 5ms).
+
+
+Example
+^^^^^^^
+
+A simple example of an FQ-CoDel policy working inside a Shaper one.
+
+
+.. code-block:: none
+
+   set traffic-policy shaper FQ-CODEL-SHAPER bandwidth 2gbit
+   set traffic-policy shaper FQ-CODEL-SHAPER default bandwidth 100%
+   set traffic-policy shaper FQ-CODEL-SHAPER default queue-type fq-codel
+
+
+
+Limiter
+-------
+
+| **Queueing discipline:** Ingress policer.
+| **Applies to:** Inbound traffic.
+
+Limiter is one of those policies that uses classes_ (Ingress qdisc is
+actually a classless policy but filters do work in it).
+
+The limiter performs basic ingress policing of traffic flows. Multiple
+classes of traffic can be defined and traffic limits can be applied to
+each class. Although the policer uses a token bucket mechanism
+internally, it does not have the capability to delay a packet as a
+shaping mechanism does. Traffic exceeding the defined bandwidth limits
+is directly dropped. A maximum allowed burst can be configured too.
+
+You can configure classes (up to 4090) with different settings and a
+default policy which will be applied to any traffic not matching any of
+the configured classes.
+
+
+.. note:: In the case you want to apply some kind of **shaping** to your
+  **inbound** traffic, check the ingress-shaping_ section.
+
+
+.. cfgcmd:: set traffic-policy limiter <policy-name> class <class ID> match <match-name> description <description>
+
+   Use this command to configure an Ingress Policer, defining its name,
+   a class identifier (1-4090), a class matching rule name and its
+   description.
+
+
+Once the matching rules are set for a class, you can start configuring
+how you want matching traffic to behave.
+
+
+.. cfgcmd:: set traffic-policy limiter <policy-name> class <class-ID> bandwidth <rate>
+
+   Use this command to configure an Ingress Policer, defining its name,
+   a class identifier (1-4090) and the maximum allowed bandwidth for
+   this class.
+
+
+.. cfgcmd:: set traffic-policy limiter <policy-name> class <class-ID> burst <burst-size>
+
+   Use this command to configure an Ingress Policer, defining its name,
+   a class identifier (1-4090) and the burst size in bytes for this
+   class (default: 15).
+
+
+.. cfgcmd:: set traffic-policy limiter <policy-name> default bandwidth <rate>
+
+   Use this command to configure an Ingress Policer, defining its name
+   and the maximum allowed bandwidth for its default policy.
+
+
+.. cfgcmd:: set traffic-policy limiter <policy-name> default burst <burst-size>
+
+   Use this command to configure an Ingress Policer, defining its name
+   and the burst size in bytes (default: 15) for its default policy.
+
+
+.. cfgcmd:: set traffic-policy limiter <policy-name> class <class ID> priority <value>
+
+   Use this command to configure an Ingress Policer, defining its name,
+   a class identifier (1-4090), and the priority (0-20, default 20) in
+   which the rule is evaluated (the lower the number, the higher the
+   priority).
+
+ 
+
+Network Emulator
+----------------
+
+| **Queueing discipline:** netem (Network Emulator) + TBF (Token Bucket Filter).
+| **Applies to:** Outbound traffic.
+
+VyOS Network Emulator policy emulates the conditions you can suffer in a
+real network. You will be able to configure things like rate, burst,
+delay, packet loss, packet corruption or packet reordering.
+
+This could be helpful if you want to test how an application behaves
+under certain network conditions.
+
+
+.. cfgcmd:: set traffic-policy network-emulator <policy-name> bandwidth <rate>
+   
+   Use this command to configure the maximum rate at which traffic will
+   be shaped in a Network Emulator policy. Define the name of the policy
+   and the rate.
+
+.. cfgcmd:: set traffic-policy network-emulator <policy-name> burst <burst-size>
+   
+   Use this command to configure the burst size of the traffic in a
+   Network Emulator policy. Define the name of the Network Emulator
+   policy and its traffic burst size (it will be configured through the
+   Token Bucket Filter qdisc). Default:15kb. It will only take effect if
+   you have configured its bandwidth too.
+
+.. cfgcmd:: set traffic-policy network-emulator <policy-name> network-delay <delay>
+   
+   Use this command to configure a Network Emulator policy defining its
+   name and the fixed amount of time you want to add to all packet going
+   out of the interface. The latency will be added through the
+   Token Bucket Filter qdisc. It will only take effect if you have
+   configured its bandwidth too. You can use secs, ms and us. Default:
+   50ms.
+
+.. cfgcmd:: set traffic-policy network-emulator <policy-name> packet-corruption <percent>
+   
+   Use this command to emulate noise in a Network Emulator policy. Set
+   the policy name and the percentage of corrupted packets you want. A
+   random error will be introduced in a random position for the chosen
+   percent of packets.
+
+.. cfgcmd:: set traffic-policy network-emulator <policy-name> packet-loss <percent>`
+   
+   Use this command to emulate packet-loss conditions in a Network
+   Emulator policy. Set the policy name and the percentage of loss
+   packets your traffic will suffer.
+
+.. cfgcmd:: set traffic-policy network-emulator <policy-name> packet-reordering <percent>`
+   
+   Use this command to emulate packet-reordering conditions in a Network
+   Emulator policy. Set the policy name and the percentage of reordered
+   packets your traffic will suffer.
+
+.. cfgcmd:: set traffic-policy network-emulator <policy-name> queue-limit <limit>
+   
+   Use this command to define the length of the queue of your Network
+   Emulator policy. Set the policy name and the maximum number of
+   packets (1-4294967295) the queue may hold queued at a time.
+
+
+
+Priority Queue
+--------------
+
+| **Queueing discipline:** PRIO.
+| **Applies to:** Outbound traffic.
+
+
+The Priority Queue is a classful scheduling policy. It does not delay
+packets (Priority Queue is not a shaping policy), it simply dequeues
+packets according to their priority.
+
+.. note:: Priority Queue, as other non-shaping policies, is only useful
+   if your outgoing interface is really full. If it is not, VyOS will
+   not own the queue and Priority Queue will have no effect. If there is
+   bandwidth available on the physical link, you can embed_ Priority
+   Queue into a classful shaping policy to make sure it owns the queue.
+   In that case packets can be prioritized based on DSCP.
+
+Up to seven queues -defined as classes_ with different priorities- can
+be configured. Packets are placed into queues based on associated match
+criteria. Packets are transmitted from the queues in priority order. If
+classes with a higher priority are being filled with packets
+continuously, packets from lower priority classes will only be
+transmitted after traffic volume from higher priority classes decreases.
+
+
+.. note:: In Priority Queue we do not define clases with a meaningless
+   class ID number but with a class priority number (1-7). The lower the
+   number, the higher the priority.
+
+
+As with other policies, you can define different type of matching rules
+for your classes:
+
+.. code-block:: none
+
+   vyos@vyos# set traffic-policy priority-queue MY-PRIO class 3 match MY-MATCH-RULE 
+   Possible completions:
+      description  Description for this match
+    > ether        Ethernet header match
+      interface    Interface name for this match
+    > ip           Match IP protocol header
+    > ipv6         Match IPV6 header
+      mark         Match on mark applied by firewall
+      vif          Virtual Local Area Network (VLAN) ID for this match
+
+
+As with other policies, you can embed_ other policies into the classes 
+(and default) of your Priority Queue policy through the ``queue-type``
+setting:
+
+.. code-block:: none
+
+   vyos@vyos# set traffic-policy priority-queue MY-PRIO class 3 queue-type 
+   Possible completions:
+      fq-codel     Fair Queue Codel
+      fair-queue   Stochastic Fair Queue (SFQ)
+      drop-tail    First-In-First-Out (FIFO)
+      priority     Priority queueing based on DSCP
+      random-detect
+                   Random Early Detection (RED)
+
+
+.. cfgcmd:: set traffic-policy priority-queue <policy-name> class <class-ID>  queue-limit <limit>`
+
+   Use this command to configure a Priority Queue policy, set its name,
+   set a class with a priority from 1 to 7 and define a hard limit on
+   the real queue size. When this limit is reached, new packets are
+   dropped.
+
+
+
+.. _Random-Detect:
+
+Random-Detect
+-------------
+
+
+| **Queueing discipline:** Generalized Random Early Drop.
+| **Applies to:** Outbound traffic.
+
+A simple Random Early Detection (RED) policy would start randomly
+dropping packets from a queue before it reaches its queue limit thus
+avoiding congestion. That is good for TCP connections as the gradual
+dropping of packets acts as a signal for the sender to decrease its
+transmission rate.
+
+In contrast to simple RED, VyOS' Random-Detect uses a Generalized Random
+Early Detect policy that provides different virtual queues based on the
+IP Precedence value so that some virtual queues can drop more packets
+than others. 
+
+This is achieved by using the first three bits of the ToS (Type of
+Service) field to categorize data streams and, in accordance with the
+defined precedence parameters, a decision is made.
+
+IP precedence as defined in :rfc:`791`:
+
+ +------------+----------------------+
+ | Precedence |      Priority        |
+ +============+======================+
+ |      7     | Network Control      |
+ +------------+----------------------+
+ |      6     | Internetwork Control |
+ +------------+----------------------+
+ |      5     | CRITIC/ECP           |
+ +------------+----------------------+
+ |      4     | Flash Override       |
+ +------------+----------------------+
+ |      3     | Flash                |
+ +------------+----------------------+
+ |      2     | Immediate            |
+ +------------+----------------------+
+ |      1     | Priority             |
+ +------------+----------------------+
+ |      0     | Routine              |
+ +------------+----------------------+
+
+
+Random-Detect could be useful for heavy traffic. One use of this
+algorithm might be to prevent a backbone overload. But only for TCP
+(because dropped packets could be retransmitted), not for UDP.
+
+
+.. cfgcmd:: set traffic-policy random-detect <policy-name> bandwidth <bandwidth>
+
+   Use this command to configure a Random-Detect policy, set its name
+   and set the available bandwidth for this policy. It is used for
+   calculating the average queue size after some idle time. It should be
+   set to the bandwidth of your interface. Random Detect is not a
+   shaping policy, this command will not shape.
+
+.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> average-packet <bytes>
+   
+   Use this command to configure a Random-Detect policy and set its
+   name, then state the IP Precedence for the virtual queue you are
+   configuring and what the size of its average-packet should be
+   (in bytes, default: 1024).
+
+.. note:: When configuring a Random-Detect policy: **the higher the
+   precedence number, the higher the priority**.
+
+.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> mark-probability <value>
+   
+   Use this command to configure a Random-Detect policy and set its
+   name, then state the IP Precedence for the virtual queue you are
+   configuring and what its mark (drop) probability will be. Set the
+   probability by giving the N value of the fraction 1/N (default: 10).
+
+
+.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> maximum-threshold <packets>
+   
+   Use this command to configure a Random-Detect policy and set its
+   name, then state the IP Precedence for the virtual queue you are
+   configuring and what its maximum threshold for random detection will
+   be (from 0 to 4096 packets, default: 18). At this size, the marking
+   (drop) probability is maximal.
+
+.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> minimum-threshold <packets>
+   
+   Use this command to configure a Random-Detect policy and set its
+   name, then state the IP Precedence for the virtual queue you are
+   configuring and what its minimum threshold for random detection will
+   be (from 0 to 4096 packets).  If this value is exceeded, packets
+   start being eligible for being dropped.
+
+
+The default values for the minimum-threshold depend on IP precedence:
+
+ +------------+-----------------------+
+ | Precedence | default min-threshold |
+ +============+=======================+
+ |      7     |         16            |
+ +------------+-----------------------+
+ |      6     |         15            |
+ +------------+-----------------------+
+ |      5     |         14            |
+ +------------+-----------------------+
+ |      4     |         13            |
+ +------------+-----------------------+
+ |      3     |         12            |
+ +------------+-----------------------+
+ |      2     |         11            |
+ +------------+-----------------------+
+ |      1     |         10            |
+ +------------+-----------------------+
+ |      0     |          9            |
+ +------------+-----------------------+
+
+
+.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> queue-limit <packets>
+   
+   Use this command to configure a Random-Detect policy and set its
+   name, then name the IP Precedence for the virtual queue you are
+   configuring and what the maximum size of its queue will be (from 1 to
+   1-4294967295 packets). Packets are dropped when the current queue
+   length reaches this value.
+
+
+If the average queue size is lower than the **min-threshold**, an
+arriving packet will be placed in the queue.
+
+In the case the average queue size is between **min-threshold** and
+**max-threshold**, then an arriving packet would be either dropped or
+placed in the queue, it will depend on the defined **mark-probability**.
+
+If the current queue size is larger than **queue-limit**,
+then packets will be dropped. The average queue size depends on its
+former average size and its current one.
+
+If **max-threshold** is set but **min-threshold is not, then
+**min-threshold** is scaled to 50% of **max-threshold**.
+
+In principle, values must be
+:code:`min-threshold` < :code:`max-threshold` < :code:`queue-limit`.
+
+
+
+
+Rate Control
+------------
+
+| **Queueing discipline:** Tocken Bucket Filter.
+| **Applies to:** Outbound traffic.
+
+Rate-Control is a classless policy that limits the packet flow to a set
+rate. It is a pure shaper, it does not schedule traffic. Traffic is
+filtered based on the expenditure of tokens. Tokens roughly correspond
+to bytes.
+
+Short bursts can be allowed to exceed the limit. On creation, the
+Rate-Control traffic is stocked with tokens which correspond to the
+amount of traffic that can be burst in one go. Tokens arrive at a steady
+rate, until the bucket is full.
+
+.. cfgcmd:: set traffic-policy rate-control <policy-name> bandwidth <rate>
+
+   Use this command to configure a Rate-Control policy, set its name
+   and the rate limit you want to have.
+
+.. cfgcmd:: set traffic-policy rate-control <policy-name> burst <burst-size>
+
+   Use this command to configure a Rate-Control policy, set its name
+   and the size of the bucket in bytes which will be available for
+   burst.
+
+
+As a reference: for 10mbit/s on Intel, you might need at least 10kbyte
+buffer if you want to reach your configured rate.
+
+A very small buffer will soon start dropping packets.
+
+.. cfgcmd:: set traffic-policy rate-control <policy-name> latency 
+
+   Use this command to configure a Rate-Control policy, set its name
+   and the maximum amount of time a packet can be queued (default: 50
+   ms).
+
+
+Rate-Control is a CPU-friendly policy. You might consider using it when
+you just simply want to slow traffic down.
+
+.. _DRR:
+
+Round Robin
+-----------
+
+| **Queueing discipline:** Deficit Round Robin.
+| **Applies to:** Outbound traffic.
+
+The round-robin policy is a classful scheduler that divides traffic in
+different classes_ you can configure (up to 4096). You can embed_ a
+new policy into each of those classes (default included).
+ 
+Each class is assigned a deficit counter (the number of bytes that a
+flow is allowed to transmit when it is its turn) initialized to quantum.
+Quantum is a parameter you configure which acts like a credit of fix
+bytes the counter receives on each round. Then the Round-Robin policy
+starts moving its Round Robin pointer through the queues. If the deficit
+counter is greater than the packet's size at the head of the queue, this
+packet will be sent and the value of the counter will be decremented by
+the packet size. Then, the size of the next packet will be compared to
+the counter value again, repeating the process. Once the queue is empty
+or the value of the counter is insufficient, the Round-Robin pointer
+will move to the next queue. If the queue is empty, the value of the
+deficit counter is reset to 0. 
+
+At every round, the deficit counter adds the quantum so that even large
+packets will have their opportunity to be dequeued.
+
+
+.. cfgcmd:: set traffic-policy round-robin <policy name> class
+   <class-ID> quantum <packets>
+
+   Use this command to configure a Round-Robin policy, set its name, set
+   a class ID, and the quantum for that class. The deficit counter will
+   add that value each round.
+
+.. cfgcmd:: set traffic-policy round-robin <policy name> class
+   <class ID> queue-limit <packets>
+
+   Use this command to configure a Round-Robin policy, set its name, set
+   a class ID, and the queue size in packets.
+
+As with other policies, Round-Robin can embed_ another policy into a
+class through the ``queue-type`` setting.
+
+.. code-block:: none
+
+   vyos@vyos# set traffic-policy round-robin DRR class 10 queue-type 
+   Possible completions:
+      fq-codel     Fair Queue Codel
+      fair-queue   Stochastic Fair Queue (SFQ)
+      drop-tail    First-In-First-Out (FIFO)
+      priority     Priority queueing based on DSCP
+            
+
+
+
+.. _Shaper:
+
+Shaper
+------
+
+| **Queueing discipline:** Hierarchical Token Bucket.
+| **Applies to:** Outbound traffic.
+
+
+The Shaper policy does not guarantee a low delay, but it does guarantee
+bandwidth to different traffic classes and also lets you decide how to
+allocate more traffic once the guarantees are met.
+
+Each class can have a guaranteed part of the total bandwidth defined for
+the whole policy, so all those shares together should not be higher
+than the policy's whole bandwidth.
+
+If guaranteed traffic for a class is met and there is room for more
+traffic, the ceiling parameter can be used to set how much more
+bandwidth could be used. If guaranteed traffic is met and there are
+several classes willing to use their ceilings, the priority parameter
+will establish the order in which that additional traffic will be
+allocated. Priority can be any number from 0 to 7. The lower the number,
+the higher the priority.
+
+
+.. cfgcmd:: set traffic-policy shaper <policy-name> bandwidth <rate>
+
+   Use this command to configure a Shaper policy, set its name
+   and the maximum bandwidth for all combined traffic.
+
+
+.. cfgcmd:: set traffic-policy shaper <policy-name> class <class-ID> bandwidth <rate>
+
+   Use this command to configure a Shaper policy, set its name, define
+   a class and set the guaranteed traffic you want to allocate to that
+   class.
+
+.. cfgcmd:: set traffic-policy shaper <policy-name> class <class-ID> burst <bytes>
+
+   Use this command to configure a Shaper policy, set its name, define
+   a class and set the size of the `tocken bucket`_ in bytes, which will
+   be available to be sent at ceiling speed (default: 15Kb).
+
+.. cfgcmd:: set traffic-policy shaper <policy-name> class <class-ID> ceiling <bandwidth>
+
+   Use this command to configure a Shaper policy, set its name, define
+   a class and set the maximum speed possible for this class. The
+   default ceiling value is the bandwidth value.
+
+.. cfgcmd:: set traffic-policy shaper <policy-name> class <class-ID> priority <0-7>
+
+   Use this command to configure a Shaper policy, set its name, define
+   a class and set the priority for usage of available bandwidth once
+   guarantees have been met. The lower the priority number, the higher
+   the priority. The default priority value is 0, the highest priority.
+
+
+As with other policies, Shaper can embed_ other policies into its
+classes through the ``queue-type`` setting and then configure their
+parameters.
+
+
+.. code-block:: none
+
+   vyos@vyos# set traffic-policy shaper HTB class 10 queue-type 
+   Possible completions:
+      fq-codel     Fair Queue Codel
+      fair-queue   Stochastic Fair Queue (SFQ)
+      drop-tail    First-In-First-Out (FIFO)
+      priority     Priority queueing based on DSCP
+      random-detect
+                   Random Early Detection (RED)
+
+
+.. code-block:: none
+
+   vyos@vyos# set traffic-policy shaper HTB class 10 
+   Possible completions:
+      bandwidth    Bandwidth used for this class
+      burst        Burst size for this class (default: 15kb)
+      ceiling      Bandwidth limit for this class
+      codel-quantum
+                   fq-codel - Number of bytes used as 'deficit' (default 1514)
+      description  Description for this traffic class
+      flows        fq-codel - Number of flows (default 1024)
+      interval     fq-codel - Interval (milliseconds) used to measure the delay (default 100)
+   +> match        Class matching rule name
+      priority     Priority for usage of excess bandwidth
+      queue-limit  Maximum queue size (packets)
+      queue-type   Queue type for this class
+      set-dscp     Change the Differentiated Services (DiffServ) field in the IP header
+      target       fq-codel - Acceptable minimum queue delay (milliseconds)
+
+
+
+.. note:: If you configure a class for **VoIP traffic**, don't give it any
+   *ceiling*, otherwise new VoIP calls could start when the link is
+   available and get suddenly dropped when other classes start using
+   their assigned *bandwidth* share.
+
+
+Example
+^^^^^^^
+
+A simple example of Shaper using priorities.
+
+
+.. code-block:: none
+
+   set traffic-policy shaper MY-HTB bandwidth '50mbit'
+   set traffic-policy shaper MY-HTB class 10 bandwidth '20%'
+   set traffic-policy shaper MY-HTB class 10 match DSCP ip dscp 'EF'
+   set traffic-policy shaper MY-HTB class 10 queue-type 'fq-codel'
+   set traffic-policy shaper MY-HTB class 20 bandwidth '10%'
+   set traffic-policy shaper MY-HTB class 20 ceiling '50%'
+   set traffic-policy shaper MY-HTB class 20 match PORT666 ip destination port '666'
+   set traffic-policy shaper MY-HTB class 20 priority '3'
+   set traffic-policy shaper MY-HTB class 20 queue-type 'fair-queue'
+   set traffic-policy shaper MY-HTB class 30 bandwidth '10%'
+   set traffic-policy shaper MY-HTB class 30 ceiling '50%'
+   set traffic-policy shaper MY-HTB class 30 match ADDRESS30 ip source address '192.168.30.0/24'
+   set traffic-policy shaper MY-HTB class 30 priority '5'
+   set traffic-policy shaper MY-HTB class 30 queue-type 'fair-queue'
+   set traffic-policy shaper MY-HTB default bandwidth '10%'
+   set traffic-policy shaper MY-HTB default ceiling '100%'
+   set traffic-policy shaper MY-HTB default priority '7'
+   set traffic-policy shaper MY-HTB default queue-type 'fair-queue'
+
+
+Applying a traffic policy
+=========================
+
+Once a traffic-policy is created, you can apply it to an interface:
+
+.. code-block:: none
+
+  set interfaces etherhet eth0 traffic-policy out WAN-OUT
+
+You can only apply one policy per interface and direction, but you could
+reuse a policy on different interfaces and directions:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 traffic-policy in WAN-IN
+  set interfaces etherhet eth0 traffic-policy out WAN-OUT
+  set interfaces etherhet eth1 traffic-policy in LAN-IN
+  set interfaces etherhet eth1 traffic-policy out LAN-OUT
+  set interfaces ethernet eth2 traffic-policy in LAN-IN
+  set interfaces ethernet eth2 traffic-policy out LAN-OUT
+  set interfaces etherhet eth3 traffic-policy in TWO-WAY-POLICY
+  set interfaces etherhet eth3 traffic-policy out TWO-WAY-POLICY
+  set interfaces etherhet eth4 traffic-policy in TWO-WAY-POLICY
+  set interfaces etherhet eth4 traffic-policy out TWO-WAY-POLICY
+
+Getting queueing information
+----------------------------
+
+.. opcmd:: show queueing <interface-type> <interface-name>
+
+   Use this command to see the queueing information for an interface.
+   You will be able to see a packet counter (Sent, Dropped, Overlimit
+   and Backlog) per policy and class configured.
+
+
+
+.. _ingress-shaping:
+
+The case of ingress shaping
+===========================
+
+| **Applies to:** Inbound traffic.
+
+For the ingress traffic of an interface, there is only one policy you
+can directly apply, a **Limiter** policy. You cannot apply a shaping
+policy directly to the ingress traffic of any interface because shaping
+only works for outbound traffic.
+
+This workaround lets you apply a shaping policy to the ingress traffic
+by first redirecting it to an in-between virtual interface
+(`Intermediate Functional Block`_). There, in that virtual interface,
+you will be able to apply any of the policies that work for outbound
+traffic, for instance, a shaping one.
+
+That is how it is possible to do the so-called "ingress shaping".
+
+
+.. code-block:: none
+
+   set traffic-policy shaper MY-INGRESS-SHAPING bandwidth 1000kbit
+   set traffic-policy shaper MY-INGRESS-SHAPING default bandwidth 1000kbit
+   set traffic-policy shaper MY-INGRESS-SHAPING default queue-type fair-queue
+   
+   set interfaces input ifb0 traffic-policy out MY-INGRESS-SHAPING
+   set interfaces ethernet eth0 redirect ifb0
+
+.. warning::
+
+  Do not configure IFB as the first step. First create everything else
+  of your traffic-policy, and then you can configure IFB.
+  Otherwise you might get the ``RTNETLINK answer: File exists`` error,
+  which can be solved with ``sudo ip link delete ifb0``.
+
+
+.. _that can give you a great deal of flexibility: https://blog.vyos.io/using-the-policy-route-and-packet-marking-for-custom-qos-matches
+.. _tc: https://en.wikipedia.org/wiki/Tc_(Linux)
+.. _tocken bucket: https://en.wikipedia.org/wiki/Token_bucket
+.. _HFSC: https://en.wikipedia.org/wiki/Hierarchical_fair-service_curve
+.. _Intermediate Functional Block: https://www.linuxfoundation.org/collaborate/workgroups/networking/ifb
diff --git a/docs/configuration/vpn/dmvpn.rst b/docs/configuration/vpn/dmvpn.rst
new file mode 100644
index 00000000..e6487292
--- /dev/null
+++ b/docs/configuration/vpn/dmvpn.rst
@@ -0,0 +1,420 @@
+.. _vpn-dmvpn:
+
+DMVPN
+-----
+
+**D** ynamic **M** ultipoint **V** irtual **P** rivate **N** etworking
+
+DMVPN is a dynamic VPN technology originally developed by Cisco. While their
+implementation was somewhat proprietary, the underlying technologies are
+actually standards based. The three technologies are:
+
+* **NHRP** - NBMA Next Hop Resolution Protocol RFC2332_
+* **mGRE** - Multipoint Generic Routing Encapsulation / mGRE RFC1702_
+* **IPSec** - IP Security (too many RFCs to list, but start with RFC4301_)
+
+NHRP provides the dynamic tunnel endpoint discovery mechanism (endpoint
+registration, and endpoint discovery/lookup), mGRE provides the tunnel
+encapsulation itself, and the IPSec protocols handle the key exchange, and
+crypto mechanism.
+
+In short, DMVPN provides the capability for creating a dynamic-mesh VPN
+network without having to pre-configure (static) all possible tunnel end-point
+peers.
+
+.. note:: DMVPN only automates the tunnel endpoint discovery and setup. A
+   complete solution also incorporates the use of a routing protocol. BGP is
+   particularly well suited for use with DMVPN.
+
+Baseline Configuration:
+
+**STEPS:**
+
+#. Create tunnel config (`interfaces tunnel`)
+#. Create nhrp (`protocols nhrp`)
+#. Create ipsec vpn (optional, but recommended for security) (`vpn ipsec`)
+
+The tunnel will be set to mGRE if for encapsulation `gre` is set, and no
+`remote-ip` is set. If the public ip is provided by DHCP the tunnel `local-ip`
+can be set to "0.0.0.0". If you do set the `remote-ip` directive at any point, the interface will need to be `delete`'d from the config and recreated without the `remote-ip` config ever being set.
+
+.. figure:: /_static/images/vpn_dmvpn_topology01.png
+   :scale: 40 %
+   :alt: Baseline DMVPN topology
+
+   Baseline DMVPN topology
+
+HUB Configuration
+^^^^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  interfaces
+      tunnel <tunN> {
+          address <ipv4>
+          encapsulation gre
+          local-ip <public ip>
+          multicast enable
+          description <txt>
+          parameters {
+              ip {
+                  <usual IP options>
+              }
+          }
+      }
+  }
+  protocols {
+      nhrp {
+          tunnel <tunN> {
+              cisco-authentication <key phrase>
+              holding-time <seconds>
+              multicast dynamic
+              redirect
+          }
+      }
+  }
+  vpn {
+      ipsec {
+          esp-group <text> {
+              lifetime <30-86400>
+              mode tunnel
+              pfs enable
+              proposal <1-65535> {
+                  encryption aes256
+                  hash sha1
+              }
+              proposal <1-65535> {
+                  encryption 3des
+                  hash md5
+              }
+          }
+          ike-group <text> {
+              key-exchange ikev1
+              lifetime <30-86400>
+              proposal <1-65535> {
+                  encryption aes256
+                  hash sha1
+              }
+              proposal <1-65535> {
+                  encryption aes128
+                  hash sha1
+              }
+          }
+          ipsec-interfaces {
+              interface <ethN>
+          }
+          profile <text> {
+              authentication {
+                  mode pre-shared-secret
+                  pre-shared-secret <key phrase>
+              }
+              bind {
+                  tunnel <tunN>
+              }
+              esp-group <text>
+              ike-group <text>
+          }
+      }
+  }
+
+HUB Example Configuration:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address '198.51.100.41/30'
+  set interfaces ethernet eth1 address '192.168.1.1/24'
+  set system host-name 'HUB'
+
+  set interfaces tunnel tun0 address 10.0.0.1/24
+  set interfaces tunnel tun0 encapsulation gre
+  set interfaces tunnel tun0 local-ip 198.51.100.41
+  set interfaces tunnel tun0 multicast enable
+  set interfaces tunnel tun0 parameters ip key 1
+
+  set protocols nhrp tunnel tun0 cisco-authentication SECRET
+  set protocols nhrp tunnel tun0 holding-time  300
+  set protocols nhrp tunnel tun0 multicast dynamic
+  set protocols nhrp tunnel tun0 redirect
+
+  set vpn ipsec ipsec-interfaces interface eth0
+  set vpn ipsec ike-group IKE-HUB proposal 1
+  set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256
+  set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1
+  set vpn ipsec ike-group IKE-HUB proposal 2 encryption aes128
+  set vpn ipsec ike-group IKE-HUB proposal 2 hash sha1
+  set vpn ipsec ike-group IKE-HUB lifetime 3600
+  set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256
+  set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1
+  set vpn ipsec esp-group ESP-HUB proposal 2 encryption 3des
+  set vpn ipsec esp-group ESP-HUB proposal 2 hash md5
+  set vpn ipsec esp-group ESP-HUB lifetime 1800
+  set vpn ipsec esp-group ESP-HUB pfs dh-group2
+
+  set vpn ipsec profile NHRPVPN
+  set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
+  set vpn ipsec profile NHRPVPN authentication pre-shared-secret SECRET
+  set vpn ipsec profile NHRPVPN bind tunnel tun0
+  set vpn ipsec profile NHRPVPN esp-group ESP-HUB
+  set vpn ipsec profile NHRPVPN ike-group IKE-HUB
+
+  set protocols static route 0.0.0.0/0 next-hop 1.1.1.2
+  set protocols static route 192.168.2.0/24 next-hop 10.0.0.2
+  set protocols static route 192.168.3.0/24 next-hop 10.0.0.3
+  
+HUB on AWS Configuration Specifics
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Setting this up on AWS will require a "Custom Protocol Rule" for protocol number "47" (GRE) Allow Rule in TWO places. Firstly on the VPC Network ACL, and secondly on the security group network ACL attached to the EC2 instance. This has been tested as working for the offical AMI image on the AWS Marketplace. (Locate the correct VPC and security group by navigating through the details pane below your EC2 instance in the AWS console)
+
+SPOKE Configuration
+^^^^^^^^^^^^^^^^^^^
+
+SPOKE1 Configuration:
+
+.. code-block:: none
+
+  interfaces
+      tunnel <tunN> {
+          address <ipv4>
+          encapsulation gre
+          local-ip <public ip>
+          multicast enable
+          description <txt>
+          parameters {
+              ip {
+                  <usual IP options>
+              }
+          }
+      }
+  }
+  protocols {
+      nhrp {
+          tunnel <tunN> {
+              cisco-authentication <key phrase>
+              map <ipv4/net> {
+                  nbma-address <ipv4>
+                  register
+              }
+              holding-time <seconds>
+              multicast nhs
+              redirect
+              shortcut
+          }
+      }
+  }
+  vpn {
+      ipsec {
+          esp-group <text> {
+              lifetime <30-86400>
+              mode tunnel
+              pfs enable
+              proposal <1-65535> {
+                  encryption aes256
+                  hash sha1
+              }
+              proposal <1-65535> {
+                  encryption 3des
+                  hash md5
+              }
+          }
+          ike-group <text> {
+              key-exchange ikev1
+              lifetime <30-86400>
+              proposal <1-65535> {
+                  encryption aes256
+                  hash sha1
+              }
+              proposal <1-65535> {
+                  encryption aes128
+                  hash sha1
+              }
+          }
+          ipsec-interfaces {
+              interface <ethN>
+          }
+          profile <text> {
+              authentication {
+                  mode pre-shared-secret
+                  pre-shared-secret <key phrase>
+              }
+              bind {
+                  tunnel <tunN>
+              }
+              esp-group <text>
+              ike-group <text>
+          }
+      }
+  }
+
+SPOKE1 Example Configuration
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address 'dhcp'
+  set interfaces ethernet eth1 address '192.168.2.1/24'
+  set system host-name 'SPOKE1'
+
+  set interfaces tunnel tun0 address 10.0.0.2/24
+  set interfaces tunnel tun0 encapsulation gre
+  set interfaces tunnel tun0 local-ip 0.0.0.0
+  set interfaces tunnel tun0 multicast enable
+  set interfaces tunnel tun0 parameters ip key 1
+
+  set protocols nhrp tunnel tun0 cisco-authentication 'SECRET'
+  set protocols nhrp tunnel tun0 map 10.0.0.1/24 nbma-address 198.51.100.41
+  set protocols nhrp tunnel tun0 map 10.0.0.1/24 'register'
+  set protocols nhrp tunnel tun0 multicast 'nhs'
+  set protocols nhrp tunnel tun0 'redirect'
+  set protocols nhrp tunnel tun0 'shortcut'
+
+  set vpn ipsec ipsec-interfaces interface eth0
+  set vpn ipsec ike-group IKE-SPOKE proposal 1
+  set vpn ipsec ike-group IKE-SPOKE proposal 1 encryption aes256
+  set vpn ipsec ike-group IKE-SPOKE proposal 1 hash sha1
+  set vpn ipsec ike-group IKE-SPOKE proposal 2 encryption aes128
+  set vpn ipsec ike-group IKE-SPOKE proposal 2 hash sha1
+  set vpn ipsec ike-group IKE-SPOKE lifetime 3600
+  set vpn ipsec esp-group ESP-SPOKE proposal 1 encryption aes256
+  set vpn ipsec esp-group ESP-SPOKE proposal 1 hash sha1
+  set vpn ipsec esp-group ESP-SPOKE proposal 2 encryption 3des
+  set vpn ipsec esp-group ESP-SPOKE proposal 2 hash md5
+  set vpn ipsec esp-group ESP-SPOKE lifetime 1800
+  set vpn ipsec esp-group ESP-SPOKE pfs dh-group2
+
+  set vpn ipsec profile NHRPVPN
+  set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
+  set vpn ipsec profile NHRPVPN authentication pre-shared-secret SECRET
+  set vpn ipsec profile NHRPVPN bind tunnel tun0
+  set vpn ipsec profile NHRPVPN esp-group ESP-SPOKE
+  set vpn ipsec profile NHRPVPN ike-group IKE-SPOKE
+
+  set protocols static route 192.168.1.0/24 next-hop 10.0.0.1
+  set protocols static route 192.168.3.0/24 next-hop 10.0.0.3
+
+
+SPOKE2 Configuration
+
+.. code-block:: none
+
+  interfaces
+      tunnel <tunN> {
+          address <ipv4>
+          encapsulation gre
+          local-ip <public ip>
+          multicast enable
+          description <txt>
+          parameters {
+              ip {
+                  <usual IP options>
+              }
+          }
+      }
+  }
+  protocols {
+      nhrp {
+          tunnel <tunN> {
+              cisco-authentication <key phrase>
+              map <ipv4/net> {
+                  nbma-address <ipv4>
+                  register
+              }
+              holding-time <seconds>
+              multicast nhs
+              redirect
+              shortcut
+          }
+      }
+  }
+  vpn {
+      ipsec {
+          esp-group <text> {
+              lifetime <30-86400>
+              mode tunnel
+              pfs enable
+              proposal <1-65535> {
+                  encryption aes256
+                  hash sha1
+              }
+              proposal <1-65535> {
+                  encryption 3des
+                  hash md5
+              }
+          }
+          ike-group <text> {
+              key-exchange ikev1
+              lifetime <30-86400>
+              proposal <1-65535> {
+                  encryption aes256
+                  hash sha1
+              }
+              proposal <1-65535> {
+                  encryption aes128
+                  hash sha1
+              }
+          }
+          ipsec-interfaces {
+              interface <ethN>
+          }
+          profile <text> {
+              authentication {
+                  mode pre-shared-secret
+                  pre-shared-secret <key phrase>
+              }
+              bind {
+                  tunnel <tunN>
+              }
+              esp-group <text>
+              ike-group <text>
+          }
+      }
+  }
+
+SPOKE2 Example Configuration
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address 'dhcp'
+  set interfaces ethernet eth1 address '192.168.3.1/24'
+  set system host-name 'SPOKE2'
+
+  set interfaces tunnel tun0 address 10.0.0.3/24
+  set interfaces tunnel tun0 encapsulation gre
+  set interfaces tunnel tun0 local-ip 0.0.0.0
+  set interfaces tunnel tun0 multicast enable
+  set interfaces tunnel tun0 parameters ip key 1
+
+  set protocols nhrp tunnel tun0 cisco-authentication SECRET
+  set protocols nhrp tunnel tun0 map 10.0.0.1/24 nbma-address 198.51.100.41
+  set protocols nhrp tunnel tun0 map 10.0.0.1/24 register
+  set protocols nhrp tunnel tun0 multicast nhs
+  set protocols nhrp tunnel tun0 redirect
+  set protocols nhrp tunnel tun0 shortcut
+
+  set vpn ipsec ipsec-interfaces interface eth0
+  set vpn ipsec ike-group IKE-SPOKE proposal 1
+  set vpn ipsec ike-group IKE-SPOKE proposal 1 encryption aes256
+  set vpn ipsec ike-group IKE-SPOKE proposal 1 hash sha1
+  set vpn ipsec ike-group IKE-SPOKE proposal 2 encryption aes128
+  set vpn ipsec ike-group IKE-SPOKE proposal 2 hash sha1
+  set vpn ipsec ike-group IKE-SPOKE lifetime 3600
+  set vpn ipsec esp-group ESP-SPOKE proposal 1 encryption aes256
+  set vpn ipsec esp-group ESP-SPOKE proposal 1 hash sha1
+  set vpn ipsec esp-group ESP-SPOKE proposal 2 encryption 3des
+  set vpn ipsec esp-group ESP-SPOKE proposal 2 hash md5
+  set vpn ipsec esp-group ESP-SPOKE lifetime 1800
+  set vpn ipsec esp-group ESP-SPOKE pfs dh-group2
+
+  set vpn ipsec profile NHRPVPN
+  set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
+  set vpn ipsec profile NHRPVPN authentication pre-shared-secret SECRET
+  set vpn ipsec profile NHRPVPN bind tunnel tun0
+  set vpn ipsec profile NHRPVPN esp-group ESP-SPOKE
+  set vpn ipsec profile NHRPVPN ike-group IKE-SPOKE
+
+  set protocols static route 192.168.1.0/24 next-hop 10.0.0.1
+  set protocols static route 192.168.2.0/24 next-hop 10.0.0.2
+
+
+.. _RFC2332: https://tools.ietf.org/html/rfc2332
+.. _RFC1702: https://tools.ietf.org/html/rfc1702
+.. _RFC4301: https://tools.ietf.org/html/rfc4301
diff --git a/docs/configuration/vpn/index.rst b/docs/configuration/vpn/index.rst
new file mode 100644
index 00000000..522842d1
--- /dev/null
+++ b/docs/configuration/vpn/index.rst
@@ -0,0 +1,17 @@
+.. _vpn:
+
+.. include:: references.rst
+
+VPN
+===
+
+This chapter describes the available VPN services provided by VyOS.
+
+.. toctree::
+   :hidden:
+
+   l2tp
+   site2site_ipsec
+   ipsec
+   dmvpn
+   pptp
diff --git a/docs/configuration/vpn/ipsec.rst b/docs/configuration/vpn/ipsec.rst
new file mode 100644
index 00000000..38849f67
--- /dev/null
+++ b/docs/configuration/vpn/ipsec.rst
@@ -0,0 +1,190 @@
+.. _gre-ipsec:
+
+GRE/IPsec
+---------
+
+Generic Routing Encapsulation (GRE), GRE/IPsec (or IPIP/IPsec, SIT/IPsec, or any
+other stateless tunnel protocol over IPsec) is the usual way to protect the
+traffic inside a tunnel.
+
+An advantage of this scheme is that you get a real interface with its own
+address, which makes it easier to setup static routes or use dynamic routing
+protocols without having to modify IPsec policies. The other advantage is that
+it greatly simplifies router to router communication, which can be tricky with
+plain IPsec because the external outgoing address of the router usually doesn't
+match the IPsec policy of typical site-to-site setup and you need to add special
+configuration for it, or adjust the source address for outgoing traffic of your
+applications. GRE/IPsec has no such problem and is completely transparent for
+the applications.
+
+GRE/IPIP/SIT and IPsec are widely accepted standards, which make this scheme
+easy to implement between VyOS and virtually any other router.
+
+For simplicity we'll assume that the protocol is GRE, it's not hard to guess
+what needs to be changed to make it work with a different protocol. We assume
+that IPsec will use pre-shared secret authentication and will use AES128/SHA1
+for the cipher and hash. Adjust this as necessary.
+
+.. NOTE:: VMWare users should ensure that VMXNET3 adapters used, e1000 adapters
+   have known issue with GRE processing
+
+IPsec policy matching GRE
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The first and arguably cleaner option is to make your IPsec policy match GRE
+packets between external addresses of your routers. This is the best option if
+both routers have static external addresses.
+
+Suppose the LEFT router has external address 192.0.2.10 on its eth0 interface,
+and the RIGHT router is 203.0.113.45
+
+On the LEFT:
+
+.. code-block:: none
+
+  # GRE tunnel
+  set interfaces tunnel tun0 encapsulation gre
+  set interfaces tunnel tun0 local-ip 192.0.2.10
+  set interfaces tunnel tun0 remote-ip 203.0.113.45
+  set interfaces tunnel tun0 address 10.10.10.1/30
+
+  ## IPsec
+  set vpn ipsec ipsec-interfaces interface eth0
+
+  # IKE group
+  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '2'
+  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes128'
+  set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha1'
+
+  # ESP group
+  set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes128'
+  set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha1'
+
+  # IPsec tunnel
+  set vpn ipsec site-to-site peer 203.0.113.45 authentication mode pre-shared-secret
+  set vpn ipsec site-to-site peer 203.0.113.45 authentication pre-shared-secret MYSECRETKEY
+
+  set vpn ipsec site-to-site peer 203.0.113.45 ike-group MyIKEGroup
+  set vpn ipsec site-to-site peer 203.0.113.45 default-esp-group MyESPGroup
+
+  set vpn ipsec site-to-site peer 203.0.113.45 local-address 192.0.2.10
+
+  # This will match all GRE traffic to the peer
+  set vpn ipsec site-to-site peer 203.0.113.45 tunnel 1 protocol gre
+
+On the RIGHT, setup by analogy and swap local and remote addresses.
+
+
+Source tunnel from loopbacks
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The scheme above doesn't work when one of the routers has a dynamic external
+address though. The classic workaround for this is to setup an address on a
+loopback interface and use it as a source address for the GRE tunnel, then setup
+an IPsec policy to match those loopback addresses.
+
+We assume that the LEFT router has static 192.0.2.10 address on eth0, and the
+RIGHT router has a dynamic address on eth0.
+
+**Setting up the GRE tunnel**
+
+On the LEFT:
+
+.. code-block:: none
+
+  set interfaces loopback lo address 192.168.99.1/32
+
+  set interfaces tunnel tun0 encapsulation gre
+  set interfaces tunnel tun0 address 10.10.10.1/30
+  set interfaces tunnel tun0 local-ip 192.168.99.1
+  set interfaces tunnel tun0 remote-ip 192.168.99.2
+
+On the RIGHT:
+
+.. code-block:: none
+
+  set interfaces loopback lo address 192.168.99.2/32
+
+  set interfaces tunnel tun0 encapsulation gre
+  set interfaces tunnel tun0 address 10.10.10.2/30
+  set interfaces tunnel tun0 local-ip 192.168.99.2
+  set interfaces tunnel tun0 remote-ip 192.168.99.1
+
+**Setting up IPSec**
+
+However, now you need to make IPsec work with dynamic address on one side. The
+tricky part is that pre-shared secret authentication doesn't work with dynamic
+address, so we'll have to use RSA keys.
+
+First, on both routers run the operational command "generate vpn rsa-key bits
+2048". You may choose different length than 2048 of course.
+
+.. code-block:: none
+
+  vyos@left# run generate vpn rsa-key bits 2048
+  Generating rsa-key to /config/ipsec.d/rsa-keys/localhost.key
+
+  Your new local RSA key has been generated
+  The public portion of the key is:
+
+  0sAQO2335[long string here]
+
+Then on the opposite router, add the RSA key to your config.
+
+.. code-block:: none
+
+  set vpn rsa-keys rsa-key-name LEFT rsa-key KEYGOESHERE
+
+Now you are ready to setup IPsec. You'll need to use an ID instead of address
+for the peer on the dynamic side.
+
+On the LEFT (static address):
+
+.. code-block:: none
+
+  set vpn rsa-keys rsa-key-name RIGHT rsa-key <PUBLIC KEY FROM THE RIGHT>
+
+  set vpn ipsec ipsec-interfaces interface eth0
+
+  set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128
+  set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1
+
+  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2
+  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
+  set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1
+
+  set vpn ipsec site-to-site peer @RIGHT authentication mode rsa
+  set vpn ipsec site-to-site peer @RIGHT authentication rsa-key-name RIGHT
+  set vpn ipsec site-to-site peer @RIGHT default-esp-group MyESPGroup
+  set vpn ipsec site-to-site peer @RIGHT ike-group MyIKEGroup
+  set vpn ipsec site-to-site peer @RIGHT local-address 192.0.2.10
+  set vpn ipsec site-to-site peer @RIGHT connection-type respond
+  set vpn ipsec site-to-site peer @RIGHT tunnel 1 local prefix 192.168.99.1/32  # Additional loopback address on the local
+  set vpn ipsec site-to-site peer @RIGHT tunnel 1 remote prefix 192.168.99.2/32 # Additional loopback address on the remote
+
+
+On the RIGHT (dynamic address):
+
+.. code-block:: none
+
+  set vpn rsa-keys rsa-key-name LEFT rsa-key <PUBLIC KEY FROM THE LEFT>
+
+  set vpn ipsec ipsec-interfaces interface eth0
+
+  set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128
+  set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1
+
+  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2
+  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
+  set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1
+
+  set vpn ipsec site-to-site peer 192.0.2.10 authentication id @RIGHT
+  set vpn ipsec site-to-site peer 192.0.2.10 authentication mode rsa
+  set vpn ipsec site-to-site peer 192.0.2.10 authentication rsa-key-name LEFT
+  set vpn ipsec site-to-site peer 192.0.2.10 remote-id @LEFT
+  set vpn ipsec site-to-site peer 192.0.2.10 connection-type initiate
+  set vpn ipsec site-to-site peer 192.0.2.10 default-esp-group MyESPGroup
+  set vpn ipsec site-to-site peer 192.0.2.10 ike-group MyIKEGroup
+  set vpn ipsec site-to-site peer 192.0.2.10 local-address any
+  set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 local prefix 192.168.99.2/32  # Additional loopback address on the local
+  set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 remote prefix 192.168.99.1/32 # Additional loopback address on the remote
diff --git a/docs/configuration/vpn/l2tp.rst b/docs/configuration/vpn/l2tp.rst
new file mode 100644
index 00000000..64223475
--- /dev/null
+++ b/docs/configuration/vpn/l2tp.rst
@@ -0,0 +1,131 @@
+.. _l2tp:
+
+L2TP over IPsec
+---------------
+
+Example for configuring a simple L2TP over IPsec VPN for remote access (works
+with native Windows and Mac VPN clients):
+
+.. code-block:: none
+
+  set vpn ipsec ipsec-interfaces interface eth0
+  set vpn ipsec nat-traversal enable
+  set vpn ipsec nat-networks allowed-network 0.0.0.0/0
+
+  set vpn l2tp remote-access outside-address 203.0.113.2
+  set vpn l2tp remote-access client-ip-pool start 192.168.255.1
+  set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
+  set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
+  set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret <secret>
+  set vpn l2tp remote-access authentication mode local
+  set vpn l2tp remote-access authentication local-users username <username> password <password>
+
+In the example above an external IP of 203.0.113.2 is assumed.
+
+If a local firewall policy is in place on your external interface you will need
+to open:
+
+* UDP port 500 (IKE)
+* IP protocol number 50 (ESP)
+* UDP port 1701 for IPsec
+
+In addition when NAT is detected by the VPN client ESP is encapsulated in UDP
+for NAT-traversal:
+
+* UDP port 4500 (NAT-T)
+
+Example:
+
+.. code-block:: none
+
+  set firewall name OUTSIDE-LOCAL rule 40 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 40 protocol 'esp'
+  set firewall name OUTSIDE-LOCAL rule 41 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 41 destination port '500'
+  set firewall name OUTSIDE-LOCAL rule 41 protocol 'udp'
+  set firewall name OUTSIDE-LOCAL rule 42 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 42 destination port '4500'
+  set firewall name OUTSIDE-LOCAL rule 42 protocol 'udp'
+  set firewall name OUTSIDE-LOCAL rule 43 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 43 destination port '1701'
+  set firewall name OUTSIDE-LOCAL rule 43 ipsec 'match-ipsec'
+  set firewall name OUTSIDE-LOCAL rule 43 protocol 'udp'
+
+Also note that if you wish to allow the VPN to be used for external access you
+will need to add the appropriate source NAT rules to your configuration.
+
+.. code-block:: none
+
+  set nat source rule 110 outbound-interface 'eth0'
+  set nat source rule 110 source address '192.168.255.0/24'
+  set nat source rule 110 translation address masquerade
+
+To be able to resolve when connected to the VPN, the following DNS rules are
+needed as well.
+
+.. code-block:: none
+
+  set vpn l2tp remote-access dns-servers server-1 '8.8.8.8'
+  set vpn l2tp remote-access dns-servers server-2 '8.8.4.4'
+
+.. note:: Those are the `Google public DNS`_ servers. You can also use the
+   public available servers from Quad9_ (9.9.9.9) or Cloudflare_ (1.1.1.1).
+
+Established sessions can be viewed using the **show vpn remote-access**
+operational command.
+
+.. code-block:: none
+
+  vyos@vyos:~$ show vpn remote-access
+  Active remote access VPN sessions:
+  User            Proto Iface     Tunnel IP       TX byte RX byte  Time
+  ----            ----- -----     ---------       ------- -------  ----
+  vyos            L2TP  l2tp0     192.168.255.1      3.2K    8.0K  00h06m13s
+
+RADIUS authentication
+^^^^^^^^^^^^^^^^^^^^^
+
+The above configuration made use of local accounts on the VyOS router for
+authenticating L2TP/IPSec clients. In bigger environments usually something
+like RADIUS_ (FreeRADIUS_ or Microsoft `Network Policy Server`_, NPS) is used.
+
+VyOS supports either `local` or `radius` user authentication:
+
+.. code-block:: none
+
+  set vpn l2tp remote-access authentication mode <local|radius>
+
+In addition one or more RADIUS_ servers can be configured to server for user
+authentication. This is done using the `radius server` and `radius server key`
+nodes:
+
+.. code-block:: none
+
+  set vpn l2tp remote-access authentication radius server 1.1.1.1 key 'foo'
+  set vpn l2tp remote-access authentication radius server 2.2.2.2 key 'foo'
+
+.. note:: Some RADIUS_ severs make use of an access control list who is allowed
+   to query the server. Please configure your VyOS router in the allowed client
+   list.
+
+RADIUS source address
+*********************
+
+If you are using e.g. OSPF as IGP always the nearest interface facing the RADIUS
+server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests to a
+single source IP e.g. the loopback interface.
+
+.. code-block:: none
+
+  set vpn l2tp remote-access authentication radius source-address 3.3.3.3
+
+Above command will use `3.3.3.3` as source IPv4 address for all RADIUS queries
+on this NAS.
+
+
+.. _`Google Public DNS`: https://developers.google.com/speed/public-dns
+.. _Quad9: https://quad9.net
+.. _CloudFlare: https://blog.cloudflare.com/announcing-1111
+.. _RADIUS: https://en.wikipedia.org/wiki/RADIUS
+.. _FreeRADIUS: https://freeradius.org
+.. _`Network Policy Server`: https://en.wikipedia.org/wiki/Network_Policy_Server
diff --git a/docs/configuration/vpn/pptp.rst b/docs/configuration/vpn/pptp.rst
new file mode 100644
index 00000000..72b3feb0
--- /dev/null
+++ b/docs/configuration/vpn/pptp.rst
@@ -0,0 +1,47 @@
+.. _pptp:
+
+PPTP-Server
+-----------
+
+The Point-to-Point Tunneling Protocol (PPTP_) has been implemented in VyOS only for backwards compatibility.
+PPTP has many well known security issues and you should use one of the many other new VPN implementations.
+
+As per default and if not otherwise defined, mschap-v2 is being used for authentication and mppe 128-bit (stateless) for encryption.
+If no gateway-address is set within the configuration, the lowest IP out of the /24 client-ip-pool is being used. For instance, in the example below it would be 192.168.0.1.
+
+server example
+^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  set vpn pptp remote-access authentication local-users username test password 'test'
+  set vpn pptp remote-access authentication mode 'local'
+  set vpn pptp remote-access client-ip-pool start '192.168.0.10'
+  set vpn pptp remote-access client-ip-pool stop '192.168.0.15'
+  set vpn pptp remote-access gateway-address '10.100.100.1'
+  set vpn pptp remote-access outside-address '10.1.1.120'
+
+
+client example (debian 9)
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Install the client software via apt and execute pptpsetup to generate the configuration.
+
+
+.. code-block:: none
+
+  apt-get install pptp-linux
+  pptpsetup --create TESTTUNNEL --server 10.1.1.120 --username test --password test --encrypt
+  pon TESTTUNNEL
+
+The command pon TESTUNNEL establishes the PPTP tunnel to the remote system.
+
+
+All tunnel sessions can be checked via:
+
+.. code-block:: none
+
+  run sh pptp-server sessions
+   ifname | username | calling-sid |      ip      | type | comp | state  |  uptime
+  --------+----------+-------------+--------------+------+------+--------+----------
+   ppp0   | test     | 10.1.1.99   | 192.168.0.10 | pptp | mppe | active | 00:00:58
diff --git a/docs/configuration/vpn/references.rst b/docs/configuration/vpn/references.rst
new file mode 100644
index 00000000..49b65cb0
--- /dev/null
+++ b/docs/configuration/vpn/references.rst
@@ -0,0 +1,10 @@
+.. _`Google Public DNS`: https://developers.google.com/speed/public-dns
+.. _Quad9: https://quad9.net
+.. _CloudFlare: https://blog.cloudflare.com/announcing-1111
+.. _RADIUS: https://en.wikipedia.org/wiki/RADIUS
+.. _FreeRADIUS: https://freeradius.org
+.. _`Network Policy Server`: https://en.wikipedia.org/wiki/Network_Policy_Server
+.. _RFC2332: https://tools.ietf.org/html/rfc2332
+.. _RFC1702: https://tools.ietf.org/html/rfc1702
+.. _RFC4301: https://tools.ietf.org/html/rfc4301
+.. _PPTP: https://en.wikipedia.org/wiki/Point-to-Point_Tunneling_Protocol
diff --git a/docs/configuration/vpn/site2site_ipsec.rst b/docs/configuration/vpn/site2site_ipsec.rst
new file mode 100644
index 00000000..e0156a6f
--- /dev/null
+++ b/docs/configuration/vpn/site2site_ipsec.rst
@@ -0,0 +1,299 @@
+.. _size2site_ipsec:
+
+Site-to-Site
+============
+
+Site-to-site mode provides a way to add remote peers, which could be configured to exchange encrypted information between them and VyOS itself or connected/routed networks.
+
+To configure site-to-site connection you need to add peers with the ``set vpn ipsec site-to-site`` command.
+
+You can identify a remote peer with:
+
+* IPv4 or IPv6 address. This mode is easiest for configuration and mostly used when a peer has a public static IP address;
+* Hostname. This mode is similar to IP address, only you define DNS name instead of an IP. Could be used when a peer has a public IP address and DNS name, but an IP address could be changed from time to time;
+* Remote ID of the peer. In this mode, there is no predefined remote address nor DNS name of the peer. This mode is useful when a peer doesn't have a publicly available IP address (NAT between it and VyOS), or IP address could be changed.
+
+Each site-to-site peer has the next options:
+
+* ``authentication`` - configure authentication between VyOS and a remote peer. Suboptions:
+
+ * ``id`` - ID for the local VyOS router. If defined, during the authentication it will be send to remote peer;
+
+ * ``mode`` - mode for authentication between VyOS and remote peer:
+
+  * ``pre-shared-secret`` - use predefined shared secret phrase, must be the same for local and remote side;
+
+  * ``rsa`` - use simple shared RSA key. The key must be defined in the ``set vpn rsa-keys`` section;
+
+  * ``x509`` - use certificates infrastructure for authentication.
+
+ * ``pre-shared-secret`` - predefined shared secret. Used if configured ``mode pre-shared-secret``;
+
+ * ``remote-id`` - define an ID for remote peer, instead of using peer name or address. Useful in case if the remote peer is behind NAT or if ``mode x509`` is used;
+
+ * ``rsa-key-name`` - shared RSA key for authentication. The key must be defined in the ``set vpn rsa-keys`` section;
+
+ * ``use-x509-id`` - use local ID from x509 certificate. Cannot be used when ``id`` is defined;
+
+ * ``x509`` - options for x509 authentication mode:
+
+  * ``ca-cert-file`` - CA certificate file. Using for authenticating remote peer;
+
+  * ``cert-file`` - certificate file, which will be used for authenticating local router on remote peer;
+
+  * ``crl-file`` - file with the Certificate Revocation List. Using to check if a certificate for the remote peer is valid or revoked;
+
+  * ``key`` - a private key, which will be used for authenticating local router on remote peer:
+
+   * ``file`` - path to the key file;
+
+   * ``password`` - passphrase private key, if needed.
+
+* ``connection-type`` - how to handle this connection process. Possible variants:
+
+ * ``initiate`` - do initial connection to remote peer immediately after configuring and after boot. In this mode the connection will not be restarted in case of disconnection, therefore should be used only together with DPD or another session tracking methods;
+
+ * ``respond`` - do not try to initiate a connection to a remote peer. In this mode, the IPSec session will be established only after initiation from a remote peer. Could be useful when there is no direct connectivity to the peer due to firewall or NAT in the middle of the local and remote side.
+
+* ``default-esp-group`` - ESP group to use by default for traffic encryption. Might be overwritten by individual settings for tunnel or VTI interface binding;
+
+* ``description`` - description for this peer;
+
+* ``dhcp-interface`` - use an IP address, received from DHCP for IPSec connection with this peer, instead of ``local-address``;
+
+* ``force-encapsulation`` - force encapsulation of ESP into UDP datagrams. Useful in case if between local and remote side is firewall or NAT, which not allows passing plain ESP packets between them;
+
+* ``ike-group`` - IKE group to use for key exchanges;
+
+* ``ikev2-reauth`` - reauthenticate remote peer during the rekeying process. Can be used only with IKEv2:
+
+ * ``yes`` - create a new IKE_SA from the scratch and try to recreate all IPsec SAs;
+
+ * ``no`` - rekey without uninstalling the IPsec SAs;
+
+ * ``inherit`` - use default behavior for the used IKE group.
+
+* ``local-address`` - local IP address for IPSec connection with this peer. If defined ``any``, then an IP address which configured on interface with default route will be used;
+
+* ``tunnel`` - define criteria for traffic to be matched for encrypting and send it to a peer:
+
+ * ``disable`` - disable this tunnel;
+
+ * ``esp-group`` - define ESP group for encrypt traffic, defined by this tunnel;
+
+ * ``local`` - define a local source for match traffic, which should be encrypted and send to this peer:
+
+  * ``port`` - define port. Have effect only when used together with ``prefix``;
+
+  * ``prefix`` - IP network at local side.
+
+ * ``protocol`` - define the protocol for match traffic, which should be encrypted and send to this peer;
+
+ * ``remote`` - define the remote destination for match traffic, which should be encrypted and send to this peer:
+
+  * ``port`` - define port. Have effect only when used together with ``prefix``;
+
+  * ``prefix`` - IP network at remote side.
+
+* ``vti`` - use a VTI interface for traffic encryption. Any traffic, which will be send to VTI interface will be encrypted and send to this peer. Using VTI makes IPSec configuration much flexible and easier in complex situation, and allows to dynamically add/delete remote networks, reachable via a peer, as in this mode router don't need to create additional SA/policy for each remote network:
+
+ * ``bind`` - select a VTI interface to bind to this peer;
+
+ * ``esp-group`` - define ESP group for encrypt traffic, passed this VTI interface.
+
+Examples:
+------------------
+
+IKEv1
+^^^^^
+
+Example:
+
+* WAN interface on `eth1`
+* left subnet: `192.168.0.0/24` site1, server side (i.e. locality, actually
+  there is no client or server roles)
+* left local_ip: `198.51.100.3` # server side WAN IP
+* right subnet: `10.0.0.0/24` site2,remote office side
+* right local_ip: `203.0.113.2` # remote office side WAN IP
+
+.. code-block:: none
+
+  # server config
+  set vpn ipsec esp-group office-srv-esp compression 'disable'
+  set vpn ipsec esp-group office-srv-esp lifetime '1800'
+  set vpn ipsec esp-group office-srv-esp mode 'tunnel'
+  set vpn ipsec esp-group office-srv-esp pfs 'enable'
+  set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
+  set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
+  set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
+  set vpn ipsec ike-group office-srv-ike lifetime '3600'
+  set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
+  set vpn ipsec ipsec-interfaces interface 'eth1'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'SomePreSharedKey'
+  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'office-srv-ike'
+  set vpn ipsec site-to-site peer 203.0.113.2 local-address '198.51.100.3'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 allow-nat-networks 'disable'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 allow-public-networks 'disable'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 esp-group 'office-srv-esp'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 local prefix '192.168.0.0/24'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 remote prefix '10.0.0.0/21'
+
+  # remote office config
+  set vpn ipsec esp-group office-srv-esp compression 'disable'
+  set vpn ipsec esp-group office-srv-esp lifetime '1800'
+  set vpn ipsec esp-group office-srv-esp mode 'tunnel'
+  set vpn ipsec esp-group office-srv-esp pfs 'enable'
+  set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
+  set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
+  set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
+  set vpn ipsec ike-group office-srv-ike lifetime '3600'
+  set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
+  set vpn ipsec ipsec-interfaces interface 'eth1'
+  set vpn ipsec site-to-site peer 198.51.100.3 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 198.51.100.3 authentication pre-shared-secret 'SomePreSharedKey'
+  set vpn ipsec site-to-site peer 198.51.100.3 ike-group 'office-srv-ike'
+  set vpn ipsec site-to-site peer 198.51.100.3 local-address '203.0.113.2'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 allow-nat-networks 'disable'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 allow-public-networks 'disable'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 esp-group 'office-srv-esp'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 local prefix '10.0.0.0/21'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 remote prefix '192.168.0.0/24'
+
+Show status of new setup:
+
+.. code-block:: none
+
+  vyos@srv-gw0:~$ show vpn ike sa
+  Peer ID / IP                            Local ID / IP
+  ------------                            -------------
+  203.0.113.2                                 198.51.100.3
+     State  Encrypt  Hash    D-H Grp  NAT-T  A-Time  L-Time
+     -----  -------  ----    -------  -----  ------  ------
+     up     aes256   sha1    5        no     734     3600
+
+  vyos@srv-gw0:~$ show vpn ipsec sa
+  Peer ID / IP                            Local ID / IP
+  ------------                            -------------
+  203.0.113.2                                 198.51.100.3
+     Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
+     ------  -----  -------------  -------  ----    -----  ------  ------  -----
+     0       up     7.5M/230.6K    aes256   sha1    no     567     1800    all
+
+If there is SNAT rules on eth1, need to add exclude rule
+
+.. code-block:: none
+
+  # server side
+  set nat source rule 10 destination address '10.0.0.0/24'
+  set nat source rule 10 'exclude'
+  set nat source rule 10 outbound-interface 'eth1'
+  set nat source rule 10 source address '192.168.0.0/24'
+
+  # remote office side
+  set nat source rule 10 destination address '192.168.0.0/24'
+  set nat source rule 10 'exclude'
+  set nat source rule 10 outbound-interface 'eth1'
+  set nat source rule 10 source address '10.0.0.0/24'
+
+To allow traffic to pass through to clients, you need to add the following
+rules. (if you used the default configuration at the top of this page)
+
+.. code-block:: none
+
+  # server side
+  set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 32 source address '10.0.0.0/24'
+
+  # remote office side
+  set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 32 source address '192.168.0.0/24'
+
+IKEv2
+^^^^^
+
+Imagine the following topology
+
+.. figure:: /_static/images/vpn_s2s_ikev2.png
+   :scale: 50 %
+   :alt: IPSec IKEv2 site2site VPN
+
+   IPSec IKEv2 site2site VPN (source ./draw.io/vpn_s2s_ikev2.drawio)
+
+
+.. note:: Don't get confused about the used /31 tunnel subnet. RFC3031_ gives
+   you additional information for using /31 subnets on point-to-point links.
+
+**left**
+
+.. code-block:: none
+
+  set interfaces vti vti10 address '10.0.0.2/31'
+
+  set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
+  set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
+  set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
+  set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
+  set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
+  set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'hold'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
+  set vpn ipsec ike-group IKEv2_DEFAULT ikev2-reauth 'no'
+  set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
+  set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
+  set vpn ipsec ike-group IKEv2_DEFAULT mobike 'disable'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
+  set vpn ipsec ipsec-interfaces interface 'eth0.201'
+  set vpn ipsec site-to-site peer 172.18.202.10 authentication id '172.18.201.10'
+  set vpn ipsec site-to-site peer 172.18.202.10 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 172.18.202.10 authentication pre-shared-secret 'secretkey'
+  set vpn ipsec site-to-site peer 172.18.202.10 authentication remote-id '172.18.202.10'
+  set vpn ipsec site-to-site peer 172.18.202.10 connection-type 'initiate'
+  set vpn ipsec site-to-site peer 172.18.202.10 ike-group 'IKEv2_DEFAULT'
+  set vpn ipsec site-to-site peer 172.18.202.10 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 172.18.202.10 local-address '172.18.201.10'
+  set vpn ipsec site-to-site peer 172.18.202.10 vti bind 'vti10'
+  set vpn ipsec site-to-site peer 172.18.202.10 vti esp-group 'ESP_DEFAULT'
+
+**right**
+
+.. code-block:: none
+
+  set interfaces vti vti10 address '10.0.0.3/31'
+
+  set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
+  set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
+  set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
+  set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
+  set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
+  set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'hold'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
+  set vpn ipsec ike-group IKEv2_DEFAULT ikev2-reauth 'no'
+  set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
+  set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
+  set vpn ipsec ike-group IKEv2_DEFAULT mobike 'disable'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
+  set vpn ipsec ipsec-interfaces interface 'eth0.202'
+  set vpn ipsec site-to-site peer 172.18.201.10 authentication id '172.18.202.10'
+  set vpn ipsec site-to-site peer 172.18.201.10 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 172.18.201.10 authentication pre-shared-secret 'secretkey'
+  set vpn ipsec site-to-site peer 172.18.201.10 authentication remote-id '172.18.201.10'
+  set vpn ipsec site-to-site peer 172.18.201.10 connection-type 'initiate'
+  set vpn ipsec site-to-site peer 172.18.201.10 ike-group 'IKEv2_DEFAULT'
+  set vpn ipsec site-to-site peer 172.18.201.10 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 172.18.201.10 local-address '172.18.202.10'
+  set vpn ipsec site-to-site peer 172.18.201.10 vti bind 'vti10'
+  set vpn ipsec site-to-site peer 172.18.201.10 vti esp-group 'ESP_DEFAULT'
+
+.. _RFC3031:  https://tools.ietf.org/html/rfc3021
diff --git a/docs/configuration/zonepolicy/index.rst b/docs/configuration/zonepolicy/index.rst
new file mode 100644
index 00000000..5da40d6d
--- /dev/null
+++ b/docs/configuration/zonepolicy/index.rst
@@ -0,0 +1,9 @@
+Zone-based Firewall Policy
+--------------------------
+
+As an alternative to applying policy to an interface directly, a zone-based
+firewall can be created to simplify configuration when multiple interfaces
+belong to the same security zone. Instead of applying to rulesets to interfaces
+they are applied to source zone-destination zone pairs.
+
+An example to zone-based firewalls can be found here: :ref:`examples-zone-policy`.
\ No newline at end of file
diff --git a/docs/contributing/documentation.rst b/docs/contributing/documentation.rst
deleted file mode 100644
index 40edf750..00000000
--- a/docs/contributing/documentation.rst
+++ /dev/null
@@ -1,175 +0,0 @@
-.. _documentation:
-
-Documentation
-=============
-
-As most software projects we also have a lack in documentation. We encourage
-every VyOS user to help us improve our documentation. This will not only be
-benefical four you (when reading something up) but also for the whole world.
-
-If you are willing to contribute to our documentation this is the definate
-guid how to do so.
-
-.. note:: In contrast to submitting code patches there is no requirement that
-   you open up a Phabricator_ task prior to submitting a Pull-Request to the
-   documentation.
-
-Forking Workflow
-----------------
-
-The Forking Workflow is fundamentally different than other popular Git
-workflows. Instead of using a single server-side repository to act as the
-"central" codebase, it gives every developer their own server-side repository.
-This means that each contributor has not one, but two Git repositories: a
-private local one and a public server-side one.
-
-The main advantage of the Forking Workflow is that contributions can be
-integrated without the need for everybody to push to a single central
-repository. Developers push to their own server-side repositories, and only the
-project maintainer can push to the official repository. This allows the
-maintainer to accept commits from any developer without giving them write
-access to the official codebase.
-
-.. note:: Updates to our documentation should be delivered by a GitHub
-   pull-request. This requires you already have a GitHub account.
-
-* Fork this project on GitHub https://github.com/vyos/vyos-documentation/fork
-
-* Clone fork to local machine
-
-* Change to your new local directory ``$ cd vyos-documentation``
-
-* Create new branch for your work, use a descriptive name of your work:
-  ``$ git checkout -b fix-vxlan-typo``
-
-* Make all your changes - please keep our commit rules in mind
-  (:ref:`prepare_commit`). This mainly applies to proper commit messages
-  describing your change (how and why). Please check out the documentation of
-  Sphinx-doc_ or reStructuredText_ if you are not familiar with it. This is used
-  for writing our docs.
-
-* Check your changes by locally building the documentation ``$ make html``.
-  Sphinx will build the html files in the ``docs/_build`` folder. We provide
-  you with a Docker container for an easy to use user experience. Check the
-  README.md_ file of this repository.
-
-* View modified files by calling ``$ git status``. You will get an overview of
-  all files modified by you. You can add individual files to the Git Index in
-  the next step.
-
-* Add modified files to Git index ``$ git add path/to/filename`` or add all
-  unstaged files ``$ git add .``. All files added to the Git index will be part
-  of you following Git commit.
-
-* Commit your changes ``$ git commit -v`` - your configured editor will now ne
-  launched where you can type in a commit message. Again please make yourself
-  comfortable with out rules (:ref:`prepare_commit`).
-
-* Push your commits to your GitHub project: ``$ git push -u origin foo-branch``
-
-* Submit pull-request. In GitHub visit the main repository and you should
-  see a banner suggesting to make a pull request. Fill out the form and
-  describe what you do.
-
-* Once pull resquests have been approved, you may want to locally update
-  your forked repository too. First you'll have to add a second remote
-  called `upstream` which points to our main repository. ``$ git remote add
-  upstream https://github.com/vyos/vyos-documentation.git``
-
-  Check your configured remote repositories:
-
-  .. code-block:: none
-
-    $ git remote -v
-    origin    https://github.com/<username>/vyos-documentation.git (fetch)
-    origin    https://github.com/<username>/vyos.documentation.git (push)
-    upstream  https://github.com/vyos/vyos-documentation.git (fetch)
-    upstream  https://github.com/vyos/vyos-documentation.git (push)
-
-  Your remote repo on Github is called ``origin``, while the original repo you
-  have forked is called ``upstream``. Now you can locally update your forked
-  repo.
-
-  .. code-block:: none
-
-    $ git fetch upstream
-    $ git checkout master
-    $ git merge upstream/master
-
-* If you want to update your fork on GitHub, too use the following: ``$ git
-  push origin master``
-
-Style Guide
------------
-
-Sections
-^^^^^^^^
-
-We use the following syntax for Headlines.
-
-.. code-block:: none
-
-  #####
-  Parts
-  #####
-
-  ********
-  Chapters
-  ********
-
-  Sections
-  ========
-
-  Subsections
-  -----------
-
-  Subsubsections
-  ^^^^^^^^^^^^^^
-
-  Paragraphs
-  """"""""""
-
-Address space
-^^^^^^^^^^^^^
-
-Note the following RFCs (:rfc:`5737`, :rfc:`3849`, :rfc:`5389` and
-:rfc:`7042`), which describe the reserved public IP addresses and autonomous
-system numbers for the documentation:
-
-  * ``192.0.2.0/24``
-  * ``198.51.100.0/24``
-  * ``203.0.113.0/24``
-  * ``2001:db8::/32``
-  * 16bit ASN: ``64496 - 64511``
-  * 32bit ASN: ``65536 - 65551``
-  * Unicast MAC Addresses: ``00-53-00`` to ``00-53-FF``
-  * Multicast MAC-Addresses: ``90-10-00`` to ``90-10-FF``
-
-Please don't use other public address space.
-
-
-Custom Sphinx-doc Markup
-^^^^^^^^^^^^^^^^^^^^^^^^
-
-When documenting CLI commands use the ``.. cfgcmd::`` directive for all
-configuration mode commands. When documenting operational level command use
-the ``.. opcmd::`` directive. An explanation of the described command should
-be added below this statement.
-
-**Example**
-
-.. code-block:: none
-
-  .. opcmd:: show protocols static arp
-
-  Display all known ARP table entries spanning accross all interfaces
-
-  .. cfgcmd:: set protocols static arp 192.0.2.100 hwaddr 00:53:27:de:23:aa
-
-  This will configure a static ARP entry always resolving `192.0.2.100` to
-  `00:53:27:de:23:aa`.
-
-.. _Sphinx-doc: https://www.sphinx-doc.org
-.. _reStructuredText: http://www.sphinx-doc.org/en/master/usage/restructuredtext/index.html
-.. _Phabricator: https://phabricator.vyos.net
-.. _README.md: https://github.com/vyos/vyos-documentation/blob/master/README.md
diff --git a/docs/contributing/index.rst b/docs/contributing/index.rst
new file mode 100644
index 00000000..8dd81d60
--- /dev/null
+++ b/docs/contributing/index.rst
@@ -0,0 +1,13 @@
+############
+Contributing
+############
+
+.. toctree::
+   :maxdepth: 2
+
+   issues-features
+   development
+   vyos_cli
+   coding_guidelines
+   upstream-packages
+   build-vyos
\ No newline at end of file
diff --git a/docs/contributing/issues-features.rst b/docs/contributing/issues-features.rst
new file mode 100644
index 00000000..02de2df6
--- /dev/null
+++ b/docs/contributing/issues-features.rst
@@ -0,0 +1,72 @@
+.. _issues_features:
+
+Issues and Feature requests
+===========================
+
+Bug Report / Issue
+------------------
+Issues or bugs are found in any software project. VyOS is not an exception.
+
+All issues should be reported to the developers. This lets the developers know
+what is not working properly. Without this sort of feedback every developer
+will believe that everything is working correctly.
+
+I have found a bug, what should I do?
+*************************************
+
+When you believe you have found a bug, it is always a good idea to verify the
+issue prior to opening a bug request.
+
+* Consult the documentation_ to ensure that you have configured your system
+  correctly
+* Get community support via Slack_ or our Forum_
+
+Ensure the problem is reproducible
+**********************************
+
+When you are able to verify that it is actually a bug, spend some time to
+document how to reproduce the issue. This documentation can be invaluable.
+
+When you wish to have a developer fix a bug that you found, helping them
+reproduce the issue is beneficial to everyone. Be sure to include information
+about the hardware you are using, commands that you were running, any other
+activities that you may have been doing at the time. This additional
+information can be very useful.
+
+* What were you attempting to achieve?
+* What was the configuration prior to the change?
+* What commands did you use? Use e.g. ``run show configuration commands``
+
+Include output
+**************
+
+The output you get when you find a bug can provide lots of information. If you
+get an error message on the screen, copy it exactly. Having the exact message
+can provide detail that the developers can use. Like wise if you have any log
+messages that also are from the time of the issue, include those. They may
+also contain information that is helpful for the development team.
+
+Report a Bug
+************
+
+Create an account on VyOS Phabricator_. Phabricator_ is located at
+https://phabricator.vyos.net. To create a bug-report use the quick link in the
+left side under the specific project. 
+
+* Provide as much information as you can
+* Which version of VyOS are you using? ``run show version``
+* How can we reproduce this Bug?
+
+Feature Request
+---------------
+
+You have an idea of how to make VyOS better or you are in need of a specific
+feature which all users of VyOS would benefit from? To send a feature request
+please search Phabricator_ if there is already a request pending. You can
+enhance it or if you don't find one, create a new one by use the quick link in
+the left side under the specific project.
+
+.. _documentation: https://vyos.redthedocs.io
+.. _Slack: https://slack.vyos.io
+.. _Forum: https://forum.vyos.io
+.. _Phabricator: https://phabricator.vyos.net
\ No newline at end of file
diff --git a/docs/contributing/issues_features.rst b/docs/contributing/issues_features.rst
deleted file mode 100644
index 02de2df6..00000000
--- a/docs/contributing/issues_features.rst
+++ /dev/null
@@ -1,72 +0,0 @@
-.. _issues_features:
-
-Issues and Feature requests
-===========================
-
-Bug Report / Issue
-------------------
-Issues or bugs are found in any software project. VyOS is not an exception.
-
-All issues should be reported to the developers. This lets the developers know
-what is not working properly. Without this sort of feedback every developer
-will believe that everything is working correctly.
-
-I have found a bug, what should I do?
-*************************************
-
-When you believe you have found a bug, it is always a good idea to verify the
-issue prior to opening a bug request.
-
-* Consult the documentation_ to ensure that you have configured your system
-  correctly
-* Get community support via Slack_ or our Forum_
-
-Ensure the problem is reproducible
-**********************************
-
-When you are able to verify that it is actually a bug, spend some time to
-document how to reproduce the issue. This documentation can be invaluable.
-
-When you wish to have a developer fix a bug that you found, helping them
-reproduce the issue is beneficial to everyone. Be sure to include information
-about the hardware you are using, commands that you were running, any other
-activities that you may have been doing at the time. This additional
-information can be very useful.
-
-* What were you attempting to achieve?
-* What was the configuration prior to the change?
-* What commands did you use? Use e.g. ``run show configuration commands``
-
-Include output
-**************
-
-The output you get when you find a bug can provide lots of information. If you
-get an error message on the screen, copy it exactly. Having the exact message
-can provide detail that the developers can use. Like wise if you have any log
-messages that also are from the time of the issue, include those. They may
-also contain information that is helpful for the development team.
-
-Report a Bug
-************
-
-Create an account on VyOS Phabricator_. Phabricator_ is located at
-https://phabricator.vyos.net. To create a bug-report use the quick link in the
-left side under the specific project. 
-
-* Provide as much information as you can
-* Which version of VyOS are you using? ``run show version``
-* How can we reproduce this Bug?
-
-Feature Request
----------------
-
-You have an idea of how to make VyOS better or you are in need of a specific
-feature which all users of VyOS would benefit from? To send a feature request
-please search Phabricator_ if there is already a request pending. You can
-enhance it or if you don't find one, create a new one by use the quick link in
-the left side under the specific project.
-
-.. _documentation: https://vyos.redthedocs.io
-.. _Slack: https://slack.vyos.io
-.. _Forum: https://forum.vyos.io
-.. _Phabricator: https://phabricator.vyos.net
\ No newline at end of file
diff --git a/docs/copyright.rst b/docs/copyright.rst
new file mode 100644
index 00000000..b727272b
--- /dev/null
+++ b/docs/copyright.rst
@@ -0,0 +1,19 @@
+################
+Copyright Notice
+################
+
+Copyright (C) 2018-2019 VyOS maintainers and contributors
+
+Permission is granted to make and distribute verbatim copies of this manual
+provided the copyright notice and this permission notice are preserved on all
+copies.
+
+Permission is granted to copy and distribute modified versions of this manual
+under the conditions for verbatim copying, provided that the entire resulting
+derived work is distributed under the terms of a permission notice identical
+to this one.
+
+Permission is granted to copy and distribute translations of this manual into
+another language, under the above conditions for modified versions, except that
+this permission notice may be stated in a translation approved by the VyOS
+maintainers.
\ No newline at end of file
diff --git a/docs/documentation.rst b/docs/documentation.rst
new file mode 100644
index 00000000..40edf750
--- /dev/null
+++ b/docs/documentation.rst
@@ -0,0 +1,175 @@
+.. _documentation:
+
+Documentation
+=============
+
+As most software projects we also have a lack in documentation. We encourage
+every VyOS user to help us improve our documentation. This will not only be
+benefical four you (when reading something up) but also for the whole world.
+
+If you are willing to contribute to our documentation this is the definate
+guid how to do so.
+
+.. note:: In contrast to submitting code patches there is no requirement that
+   you open up a Phabricator_ task prior to submitting a Pull-Request to the
+   documentation.
+
+Forking Workflow
+----------------
+
+The Forking Workflow is fundamentally different than other popular Git
+workflows. Instead of using a single server-side repository to act as the
+"central" codebase, it gives every developer their own server-side repository.
+This means that each contributor has not one, but two Git repositories: a
+private local one and a public server-side one.
+
+The main advantage of the Forking Workflow is that contributions can be
+integrated without the need for everybody to push to a single central
+repository. Developers push to their own server-side repositories, and only the
+project maintainer can push to the official repository. This allows the
+maintainer to accept commits from any developer without giving them write
+access to the official codebase.
+
+.. note:: Updates to our documentation should be delivered by a GitHub
+   pull-request. This requires you already have a GitHub account.
+
+* Fork this project on GitHub https://github.com/vyos/vyos-documentation/fork
+
+* Clone fork to local machine
+
+* Change to your new local directory ``$ cd vyos-documentation``
+
+* Create new branch for your work, use a descriptive name of your work:
+  ``$ git checkout -b fix-vxlan-typo``
+
+* Make all your changes - please keep our commit rules in mind
+  (:ref:`prepare_commit`). This mainly applies to proper commit messages
+  describing your change (how and why). Please check out the documentation of
+  Sphinx-doc_ or reStructuredText_ if you are not familiar with it. This is used
+  for writing our docs.
+
+* Check your changes by locally building the documentation ``$ make html``.
+  Sphinx will build the html files in the ``docs/_build`` folder. We provide
+  you with a Docker container for an easy to use user experience. Check the
+  README.md_ file of this repository.
+
+* View modified files by calling ``$ git status``. You will get an overview of
+  all files modified by you. You can add individual files to the Git Index in
+  the next step.
+
+* Add modified files to Git index ``$ git add path/to/filename`` or add all
+  unstaged files ``$ git add .``. All files added to the Git index will be part
+  of you following Git commit.
+
+* Commit your changes ``$ git commit -v`` - your configured editor will now ne
+  launched where you can type in a commit message. Again please make yourself
+  comfortable with out rules (:ref:`prepare_commit`).
+
+* Push your commits to your GitHub project: ``$ git push -u origin foo-branch``
+
+* Submit pull-request. In GitHub visit the main repository and you should
+  see a banner suggesting to make a pull request. Fill out the form and
+  describe what you do.
+
+* Once pull resquests have been approved, you may want to locally update
+  your forked repository too. First you'll have to add a second remote
+  called `upstream` which points to our main repository. ``$ git remote add
+  upstream https://github.com/vyos/vyos-documentation.git``
+
+  Check your configured remote repositories:
+
+  .. code-block:: none
+
+    $ git remote -v
+    origin    https://github.com/<username>/vyos-documentation.git (fetch)
+    origin    https://github.com/<username>/vyos.documentation.git (push)
+    upstream  https://github.com/vyos/vyos-documentation.git (fetch)
+    upstream  https://github.com/vyos/vyos-documentation.git (push)
+
+  Your remote repo on Github is called ``origin``, while the original repo you
+  have forked is called ``upstream``. Now you can locally update your forked
+  repo.
+
+  .. code-block:: none
+
+    $ git fetch upstream
+    $ git checkout master
+    $ git merge upstream/master
+
+* If you want to update your fork on GitHub, too use the following: ``$ git
+  push origin master``
+
+Style Guide
+-----------
+
+Sections
+^^^^^^^^
+
+We use the following syntax for Headlines.
+
+.. code-block:: none
+
+  #####
+  Parts
+  #####
+
+  ********
+  Chapters
+  ********
+
+  Sections
+  ========
+
+  Subsections
+  -----------
+
+  Subsubsections
+  ^^^^^^^^^^^^^^
+
+  Paragraphs
+  """"""""""
+
+Address space
+^^^^^^^^^^^^^
+
+Note the following RFCs (:rfc:`5737`, :rfc:`3849`, :rfc:`5389` and
+:rfc:`7042`), which describe the reserved public IP addresses and autonomous
+system numbers for the documentation:
+
+  * ``192.0.2.0/24``
+  * ``198.51.100.0/24``
+  * ``203.0.113.0/24``
+  * ``2001:db8::/32``
+  * 16bit ASN: ``64496 - 64511``
+  * 32bit ASN: ``65536 - 65551``
+  * Unicast MAC Addresses: ``00-53-00`` to ``00-53-FF``
+  * Multicast MAC-Addresses: ``90-10-00`` to ``90-10-FF``
+
+Please don't use other public address space.
+
+
+Custom Sphinx-doc Markup
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+When documenting CLI commands use the ``.. cfgcmd::`` directive for all
+configuration mode commands. When documenting operational level command use
+the ``.. opcmd::`` directive. An explanation of the described command should
+be added below this statement.
+
+**Example**
+
+.. code-block:: none
+
+  .. opcmd:: show protocols static arp
+
+  Display all known ARP table entries spanning accross all interfaces
+
+  .. cfgcmd:: set protocols static arp 192.0.2.100 hwaddr 00:53:27:de:23:aa
+
+  This will configure a static ARP entry always resolving `192.0.2.100` to
+  `00:53:27:de:23:aa`.
+
+.. _Sphinx-doc: https://www.sphinx-doc.org
+.. _reStructuredText: http://www.sphinx-doc.org/en/master/usage/restructuredtext/index.html
+.. _Phabricator: https://phabricator.vyos.net
+.. _README.md: https://github.com/vyos/vyos-documentation/blob/master/README.md
diff --git a/docs/draw.io/pbr_example_1.drawio b/docs/draw.io/pbr_example_1.drawio
deleted file mode 100644
index 0d496572..00000000
--- a/docs/draw.io/pbr_example_1.drawio
+++ /dev/null
@@ -1 +0,0 @@
-<mxfile modified="2019-06-20T09:46:15.910Z" host="www.draw.io" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" etag="pgW5M9QC_GIVY4GNWbyF" version="10.7.9" type="device"><diagram name="Page-1" id="c37626ed-c26b-45fb-9056-f9ebc6bb27b6">7VrbcqM4EP0aP4ZCgLk8xkk8u1UzW97K7FyepmRQsGoEYoUc2/P1K4G4CLBNJo7j2rLzAGpJrVafPq2WnYl9l2w/MJitPtEIkYllRtuJfT+xLMtzTPGQkl0pCQKnFMQMR6UINIJH/AspoZoXr3GEcm0gp5RwnOnCkKYpCrkmg4zRjT7siRJ91QzGqCd4DCHpS7/iiK+UFJhm0/EHwvFKLe1PVccShj9jRtepWm9i2U/Fp+xOYKVLjc9XMKKblsh+mNh3jFJeviXbO0Skbyu3lfPme3pruxlK+ZgJn4MU/ArY39bX3eKfT37yffHh8w2wSzXPkKxRtQ+XCIWzCD9Lq/lOecr9dy1NnXG05TeQ4Did2LdiBEFPXDxET+H+lN/kBciyD9jZtpkp3mL1LFbIM5h2ZcuuQGoctGPUUn8+LkClSbimVKYvIMS9RYVsyDghLryiS9/HUa/zCwgswzSAMcI5YxxhaZZYK54Q8QZE3zNiHAu2fYRLRBY0xxxT4Y/7JeWcJmKActB9KMIYMSEgcuSsJtcdJZQVait6NUpv1VxOM+klzujPmsRWLWlpME3fnEsEnjAhQ5prkspBEcxXKFIN0ZPJ7SXbWCZCA9PcM7DISrkRErqOaj9I49B2L0lBTX2RUhFNEGc7MURNuAkCv5yj0qkTlM1NKzf5SrZqpSVgqbQLVT6Ma91NThAvKi28JEU4r04RrLDzgnOEdZwG58kRJ/bUKZKEZYzwzjVJnDNJeO6lJQnLHUgSHcBRJAov1cxRnIjdPjSiGUqjW1nPSZgJzHMcCmErSNAW82+t9+/S58ZUte63CoKisVMNGa0tBGf2fO66fWSjKfIjZygWXHdmzee9uLFrIOWmDsMofEDXLEQHvBcMw92Csyo622hWMoYI5PhZN2MIYbXCguIiK1TR5HeiyfV94VZNS7kDNbFdY/Z0TXVdoK+LQxYj3tMlsIe71rBMDsgPmd1Zyp0GaqnR1gnz9CnipbSjYUKNxyvIEZyNHOb/jxzWu5LD87wqgOs48w3fbj6/SxXPORtVukv1qPI2cQ+s43HfPTFDnIfUEIe6OOdz9dRDXTtwO7Fq2q4feEOx2hzevQLgaPUxXEkUhUf75G9qgpAmkqA1y+YwwUT6/gtiEUyhEqsvQ4B1qruDr0eq5Vcwt9li+85AZVCVCyevDGxwPAhkEZft9YD65gcuq+Hmiz3jAZ0AU98Z8AzwBxIJqDLJ6WumnmO+fLz9C9RX8iUbLvH3lfMbZbUs6FPKEkiGS3rg+obA2xD7msuCcE8R38Fos8IcPWawyNUbwVWdlSPZoLMPjOOHM1CLT+Vfj+gpTVE1WZkO9hJ4FOUOxPTBM+nMsTR0Rx+VaQU4WZFrf8A0+pEhhrMVYpDkRtYpMS4j754cM6XGcbUEMXCj8vw+oN5b4TniOnXF8xCeUx3P6TvjaY8ohd78FARmtb9LOgb7l6PiGDTPcwz612Pw9yl4/Gp25liqflS85s0Xg3aZ5yAYcXu4AnoRB6FoNj9ml18hNP8xYD/8Bw==</diagram></mxfile>
\ No newline at end of file
diff --git a/docs/draw.io/vpn_s2s_ikev2.drawio b/docs/draw.io/vpn_s2s_ikev2.drawio
deleted file mode 100644
index b240c191..00000000
--- a/docs/draw.io/vpn_s2s_ikev2.drawio
+++ /dev/null
@@ -1 +0,0 @@
-<mxfile modified="2019-07-18T20:12:29.116Z" host="www.draw.io" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36" etag="se-JT0q6YZwCfwyGJaAA" version="10.9.8" type="device"><diagram name="Page-1" id="c37626ed-c26b-45fb-9056-f9ebc6bb27b6">7Zrdk6I4EMD/Gh+lSMLn4zgz7j7cVk3V1H3svWxFiJhaIB7EUfevv4QEIYCje6eOW4XzIOmQTtL5ddP0OEGP2e5TgderLywm6QTa8W6CniYQIoCA+JKSvZJA2/WVJClorGSgEbzSH0QLbS3d0JiUxo2csZTTtSmMWJ6TiBsyXBRsa962ZKk56xonpCd4jXDal/5JY77SUmDbTcdnQpOVnjpwdccCR9+Tgm1yPd8EomX1Ud0ZrnXp+8sVjtm2JULPE/RYMMbVVbZ7JKk0bm02NW5+pPew7oLk/JwBv/tf4d9PP749rV+/8DAihK2iqRwg1bzhdEPqfVSr5fvaQtUeidQCJmi2XVFOXtc4kr1bAYWQrXiW6m6tjhSc7I4uFBy2L7giLCO82Itb9ICp43pqjGZqilytZNuckOM4SrZqHQ6qccSaiuSgvbGMuNDG+RlDgTs0FLADdHeWOsNQwhXW8jLbJTKqWBEtI2YJ83FSlPrbtFaMy1VlWVs0ljRNH1nKikobspEXhL6Ql7xg30mrR/tj3VP7tzDpTBqeiijwG16Q9IWVlFOWi74F45xlrRseUprIDs7kATZHLBdycGnZiFhGo3qFLOdznNFUnssfpIhxjrVYR0AAL8aA65gMwNDtMYCCAQZAEF7LW0YGbsmAg+4PATQicEsEfMe3XBOCAKCPhsA5DQGJRTqmmyVJMrHh50Y0I3n8ILM80ZuznJg4kB3lf0lbi62r1ldteXn9tGs39q0zabExQ/O55/Vpil0SxM4QTZ43g/N5jyakJ3ohBRXGk+SqyXNhSLXI6rCrdrVMK6ybzUqr1r7d6uuL51SeQtVS5pQ2fB8cYXK2KSJy+rnNcZEQfsqx+yC2IKsz5DZjtawgKeb0zVzuEHd6hhdGxUYazgMPWQFqPp30B3qmRrVrraSdHPf0hu/p9UPf8lof15xF2aw3iwAX71u3reUN5bubOxLHjy+7O8LxT4zwbfDuCHGh1t14/eGU/3sgcMdA0AoEQXDPgQD+EoHA8aDhsHbHZcWbutVx07ODAfKBBfruXqt2PTAQKy4dDKADf9K1nbqmclPXBkOZnpeK454txEXCKzqVQPqc4fXePxtWd0zLKid6EDeAYL1rOmstwIcWCCzRbYmNzqFTqxUNpdmcTYhbK+iEG5FrcTOImA6ug0w7GmgR1qlgJDyrSlC7OWJG47iKWUMlADN1vETq13sGuHY/+weO2/fFujR1+RrAUOJ3FSYs6I4YqAd7FwOvrvu0a0H+LSkYeupfhwIZ+UYI4DSEdvc1EDWiDwPBG8PBrUlw7LsLB/4YDm4MAewWBg9l/w+DILh5tgjHbLH9bhPeXbYYHkXi/xHwxmkTCBZF98DLNc6PK9/qnUv1OSsynA4gZlvyT25f+tWBI6W5h5dJXYewE/8uPLPibJYiwOSsGrQz6VU9lq78O4q5HKyXDgaQVkXyS9AK7O7LdwgGshlYv/0blQZ0JV5rR/hlgUUjsNcCtle1Ce2PpvUK7+LQGcK3qHYzPmWrUlwv8Rp8CxsokF7tMQuv8Do+DEJKliMH+vnldP9FNZSBXwYD0Wx+TqbKu82P9tDzvw==</diagram></mxfile>
\ No newline at end of file
diff --git a/docs/firewall.rst b/docs/firewall.rst
deleted file mode 100644
index 59bbaa31..00000000
--- a/docs/firewall.rst
+++ /dev/null
@@ -1,202 +0,0 @@
-.. _firewall:
-
-Firewall
-========
-
-VyOS makes use of Linux `netfilter <http://netfilter.org/>`_ for packet filtering.
-
-The firewall supports the creation of groups for ports, addresses, and networks
-(implemented using netfilter ipset) and the option of interface or zone based
-firewall policy.
-
-**Important note on usage of terms:** The firewall makes use of the terms
-`in`, `out`, and `local` for firewall policy. Users experienced with netfilter
-often confuse `in` to be a reference to the `INPUT` chain, and `out` the
-`OUTPUT` chain from netfilter. This is not the case. These instead indicate the
-use of the `FORWARD` chain and either the input or output interface. The
-`INPUT` chain, which is used for local traffic to the OS, is a reference to
-as `local` with respect to its input interface.
-
-Zone-based Firewall Policy
---------------------------
-
-As an alternative to applying policy to an interface directly, a zone-based
-firewall can be created to simplify configuration when multiple interfaces
-belong to the same security zone. Instead of applying to rulesets to interfaces
-they are applied to source zone-destination zone pairs.
-
-An example to zone-based firewalls can be found here: :ref:`examples-zone-policy`.
-
-Groups
-------
-
-Firewall groups represent collections of IP addresses, networks, or ports. Once
-created, a group can be referenced by firewall rules as either a source or
-destination. Members can be added or removed from a group without changes to
-or the need to reload individual firewall rules.
-
-.. note:: Groups can also be referenced by NAT configuration.
-
-While **network groups** accept IP networks in CIDR notation, specific IP addresses
-can be added as a 32-bit prefix. If you foresee the need to add a mix of
-addresses and networks, the network group is recommended.
-
-Here is an example of a network group for the IP networks that make up the
-internal network:
-
-.. code-block:: none
-
-  set firewall group network-group NET-INSIDE network 192.168.0.0/24
-  set firewall group network-group NET-INSIDE network 192.168.1.0/24
-
-Groups need to have unique names. Even though some contain IPv4 addresses and others contain IPv6 addresses, they still need to have unique names, so you may want to append "-v4" or "-v6" to your group names.
-
-.. code-block:: none
-
-  set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24
-  set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64
-
-
-A **port group** represents only port numbers, not the protocol. Port groups can
-be referenced for either TCP or UDP. It is recommended that TCP and UDP groups
-are created separately to avoid accidentally filtering unnecessary ports.
-Ranges of ports can be specified by using `-`.
-
-Here is an example of a port group a server:
-
-.. code-block:: none
-
-  set firewall group port-group PORT-TCP-SERVER1 port 80
-  set firewall group port-group PORT-TCP-SERVER1 port 443
-  set firewall group port-group PORT-TCP-SERVER1 port 5000-5010
-
-Rule-Sets
----------
-
-A rule-set is a named collection of firewall rules that can be applied to an
-interface or zone. Each rule is numbered, has an action to apply if the rule
-is matched, and the ability to specify the criteria to match.
-
-Example of a rule-set to filter traffic to the internal network:
-
-.. code-block:: none
-
-  set firewall name INSIDE-OUT default-action drop
-  set firewall name INSIDE-OUT rule 1010 action accept
-  set firewall name INSIDE-OUT rule 1010 state established enable
-  set firewall name INSIDE-OUT rule 1010 state related enable
-  set firewall name INSIDE-OUT rule 1020 action drop
-  set firewall name INSIDE-OUT rule 1020 state invalid enable
-
-Applying a Rule-Set to an Interface
------------------------------------
-
-Once a rule-set is created, it can be applied to an interface.
-
-.. note:: Only one rule-set can be applied to each interface for `in`, `out`,
-   or `local` traffic for each protocol (IPv4 and IPv6).
-
-.. code-block:: none
-
-  set interfaces ethernet eth1 firewall out name INSIDE-OUT
-
-Applying a Rule-Set to a Zone
------------------------------
-
-A named rule-set can also be applied to a zone relationship (note, zones must
-first be created):
-
-.. code-block:: none
-
-  set zone-policy zone INSIDE from OUTSIDE firewall name INSIDE-OUT
-
-How VyOS replies when being pinged
-----------------------------------
-
-By default, when VyOS receives an ICMP echo request packet destined for itself, it will answer with an ICMP echo reply, unless you avoid it through its firewall.
-
-With the firewall you can set rules to accept, drop or reject ICMP in, out or local traffic. You can also use the general **firewall all-ping** command. This command affects only to LOCAL (packets destined for your VyOS system), not to IN or OUT traffic.
-
-.. note:: **firewall all-ping** affects only to LOCAL and it always behaves in the most restrictive way
-
-.. code-block:: none
-
-  set firewall all-ping enable
-
-When the command above is set, VyOS will answer every ICMP echo request addressed to itself, but that will only happen if no other rule is applied droping or rejecting local echo requests. In case of conflict, VyOS will not answer ICMP echo requests.
-
-.. code-block:: none
-
-  set firewall all-ping disable
-
-When the comand above is set, VyOS will answer no ICMP echo request addressed to itself at all, no matter where it comes from or whether more specific rules are being applied to accept them.
-
-Example Partial Config
-----------------------
-
-.. code-block:: none
-
-  firewall {
-     all-ping enable
-     broadcast-ping disable
-     config-trap disable
-     group {
-         network-group BAD-NETWORKS {
-             network 198.51.100.0/24
-             network 203.0.113.0/24
-         }
-         network-group GOOD-NETWORKS {
-             network 192.0.2.0/24
-         }
-         port-group BAD-PORTS {
-             port 65535
-         }
-     }
-     name FROM-INTERNET {
-         default-action accept
-         description "From the Internet"
-         rule 10 {
-             action accept
-             description "Authorized Networks"
-             protocol all
-             source {
-                 group {
-                     network-group GOOD-NETWORKS
-                 }
-             }
-         }
-         rule 11 {
-             action drop
-             description "Bad Networks"
-             protocol all
-             source {
-                 group {
-                     network-group BAD-NETWORKS
-                 }
-             }
-         }
-         rule 30 {
-             action drop
-             description "BAD PORTS"
-             destination {
-                 group {
-                     port-group BAD-PORTS
-                 }
-             }
-             log enable
-             protocol all
-         }
-     }
-  }
-  interfaces {
-     ethernet eth1 {
-         address dhcp
-         description OUTSIDE
-         duplex auto
-         firewall {
-             in {
-                 name FROM-INTERNET
-             }
-         }
-     }
-  }
diff --git a/docs/high-availability.rst b/docs/high-availability.rst
deleted file mode 100644
index 81cc2d44..00000000
--- a/docs/high-availability.rst
+++ /dev/null
@@ -1,158 +0,0 @@
-.. _high-availability:
-
-High availability
-=================
-
-VRRP (Virtual Redundancy Protocol) provides active/backup redundancy for routers. 
-Every VRRP router has a physical IP/IPv6 address, and a virtual address.
-On startup, routers elect the master, and the router with the highest priority becomes the master and assigns the virtual address to its interface.
-All routers with lower priorities become backup routers. The master then starts sending keepalive packets to notify other routers that it's available.
-If the master fails and stops sending keepalive packets, the router with the next highest priority becomes the new master and takes over the virtual address.
-
-VRRP keepalive packets use multicast, and VRRP setups are limited to a single datalink layer segment.
-You can setup multiple VRRP groups (also called virtual routers). Virtual routers are identified by a VRID (Virtual Router IDentifier).
-If you setup multiple groups on the same interface, their VRIDs must be unique, but it's possible (even if not recommended for readability reasons) to use duplicate VRIDs on different interfaces.
-
-Basic setup
------------
-
-VRRP groups are created with the ``set high-availability vrrp group $GROUP_NAME`` commands.
-The required parameters are interface, vrid, and virtual-address.
-
-minimal config
-
-.. code-block:: none
-
-  set high-availability vrrp group Foo vrid 10
-  set high-availability vrrp group Foo interface eth0
-  set high-availability vrrp group Foo virtual-address 192.0.2.1/24
-
-You can verify your VRRP group status with the operational mode ``run show vrrp`` command:
-
-.. code-block:: none
-
-  vyos@vyos# run show vrrp 
-  Name        Interface      VRID  State    Last Transition
-  ----------  -----------  ------  -------  -----------------
-  Foo         eth1             10  MASTER   2s
-
-IPv6 support
-------------
-
-The ``virtual-address`` parameter can be either an IPv4 or IPv6 address, but you cannot mix IPv4 and IPv6 in the same group, and will need to create groups with different VRIDs specially for IPv4 and IPv6.
-
-Disabling a VRRP group
-----------------------
-
-You can disable a VRRP group with ``disable`` option:
-
-.. code-block:: none
-
-  set high-availability vrrp group Foo disable
-
-A disabled group will be removed from the VRRP process and your router will not participate in VRRP for that VRID. It will disappear from operational mode commands output, rather than enter the backup state.
-
-Setting VRRP group priority
----------------------------
-
-VRRP priority can be set with ``priority`` option:
-
-.. code-block:: none
-
-  set high-availability vrrp group Foo priority 200
-
-The priority must be an integer number from 1 to 255. Higher priority value increases router's precedence in the master elections.
-
-Sync groups
------------
-
-A sync group allows VRRP groups to transition together.  
-
-.. code-block:: none
-
-    edit high-availability
-    set sync-group MAIN member VLAN9
-    set sync-group MAIN member VLAN20
-
-In the following example, when VLAN9 transitions, VLAN20 will also transition:
-
-.. code-block:: none
-
-    vrrp {
-        group VLAN9 {
-            interface eth0.9
-            virtual-address 10.9.1.1/24
-            priority 200
-            vrid 9
-        }
-        group VLAN20 {
-            interface eth0.20
-            priority 200
-            virtual-address 10.20.20.1/24
-            vrid 20
-        }
-        sync-group MAIN {
-            member VLAN20
-            member VLAN9
-        }
-    }
-
-
-.. warning:: All items in a sync group should be similarly configured.  If one VRRP group is set to a different premption delay or priority, it would result in an endless transition loop.
-
-
-Preemption
-----------
-
-VRRP can use two modes: preemptive and non-preemptive. In the preemptive mode, if a router with a higher priority fails and then comes back, routers with lower priority will give up their master status. In non-preemptive mode, the newly elected master will keep the master status and the virtual address indefinitely.
-
-By default VRRP uses preemption. You can disable it with the "no-preempt" option:
-
-.. code-block:: none
-
-  set high-availability vrrp group Foo no-preempt
-
-You can also configure the time interval for preemption with the "preempt-delay" option. For example, to set the higher priority router to take over in 180 seconds, use:
-
-.. code-block:: none
-
-  set high-availability vrrp group Foo preempt-delay 180
-
-Unicast VRRP
-------------
-
-By default VRRP uses multicast packets. If your network does not support multicast for whatever reason, you can make VRRP use unicast communication instead.
-
-.. code-block:: none
-
-  set high-availability vrrp group Foo peer-address 192.0.2.10
-  set high-availability vrrp group Foo hello-source-address 192.0.2.15
-
-Scripting
----------
-
-VRRP functionality can be extended with scripts. VyOS supports two kinds of scripts: health check scripts and transition scripts. Health check scripts execute custom checks in addition to the master router reachability.
-Transition scripts are executed when VRRP state changes from master to backup or fault and vice versa and can be used to enable or disable certain services, for example.
-
-Health check scripts
-^^^^^^^^^^^^^^^^^^^^
-
-This setup will make the VRRP process execute the ``/config/scripts/vrrp-check.sh script`` every 60 seconds, and transition the group to the fault state if it fails (i.e. exits with non-zero status) three times:
-
-.. code-block:: none
-
-  set high-availability vrrp group Foo health-check script /config/scripts/vrrp-check.sh
-  set high-availability vrrp group Foo health-check interval 60
-  set high-availability vrrp group Foo health-check failure-count 3
-
-Transition scripts
-^^^^^^^^^^^^^^^^^^
-
-Transition scripts can help you implement various fixups, such as starting and stopping services, or even modifying the VyOS config on VRRP transition.
-This setup will make the VRRP process execute the ``/config/scripts/vrrp-fail.sh`` with argument ``Foo`` when VRRP fails, and the ``/config/scripts/vrrp-master.sh`` when the router becomes the master:
-
-.. code-block:: none
-
-  set high-availability vrrp group Foo transition-script backup "/config/scripts/vrrp-fail.sh Foo"
-  set high-availability vrrp group Foo transition-script fault "/config/scripts/vrrp-fail.sh Foo"
-  set high-availability vrrp group Foo transition-script master "/config/scripts/vrrp-master.sh Foo"
diff --git a/docs/history.rst b/docs/history.rst
deleted file mode 100644
index 957cc6f3..00000000
--- a/docs/history.rst
+++ /dev/null
@@ -1,45 +0,0 @@
-.. _history:
-
-VyOS History
-==================
-
-VyOS is a Linux-based network operating system that provides software-based
-network routing, firewall, and VPN functionality.
-
-The VyOS project was started in late 2013 as a community fork of the
-`GPL <http://en.wikipedia.org/wiki/GNU_General_Public_License>`_ portions of
-Vyatta Core 6.6R1 with the goal of maintaining a free and open source network
-operating system in response to the decision to discontinue the community
-edition of Vyatta. Here everyone loves learning, older managers and new users.
-
-VyOS is primarily based on `Debian GNU/Linux <http://www.debian.org/>`_ and the
-`Quagga <http://www.nongnu.org/quagga/>`_ routing engine. Its configuration
-syntax and :ref:`cli` are loosely derived from Juniper JUNOS as modelled by the
-`XORP project <http://www.xorp.org/>`_, which was the original routing engine for
-Vyatta.
-
-In the 4.0 release of Vyatta, the routing engine was changed to Quagga.
-
-As of version 1.2.0, VyOS now uses `FRRouting <https://frrouting.org/>`_ as
-the routing engine.
-
-**How it's different from other router distributions and platforms?**
-
-- More than just a firewall and VPN, VyOS includes extended routing capabilities like OSPFv2, OSPFv3, BGP,
-  VRRP, and extensive route policy mapping and filtering.   
-- Unified command line interface in the style of hardware routers.
-- Scriptable CLI.
-- Stateful configuration system: prepare changes and commit at once or discard,
-  view previous revisions or rollback to them, archive revisions to remote
-  server and execute hooks at commit time.
-- Image-based upgrade: keep multiple versions on the same system and revert to
-  previous image if a problem arises.
-- Multiple VPN capabilities: OpenVPN, IPSec, Wireguard (in 1.2.0+), DPMVPN, and more.
-- IPv4 and IPv6 support.
-- Runs on physical and virtual platforms alike: small x86 boards, big servers,
-  KVM, Xen, VMWare, Hyper-V, and more. 
-- Completely free and open source, with documented internal APIs and build
-  procedures.
-- Community driven. Patches are welcome and all code, bugs, and nightly builds are
-  public.
-
diff --git a/docs/image-mgmt.rst b/docs/image-mgmt.rst
deleted file mode 100644
index 143d02b2..00000000
--- a/docs/image-mgmt.rst
+++ /dev/null
@@ -1,193 +0,0 @@
-.. _image-mgmt:
-
-################
-Image Management
-################
-
-The VyOS image-based installation is implemented by creating a directory for
-each image on the storage device selected during the install process.
-
-The directory structure of the boot device:
-
-.. code-block:: none
-
-  /
-  /boot
-  /boot/grub
-  /boot/1.2.0-rolling+201810021347
-
-The image directory contains the system kernel, a compressed image of the root
-filesystem for the OS, and a directory for persistent storage, such as
-configuration. On boot, the system will extract the OS image into memory and
-mount the appropriate live-rw sub-directories to provide persistent storage
-system configuration.
-
-This process allows for a system to always boot to a known working state, as
-the OS image is fixed and non-persistent. It also allows for multiple releases
-of VyOS to be installed on the same storage device. The image can be selected
-manually at boot if needed, but the system will otherwise boot the image
-configured to be the default.
-
-.. opcmd:: show system image
-
-   List all available system images which can be bootet on the current system.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show system image
-     The system currently has the following image(s) installed:
-
-        1: 1.2.0-rolling+201810021347 (default boot)
-        2: 1.2.0-rolling+201810021217
-        3: 1.2.0-rolling+201809252218
-
-
-.. opcmd:: delete system image [image-name]
-
-   Delete no longer needed images from the system. You can specify an optional
-   image name to delete, the image name can be retrieved via a list of available
-   images can be shown using the :opcmd:`show system image`.
-
-   .. code-block:: none
-
-      vyos@vyos:~$ delete system image
-      The following image(s) can be deleted:
-
-         1: 1.3-rolling-201912181733 (default boot) (running image)
-         2: 1.3-rolling-201912180242
-         3: 1.2.2
-         4: 1.2.1
-
-      Select the image to delete: 2
-
-      Are you sure you want to delete the
-      "1.3-rolling-201912180242" image? (Yes/No) [No]: y
-      Deleting the "1.3-rolling-201912180242" image...
-      Done
-
-.. opcmd:: show version
-
-   Show current system image version.
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show version
-      Version:          VyOS 1.3-rolling-201912181733
-      Built by:         autobuild@vyos.net
-      Built on:         Wed 18 Dec 2019 17:33 UTC
-      Build UUID:       bccde2c3-261c-49cc-b421-9b257204e06c
-      Build Commit ID:  f7ce0d8a692f2d
-
-      Architecture:     x86_64
-      Boot via:         installed image
-      System type:      bare metal
-
-      Hardware vendor:  VMware, Inc.
-      Hardware model:   VMware Virtual Platform
-      Hardware S/N:     VMware-42 1d 83 b9 fe c1 bd b2-7d 3d 49 db 94 18 f5 c9
-      Hardware UUID:    b9831d42-c1fe-b2bd-7d3d-49db9418f5c9
-
-      Copyright:        VyOS maintainers and contributors
-
-
-.. _update_vyos:
-
-Update VyOS
-===========
-
-New system images can be added using the :opcmd:`add system image`
-command. The command will extract the chosen image and will prompt you
-to use the current system configuration and SSH security keys, allowing
-for the new image to boot using the current configuration.
-
-.. note:: Only LTS releases are PGP-signed.
-
-.. opcmd:: add system image <url | path> [vrf name] [username user [password pass]]
-
-   Use this command to install a new system image. You can reach the
-   image from the web (http://, https://) or from your local system,
-   e.g.  /tmp/vyos-1.2.3-amd64.iso.
-
-   The `add system image` command also supports installing new versions
-   of VyOS through an optional given VRF. Also if URL in question requires
-   authentication, you can specify an optional username and password via
-   the commandline which will be passed as "Basic-Auth" to the server.
-
-If there is not enough **free disk space available**, the installation
-will be canceled. To delete images use the :opcmd:`delete system image`
-command.
-
-VyOS configuration is associated to each image, and **each image has a
-unique copy of its configuration**. This is different than a traditional
-network router where the configuration is shared across all images.
-
-.. note:: If you have any personal files, like some scripts you created,
-   and you don't want them to be lost during the upgrade, make sure
-   those files are stored in ``/config`` as this directory is always copied
-   to newer installed images.
-
-You can access files from a previous installation and copy them to your
-current image if they were located in the ``/config`` directory. This
-can be done using the :opcmd:`copy` command. So, for instance, in order
-to copy ``/config/config.boot`` from VyOS 1.2.1 image, you would use the
-following command:
-
-.. code::
-
-   copy file 1.2.1://config/config.boot to /tmp/config.boot.1.2.1
-
-
-Example
-"""""""
-
-.. code-block:: none
-
-     vyos@vyos:~$ add system image https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
-     Trying to fetch ISO file from https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
-       % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
-                                      Dload  Upload   Total   Spent    Left  Speed
-     100  338M  100  338M    0     0  3837k      0  0:01:30  0:01:30 --:--:-- 3929k
-     ISO download succeeded.
-     Checking for digital signature file...
-       % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
-                                      Dload  Upload   Total   Spent    Left  Speed
-       0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
-     curl: (22) The requested URL returned error: 404 Not Found
-
-     Unable to fetch digital signature file.
-     Do you want to continue without signature check? (yes/no) [yes]
-     Checking MD5 checksums of files on the ISO image...OK.
-     Done!
-
-     What would you like to name this image? [vyos-1.3-rolling-201912201452]:
-
-     OK.  This image will be named: vyos-1.3-rolling-201912201452
-
-
-.. hint:: | The most up-do-date Rolling Release for AMD64 can be accessed using the following URL:
-   | https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
-
-After reboot you might want to verify the version you are running with
-the :opcmd:`show version` command.
-
-
-System rollback
-===============
-
-If you need to rollback to a previous image, you can easily do so. First
-check the available images through the :opcmd:`show system image`
-command and then select your image with the following command:
-
-.. opcmd:: set system image default-boot [image-name]
-
-   Select the default boot image which will be started on the next boot
-   of the system.
-
-Then reboot the system.
-
-.. note:: VyOS automatically associates the configuration to the image,
-   so you don't need to worry about that. Each image has a unique copy
-   of its configuration.
-
-If you have access to the console, there is a another way to select
-your booting image: reboot and use the GRUB menu at startup.
diff --git a/docs/index.rst b/docs/index.rst
index d0f2c6e7..e3c92e22 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -4,85 +4,43 @@
 VyOS User Guide
 ###############
 
-
-.. toctree::
-   :caption: Introduction
-   :name: intro
-   :maxdepth: 2
-
-   about
-   history
-   install
-   cli
-   quick-start
-
 .. toctree::
-   :caption: Configuration
-   :name: configuration
-   :maxdepth: 2
-
-   configuration-overview
-   interfaces/index
-   routing/index
-   firewall
-   nat
-   vpn/index
-   qos
-   services/index
-   system/index
-   high-availability
-   load-balancing
-   image-mgmt
-   commandscripting
-.. modules
+   :maxdepth: 1
 
+   introducing/about
+   introducing/history
+   changelog/index
 
 
 .. toctree::
-   :caption: Appendix
-   :name: appendix
    :maxdepth: 2
+   :includehidden:
+   :caption: First Steps
 
-   appendix/releasenotes
-   appendix/troubleshooting
-   appendix/examples/index
-   appendix/commandtree/index
-   appendix/vyos-on-vmware
-   appendix/vyos-on-gns3
-   appendix/vyos-on-baremetal
-   appendix/migrate-from-vyatta
+   installation/index
+   quick-start
+   cli
+   commandtree/index
 
 
 .. toctree::
-   :caption: Contributing
-   :name: contributing
    :maxdepth: 2
-   
-   contributing/issues_features
-   contributing/development
-   contributing/documentation
-   contributing/vyos_cli
-   contributing/coding_guidelines
-   contributing/upstream-packages
-   contributing/build-vyos
+   :includehidden:
+   :caption: Adminguide
 
+   configuration/index
+   operation/index
+   automation/index
+   troubleshooting/index
+   configexamples/index
 
-################
-Copyright Notice
-################
 
-Copyright (C) 2018-2019 VyOS maintainers and contributors
 
-Permission is granted to make and distribute verbatim copies of this manual
-provided the copyright notice and this permission notice are preserved on all
-copies.
-
-Permission is granted to copy and distribute modified versions of this manual
-under the conditions for verbatim copying, provided that the entire resulting
-derived work is distributed under the terms of a permission notice identical
-to this one.
+.. toctree::
+   :maxdepth: 2
+   :includehidden:
+   :caption: Development
 
-Permission is granted to copy and distribute translations of this manual into
-another language, under the above conditions for modified versions, except that
-this permission notice may be stated in a translation approved by the VyOS
-maintainers.
+   contributing/index
+   documentation
+   copyright
\ No newline at end of file
diff --git a/docs/install.rst b/docs/install.rst
deleted file mode 100644
index 87be9561..00000000
--- a/docs/install.rst
+++ /dev/null
@@ -1,514 +0,0 @@
-.. _installation:
-
-############
-Installation
-############
-
-VyOS installation requires to download a VyOS .iso file. That file is
-a live install image that lets you boot a live VyOS. From that live
-system you can proceed to the permanent installation on a hard drive or
-any other type of storage.
-
-
-Hardware requirements
-=====================
-
-The minimum system requirements are 512 MiB RAM and 2 GiB storage.
-Depending on your use you might need additional RAM and CPU resources e.g.
-when having multiple BGP full tables in your system.
-
-Download
-========
-
-Registered Subscribers
-----------------------
-
-Registered subscribers can log into https://support.vyos.io/ to have access to
-a variety of different downloads via the "Downloads" link. These downloads
-include LTS (Long-Term-Support) and associated hot-fix releases, early public
-access releases, pre-built VM images, as well as device specific installation
-ISOs.
-
-.. figure:: /_static/images/vyos-downloads.png
-
-Building from source
-----------------------
-
-Non-subscribers can always get the LTS release by building it from source.
-Instruction can be found in the :ref:`build` section of this manual. VyOS
-source code repository is available for everyone at
-https://github.com/vyos/vyos-build.
-
-Rolling Release
----------------
-
-Everyone can download bleeding-edge VyOS rolling images from:
-https://downloads.vyos.io/
-
-.. note:: Rolling releases contain all the latest enhancements and fixes. This
-   means that there will be new bugs of course. If you think you hit a bug
-   please follow the guide at :ref:`issues_features`. To improve VyOS we depend on
-   your feedback!
-
-The following link will always fetch the most recent VyOS build for AMD64
-systems from the current branch:
-https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
-
-
-Download Verification
----------------------
-
-LTS images are signed by VyOS lead package-maintainer private key. With
-the official public key, the authenticity of the package can be
-verified. :abbr:`GPG (GNU Privacy Guard)` is used for verification.
-
-.. note:: This subsection only applies e applies to LTS images, for
-   Rolling images please jump to :ref:`live_installation`.
-
-Preparing for the verification
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-First, install GPG or another OpenPGP implementation. On most GNU+Linux
-distributions it is installed by default as package managers use it to
-verify package signatures. If not pre-installed, it will need to be
-downloaded and installed.
-
-The official VyOS public key can be retrieved in a number of ways. Skip
-to :ref:`gpg-verification` if the key is already present.
-
-It can be retrieved directly from a key server:
-
-``gpg --recv-keys FD220285A0FE6D7E``
-
-Or it can be accessed via a web browser:
-
-https://pgp.mit.edu/pks/lookup?op=get&search=0xFD220285A0FE6D7E
-
-Or from the following block:
-
-.. code-block:: none
-
-  -----BEGIN PGP PUBLIC KEY BLOCK-----
-  Version: GnuPG v1.4.12 (GNU/Linux)
-
-  mQINBFXKsiIBEACyid9PR/v56pSRG8VgQyRwvzoI7rLErZ8BCQA2WFxA6+zNy+6G
-  +0E/6XAOzE+VHli+wtJpiVJwAh+wWuqzOmv9css2fdJxpMW87pJAS2i3EVVVf6ab
-  wU848JYLGzc9y7gZrnT1m2fNh4MXkZBNDp780WpOZx8roZq5X+j+Y5hk5KcLiBn/
-  lh9Zoh8yzrWDSXQsz0BGoAbVnLUEWyo0tcRcHuC0eLx6oNG/IHvd/+kxWB1uULHU
-  SlB/6vcx56lLqgzywkmhP01050ZDyTqrFRIfrvw6gLQaWlgR3lB93txvF/sz87Il
-  VblV7e6HEyVUQxedDS8ikOyzdb5r9a6Zt/j8ZPSntFNM6OcKAI7U1nDD3FVOhlVn
-  7lhUiNc+/qjC+pR9CrZjr/BTWE7Zpi6/kzeH4eAkfjyALj18oC5udJDjXE5daTL3
-  k9difHf74VkZm29Cy9M3zPckOZpsGiBl8YQsf+RXSBMDVYRKZ1BNNLDofm4ZGijK
-  mriXcaY+VIeVB26J8m8y0zN4/ZdioJXRcy72c1KusRt8e/TsqtC9UFK05YpzRm5R
-  /nwxDFYb7EdY/vHUFOmfwXLaRvyZtRJ9LwvRUAqgRbbRZg3ET/tn6JZk8hqx3e1M
-  IxuskOB19t5vWyAo/TLGIFw44SErrq9jnpqgclTSRgFjcjHEm061r4vjoQARAQAB
-  tDZWeU9TIE1haW50YWluZXJzIChWeU9TIFJlbGVhc2UpIDxtYWludGFpbmVyc0B2
-  eW9zLm5ldD6JAjgEEwECACIFAlXKsiICGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4B
-  AheAAAoJEP0iAoWg/m1+xbgP+QEDYZi5dA4IPY+vU1L95Bavju2m2o35TSUDPg5B
-  jfAGuhbsNUceU+l/yUlxjpKEmvshyW3GHR5QzUaKGup/ZDBo1CBxZNhpSlFida2E
-  KAYTx4vHk3MRXcntiAj/hIJwRtzCUp5UQIqHoU8dmHoHOkKEP+zhJuR6E2s+WwDr
-  nTwE6eRa0g/AHY+chj2Je6flpPm2CKoTfUE7a2yBBU3wPq3rGtsQgVxPAxHRZz7A
-  w4AjH3NM1Uo3etuiDnGkJAuoKKb1J4X3w2QlbwlR4cODLKhJXHIufwaGtRwEin9S
-  1l2bL8V3gy2Hv3D2t9TQZuR5NUHsibJRXLSa8WnSCcc6Bij5aqfdpYB+YvKH/rIm
-  GvYPmLZDfKGkx0JE4/qtfFjiPJ5VE7BxNyliEw/rnQsxWAGPqLlL61SD8w5jGkw3
-  CinwO3sccTVcPz9b6A1RsbBVhTJJX5lcPn1lkOEVwQ7l8bRhOKCMe0P53qEDcLCd
-  KcXNnAFbVes9u+kfUQ4oxS0G2JS9ISVNmune+uv+JR7KqSdOuRYlyXA9uTjgWz4y
-  Cs7RS+CpkJFqrqOtS1rmuDW9Ea4PA8ygGlisM5d/AlVkniHz/2JYtgetiLCj9mfE
-  MzQpgnldNSPumKqJ3wwmCNisE+lXQ5UXCaoaeqF/qX1ykybQn41LQ+0xT5Uvy7sL
-  9IwGuQINBFXKsiIBEACg2mP3QYkXdgWTK5JyTGyttE6bDC9uqsK8dc1J66Tjd5Ly
-  Be0amO+88GHXa0o5Smwk2QNoxsRR41G/D/eAeGsuOEYnePROEr3tcLnDjo4KLgQ+
-  H69zRPn77sdP3A34Jgp+QIzByJWM7Cnim31quQP3qal2QdpGJcT/jDJWdticN76a
-  Biaz+HN13LyvZM+DWhUDttbjAJc+TEwF9YzIrU+3AzkTRDWkRh4kNIQxjlpNzvho
-  9V75riVqg2vtgPwttPEhOLb0oMzy4ADdfezrfVvvMb4M4kY9npu4MlSkNTM97F/I
-  QKy90JuSUIjE05AO+PDXJF4Fd5dcpmukLV/2nV0WM2LAERpJUuAgkZN6pNUFVISR
-  +nSfgR7wvqeDY9NigHrJqJbSEgaBUs6RTk5hait2wnNKLJajlu3aQ2/QfRT/kG3h
-  ClKUz3Ju7NCURmFE6mfsdsVrlIsEjHr/dPbXRswXgC9FLlXpWgAEDYi9Wdxxz8o9
-  JDWrVYdKRGG+OpLFh8AP6QL3YnZF+p1oxGUQ5ugXauAJ9YS55pbzaUFP8oOO2P1Q
-  BeYnKRs1GcMI8KWtE/fze9C9gZ7Dqju7ZFEyllM4v3lzjhT8muMSAhw41J22mSx6
-  VRkQVRIAvPDFES45IbB6EEGhDDg4pD2az8Q7i7Uc6/olEmpVONSOZEEPsQe/2wAR
-  AQABiQIfBBgBAgAJBQJVyrIiAhsMAAoJEP0iAoWg/m1+niUQAKTxwJ9PTAfB+XDk
-  3qH3n+T49O2wP3fhBI0EGhJp9Xbx29G7qfEeqcQm69/qSq2/0HQOc+w/g8yy71jA
-  6rPuozCraoN7Im09rQ2NqIhPK/1w5ZvgNVC0NtcMigX9MiSARePKygAHOPHtrhyO
-  rJQyu8E3cV3VRT4qhqIqXs8Ydc9vL3ZrJbhcHQuSLdZxM1k+DahCJgwWabDCUizm
-  sVP3epAP19FP8sNtHi0P1LC0kq6/0qJot+4iBiRwXMervCD5ExdOm2ugvSgghdYN
-  BikFHvmsCxbZAQjykQ6TMn+vkmcEz4fGAn4L7Nx4paKEtXaAFO8TJmFjOlGUthEm
-  CtHDKjCTh9WV4pwG2WnXuACjnJcs6LcK377EjWU25H4y1ff+NDIUg/DWfSS85iIc
-  UgkOlQO6HJy0O96L5uxn7VJpXNYFa20lpfTVZv7uu3BC3RW/FyOYsGtSiUKYq6cb
-  CMxGTfFxGeynwIlPRlH68BqH6ctR/mVdo+5UIWsChSnNd1GreIEI6p2nBk3mc7jZ
-  7pTEHpjarwOjs/S/lK+vLW53CSFimmW4lw3MwqiyAkxl0tHAT7QMHH9Rgw2HF/g6
-  XD76fpFdMT856dsuf+j2uuJFlFe5B1fERBzeU18MxML0VpDmGFEaxxypfACeI/iu
-  8vzPzaWHhkOkU8/J/Ci7+vNtUOZb
-  =Ld8S
-  -----END PGP PUBLIC KEY BLOCK-----
-
-Store the key in a new text file and import it into GPG via: ``gpg --import
-file_with_the_public_key``
-
-The import can be verified with:
-
-.. code-block:: none
-
-  $ gpg --list-keys
-  ...
-  pub   rsa4096 2015-08-12 [SC]
-      0694A9230F5139BF834BA458FD220285A0FE6D7E
-  uid           [ unknown] VyOS Maintainers (VyOS Release) <maintainers@vyos.net>
-  sub   rsa4096 2015-08-12 [E]
-
-.. _gpg-verification:
-
-GPG verification
-^^^^^^^^^^^^^^^^
-
-With the public key imported, the signature for the desired image needs
-to be downloaded.
-
-.. note:: The signature can be downloaded by appending `.asc` to the URL of the
-   downloaded VyOS image. That small *.asc* file is the signature for the
-   associated image.
-
-Finally, verify the authenticity of the downloaded image:
-
-.. code-block:: none
-
-  $ gpg2 --verify vyos-1.2.1-amd64.iso.asc  vyos-1.2.1-amd64.iso
-  gpg: Signature made So 14 Apr 12:58:07 2019 CEST
-  gpg:                using RSA key FD220285A0FE6D7E
-  gpg: Good signature from "VyOS Maintainers (VyOS Release) <maintainers@vyos.net>" [unknown]
-  Primary key fingerprint: 0694 A923 0F51 39BF 834B  A458 FD22 0285 A0FE 6D7E
-
-.. _live_installation:
-
-Live installation
-=================
-
-.. note:: A permanent VyOS installation always requires to go first
-   through a live installation.
-
-VyOS, as other GNU+Linux distributions, can be tasted without installing
-it in your hard drive. **With your downloaded VyOS .iso file you can
-create a bootable USB drive that will let you boot into a fully
-functional VyOS system**. Once you have tested it, you can either decide
-to begin a :ref:`permanent_installation` in your hard drive or power
-your system off, remove the USB drive, and leave everythng as it was. 
-
-
-If you have a GNU+Linux system, you can create your VyOS bootable USB
-stick with with the ``dd`` command:
-
- 1. Open your terminal emulator.
-
- 2. Find out the device name of your USB drive (you can use the ``lsblk``
-    command)
-
- 3. Unmount the USB drive. Replace X in the example below with the
-    letter of your device and keep the asterisk (wildcard) to unmount
-    all partitions.
-
- .. code-block:: none
- 
-  $ umount /dev/sdX* 
-
- 4. Write the image (your VyOS .iso file) to the USB drive.
-    Note that here you want to use the device name (e.g. /dev/sdb), not
-    the partition name (e.g. /dev/sdb1).
-
-  **Warning**: This will destroy all data on the USB drive!
-
- .. code-block:: none
- 
-   # dd if=/path/to/vyos.iso of=/dev/sdX bs=8M; sync
-
- 5. Wait until you get the outcome (bytes copied). Be patient, in some
-    computers it might take more than one minute.
-
- 6. Once ``dd`` has finished, pull the USB drive out and plug it into
-    the powered-off computer where you want to install (or test) VyOS.
-
- 7. Power the computer on, making sure it boots from the USB drive (you
-    might need to select booting device or change booting settings).
-
- 8. Once VyOS is completely loaded, enter the default credentials
-    (login: vyos, password: vyos).
-
-
-If you find difficulties with this method, prefer to use a GUI program,
-or have a different operating system, there are other programs you can
-use to create a bootable USB drive, like balenaEtcher_ (for GNU/Linux,
-macOS and Windows), Rufus_ (for Windows) and `many others`_. You can
-follow their instructions to create a bootable USB drive from an .iso
-file.
-
-.. hint:: The default username and password for the live system is *vyos*.
-
-
-.. _permanent_installation:
-
-Permanent installation
-======================
-
-.. note:: Before a permanent installation, VyOS requires a :ref:`live_installation`.
-
-Unlike general purpose Linux distributions, VyOS uses "image installation" that
-mimics the user experience of traditional hardware routers and allows keeping
-multiple VyOS versions installed simultaneously. This makes it possible to
-switch to a previous version if something breaks or miss-behaves after an image
-upgrade.
-
-Every version is contained in its own squashfs image that is mounted in a union
-filesystem together with a directory for mutable data such as configurations,
-keys, or custom scripts.
-
-.. note:: Older versions (prior to VyOS 1.1) used to support non-image
-   installation (``install system`` command). Support for this has been removed
-   from VyOS 1.2 and newer releases. Older releases can still be upgraded via
-   the general ``add system image <image_path>`` upgrade command (consult
-   :ref:`image-mgmt` for further information).
-
-
-In order to proceed with a permanent installation:
-
- 1. Log into the VyOS live system (use the default credentials: vyos,
-    vyos)
-
- 2. Run the ``install image`` command and follow the wizard:
-
- .. code-block:: none
-
-   vyos@vyos:~$ install image
-   Welcome to the VyOS install program.  This script
-   will walk you through the process of installing the
-   VyOS image to a local hard drive.
-   Would you like to continue? (Yes/No) [Yes]: Yes
-   Probing drives: OK
-   Looking for pre-existing RAID groups...none found.
-   The VyOS image will require a minimum 2000MB root.
-   Would you like me to try to partition a drive automatically
-   or would you rather partition it manually with parted?  If
-   you have already setup your partitions, you may skip this step
-   
-   Partition (Auto/Parted/Skip) [Auto]:
-   
-   I found the following drives on your system:
-    sda    4294MB
-   
-   Install the image on? [sda]:
-   
-   This will destroy all data on /dev/sda.
-   Continue? (Yes/No) [No]: Yes
-   
-   How big of a root partition should I create? (2000MB - 4294MB) [4294]MB:
-   
-   Creating filesystem on /dev/sda1: OK
-   Done!
-   Mounting /dev/sda1...
-   What would you like to name this image? [1.2.0-rolling+201809210337]:
-   OK.  This image will be named: 1.2.0-rolling+201809210337
-   Copying squashfs image...
-   Copying kernel and initrd images...
-   Done!
-   I found the following configuration files:
-       /opt/vyatta/etc/config.boot.default
-   Which one should I copy to sda? [/opt/vyatta/etc/config.boot.default]:
-   
-   Copying /opt/vyatta/etc/config.boot.default to sda.
-   Enter password for administrator account
-   Enter password for user 'vyos':
-   Retype password for user 'vyos':
-   I need to install the GRUB boot loader.
-   I found the following drives on your system:
-    sda    4294MB
-   
-   Which drive should GRUB modify the boot partition on? [sda]:
-   
-   Setting up grub: OK
-   Done!
-
-
- 3. After the installation is complete, remove the live USB stick or
-    CD.
-
- 4. Reboot the system.
-
- .. code-block:: none
-
-  vyos@vyos:~$ reboot
-  Proceed with reboot? (Yes/No) [No] Yes
-
- You will boot now into a permanent VyOS system.
-
-
-PXE Boot
-========
-
-VyOS can also be installed through PXE. This is a more complex
-installation method which allows deploying VyOS through the network.
-
-**Requirements**
-
-* Clients (where VyOS is to be installed) with a PXE-enabled NIC
-* DHCP Server 
-* TFTP Server
-* Webserver (HTTP) - optional, but we will use it to speed up installation
-* VyOS ISO image to be installed (do not use images prior to VyOS 1.2.3)
-* Files *pxelinux.0* and *ldlinux.c32* `from the Syslinux distribution <https://kernel.org/pub/linux/utils/boot/syslinux/>`_
-
-Configuration
--------------
-
-Step 1: DHCP
-^^^^^^^^^^^^
-
-Configure a DHCP server to provide the client with:
-
-* An IP address
-* The TFTP server address (DHCP option 66). Sometimes referred as *boot server*
-* The *bootfile name* (DHCP option 67), which is *pxelinux.0*
-
-In this example we configured an existent VyOS as the DHCP server:
-
-.. code-block:: none
-
-  vyos@vyos# show service dhcp-server
-   shared-network-name mydhcp {
-       subnet 192.168.1.0/24 {
-           bootfile-name pxelinux.0
-           bootfile-server 192.168.1.50
-           default-router 192.168.1.50
-           range 0 {
-               start 192.168.1.70
-               stop 192.168.1.100
-           }
-       }
-   }
-
-.. _install_from_tftp:
-
-Step 2: TFTP
-^^^^^^^^^^^^
-
-Configure a TFTP server so that it serves the following:
-
-* The *pxelinux.0* file from the Syslinux distribution
-* The *ldlinux.c32* file from the Syslinux distribution
-* The kernel of the VyOS software you want to deploy. That is the
-  *vmlinuz* file inside the */live* directory of the extracted
-  contents from the ISO file.
-* The initial ramdisk of the VyOS ISO you want to deploy. That is the
-  *initrd.img* file inside the */live* directory of the extracted
-  contents from the ISO file. Do not use an empty (0 bytes) initrd.img
-  file you might find, the correct file may have a longer name.
-* A directory named pxelinux.cfg which must contain the configuration
-  file. We will use the configuration_ file shown below, which we named
-  default_.
-
-.. _configuration: https://wiki.syslinux.org/wiki/index.php?title=Config
-.. _default: https://wiki.syslinux.org/wiki/index.php?title=PXELINUX#Configuration
-
-In the example we configured our existent VyOS as the TFTP server too:
-
-.. code-block:: none
-
-  vyos@vyos# show service tftp-server
-   directory /config/tftpboot
-   listen-address 192.168.1.50
-
-Example of the contents of the TFTP server:
-
-.. code-block:: none
-
-  vyos@vyos# ls -hal /config/tftpboot/
-  total 29M
-  drwxr-sr-x 3 tftp tftp      4.0K Oct 14 00:23 .
-  drwxrwsr-x 9 root vyattacfg 4.0K Oct 18 00:05 ..
-  -r--r--r-- 1 root vyattacfg  25M Oct 13 23:24 initrd.img-4.19.54-amd64-vyos
-  -rwxr-xr-x 1 root vyattacfg 120K Oct 13 23:44 ldlinux.c32
-  -rw-r--r-- 1 root vyattacfg  46K Oct 13 23:24 pxelinux.0
-  drwxr-xr-x 2 root vyattacfg 4.0K Oct 14 01:10 pxelinux.cfg
-  -r--r--r-- 1 root vyattacfg 3.7M Oct 13 23:24 vmlinuz
-
-  vyos@vyos# ls -hal /config/tftpboot/pxelinux.cfg
-  total 12K
-  drwxr-xr-x 2 root vyattacfg 4.0K Oct 14 01:10 .
-  drwxr-sr-x 3 tftp tftp      4.0K Oct 14 00:23 ..
-  -rw-r--r-- 1 root root       191 Oct 14 01:10 default
-
-Example of simple (no menu) configuration file:
-
-.. code-block:: none
-
-  vyos@vyos# cat /config/tftpboot/pxelinux.cfg/default
-  DEFAULT VyOS123
-
-  LABEL VyOS123
-   KERNEL vmlinuz
-   APPEND initrd=initrd.img-4.19.54-amd64-vyos boot=live nopersistence noautologin nonetworking fetch=http://address:8000/filesystem.squashfs
-
-Step 3: HTTP
-^^^^^^^^^^^^
-
-We also need to provide the *filesystem.squashfs* file. That is a heavy
-file and TFTP is slow, so you could send it through HTTP to speed up the
-transfer. That is how it is done in our example, you can find that in
-the configuration file above.
-
-**First** run a web server - you can use a simple one like
-`Python's SimpleHTTPServer`_ and start serving the `filesystem.squashfs`
-file. The file can be found inside the `/live` directory of the
-extracted contents of the ISO file.
-
-**Second**, edit the configuration file of the :ref:`install_from_tftp`
-so that it shows the correct URL at
-``fetch=http://<address_of_your_HTTP_server>/filesystem.squashfs``.
-
-.. note:: Do not change the name of the *filesystem.squashfs* file. If 
-   you are working with different versions, you can create different
-   directories instead.
-
-And **third**, restart the TFTP service. If you are using VyOS as your
-TFTP Server, you can restart the service with
-``sudo service tftpd-hpa restart``.
-
-.. note::  Make sure the available directories and files in both TFTP
-   and HTTP server have the right permissions to be accessed from the
-   booting clients.
-
-.. _`Python's SimpleHTTPServer`: https://docs.python.org/2/library/simplehttpserver.html
-
-Client Boot
------------
-
-Finally, turn on your PXE-enabled client or clients. They will
-automatically get an IP address from the DHCP server and start booting
-into VyOS live from the files automatically taken from the TFTP and HTTP
-servers.
-
-Once finished you will be able to proceed with the ``install image``
-command as in a regular VyOS installation.
-
-
-
-Known Issues
-============
-
-This is a list of known issues that can arise during installation.
-
-Black screen on install
-^^^^^^^^^^^^^^^^^^^^^^^
-
-GRUB attempts to redirect all output to a serial port for ease of installation on headless hosts.
-This appears to cause an hard lockup on some hardware that lacks a serial port, with the result being a 
-black screen after selecting the `Live system` option from the installation image.
-
-The workaround is to type `e` when the boot menu appears and edit the GRUB boot options.  Specifically, remove the:
-
-`console=ttyS0,115200` 
-
-option, and type CTRL-X to boot. 
-
-Installation can then continue as outlined above.
-
-.. _SYSLINUX: http://www.syslinux.org/
-.. _balenaEtcher: https://www.balena.io/etcher/
-.. _Rufus: https://rufus.ie/
-.. _many others: https://en.wikipedia.org/wiki/List_of_tools_to_create_Live_USB_systems
diff --git a/docs/installation/cloud/index.rst b/docs/installation/cloud/index.rst
new file mode 100644
index 00000000..f6060762
--- /dev/null
+++ b/docs/installation/cloud/index.rst
@@ -0,0 +1,9 @@
+##################################
+Running VyOS in Cloud Environments
+##################################
+
+
+
+.. toctree::
+   :caption: Content
+
diff --git a/docs/installation/image.rst b/docs/installation/image.rst
new file mode 100644
index 00000000..074a0245
--- /dev/null
+++ b/docs/installation/image.rst
@@ -0,0 +1,115 @@
+.. _image-mgmt:
+
+################
+Image Management
+################
+
+The VyOS image-based installation is implemented by creating a directory for
+each image on the storage device selected during the install process.
+
+The directory structure of the boot device:
+
+.. code-block:: none
+
+  /
+  /boot
+  /boot/grub
+  /boot/1.2.0-rolling+201810021347
+
+The image directory contains the system kernel, a compressed image of the root
+filesystem for the OS, and a directory for persistent storage, such as
+configuration. On boot, the system will extract the OS image into memory and
+mount the appropriate live-rw sub-directories to provide persistent storage
+system configuration.
+
+This process allows for a system to always boot to a known working state, as
+the OS image is fixed and non-persistent. It also allows for multiple releases
+of VyOS to be installed on the same storage device. The image can be selected
+manually at boot if needed, but the system will otherwise boot the image
+configured to be the default.
+
+.. opcmd:: show system image
+
+   List all available system images which can be bootet on the current system.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show system image
+     The system currently has the following image(s) installed:
+
+        1: 1.2.0-rolling+201810021347 (default boot)
+        2: 1.2.0-rolling+201810021217
+        3: 1.2.0-rolling+201809252218
+
+
+.. opcmd:: delete system image [image-name]
+
+   Delete no longer needed images from the system. You can specify an optional
+   image name to delete, the image name can be retrieved via a list of available
+   images can be shown using the :opcmd:`show system image`.
+
+   .. code-block:: none
+
+      vyos@vyos:~$ delete system image
+      The following image(s) can be deleted:
+
+         1: 1.3-rolling-201912181733 (default boot) (running image)
+         2: 1.3-rolling-201912180242
+         3: 1.2.2
+         4: 1.2.1
+
+      Select the image to delete: 2
+
+      Are you sure you want to delete the
+      "1.3-rolling-201912180242" image? (Yes/No) [No]: y
+      Deleting the "1.3-rolling-201912180242" image...
+      Done
+
+.. opcmd:: show version
+
+   Show current system image version.
+
+   .. code-block:: none
+
+      vyos@vyos:~$ show version
+      Version:          VyOS 1.3-rolling-201912181733
+      Built by:         autobuild@vyos.net
+      Built on:         Wed 18 Dec 2019 17:33 UTC
+      Build UUID:       bccde2c3-261c-49cc-b421-9b257204e06c
+      Build Commit ID:  f7ce0d8a692f2d
+
+      Architecture:     x86_64
+      Boot via:         installed image
+      System type:      bare metal
+
+      Hardware vendor:  VMware, Inc.
+      Hardware model:   VMware Virtual Platform
+      Hardware S/N:     VMware-42 1d 83 b9 fe c1 bd b2-7d 3d 49 db 94 18 f5 c9
+      Hardware UUID:    b9831d42-c1fe-b2bd-7d3d-49db9418f5c9
+
+      Copyright:        VyOS maintainers and contributors
+
+
+
+
+
+System rollback
+===============
+
+If you need to rollback to a previous image, you can easily do so. First
+check the available images through the :opcmd:`show system image`
+command and then select your image with the following command:
+
+.. opcmd:: set system image default-boot [image-name]
+
+   Select the default boot image which will be started on the next boot
+   of the system.
+
+Then reboot the system.
+
+.. note:: VyOS automatically associates the configuration to the image,
+   so you don't need to worry about that. Each image has a unique copy
+   of its configuration.
+
+If you have access to the console, there is a another way to select
+your booting image: reboot and use the GRUB menu at startup.
diff --git a/docs/installation/index.rst b/docs/installation/index.rst
new file mode 100644
index 00000000..187f3bf1
--- /dev/null
+++ b/docs/installation/index.rst
@@ -0,0 +1,17 @@
+#################################
+Installation and Image Management
+#################################
+
+
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Content
+
+   install
+   virtual/index
+   cloud/index
+   vyos-on-baremetal
+   update
+   image
+   migrate-from-vyatta
\ No newline at end of file
diff --git a/docs/installation/install.rst b/docs/installation/install.rst
new file mode 100644
index 00000000..8b567752
--- /dev/null
+++ b/docs/installation/install.rst
@@ -0,0 +1,514 @@
+.. _installation:
+
+############
+Installation
+############
+
+VyOS installation requires to download a VyOS .iso file. That file is
+a live install image that lets you boot a live VyOS. From that live
+system you can proceed to the permanent installation on a hard drive or
+any other type of storage.
+
+
+Hardware requirements
+=====================
+
+The minimum system requirements are 512 MiB RAM and 2 GiB storage.
+Depending on your use you might need additional RAM and CPU resources e.g.
+when having multiple BGP full tables in your system.
+
+Download
+========
+
+Registered Subscribers
+----------------------
+
+Registered subscribers can log into https://support.vyos.io/ to have access to
+a variety of different downloads via the "Downloads" link. These downloads
+include LTS (Long-Term-Support) and associated hot-fix releases, early public
+access releases, pre-built VM images, as well as device specific installation
+ISOs.
+
+.. figure:: /_static/images/vyos-downloads.png
+
+Building from source
+----------------------
+
+Non-subscribers can always get the LTS release by building it from source.
+Instruction can be found in the :ref:`build` section of this manual. VyOS
+source code repository is available for everyone at
+https://github.com/vyos/vyos-build.
+
+Rolling Release
+---------------
+
+Everyone can download bleeding-edge VyOS rolling images from:
+https://downloads.vyos.io/
+
+.. note:: Rolling releases contain all the latest enhancements and fixes. This
+   means that there will be new bugs of course. If you think you hit a bug
+   please follow the guide at :ref:`issues_features`. To improve VyOS we depend on
+   your feedback!
+
+The following link will always fetch the most recent VyOS build for AMD64
+systems from the current branch:
+https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
+
+
+Download Verification
+---------------------
+
+LTS images are signed by VyOS lead package-maintainer private key. With
+the official public key, the authenticity of the package can be
+verified. :abbr:`GPG (GNU Privacy Guard)` is used for verification.
+
+.. note:: This subsection only applies e applies to LTS images, for
+   Rolling images please jump to :ref:`live_installation`.
+
+Preparing for the verification
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+First, install GPG or another OpenPGP implementation. On most GNU+Linux
+distributions it is installed by default as package managers use it to
+verify package signatures. If not pre-installed, it will need to be
+downloaded and installed.
+
+The official VyOS public key can be retrieved in a number of ways. Skip
+to :ref:`gpg-verification` if the key is already present.
+
+It can be retrieved directly from a key server:
+
+``gpg --recv-keys FD220285A0FE6D7E``
+
+Or it can be accessed via a web browser:
+
+https://pgp.mit.edu/pks/lookup?op=get&search=0xFD220285A0FE6D7E
+
+Or from the following block:
+
+.. code-block:: none
+
+  -----BEGIN PGP PUBLIC KEY BLOCK-----
+  Version: GnuPG v1.4.12 (GNU/Linux)
+
+  mQINBFXKsiIBEACyid9PR/v56pSRG8VgQyRwvzoI7rLErZ8BCQA2WFxA6+zNy+6G
+  +0E/6XAOzE+VHli+wtJpiVJwAh+wWuqzOmv9css2fdJxpMW87pJAS2i3EVVVf6ab
+  wU848JYLGzc9y7gZrnT1m2fNh4MXkZBNDp780WpOZx8roZq5X+j+Y5hk5KcLiBn/
+  lh9Zoh8yzrWDSXQsz0BGoAbVnLUEWyo0tcRcHuC0eLx6oNG/IHvd/+kxWB1uULHU
+  SlB/6vcx56lLqgzywkmhP01050ZDyTqrFRIfrvw6gLQaWlgR3lB93txvF/sz87Il
+  VblV7e6HEyVUQxedDS8ikOyzdb5r9a6Zt/j8ZPSntFNM6OcKAI7U1nDD3FVOhlVn
+  7lhUiNc+/qjC+pR9CrZjr/BTWE7Zpi6/kzeH4eAkfjyALj18oC5udJDjXE5daTL3
+  k9difHf74VkZm29Cy9M3zPckOZpsGiBl8YQsf+RXSBMDVYRKZ1BNNLDofm4ZGijK
+  mriXcaY+VIeVB26J8m8y0zN4/ZdioJXRcy72c1KusRt8e/TsqtC9UFK05YpzRm5R
+  /nwxDFYb7EdY/vHUFOmfwXLaRvyZtRJ9LwvRUAqgRbbRZg3ET/tn6JZk8hqx3e1M
+  IxuskOB19t5vWyAo/TLGIFw44SErrq9jnpqgclTSRgFjcjHEm061r4vjoQARAQAB
+  tDZWeU9TIE1haW50YWluZXJzIChWeU9TIFJlbGVhc2UpIDxtYWludGFpbmVyc0B2
+  eW9zLm5ldD6JAjgEEwECACIFAlXKsiICGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4B
+  AheAAAoJEP0iAoWg/m1+xbgP+QEDYZi5dA4IPY+vU1L95Bavju2m2o35TSUDPg5B
+  jfAGuhbsNUceU+l/yUlxjpKEmvshyW3GHR5QzUaKGup/ZDBo1CBxZNhpSlFida2E
+  KAYTx4vHk3MRXcntiAj/hIJwRtzCUp5UQIqHoU8dmHoHOkKEP+zhJuR6E2s+WwDr
+  nTwE6eRa0g/AHY+chj2Je6flpPm2CKoTfUE7a2yBBU3wPq3rGtsQgVxPAxHRZz7A
+  w4AjH3NM1Uo3etuiDnGkJAuoKKb1J4X3w2QlbwlR4cODLKhJXHIufwaGtRwEin9S
+  1l2bL8V3gy2Hv3D2t9TQZuR5NUHsibJRXLSa8WnSCcc6Bij5aqfdpYB+YvKH/rIm
+  GvYPmLZDfKGkx0JE4/qtfFjiPJ5VE7BxNyliEw/rnQsxWAGPqLlL61SD8w5jGkw3
+  CinwO3sccTVcPz9b6A1RsbBVhTJJX5lcPn1lkOEVwQ7l8bRhOKCMe0P53qEDcLCd
+  KcXNnAFbVes9u+kfUQ4oxS0G2JS9ISVNmune+uv+JR7KqSdOuRYlyXA9uTjgWz4y
+  Cs7RS+CpkJFqrqOtS1rmuDW9Ea4PA8ygGlisM5d/AlVkniHz/2JYtgetiLCj9mfE
+  MzQpgnldNSPumKqJ3wwmCNisE+lXQ5UXCaoaeqF/qX1ykybQn41LQ+0xT5Uvy7sL
+  9IwGuQINBFXKsiIBEACg2mP3QYkXdgWTK5JyTGyttE6bDC9uqsK8dc1J66Tjd5Ly
+  Be0amO+88GHXa0o5Smwk2QNoxsRR41G/D/eAeGsuOEYnePROEr3tcLnDjo4KLgQ+
+  H69zRPn77sdP3A34Jgp+QIzByJWM7Cnim31quQP3qal2QdpGJcT/jDJWdticN76a
+  Biaz+HN13LyvZM+DWhUDttbjAJc+TEwF9YzIrU+3AzkTRDWkRh4kNIQxjlpNzvho
+  9V75riVqg2vtgPwttPEhOLb0oMzy4ADdfezrfVvvMb4M4kY9npu4MlSkNTM97F/I
+  QKy90JuSUIjE05AO+PDXJF4Fd5dcpmukLV/2nV0WM2LAERpJUuAgkZN6pNUFVISR
+  +nSfgR7wvqeDY9NigHrJqJbSEgaBUs6RTk5hait2wnNKLJajlu3aQ2/QfRT/kG3h
+  ClKUz3Ju7NCURmFE6mfsdsVrlIsEjHr/dPbXRswXgC9FLlXpWgAEDYi9Wdxxz8o9
+  JDWrVYdKRGG+OpLFh8AP6QL3YnZF+p1oxGUQ5ugXauAJ9YS55pbzaUFP8oOO2P1Q
+  BeYnKRs1GcMI8KWtE/fze9C9gZ7Dqju7ZFEyllM4v3lzjhT8muMSAhw41J22mSx6
+  VRkQVRIAvPDFES45IbB6EEGhDDg4pD2az8Q7i7Uc6/olEmpVONSOZEEPsQe/2wAR
+  AQABiQIfBBgBAgAJBQJVyrIiAhsMAAoJEP0iAoWg/m1+niUQAKTxwJ9PTAfB+XDk
+  3qH3n+T49O2wP3fhBI0EGhJp9Xbx29G7qfEeqcQm69/qSq2/0HQOc+w/g8yy71jA
+  6rPuozCraoN7Im09rQ2NqIhPK/1w5ZvgNVC0NtcMigX9MiSARePKygAHOPHtrhyO
+  rJQyu8E3cV3VRT4qhqIqXs8Ydc9vL3ZrJbhcHQuSLdZxM1k+DahCJgwWabDCUizm
+  sVP3epAP19FP8sNtHi0P1LC0kq6/0qJot+4iBiRwXMervCD5ExdOm2ugvSgghdYN
+  BikFHvmsCxbZAQjykQ6TMn+vkmcEz4fGAn4L7Nx4paKEtXaAFO8TJmFjOlGUthEm
+  CtHDKjCTh9WV4pwG2WnXuACjnJcs6LcK377EjWU25H4y1ff+NDIUg/DWfSS85iIc
+  UgkOlQO6HJy0O96L5uxn7VJpXNYFa20lpfTVZv7uu3BC3RW/FyOYsGtSiUKYq6cb
+  CMxGTfFxGeynwIlPRlH68BqH6ctR/mVdo+5UIWsChSnNd1GreIEI6p2nBk3mc7jZ
+  7pTEHpjarwOjs/S/lK+vLW53CSFimmW4lw3MwqiyAkxl0tHAT7QMHH9Rgw2HF/g6
+  XD76fpFdMT856dsuf+j2uuJFlFe5B1fERBzeU18MxML0VpDmGFEaxxypfACeI/iu
+  8vzPzaWHhkOkU8/J/Ci7+vNtUOZb
+  =Ld8S
+  -----END PGP PUBLIC KEY BLOCK-----
+
+Store the key in a new text file and import it into GPG via: ``gpg --import
+file_with_the_public_key``
+
+The import can be verified with:
+
+.. code-block:: none
+
+  $ gpg --list-keys
+  ...
+  pub   rsa4096 2015-08-12 [SC]
+      0694A9230F5139BF834BA458FD220285A0FE6D7E
+  uid           [ unknown] VyOS Maintainers (VyOS Release) <maintainers@vyos.net>
+  sub   rsa4096 2015-08-12 [E]
+
+.. _gpg-verification:
+
+GPG verification
+^^^^^^^^^^^^^^^^
+
+With the public key imported, the signature for the desired image needs
+to be downloaded.
+
+.. note:: The signature can be downloaded by appending `.asc` to the URL of the
+   downloaded VyOS image. That small *.asc* file is the signature for the
+   associated image.
+
+Finally, verify the authenticity of the downloaded image:
+
+.. code-block:: none
+
+  $ gpg2 --verify vyos-1.2.1-amd64.iso.asc  vyos-1.2.1-amd64.iso
+  gpg: Signature made So 14 Apr 12:58:07 2019 CEST
+  gpg:                using RSA key FD220285A0FE6D7E
+  gpg: Good signature from "VyOS Maintainers (VyOS Release) <maintainers@vyos.net>" [unknown]
+  Primary key fingerprint: 0694 A923 0F51 39BF 834B  A458 FD22 0285 A0FE 6D7E
+
+.. _live_installation:
+
+Live installation
+=================
+
+.. note:: A permanent VyOS installation always requires to go first
+   through a live installation.
+
+VyOS, as other GNU+Linux distributions, can be tasted without installing
+it in your hard drive. **With your downloaded VyOS .iso file you can
+create a bootable USB drive that will let you boot into a fully
+functional VyOS system**. Once you have tested it, you can either decide
+to begin a :ref:`permanent_installation` in your hard drive or power
+your system off, remove the USB drive, and leave everythng as it was. 
+
+
+If you have a GNU+Linux system, you can create your VyOS bootable USB
+stick with with the ``dd`` command:
+
+ 1. Open your terminal emulator.
+
+ 2. Find out the device name of your USB drive (you can use the ``lsblk``
+    command)
+
+ 3. Unmount the USB drive. Replace X in the example below with the
+    letter of your device and keep the asterisk (wildcard) to unmount
+    all partitions.
+
+ .. code-block:: none
+ 
+  $ umount /dev/sdX* 
+
+ 4. Write the image (your VyOS .iso file) to the USB drive.
+    Note that here you want to use the device name (e.g. /dev/sdb), not
+    the partition name (e.g. /dev/sdb1).
+
+  **Warning**: This will destroy all data on the USB drive!
+
+ .. code-block:: none
+ 
+   # dd if=/path/to/vyos.iso of=/dev/sdX bs=8M; sync
+
+ 5. Wait until you get the outcome (bytes copied). Be patient, in some
+    computers it might take more than one minute.
+
+ 6. Once ``dd`` has finished, pull the USB drive out and plug it into
+    the powered-off computer where you want to install (or test) VyOS.
+
+ 7. Power the computer on, making sure it boots from the USB drive (you
+    might need to select booting device or change booting settings).
+
+ 8. Once VyOS is completely loaded, enter the default credentials
+    (login: vyos, password: vyos).
+
+
+If you find difficulties with this method, prefer to use a GUI program,
+or have a different operating system, there are other programs you can
+use to create a bootable USB drive, like balenaEtcher_ (for GNU/Linux,
+macOS and Windows), Rufus_ (for Windows) and `many others`_. You can
+follow their instructions to create a bootable USB drive from an .iso
+file.
+
+.. hint:: The default username and password for the live system is *vyos*.
+
+
+.. _permanent_installation:
+
+Permanent installation
+======================
+
+.. note:: Before a permanent installation, VyOS requires a :ref:`live_installation`.
+
+Unlike general purpose Linux distributions, VyOS uses "image installation" that
+mimics the user experience of traditional hardware routers and allows keeping
+multiple VyOS versions installed simultaneously. This makes it possible to
+switch to a previous version if something breaks or miss-behaves after an image
+upgrade.
+
+Every version is contained in its own squashfs image that is mounted in a union
+filesystem together with a directory for mutable data such as configurations,
+keys, or custom scripts.
+
+.. note:: Older versions (prior to VyOS 1.1) used to support non-image
+   installation (``install system`` command). Support for this has been removed
+   from VyOS 1.2 and newer releases. Older releases can still be upgraded via
+   the general ``add system image <image_path>`` upgrade command (consult
+   :ref:`image-mgmt` for further information).
+
+
+In order to proceed with a permanent installation:
+
+ 1. Log into the VyOS live system (use the default credentials: vyos,
+    vyos)
+
+ 2. Run the ``install image`` command and follow the wizard:
+
+ .. code-block:: none
+
+   vyos@vyos:~$ install image
+   Welcome to the VyOS install program.  This script
+   will walk you through the process of installing the
+   VyOS image to a local hard drive.
+   Would you like to continue? (Yes/No) [Yes]: Yes
+   Probing drives: OK
+   Looking for pre-existing RAID groups...none found.
+   The VyOS image will require a minimum 2000MB root.
+   Would you like me to try to partition a drive automatically
+   or would you rather partition it manually with parted?  If
+   you have already setup your partitions, you may skip this step
+   
+   Partition (Auto/Parted/Skip) [Auto]:
+   
+   I found the following drives on your system:
+    sda    4294MB
+   
+   Install the image on? [sda]:
+   
+   This will destroy all data on /dev/sda.
+   Continue? (Yes/No) [No]: Yes
+   
+   How big of a root partition should I create? (2000MB - 4294MB) [4294]MB:
+   
+   Creating filesystem on /dev/sda1: OK
+   Done!
+   Mounting /dev/sda1...
+   What would you like to name this image? [1.2.0-rolling+201809210337]:
+   OK.  This image will be named: 1.2.0-rolling+201809210337
+   Copying squashfs image...
+   Copying kernel and initrd images...
+   Done!
+   I found the following configuration files:
+       /opt/vyatta/etc/config.boot.default
+   Which one should I copy to sda? [/opt/vyatta/etc/config.boot.default]:
+   
+   Copying /opt/vyatta/etc/config.boot.default to sda.
+   Enter password for administrator account
+   Enter password for user 'vyos':
+   Retype password for user 'vyos':
+   I need to install the GRUB boot loader.
+   I found the following drives on your system:
+    sda    4294MB
+   
+   Which drive should GRUB modify the boot partition on? [sda]:
+   
+   Setting up grub: OK
+   Done!
+
+
+ 3. After the installation is complete, remove the live USB stick or
+    CD.
+
+ 4. Reboot the system.
+
+ .. code-block:: none
+
+  vyos@vyos:~$ reboot
+  Proceed with reboot? (Yes/No) [No] Yes
+
+ You will boot now into a permanent VyOS system.
+
+
+PXE Boot
+========
+
+VyOS can also be installed through PXE. This is a more complex
+installation method which allows deploying VyOS through the network.
+
+**Requirements**
+
+* Clients (where VyOS is to be installed) with a PXE-enabled NIC
+* DHCP Server 
+* TFTP Server
+* Webserver (HTTP) - optional, but we will use it to speed up installation
+* VyOS ISO image to be installed (do not use images prior to VyOS 1.2.3)
+* Files *pxelinux.0* and *ldlinux.c32* `from the Syslinux distribution <https://kernel.org/pub/linux/utils/boot/syslinux/>`_
+
+Configuration
+-------------
+
+Step 1: DHCP
+^^^^^^^^^^^^
+
+Configure a DHCP server to provide the client with:
+
+* An IP address
+* The TFTP server address (DHCP option 66). Sometimes referred as *boot server*
+* The *bootfile name* (DHCP option 67), which is *pxelinux.0*
+
+In this example we configured an existent VyOS as the DHCP server:
+
+.. code-block:: none
+
+  vyos@vyos# show service dhcp-server
+   shared-network-name mydhcp {
+       subnet 192.168.1.0/24 {
+           bootfile-name pxelinux.0
+           bootfile-server 192.168.1.50
+           default-router 192.168.1.50
+           range 0 {
+               start 192.168.1.70
+               stop 192.168.1.100
+           }
+       }
+   }
+
+.. _install_from_tftp:
+
+Step 2: TFTP
+^^^^^^^^^^^^
+
+Configure a TFTP server so that it serves the following:
+
+* The *pxelinux.0* file from the Syslinux distribution
+* The *ldlinux.c32* file from the Syslinux distribution
+* The kernel of the VyOS software you want to deploy. That is the
+  *vmlinuz* file inside the */live* directory of the extracted
+  contents from the ISO file.
+* The initial ramdisk of the VyOS ISO you want to deploy. That is the
+  *initrd.img* file inside the */live* directory of the extracted
+  contents from the ISO file. Do not use an empty (0 bytes) initrd.img
+  file you might find, the correct file may have a longer name.
+* A directory named pxelinux.cfg which must contain the configuration
+  file. We will use the configuration_ file shown below, which we named
+  default_.
+
+.. _configuration: https://wiki.syslinux.org/wiki/index.php?title=Config
+.. _default: https://wiki.syslinux.org/wiki/index.php?title=PXELINUX#Configuration
+
+In the example we configured our existent VyOS as the TFTP server too:
+
+.. code-block:: none
+
+  vyos@vyos# show service tftp-server
+   directory /config/tftpboot
+   listen-address 192.168.1.50
+
+Example of the contents of the TFTP server:
+
+.. code-block:: none
+
+  vyos@vyos# ls -hal /config/tftpboot/
+  total 29M
+  drwxr-sr-x 3 tftp tftp      4.0K Oct 14 00:23 .
+  drwxrwsr-x 9 root vyattacfg 4.0K Oct 18 00:05 ..
+  -r--r--r-- 1 root vyattacfg  25M Oct 13 23:24 initrd.img-4.19.54-amd64-vyos
+  -rwxr-xr-x 1 root vyattacfg 120K Oct 13 23:44 ldlinux.c32
+  -rw-r--r-- 1 root vyattacfg  46K Oct 13 23:24 pxelinux.0
+  drwxr-xr-x 2 root vyattacfg 4.0K Oct 14 01:10 pxelinux.cfg
+  -r--r--r-- 1 root vyattacfg 3.7M Oct 13 23:24 vmlinuz
+
+  vyos@vyos# ls -hal /config/tftpboot/pxelinux.cfg
+  total 12K
+  drwxr-xr-x 2 root vyattacfg 4.0K Oct 14 01:10 .
+  drwxr-sr-x 3 tftp tftp      4.0K Oct 14 00:23 ..
+  -rw-r--r-- 1 root root       191 Oct 14 01:10 default
+
+Example of simple (no menu) configuration file:
+
+.. code-block:: none
+
+  vyos@vyos# cat /config/tftpboot/pxelinux.cfg/default
+  DEFAULT VyOS123
+
+  LABEL VyOS123
+   KERNEL vmlinuz
+   APPEND initrd=initrd.img-4.19.54-amd64-vyos boot=live nopersistence noautologin nonetworking fetch=http://address:8000/filesystem.squashfs
+
+Step 3: HTTP
+^^^^^^^^^^^^
+
+We also need to provide the *filesystem.squashfs* file. That is a heavy
+file and TFTP is slow, so you could send it through HTTP to speed up the
+transfer. That is how it is done in our example, you can find that in
+the configuration file above.
+
+**First** run a web server - you can use a simple one like
+`Python's SimpleHTTPServer`_ and start serving the `filesystem.squashfs`
+file. The file can be found inside the `/live` directory of the
+extracted contents of the ISO file.
+
+**Second**, edit the configuration file of the :ref:`install_from_tftp`
+so that it shows the correct URL at
+``fetch=http://<address_of_your_HTTP_server>/filesystem.squashfs``.
+
+.. note:: Do not change the name of the *filesystem.squashfs* file. If 
+   you are working with different versions, you can create different
+   directories instead.
+
+And **third**, restart the TFTP service. If you are using VyOS as your
+TFTP Server, you can restart the service with
+``sudo service tftpd-hpa restart``.
+
+.. note::  Make sure the available directories and files in both TFTP
+   and HTTP server have the right permissions to be accessed from the
+   booting clients.
+
+.. _`Python's SimpleHTTPServer`: https://docs.python.org/2/library/simplehttpserver.html
+
+Client Boot
+-----------
+
+Finally, turn on your PXE-enabled client or clients. They will
+automatically get an IP address from the DHCP server and start booting
+into VyOS live from the files automatically taken from the TFTP and HTTP
+servers.
+
+Once finished you will be able to proceed with the ``install image``
+command as in a regular VyOS installation.
+
+
+
+Known Issues
+============
+
+This is a list of known issues that can arise during installation.
+
+Black screen on install
+-----------------------
+
+GRUB attempts to redirect all output to a serial port for ease of installation on headless hosts.
+This appears to cause an hard lockup on some hardware that lacks a serial port, with the result being a 
+black screen after selecting the `Live system` option from the installation image.
+
+The workaround is to type `e` when the boot menu appears and edit the GRUB boot options.  Specifically, remove the:
+
+`console=ttyS0,115200` 
+
+option, and type CTRL-X to boot. 
+
+Installation can then continue as outlined above.
+
+.. _SYSLINUX: http://www.syslinux.org/
+.. _balenaEtcher: https://www.balena.io/etcher/
+.. _Rufus: https://rufus.ie/
+.. _many others: https://en.wikipedia.org/wiki/List_of_tools_to_create_Live_USB_systems
diff --git a/docs/installation/migrate-from-vyatta.rst b/docs/installation/migrate-from-vyatta.rst
new file mode 100644
index 00000000..eba9dc59
--- /dev/null
+++ b/docs/installation/migrate-from-vyatta.rst
@@ -0,0 +1,164 @@
+.. _migrate_from_vyatta:
+
+Migrate from Vyatta Core
+========================
+
+VyOS 1.x line aims to preserve backward compatibility and provide a safe
+upgrade path for existing Vyatta Core users. You may think of VyOS 1.0.0 as
+VC7.0.
+
+Vyatta release compatiblity
+---------------------------
+
+Vyatta Core releases from 6.5 to 6.6 should be 100% compatible.
+
+Vyatta Core 6.4 and earlier may have incompatibilities. In Vyatta 6.5 the
+"modify" firewall was removed and replaced with the ``set policy route``
+command family, old configs can not be automatically converted. You will have
+to adapt it to post-6.5 Vyatta syntax manually.
+
+.. note:: Also, in Vyatta Core 6.5 remote access VPN interfaces have been
+   renamed from ``pppX``  to ``l2tpX`` and ``pptpX``. If you are using
+   zone based firewalling in Vyatta Core pre-6.5 versions, make sure to change
+   interface names in rules for remote access VPN.
+
+Upgrade procedure
+-----------------
+
+You just use ``add system image``, as if it was a new VC release (see
+:ref:`update_vyos` for additional information). The only thing you want to do
+is to verify the new images digital signature. You will have to add the public
+key manually once as it is not shipped the first time.
+
+.. code-block:: none
+
+  vyatta@vyatta:~$ wget http://wiki.vyos.net/so3group_maintainers.key
+  Connecting to vyos.net (x.x.x.x:80)
+  so3group_maintainers 100% |*************************|  3125  --:--:-- ETA
+  vyatta@vyatta:~$ sudo apt-key add so3group_maintainers.key
+  OK
+  vyatta@vyatta:~$
+
+For completion the key below corresponds to the key listed in the URL above.
+
+.. code-block:: none
+
+  -----BEGIN PGP PUBLIC KEY BLOCK-----
+  Version: GnuPG v1.4.12 (GNU/Linux)
+  
+  mQINBFIIUZwBEADGl+wkZpYytQxd6LnjDZZScziBKYJbjInetYeS0SUrgpqnPkzL
+  2CiGfPczLwpYY0zWxpUhTvqjFsE5yDpgs0sPXIgUTFE1qfZQE+WD1I1EUM6sp/38
+  2xKQ9QaNc8oHuYINLYYmNYra6ZjIGtQP9WOX//IDYB3fhdwlmiW2z0hux2OnPWdh
+  hPZAmSrx5AiXFEEREJ1cAQyvYk7hgIRvM/rdQMUm+u4/z+S4mxCHE10KzlqOGhRv
+  hA8WQxHCVusMFGwXoKHxYf9OQpV7lsfOCODfXOMP/L9kHQ5/gBsLL5hHst+o/3VG
+  ec0QuVrVkBBehgrqhfJW2noq+9gTooURGImQHEOyE0xpJdFrrgk5Ii9RqQwdVRzI
+  ZPbqbo8uuldZIRJRGnfx+vAR9812yo38NVZ/X0P/hkkrx+UeGVgpC/ao5XLRiOzL
+  7ZBMWLA6FVmZ7mkpqdzuMXX5548ApACm6EKErULIhTYDGDzFxA3cf6gr5VVi4usD
+  wglVs+FHuiLehmuuPTMoVcT2R6+Ht44hG3BmQmKzh/SSEa1g9gKgrhZrMdIyK4hu
+  GvMqLw9z9BgJbWB3BgXOUdlkXLDwBvVpEcWsPJgxSjAvjAbLLE4YkKAdYU8bQ0Pd
+  JuN485tcXxgQCadFZB0gcipQAvVf4b810HrY88g6FldfauHxiACOlXscZwARAQAB
+  tDBTTzMgR3JvdXAgTWFpbnRhaW5lcnMgPG1haW50YWluZXJzQHNvM2dyb3VwLm5l
+  dD6JAjgEEwECACIFAlIIUZwCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJ
+  ELdE4lqkQubp8GsQAKntoRFG6bWX/4WPw7Vo7kIF5kWcmv3lVb0AQkacscWope7T
+  Iq0VcgpAycJue2bSS9LAsvNtpVkQmFawbwFjqB3CC5NbPNQ4Kf+gswKa+yaHwejo
+  7dkslAwxgXHe5g76DG7CVLMsMg6zVDFYuzeksPywls/OJBIpkuGqeXy9tAHjQzjA
+  SlZV3Gsx7azESjiVQ73EUBt2OXkwN4TN9TEHAnVsrNIXHwFl1VfFsSG1Q6uZDtkk
+  CB4DZJKN4RzCY2QSwMAqRRC2OXdwk5IAk8wwCGoFpp0UV6CO9YCeOaqJderEcBA4
+  MGHqdiPDIbH5wvckjZzFznU/Paz3MwPwBdtN+WSKvwf+JItSiUqm8Dy2Pl/1cnux
+  1g1I4WQlXUVaS/MDusqL7tbS8k5A5a2+YVMxShWH9BhXZwNXzEihl4sm8Hrg5SvZ
+  givJj2y93WoL69Wq0/86wkkH2xcrz4gsiUcQf5YXU/RHXOLnPR29/pg8TS0L7sST
+  dv0X23C2IpfqYoqN7YZ3K0Wczhi0yLPCrc27IczuHgjt/8ICda11xhB1t/pUbvnX
+  oksehaLp8O3uU8GyAsTfUgpijZFc/3jIadOl0L9NGUbYYgPzFeaZTa/njeEbz3wX
+  PZMn278sbL9UhupI5Hx7eREbKzV4VPVKz81ndKNMXyuJHXv2R0xou3nvuo1WuQIN
+  BFIIUZwBEADAhoYPDCSogG41Naq+wFkG+IPszqe0dW/UWg0xrZDT0UblwDSd4OGY
+  7FATMIhjOUyFxk6+XKA5CDCWP8Npkl0modTL59uVWNxU1vUKincc/j4ipHQeAhE6
+  fvZkrprvADD8TYIGesl/3EGNc7bzc5ZqX71hKPHG+autRtgFSOR2PSXD9MlJXIBb
+  RzHAXxlh72zvsGadcxLJm4pSWXitkR/5Wc3e0IippKdzGwZnCDpNmcBGtSTFgixP
+  JqyRZFVCPWs7jr/oQeZnq65wJp1KD2HvhhKHJfsPrnNjLSm1SQVh8hXzE9odcv6N
+  mJB7tNXywuROBt6a01ojBa9J3zuMYQj3iQl2MhxtHylKVBjr7NjZ4evZbLsRMxY1
+  hYk7sl+ZxCPFeOZ9D2ppU/CUDXCS095I1x+s+VuiUNf/3yd8ahCWDXVp9nsXyYjm
+  2pHIxb2F6r8Vd4AjlD2MQwszECS88INF3l/9ksIHEMKuuW+JAC9FiZ7k4IGcIltv
+  If/V2TgE6t6qoWIlmLhMTjOyJpwnokY1nIuXHH7yp+HsuqnYnf/dgLnt4czPLeHO
+  +TdIDHhUym0AKlCcbdgn0C6EJVTnA8BFgFjiIOMAeT0rhATg0W/cND8KQcX4V9wM
+  nHSEsgSEuP9H+67xuRx5Imuh5ntecrcuCYSNuOneUXWPThDKQPO9lQARAQABiQIf
+  BBgBAgAJBQJSCFGcAhsMAAoJELdE4lqkQubpc+0P/0IzUx8nTpF0/ii2TA0YCOgj
+  tviM6PRTVPrFcxijNeXiIMHZYrALYUvXxXGp1IZBP3IcOyuZNp2WLqF/f9a3cIr1
+  9b/LJPrwopGqV3K30lormk7hH0s3IXbhd0ZYWvRj+5kQ8TFRAFfPwjlItzjYJmYX
+  AGJmM9PxJID/4LgWSfQ/ZfNu7MJ7+2goQLu9b6x7UC1FlE4q1lcjBvHjVPM//S9G
+  lGAHaysyTjVu88W2wwBpBrO1MQnDvqFRddXPOIWp0jecBMUd4E0fB36yuStsXZT3
+  RN4V8vKRBYXuqHhiTwZeh153cHZk2EZBwz5A6DJubMaGdJTesHW5Qf2goph0pmjC
+  +XuXn8J6tc5nFDf8DP4AFVMtqa3Brj2fodWd0Zzxq3AVsbX144c1oqJUhO4t3+ie
+  8fD/6/jx4iuPCQTfyhHG+zGfyUb2LQ+OVLW1WYTxH5tzHaZUmZFdV2I1kuhuvZ1t
+  WRlmTnHZOnEb3+t8KCRWzRMfweTzXfRRKBC0/QpeX1r5pbaMHH8zF/J5PKmL0+jg
+  +DS8JSbSfv7Ke6rplf7lHYaDumAFZfxXuQkajzLZbX0E5Xu5BNz4Vq6LGBj7LDXL
+  gswIK8FFgZB+W8zwOqUV1vjIr9wkdLifXXezKpTeYpFDGLdfsK+uNAtGyvI61TDi
+  Pr6fWpIruuc7Gg9rUF0L
+  =VQTr
+  -----END PGP PUBLIC KEY BLOCK-----
+
+Next add the VyOS image.
+
+This example uses VyOS 1.0.0, however, it's better to install the latest
+release.
+
+.. code-block:: none
+
+  vyatta@vyatta:~$ show system image
+  The system currently has the following image(s) installed:
+    1: VC6.6R1 (default boot) (running image)
+
+  vyatta@vyatta:~$ add system image https://downloads.vyos.io/release/legacy/1.0.0/vyos-1.0.0-amd64.iso
+   Trying to fetch ISO file from https://downloads.vyos.io/release/legacy/1.0.0/vyos-1.0.0-amd64.iso
+     % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                    Dload  Upload   Total   Spent    Left  Speed
+   100  223M  100  223M    0     0   960k      0  0:03:57  0:03:57 --:--:--  657k
+   ISO download succeeded.
+   Checking for digital signature file...
+     % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                    Dload  Upload   Total   Spent    Left  Speed
+   100   836  100   836    0     0   4197      0 --:--:-- --:--:-- --:--:--  4287
+   Found it.  Checking digital signature...
+   gpg: directory `/root/.gnupg' created
+   gpg: new configuration file `/root/.gnupg/gpg.conf' created
+   gpg: WARNING: options in `/root/.gnupg/gpg.conf' are not yet active during this run
+   gpg: keyring `/root/.gnupg/pubring.gpg' created
+   gpg: Signature made Sun Dec 22 16:51:42 2013 GMT using RSA key ID A442E6E9
+   gpg: /root/.gnupg/trustdb.gpg: trustdb created
+   gpg: Good signature from "SO3 Group Maintainers <maintainers@so3group.net>"
+   gpg: WARNING: This key is not certified with a trusted signature!
+   gpg:          There is no indication that the signature belongs to the owner.
+   Primary key fingerprint: DD5B B405 35E7 F6E3 4278  1ABF B744 E25A A442 E6E9
+   Digital signature is valid.
+   Checking MD5 checksums of files on the ISO image...OK.
+   Done!
+   
+   What would you like to name this image? [1.0.0]: [return]
+   OK.  This image will be named: 1.0.0
+   Installing "1.0.0" image.
+   Copying new release files...
+
+   Would you like to save the current configuration
+   directory and config file? (Yes/No) [Yes]: [return]
+   Copying current configuration...
+
+   Would you like to save the SSH host keys from your
+   current configuration? (Yes/No) [Yes]: [return]
+   Copying SSH keys...
+   Setting up grub configuration...
+   Done.
+   
+   vyatta@vyatta:~$ show system image
+   The system currently has the following image(s) installed:
+
+      1: 1.0.0 (default boot)
+      2: VC6.6R1 (running image)
+
+Upon reboot, you should have a working installation of VyOS.
+
+You can go back to your Vyatta install using the ``set system image
+default-boot`` command and selecting the your previous Vyatta Core image.
+
+.. note:: Future releases of VyOS will break the direct upgrade path from
+   Vyatta core. Please upgrade through an intermediate VyOS version e.g. VyOS
+   1.2. After this you can continue upgrading to newer releases once you bootet
+   into VyOS 1.2 once.
diff --git a/docs/installation/update.rst b/docs/installation/update.rst
new file mode 100644
index 00000000..a3a887f0
--- /dev/null
+++ b/docs/installation/update.rst
@@ -0,0 +1,79 @@
+.. _update_vyos:
+
+Update VyOS
+===========
+
+New system images can be added using the :opcmd:`add system image`
+command. The command will extract the chosen image and will prompt you
+to use the current system configuration and SSH security keys, allowing
+for the new image to boot using the current configuration.
+
+.. note:: Only LTS releases are PGP-signed.
+
+.. opcmd:: add system image <url | path> [vrf name] [username user [password pass]]
+
+   Use this command to install a new system image. You can reach the
+   image from the web (http://, https://) or from your local system,
+   e.g.  /tmp/vyos-1.2.3-amd64.iso.
+
+   The `add system image` command also supports installing new versions
+   of VyOS through an optional given VRF. Also if URL in question requires
+   authentication, you can specify an optional username and password via
+   the commandline which will be passed as "Basic-Auth" to the server.
+
+If there is not enough **free disk space available**, the installation
+will be canceled. To delete images use the :opcmd:`delete system image`
+command.
+
+VyOS configuration is associated to each image, and **each image has a
+unique copy of its configuration**. This is different than a traditional
+network router where the configuration is shared across all images.
+
+.. note:: If you have any personal files, like some scripts you created,
+   and you don't want them to be lost during the upgrade, make sure
+   those files are stored in ``/config`` as this directory is always copied
+   to newer installed images.
+
+You can access files from a previous installation and copy them to your
+current image if they were located in the ``/config`` directory. This
+can be done using the :opcmd:`copy` command. So, for instance, in order
+to copy ``/config/config.boot`` from VyOS 1.2.1 image, you would use the
+following command:
+
+.. code::
+
+   copy file 1.2.1://config/config.boot to /tmp/config.boot.1.2.1
+
+
+Example
+"""""""
+
+.. code-block:: none
+
+     vyos@vyos:~$ add system image https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
+     Trying to fetch ISO file from https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
+       % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                      Dload  Upload   Total   Spent    Left  Speed
+     100  338M  100  338M    0     0  3837k      0  0:01:30  0:01:30 --:--:-- 3929k
+     ISO download succeeded.
+     Checking for digital signature file...
+       % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                      Dload  Upload   Total   Spent    Left  Speed
+       0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+     curl: (22) The requested URL returned error: 404 Not Found
+
+     Unable to fetch digital signature file.
+     Do you want to continue without signature check? (yes/no) [yes]
+     Checking MD5 checksums of files on the ISO image...OK.
+     Done!
+
+     What would you like to name this image? [vyos-1.3-rolling-201912201452]:
+
+     OK.  This image will be named: vyos-1.3-rolling-201912201452
+
+
+.. hint:: | The most up-do-date Rolling Release for AMD64 can be accessed using the following URL:
+   | https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
+
+After reboot you might want to verify the version you are running with
+the :opcmd:`show version` command.
\ No newline at end of file
diff --git a/docs/installation/virtual/gns3.rst b/docs/installation/virtual/gns3.rst
new file mode 100644
index 00000000..f17715b2
--- /dev/null
+++ b/docs/installation/virtual/gns3.rst
@@ -0,0 +1,175 @@
+.. _vyos-on-gns3:
+
+VyOS on GNS3
+############
+
+Sometimes you may want to test VyOS in a lab environment.
+`GNS3 <http://www.gns3.com>`__ is a network emulation software you
+might use for it.
+
+This guide will provide the necessary steps for installing
+and setting up VyOS on GNS3.
+
+Requirements
+------------
+
+The following items are required:
+
+* A VyOS installation image (.iso file).
+  `Here <https://docs.vyos.io/en/latest/install.html#download>`__ you
+  can find how to get it.
+
+* A working GNS3 installation. For further information see the
+  `GNS3 documentation <https://docs.gns3.com/>`__.
+
+.. _vm_setup:
+
+VM setup
+--------
+
+First, a virtual machine (VM) for the VyOS installation must be created
+in GNS3.
+
+Go to the GNS3 **File** menu, click **New template** and choose select
+**Manually create a new Template**.
+
+.. figure:: /_static/images/gns3-01.png
+
+Select **Quemu VMs** and then click on the ``New`` button.
+
+.. figure:: /_static/images/gns3-02.png
+
+Write a name for your VM, for instance "VyOS", and click ``Next``.
+
+.. figure:: /_static/images/gns3-03.png
+
+Select **qemu-system-x86_64** as Quemu binary, then **512MB** of RAM
+and click ``Next``.
+
+.. figure:: /_static/images/gns3-04.png
+
+Select **telnet** as your console type and click ``Next``.
+
+.. figure:: /_static/images/gns3-05.png
+
+Select **New image** for the base disk image of your VM and click
+``Create``.
+
+.. figure:: /_static/images/gns3-06.png
+
+Use the defaults in the **Binary and format** window and click
+``Next``.
+
+.. figure:: /_static/images/gns3-07.png
+
+Use the defaults in the **Qcow2 options** window and click ``Next``.
+
+.. figure:: /_static/images/gns3-08.png
+
+Set the disk size to 2000 MiB, and click ``Finish`` to end the **Quemu
+image creator**.
+
+.. figure:: /_static/images/gns3-09.png
+
+Click ``Finish`` to end the **New QEMU VM template** wizard.
+
+.. figure:: /_static/images/gns3-10.png
+
+Now the VM settings have to be edited.
+
+Being again at the **Preferences** window, having **Qemu VMs**
+selected and having our new VM selected, click the ``Edit`` button.
+
+.. figure:: /_static/images/gns3-11.png
+
+In the **General settings** tab of your **QEMU VM template
+configuration**, do the following:
+
+* Click on the ``Browse...`` button to choose the **Symbol** you want to
+  have representing your VM.
+* In **Category** select in which group you want to find your VM.
+* Set the **Boot priority** to **CD/DVD-ROM**.
+
+.. figure:: /_static/images/gns3-12.png
+
+At the **HDD** tab, change the Disk interface to **sata** to speed up
+the boot process.
+
+.. figure:: /_static/images/gns3-13.png
+
+At the **CD/DVD** tab click on ``Browse...`` and locate the VyOS image
+you want to install.
+
+.. figure:: /_static/images/gns3-14.png
+
+.. note:: You probably will want to accept to copy the .iso file to your
+   default image directory when you are asked.
+
+In the **Network** tab,  set **0** as the number of adapters, set the
+**Name format** to **eth{0}** and the **Type** to **Paravirtualized
+Network I/O (virtio-net-pci)**.
+
+.. figure:: /_static/images/gns3-15.png
+
+In the **Advanced** tab, unmark the checkbox **Use as a linked base
+VM** and click ``OK``, which will save and close the **QEMU VM template
+configuration** window.
+
+.. figure:: /_static/images/gns3-16.png
+
+At the general **Preferences** window, click ``OK`` to save and close.
+
+.. figure:: /_static/images/gns3-17.png
+
+
+.. _vyos_installation:
+
+VyOS installation
+-----------------
+
+* Create a new project.
+* Drag the newly created VyOS VM into it.
+* Start the VM.
+* Open a console.
+  The console should show the system booting. It will ask for the login
+  credentials, you are at the VyOS live system.
+* `Install VyOS <https://docs.vyos.io/en/latest/install.html#install>`__
+  as normal (that is, using the ``install image`` command).
+
+* After a successful installation, shutdown the VM with the ``poweroff``
+  command.
+
+* **Delete the VM** from the GNS3 project.
+
+The *VyOS-hda.qcow2* file now contains a working VyOS image and can be
+used as a template. But it still needs some fixes before we can deploy
+VyOS in our labs.
+
+.. _vyos_vm_configuration:
+
+VyOS VM configuration
+---------------------
+
+To turn the template into a working VyOS machine, further steps are
+necessary as outlined below:
+
+**General settings** tab: Set the boot priority to **HDD**
+
+.. figure:: /_static/images/gns3-20.png
+  
+**CD/DVD** tab: Unmount the installation image file by clearing the
+**Image** entry field.
+
+.. figure:: /_static/images/gns3-21.png
+
+Set the number of required network adapters, for example **4**.
+
+.. figure:: /_static/images/gns3-215.png
+
+**Advanced** settings tab: Mark the checkbox **Use as a linked
+base VM** and click ``OK`` to save the changes.
+
+.. figure:: /_static/images/gns3-22.png
+
+The VyOS VM is now ready to be deployed.
+
diff --git a/docs/installation/virtual/index.rst b/docs/installation/virtual/index.rst
new file mode 100644
index 00000000..dab5bc59
--- /dev/null
+++ b/docs/installation/virtual/index.rst
@@ -0,0 +1,9 @@
+####################################
+Running VyOS in Virtual Environments
+####################################
+
+.. toctree::
+   :caption: Content
+
+   gns3
+   vmware
\ No newline at end of file
diff --git a/docs/installation/virtual/vmware.rst b/docs/installation/virtual/vmware.rst
new file mode 100644
index 00000000..6feb95ba
--- /dev/null
+++ b/docs/installation/virtual/vmware.rst
@@ -0,0 +1,32 @@
+.. _vyosonvmware:
+
+Running on VMWare ESXi
+######################
+
+ESXi 5.5 or later
+*****************
+
+.ova files are available for supporting users, and a VyOS can also be stood up using a generic Linux instance, and attaching the bootable ISO file and installing from the ISO 
+using the normal process around `install image`.
+
+.. NOTE:: There have been previous documented issues with GRE/IPSEC tunneling using the E1000 adapter on the VyOS guest, and use of the VMXNET3 has been advised.
+
+Memory Contention Considerations
+--------------------------------
+When the underlying ESXi host is approaching ~92% memory utilisation it will start the balloon process in s a 'soft' state to start reclaiming memory from guest operating systems. 
+This causes an artifical pressure using the vmmemctl driver on memory usage on the virtual guest. As VyOS by default does not have a swap file, this vmmemctl pressure is unable to
+force processes to move in memory data to the paging file, and blindly consumes memory forcing the virtual guest into a low memory state with no way to escape. The balloon can expand to 65% of 
+guest allocated memory, so a VyOS guest running >35% of memory usage, can encounter an out of memory situation, and trigger the kernel oom_kill process. At this point a weighted 
+lottery favouring memory hungry processes will be run with the unlucky winner being terminated by the kernel.
+
+It is advised that VyOS routers are configured in a resource group with adequate memory reservations so that ballooning is not inflicted on virtual VyOS guests.
+
+
+
+
+
+References
+----------
+
+https://muralidba.blogspot.com/2018/03/how-does-linux-out-of-memory-oom-killer.html
+
diff --git a/docs/installation/vyos-on-baremetal.rst b/docs/installation/vyos-on-baremetal.rst
new file mode 100644
index 00000000..14ba2adf
--- /dev/null
+++ b/docs/installation/vyos-on-baremetal.rst
@@ -0,0 +1,380 @@
+.. _vyosonbaremetal:
+
+Running on Bare Metal
+#####################
+
+Intel Atom C3000
+****************
+
+I opted to get one of the new Intel Atom C3000 CPUs to spawn VyOS on it.
+Running VyOS on an UEFI only device is supported as of VyOS release 1.2.
+
+Shopping Cart
+-------------
+
+* 1x Supermicro CSE-505-203B (19" 1U chassis, inkl. 200W PSU)
+* 1x Supermicro MCP-260-00085-0B (I/O Shield for A2SDi-2C-HLN4F)
+* 1x Supermicro A2SDi-2C-HLN4F (Intel Atom C3338, 2C/2T, 4MB cache, Quad LAN with
+  Intel C3000 SoC 1GbE)
+* 1x Crucial CT4G4DFS824A (4GB DDR4 RAM 2400 MT/s, PC4-19200)
+* 1x SanDisk Ultra Fit 32GB (USB-A 3.0 SDCZ43-032G-G46 mass storage for OS)
+* 1x Supermicro MCP-320-81302-0B (optional FAN tray)
+
+Optional (10GE)
+---------------
+If you wan't to get additional ethernet ports or even 10GE connectivity
+the following optional parts will be required:
+
+* 1x Supermicro RSC-RR1U-E8 (Riser Card)
+* 1x Supermicro MCP-120-00063-0N (Riser Card Bracket)
+
+Latest VyOS rolling releases boot without any problem on this board. You also
+receive a nice IPMI interface realized with an ASPEED AST2400 BMC (no information
+about `OpenBMC <https://www.openbmc.org/>`_ so far on this motherboard).
+
+Pictures
+--------
+
+.. figure:: /_static/images/1u_vyos_back.jpg
+   :scale: 25 %
+   :alt: CSE-505-203B Back
+
+.. figure:: /_static/images/1u_vyos_front.jpg
+   :scale: 25 %
+   :alt: CSE-505-203B Front
+
+.. figure:: /_static/images/1u_vyos_front_open_1.jpg
+   :scale: 25 %
+   :alt: CSE-505-203B Open 1
+
+.. figure:: /_static/images/1u_vyos_front_open_2.jpg
+   :scale: 25 %
+   :alt: CSE-505-203B Open 2
+
+.. figure:: /_static/images/1u_vyos_front_open_3.jpg
+   :scale: 25 %
+   :alt: CSE-505-203B Open 3
+
+.. figure:: /_static/images/1u_vyos_front_10ge_open_1.jpg
+   :scale: 25 %
+   :alt: CSE-505-203B w/ 10GE Open 1
+
+.. figure:: /_static/images/1u_vyos_front_10ge_open_2.jpg
+   :scale: 25 %
+   :alt: CSE-505-203B w/ 10GE Open 2
+
+.. figure:: /_static/images/1u_vyos_front_10ge_open_3.jpg
+   :scale: 25 %
+   :alt: CSE-505-203B w/ 10GE Open 3
+
+.. figure:: /_static/images/1u_vyos_front_10ge_open_4.jpg
+   :scale: 25 %
+   :alt: CSE-505-203B w/ 10GE Open
+
+
+PC Engines APU4
+***************
+
+As this platform seems to be quiet common in terms of noise, cost, power and
+performance it makes sense to write a small installation manual.
+
+This guide was developed using an APU4C4 board with the following specs:
+
+* AMD Embedded G series GX-412TC, 1 GHz quad Jaguar core with 64 bit and AES-NI
+  support, 32K data + 32K instruction cache per core, shared 2MB L2 cache.
+* 4 GB DDR3-1333 DRAM, with optional ECC support
+* About 6 to 10W of 12V DC power depending on CPU load
+* 2 miniPCI express (one with SIM socket for 3G modem).
+* 4 Gigabit Ethernet channels using Intel i211AT NICs
+
+The board can be powered via 12V from the front or via a 5V onboard connector.
+
+Shopping Cart
+-------------
+
+* 1x apu4c4 = 4 i211AT LAN / AMD GX-412TC CPU / 4 GB DRAM / dual SIM
+* 1x Kingston SUV500MS/120G
+* 1x VARIA Group Item 326745 19" dual rack rack for APU4
+* 1x Compex WLE900VX (Optional mini PCIe WiFi module)
+
+The 19" enclosure can accomodate up to two APU4 boards - there is a single and
+dual front cover.
+
+.. note:: Compex WLE900VX is only supported in mPCIe slot 1.
+
+VyOS 1.2 (crux)
+---------------
+
+Depending on the VyOS versions you intend to install there is a difference in
+the serial port settings (T1327_).
+
+Create a bootable USB pendrive using e.g. Rufus_ on a Windows machine.
+
+Connect serial port to a PC through null modem cable (RXD / TXD crossed over).
+Set terminal emulator to 115200 8N1.
+
+.. code-block:: none
+
+  PC Engines apu4
+  coreboot build 20171130
+  BIOS version v4.6.4
+  4080 MB ECC DRAM
+  SeaBIOS (version rel-1.11.0.1-0-g90da88d)
+
+  Press F10 key now for boot menu:
+
+  Select boot device:
+
+  1. ata0-0: KINGSTON SUV500MS120G ATA-11 Hard-Disk (111 GiBytes)
+  2. USB MSC Drive Generic Flash Disk 8.07
+  3. Payload [memtest]
+  4. Payload [setup]
+
+Now boot from the ``USB MSC Drive Generic Flash Disk 8.07`` media by pressing
+``2``, the VyOS boot menu will appear, just wait 10 seconds or press ``Enter``
+to continue.
+
+.. code-block:: none
+
+  lqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqk
+  x                      VyOS - Boot Menu                      x
+  tqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqu
+  x Live (amd64-vyos)                                          x
+  x Live (amd64-vyos failsafe)                                 x
+  x                                                            x
+  mqqqqqqPress ENAutomatic boot in 10 seconds...nu entryqqqqqqqj
+
+The image will be loaded and the last lines you will get will be:
+
+.. code-block:: none
+
+  Loading /live/vmlinuz... ok
+  Loading /live/initrd.img...
+
+The Kernel will now spin up using a different console setting. Set terminal
+emulator to 9600 8N1 and after a while your console will show:
+
+.. code-block:: none
+
+  Loading /live/vmlinuz... ok
+  Loading /live/initrd.img...
+  Welcome to VyOS - vyos ttyS0
+
+  vyos login:
+
+You can now proceed with a regular image installation as described in
+:ref:`installation`.
+
+As the APU board itself still used a serial setting of 115200 8N1 it is strongly
+recommended that you change the VyOS serial interface settings after your first
+successful boot.
+
+Use the following command to adjust the :ref:`serial-console` settings:
+
+.. code-block:: none
+
+  set system console device ttyS0 speed 115200
+
+.. note:: Once you ``commit`` the above changes access to the serial interface
+   is lost until you set your terminal emulator to 115200 8N1 again.
+
+.. code-block:: none
+
+  vyos@vyos# show system console
+   device ttyS0 {
+     speed 115200
+   }
+
+VyOS 1.2 (rolling)
+------------------
+
+Installing the rolling release on an APU2 board does not require any change
+on the serial console from your host side as T1327_ was successfully
+implemented.
+
+Simply proceed with a regular image installation as described in :ref:`installation`.
+
+Pictures
+--------
+
+.. note:: Both device types operate without any moving parts and emit zero noise.
+
+Rack Mount
+^^^^^^^^^^
+
+.. figure:: /_static/images/apu4c4_rack_1.jpg
+   :scale: 25 %
+   :alt: APU4C4 rack closed
+
+.. figure:: /_static/images/apu4c4_rack_2.jpg
+   :scale: 25 %
+   :alt: APU4C4 rack front
+
+.. figure:: /_static/images/apu4c4_rack_3.jpg
+   :scale: 25 %
+   :alt: APU4C4 rack module #1
+
+.. figure:: /_static/images/apu4c4_rack_4.jpg
+   :scale: 25 %
+   :alt: APU4C4 rack module #2
+
+.. figure:: /_static/images/apu4c4_rack_5.jpg
+   :scale: 25 %
+   :alt: APU4C4 rack module #3 with PSU
+
+
+Desktop
+^^^^^^^
+
+.. figure:: /_static/images/apu4c4_desk_1.jpg
+   :scale: 25 %
+   :alt: APU4C4 desktop closed
+
+.. figure:: /_static/images/apu4c4_desk_2.jpg
+   :scale: 25 %
+   :alt: APU4C4 desktop closed
+
+.. figure:: /_static/images/apu4c4_desk_3.jpg
+   :scale: 25 %
+   :alt: APU4C4 desktop back
+
+.. figure:: /_static/images/apu4c4_desk_4.jpg
+   :scale: 25 %
+   :alt: APU4C4 desktop back
+
+.. _Rufus: https://rufus.ie/
+.. _T1327: https://phabricator.vyos.net/T1327
+
+
+Qotom Q355G4
+************
+
+The install on this Q355G4 box is pretty much plug and play. The port numbering
+the OS does might differ from the labels on the outside, but the UEFI firmware
+has a port blink test built in with MAC adresses so you can very quickly identify
+which is which. MAC labels are on the inside as well, and this test can be done
+from VyOS or plain Linux too. Default settings in the UEFI will make it boot,
+but depending on your installation wishes (i.e. storage type, boot type, console
+type) you might want to adjust them. This Qotom company seems to be the real
+OEM/ODM for many other relabelling companies like Protectli.
+
+Hardware
+--------
+
+There are a number of other options, but they all seem to be close to Intel
+reference designs, with added features like more serial ports, more network
+interfaces and the likes. Because they don't deviate too much from standard
+designs all the hardware is well-supported by mainline. It accepts one LPDDR3
+SO-DIMM, but chances are that if you need more than that, you'll also want
+something even beefier than an i5. There are options for antenna holes, and SIM
+slots, so you could in theory add an LTE/Cell modem (not tested so far).
+
+The chassis is a U-shaped alu extrusion with removable I/O plates and removable
+bottom plate. Cooling is completely passive with a heatsink on the SoC with
+internal and external fins, a flat interface surface, thermal pad on top of that,
+which then directly attaches to the chassis, which has fins as well. It comes
+with mounting hardware and rubber feet, so you could place it like a desktop
+model or mount it on a VESA mount, or even wall mount it with the provided
+mounting plate. The closing plate doubles as internal 2.5" mounting place for
+an HDD or SSD, and comes supplied with a small SATA cable and SATA power cable.
+
+Power supply is a 12VDC barrel jack, and included switching power supply, which
+is why SATA power regulation is on-board. Internally it has a NUC-board-style
+on-board 12V input header as well, the molex locking style.
+
+There are WDT options and auto-boot on power enable, which is great for remote
+setups. Firmware is reasonably secure (no backdoors found, BootGuard is enabled
+in enforcement mode, which is good but also means no coreboot option), yet has
+most options available to configure (so it's not locked out like most firmwares
+are).
+
+An external RS232 serial port is available, internally a GPIO header as well.
+It does have Realtek based audio on board for some reason, but you can disable
+that. Booting works on both USB2 and USB3 ports. Switching between serial BIOS
+mode and HDMI BIOS mode depends on what is connected at startup; it goes into
+serial mode if you disconnect HDMI and plug in serial, in all other cases it's
+HDMI mode.
+
+Partaker i5
+***********
+
+.. figure:: ../_static/images/600px-Partaker-i5.jpg
+
+I believe this is actually the same hardware as the Protectli. I purchased it
+from `Amazon <https://www.amazon.com/gp/product/B073F9GHKL/>`_ in June 2018.
+It came pre-loaded with pfSense.
+
+`Manufacturer product page <http://www.inctel.com.cn/product/detail/338.html>`_.
+
+Installation
+------------
+
+* Write VyOS ISO to USB drive of some sort
+* Plug in VGA, power, USB keyboard, and USB drive
+* Press "SW" button on the front (this is the power button; I don't know what
+  "SW" is supposed to mean).
+* Begin rapidly pressing delete on the keyboard. The boot prompt is very quick,
+  but with a few tries you should be able to get into the BIOS.
+* Chipset > South Bridge > USB Configuration: set XHCI to Disabled and USB 2.0
+  (EHCI) to Enabled. Without doing this, the USB drive won't boot.
+* Boot to the VyOS installer and install as usual.
+
+Warning the interface labels on my device are backwards; the left-most "LAN4"
+port is eth0 and the right-most "LAN1" port is eth3.
+
+Acrosser AND-J190N1
+*******************
+
+.. figure:: ../_static/images/480px-Acrosser_ANDJ190N1_Front.jpg
+
+.. figure:: ../_static/images/480px-Acrosser_ANDJ190N1_Back.jpg
+
+11/22/2016. This microbox network appliance was build to create OpenVPN bridges.
+It can saturate a 100Mbps link.
+
+It is a small (serial console only) PC with 6 Gb LAN
+http://www.acrosser.com/upload/AND-J190_J180N1-2.pdf
+
+You may have to add your own RAM and HDD/SSD. There is no VGA connector. But
+Acrosser provides a DB25 adapter for the VGA header on the motherboard (not used).
+
+BIOS Settings:
+--------------
+
+First thing you want to do is getting a more user friendly console to configure
+BIOS. Default VT100 brings a lot of issues. Configure VT100+ instead.
+
+For practical issues change speed from 115200 to 9600. 9600 is the default speed
+at which both linux kernel and VyOS will reconfigure the serial port when loading.
+
+Connect to serial (115200bps). Power on the appliance and press Del in the console
+when requested to enter BIOS settings.
+
+Advanced > Serial Port Console Redirection > Console Redirection Settings:
+
+* Terminal Type : VT100+
+* Bits per second : 9600
+
+Save, reboot and change serial speed to 9600 on your client.
+
+Some options have to be changed for VyOS to boot correctly. With XHCI enabled
+the installer can’t access the USB key. Enable EHCI instead.
+
+Reboot into BIOS, Chipset > South Bridge > USB Configuration:
+
+* Disable XHCI
+* Enable USB 2.0 (EHCI) Support
+
+Install VyOS:
+-------------
+
+Create a VyOS bootable USB key. I used the 64-bit ISO (VyOS 1.1.7) and `LinuxLive
+USB Creator <http://www.linuxliveusb.com/>`_.
+
+I'm not sure if it helps the process but I changed default option to live-serial
+(line “default xxxx”) on the USB key under syslinux/syslinux.cfg.
+
+I connected the key to one black USB port on the back and powered on. The first
+VyOS screen has some readability issues. Press :kbd:`Enter` to continue.
+
+Then VyOS should boot and you can perform the ``install image``
diff --git a/docs/interfaces/addresses.rst b/docs/interfaces/addresses.rst
deleted file mode 100644
index 6799b027..00000000
--- a/docs/interfaces/addresses.rst
+++ /dev/null
@@ -1,178 +0,0 @@
-.. _interfaces-addresses:
-
-Interface Addresses
--------------------
-
-Each interface can be configured with a description and address. Interface
-addresses might be:
-
-* Static IPv4 `address 172.16.51.129/24`
-* Static IPv6 `address 2001:db8:1::ffff/64`
-* DHCP IPv4 `address dhcp`
-* DHCP IPv6 `address dhcpv6`
-
-An interface description is assigned using the following command:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 description 'OUTSIDE'
-
-IPv4
-^^^^
-
-Static Address
-**************
-
-This method is supported on all interfaces, apart from OpenVPN that uses
-different syntax and wireless modems that are always autoconfigured through
-PPP.
-
-The command is `set interfaces $type $name address $address`. Examples:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address 192.0.2.1/24
-  set interfaces tunnel tun0 address 10.0.0.1/30
-  set interfaces bridge br0 address 203.0.113.45/26
-  set interfaces ethernet eth0 vif 30 address 192.0.30.254/24
-
-DHCP
-****
-
-This method is supported on all physical interfaces, and those that are
-directly connected to a physical interface (ethernet, VLAN, bridge, bond,
-pseudo-ethernet, wireless).
-
-The command is `set interfaces $type $name address dhcp`. Examples:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 vif 90 address dhcp
-  set interfaces bridge br0 address dhcp
-
-IPv6
-^^^^
-
-Static Address
-**************
-
-This method is supported on all interfaces, apart from OpenVPN that uses
-different syntax and wireless modems that are always autoconfigured through
-PPP. Static IPv6 addresses are supported on all interfaces
-except :ref:`interfaces-tunnel`.
-
-The command is `set interfaces $type $name address $address`. Examples:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address 2001:db8:100::ffff/64
-  set interfaces tunnel tun0 address 2001:db8::1/64
-  set interfaces bridge br0 address  2001:db8:200::1/64
-  set interfaces ethernet eth0 vif 30 address 2001:db8:3::ffff/64
-
-DHCP
-****
-
-This method is supported on all physical interfaces, and those that are
-directly connected to a physical interface (ethernet, VLAN, bridge, bond,
-pseudo-ethernet, wireless).
-
-The command is `set interfaces $type $name address dhcpv6`. Examples:
-
-.. code-block:: none
-
-  set interfaces bonding bond1 address dhcpv6
-  set interfaces bridge br0 vif 56 address dhcpv6
-
-Autoconfiguration (SLAAC)
-*************************
-
-SLAAC is specified in RFC4862_. This method is supported on all physical
-interfaces, and those that are directly connected to a physical interface
-(ethernet, VLAN, bridge, bond, pseudo-ethernet, wireless).
-
-The command is `set interfaces $type $name ipv6 address autoconf`. Examples:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 vif 90 ipv6 address autoconf
-  set interfaces bridge br0 ipv6 address autoconf
-
-.. note:: This method automatically disables IPv6 traffic forwarding on the
-   interface in question.
-
-EUI-64
-******
-
-EUI-64 (64-Bit Extended Unique Identifier) as specified in RFC4291_. IPv6
-addresses in /64 networks can be automatically generated from the prefix and
-MAC address, if you specify the prefix.
-
-The command is `set interfaces $type $name ipv6 address eui64 $prefix`.
-Examples:
-
-.. code-block:: none
-
-  set interfaces bridge br0 ipv6 address eui64 2001:db8:beef::/64
-  set interfaces pseudo-ethernet peth0 ipv6 address eui64 2001:db8:aa::/64
-
-
-Router Advertisements
-*********************
-
-Router advertisements are described in `RFC4861 section 4.2`_. They are part of what is known as SLAAC (Stateless Address Autoconfiguration). 
-
-To enable or disable, use:
-
-.. code-block:: none
-
-  set interfaces <interface> ipv6 router-advert send-advert <true or false>
-
-
-To set the options described in "Router Advertisement Message Format":
-
-.. code-block:: none
-
-  vyos@vyos#  set interfaces <interface> ipv6 router-advert
-  Possible completions:
-    cur-hop-limit         Value to be placed in the "Current Hop Limit" field in RAs
-    default-lifetime      Value to be placed in "Router Lifetime" field in RAs
-    default-preference    Default router preference
-    link-mtu              Value of link MTU to place in RAs
-    managed-flag          Value for "managed address configuration" flag in RAs
-    max-interval          Maximum interval between unsolicited multicast RAs
-    min-interval          Minimum interval between unsolicited multicast RAs
-  +  name-server          IPv6 address of a Recursive DNS Server
-    other-config-flag     Value to be placed in the "other configuration" flag in RAs
-  +> prefix               IPv6 prefix to be advertised in Router Advertisements (RAs)
-    reachable-time        Value to be placed in "Reachable Time" field in RAs
-    retrans-timer         Value to place in "Retrans Timer" field in RAs.
-    send-advert           Enable/disable sending RAs
-
-
-**Prefix Information**
-
-Prefix information is described in `RFC4861 section 4.6.2`_
-
-.. code-block:: none
-
-  vyos@vyos# set interfaces <interface> ipv6 router-advert prefix <h:h:h:h:h:h:h:h/x>
-  Possible completions:
-    autonomous-flag       Whether prefix can be used for address auto-configuration
-    on-link-flag          Flag that prefix can be used for on-link determination
-    preferred-lifetime    Time in seconds that the prefix will remain preferred
-    valid-lifetime        Time in seconds that the prefix will remain valid
-
-**Receiving Router Advertisements**
-
-To receive and accept RAs on an interface, you need to enable it with the following configuration command
-
-.. code-block:: none
-
-  vyos@vyos# set system sysctl custom net.ipv6.conf.<interface name>.accept_ra value 2
-
-
-.. _`RFC4861 section 4.6.2`: https://tools.ietf.org/html/rfc4861#section-4.6.2
-.. _`RFC4861 section 4.2`: https://tools.ietf.org/html/rfc4861#section-4.2
-.. _RFC4862: https://tools.ietf.org/html/rfc4862
-.. _RFC4291: http://tools.ietf.org/html/rfc4291#section-2.5.1
diff --git a/docs/interfaces/bonding.rst b/docs/interfaces/bonding.rst
deleted file mode 100644
index 76c8714a..00000000
--- a/docs/interfaces/bonding.rst
+++ /dev/null
@@ -1,75 +0,0 @@
-Bonding
--------
-
-You can combine (aggregate) 2 or more physical interfaces into a single
-logical one. It's called bonding, or LAG, or ether-channel, or port-channel.
-
-Create interface bondX, where X is just a number:
-
-.. code-block:: none
-
-  set interfaces bonding bond0 description 'my-sw1 int 23 and 24'
-
-You are able to choose a hash policy:
-
-.. code-block:: none
-
-  vyos@vyos# set interfaces bonding bond0 hash-policy
-  Possible completions:
-    layer2       use MAC addresses to generate the hash (802.3ad)
-    layer2+3     combine MAC address and IP address to make hash
-    layer3+4     combine IP address and port to make hash
-
-For example:
-
-.. code-block:: none
-
-  set interfaces bonding bond0 hash-policy 'layer2'
-
-You may want to set IEEE 802.3ad Dynamic link aggregation (802.3ad) AKA LACP
-(don't forget to setup it on the other end of these links):
-
-.. code-block:: none
-
- set interfaces bonding bond0 mode '802.3ad'
-
-or some other modes:
-
-.. code-block:: none
-
-  vyos@vyos# set interfaces bonding bond0 mode
-  Possible completions:
-    802.3ad      IEEE 802.3ad Dynamic link aggregation (Default)
-    active-backup
-                 Fault tolerant: only one slave in the bond is active
-    broadcast    Fault tolerant: transmits everything on all slave interfaces
-    round-robin  Load balance: transmit packets in sequential order
-    transmit-load-balance
-                 Load balance: adapts based on transmit load and speed
-    adaptive-load-balance
-                 Load balance: adapts based on transmit and receive plus ARP
-    xor-hash     Load balance: distribute based on MAC address
-
-Now bond some physical interfaces into bond0:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 bond-group 'bond0'
-  set interfaces ethernet eth0 description 'member of bond0'
-  set interfaces ethernet eth1 bond-group 'bond0'
-  set interfaces ethernet eth1 description 'member of bond0'
-
-After a commit you may treat bond0 as almost a physical interface (you can't
-change its` duplex, for example) and assign IPs or VIFs on it.
-
-You may check the result:
-
-.. code-block:: none
-
-  vyos@vyos# run sh interfaces bonding
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  bond0            -                                 u/u  my-sw1 int 23 and 24
-  bond0.10         192.168.0.1/24                    u/u  office-net
-  bond0.100        10.10.10.1/24                     u/u  management-net
diff --git a/docs/interfaces/bridging.rst b/docs/interfaces/bridging.rst
deleted file mode 100644
index 30ece53d..00000000
--- a/docs/interfaces/bridging.rst
+++ /dev/null
@@ -1,104 +0,0 @@
-Bridging
---------
-
-Interfaces in VyOS can be bridged together to provide software switching of
-Layer-2 traffic.
-
-A bridge is created when a bridge interface is defined. In the example below
-we will be creating a bridge for VLAN 100 and assigning a VIF to the bridge.
-
-.. code-block:: none
-
-  set interfaces bridge 'br100'
-  set interfaces ethernet eth1 vif 100 bridge-group bridge br100
-    
-Interfaces assigned to a bridge-group do not have address configuration. An IP
-address can be assigned to the bridge interface itself, however, like any
-normal interface.
-
-.. code-block:: none
-
-  set interfaces bridge br100 address '192.168.100.1/24'
-  set interfaces bridge br100 address '2001:db8:100::1/64'
-
-Example Result:
-
-.. code-block:: none
-
-  bridge br100 {
-      address 192.168.100.1/24
-      address 2001:db8:100::1/64
-  }
-  [...]
-  ethernet eth1 {
-  [...]
-      vif 100 {
-          bridge-group {
-              bridge br100
-          }
-      }
-  }
-
-In addition to normal IP interface configuration, bridge interfaces support
-Spanning-Tree Protocol. STP is disabled by default.
-
-.. note:: Please use caution when introducing spanning-tree protocol on a
-   network as it may result in topology changes.
-
-To enable spanning-tree use the
-`set interfaces bridge <name> stp true` command:
-
-.. code-block:: none
-
-  set interfaces bridge br100 stp true
-
-STP `priority`, `forwarding-delay`, `hello-time`, and `max-age` can be
-configured for the bridge-group. The MAC aging time can also be configured
-using the `aging` directive.
-
-For member interfaces, the bridge-group `priority` and `cost` can be
-configured.
-
-The `show bridge` operational command can be used to display configured
-bridges:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show bridge
-  bridge name     bridge id               STP enabled     interfaces
-  br100           0000.000c29443b19       yes             eth1.100
-
-If spanning-tree is enabled, the `show bridge <name> spanning-tree` command
-can be used to show STP configuration:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show bridge br100 spanning-tree
-  br100
-   bridge id              0000.000c29443b19
-   designated root        0000.000c29443b19
-   root port                 0                    path cost                  0
-   max age                  20.00                 bridge max age            20.00
-   hello time                2.00                 bridge hello time          2.00
-   forward delay            15.00                 bridge forward delay      15.00
-   ageing time             300.00
-   hello timer               0.47                 tcn timer                  0.00
-   topology change timer     0.00                 gc timer                  64.63
-   flags
-
-  eth1.100 (1)
-   port id                8001                    state                forwarding
-   designated root        0000.000c29443b19       path cost                  4
-   designated bridge      0000.000c29443b19       message age timer          0.00
-   designated port        8001                    forward delay timer        0.00
-   designated cost           0                    hold timer                 0.00
-   flags
-
-The MAC address-table for a bridge can be displayed using the
-`show bridge <name> macs` command:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show bridge br100 macs
-  port no mac addr                is local?       ageing timer
-    1     00:0c:29:44:3b:19       yes                0.00
diff --git a/docs/interfaces/dummy.rst b/docs/interfaces/dummy.rst
deleted file mode 100644
index dea4c387..00000000
--- a/docs/interfaces/dummy.rst
+++ /dev/null
@@ -1,21 +0,0 @@
-.. _dummy-interface:
-
-Dummy Interfaces
-----------------
-
-Dummy interfaces — much like the loopback, except you can have as many as you want.
-Dummy interfaces can be used as interfaces that always stay up (in the same fashion to loopbacks in IOS), or for testing purposes.
-
-Configuration commands:
-
-.. code-block:: none
-
-    interfaces
-        dummy <dum[0-999]>
-        + address           IP address
-        description         Description
-        disable             Disable interface
-        > ip                IPv4 routing parameters
-        > ipv6              IPv6 routing parameters
-        redirect            Incoming packet redirection destination
-        > traffic-policy    Traffic-policy for interface
\ No newline at end of file
diff --git a/docs/interfaces/ethernet.rst b/docs/interfaces/ethernet.rst
deleted file mode 100644
index c7744b6c..00000000
--- a/docs/interfaces/ethernet.rst
+++ /dev/null
@@ -1,72 +0,0 @@
-
-Ethernet Interfaces
--------------------
-.. _interfaces-ethernet:
-
-Ethernet interfaces allow for the configuration of speed, duplex, and hw-id
-(MAC address). Below is an example configuration:
-
-.. code-block:: none
-
-  set interfaces ethernet eth1 address '192.168.0.1/24'
-  set interfaces ethernet eth1 address '2001:db8:1::ffff/64'
-  set interfaces ethernet eth1 description 'INSIDE'
-  set interfaces ethernet eth1 duplex 'auto'
-  set interfaces ethernet eth1 speed 'auto'
-
-Resulting in:
-
-.. code-block:: none
-
-  ethernet eth1 {
-      address 192.168.0.1/24
-      address 2001:db8:1::ffff/64
-      description INSIDE
-      duplex auto
-      hw-id 00:0c:29:44:3b:19
-      smp_affinity auto
-      speed auto
-  }
-
-In addition, Ethernet interfaces provide the extended operational commands:
-
-* `show interfaces ethernet <name> physical`
-* `show interfaces ethernet <name> statistics` 
-
-Statistics available are driver dependent.
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces ethernet eth0 physical
-  Settings for eth0:
-          Supported ports: [ TP ]
-          Supported link modes:   10baseT/Half 10baseT/Full
-                                  100baseT/Half 100baseT/Full
-                                  1000baseT/Full
-          Supports auto-negotiation: Yes
-          Advertised link modes:  10baseT/Half 10baseT/Full
-                                  100baseT/Half 100baseT/Full
-                                  1000baseT/Full
-          Advertised pause frame use: No
-          Advertised auto-negotiation: Yes
-          Speed: 1000Mb/s
-          Duplex: Full
-          Port: Twisted Pair
-          PHYAD: 0
-          Transceiver: internal
-          Auto-negotiation: on
-          MDI-X: Unknown
-          Supports Wake-on: d
-          Wake-on: d
-          Current message level: 0x00000007 (7)
-          Link detected: yes
-  driver: e1000
-  version: 7.3.21-k8-NAPI
-  firmware-version:
-  bus-info: 0000:02:01.0
-
-  vyos@vyos:~$ show interfaces ethernet eth0 statistics
-  NIC statistics:
-       rx_packets: 3530
-       tx_packets: 2179
-  [...]
diff --git a/docs/interfaces/index.rst b/docs/interfaces/index.rst
deleted file mode 100644
index aa8d264e..00000000
--- a/docs/interfaces/index.rst
+++ /dev/null
@@ -1,63 +0,0 @@
-.. _network-interfaces:
-
-Network Interfaces
-==================
-
-Configured interfaces on a VyOS system can be displayed using the
-`show interfaces` command.
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             172.16.51.129/24                  u/u  OUTSIDE
-  eth1             192.168.0.1/24                    u/u  INSIDE
-  lo               127.0.0.1/8                       u/u
-                   ::1/128
-  vyos@vyos:~$
-
-A specific interface can be shown using the `show interfaces <type> <name>`
-command.
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces ethernet eth0
-  eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
-      link/ether 00:0c:29:44:3b:0f brd ff:ff:ff:ff:ff:ff
-      inet 172.16.51.129/24 brd 172.16.51.255 scope global eth0
-      inet6 fe80::20c:29ff:fe44:3b0f/64 scope link
-         valid_lft forever preferred_lft forever
-      Description: OUTSIDE
-
-      RX:  bytes    packets     errors    dropped    overrun      mcast
-          274397       3064          0          0          0          0
-      TX:  bytes    packets     errors    dropped    carrier collisions
-          257276       1890          0          0          0          0
-  vyos@vyos:~$
-
-Different network interfaces provide type-specific configuration. Ethernet
-interfaces, for example, allow the configuration of speed and duplex.
-
-Many services, such as network routing, firewall, and traffic policy also
-maintain interface-specific configuration. These will be covered in their
-respective sections.
-
-
-.. toctree::
-   :maxdepth: 2
-   :hidden:
-
-   addresses
-   dummy
-   ethernet
-   l2tpv3
-   pppoe
-   wireless
-   bridging
-   bonding
-   tunnel
-   vlan
-   qinq
-   vxlan
diff --git a/docs/interfaces/l2tpv3.rst b/docs/interfaces/l2tpv3.rst
deleted file mode 100644
index 4514412d..00000000
--- a/docs/interfaces/l2tpv3.rst
+++ /dev/null
@@ -1,119 +0,0 @@
-.. _l2tpv3-interface:
-
-L2TPv3 Interfaces
------------------
-
-L2TPv3 is a pseudowire protocol, you can read more about here `Wikipedia L2TPv3`_ or `RFC3921`_
-
-L2TPv3 can transport any traffic including ethernet frames. L2TPv2 is limited to PPP.
-
-
-L2TPv3 over IP
-^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  # show interfaces l2tpv3 
-  l2tpv3 l2tpeth10 {
-      address 192.168.37.1/27
-      encapsulation ip
-      local-ip 192.0.2.1
-      peer-session-id 100
-      peer-tunnel-id 200
-      remote-ip 203.0.113.24
-      session-id 100
-      tunnel-id 200
-  }
-
-Inverse configuration has to be applied to the remote side.
-
-L2TPv3 over UDP
-^^^^^^^^^^^^^^^
-
-UDP mode works better with NAT:
-
-* Set local-ip to your local IP (LAN).
-* Add a forwarding rule matching UDP port on your internet router.
-
-.. code-block:: none
-
-  # show interfaces l2tpv3 
-  l2tpv3 l2tpeth10 {
-      address 192.168.37.1/27
-      destination-port 9001
-      encapsulation udp
-      local-ip 192.0.2.1
-      peer-session-id 100
-      peer-tunnel-id 200
-      remote-ip 203.0.113.24
-      session-id 100
-      source-port 9000
-      tunnel-id 200
-  }
-
-To create more than one tunnel, use distinct UDP ports.
-
-
-L2TPv3 over IPSec, L2 VPN (bridge)
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-This is the LAN extension use case. The eth0 port of the distant VPN peers will be directly connected like if there was a switch between them.
-
-IPSec:
-
-.. code-block:: none
-
-  set vpn ipsec ipsec-interfaces <VPN-interface>
-  set vpn ipsec esp-group test-ESP-1 compression 'disable'
-  set vpn ipsec esp-group test-ESP-1 lifetime '3600'
-  set vpn ipsec esp-group test-ESP-1 mode 'transport'
-  set vpn ipsec esp-group test-ESP-1 pfs 'enable'
-  set vpn ipsec esp-group test-ESP-1 proposal 1 encryption 'aes128'
-  set vpn ipsec esp-group test-ESP-1 proposal 1 hash 'sha1'
-  set vpn ipsec ike-group test-IKE-1 ikev2-reauth 'no'
-  set vpn ipsec ike-group test-IKE-1 key-exchange 'ikev1'
-  set vpn ipsec ike-group test-IKE-1 lifetime '3600'
-  set vpn ipsec ike-group test-IKE-1 proposal 1 dh-group '5'
-  set vpn ipsec ike-group test-IKE-1 proposal 1 encryption 'aes128'
-  set vpn ipsec ike-group test-IKE-1 proposal 1 hash 'sha1'
-  set vpn ipsec site-to-site peer <peer-ip> authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer <peer-ip> authentication pre-shared-secret <pre-shared-key>
-  set vpn ipsec site-to-site peer <peer-ip> connection-type 'initiate'
-  set vpn ipsec site-to-site peer <peer-ip> ike-group 'test-IKE-1'
-  set vpn ipsec site-to-site peer <peer-ip> ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer <peer-ip> local-address <local-ip>
-  set vpn ipsec site-to-site peer <peer-ip> tunnel 1 allow-nat-networks 'disable'
-  set vpn ipsec site-to-site peer <peer-ip> tunnel 1 allow-public-networks 'disable'
-  set vpn ipsec site-to-site peer <peer-ip> tunnel 1 esp-group 'test-ESP-1'
-  set vpn ipsec site-to-site peer <peer-ip> tunnel 1 protocol 'l2tp'
-
-Bridge:
-
-.. code-block:: none
-
-  set interfaces bridge br0 description 'L2 VPN Bridge'
-  # remote side in this example:
-  # set interfaces bridge br0 address '172.16.30.18/30'
-  set interfaces bridge br0 address '172.16.30.17/30'
-  set interfaces ethernet eth0 bridge-group bridge 'br0'
-  set interfaces ethernet eth0 description 'L2 VPN Physical port'
-
-L2TPv3:
-
-.. code-block:: none
-
-  set interfaces l2tpv3 l2tpeth0 bridge-group bridge 'br0'
-  set interfaces l2tpv3 l2tpeth0 description 'L2 VPN Tunnel'
-  set interfaces l2tpv3 l2tpeth0 destination-port '5000'
-  set interfaces l2tpv3 l2tpeth0 encapsulation 'ip'
-  set interfaces l2tpv3 l2tpeth0 local-ip <local-ip>
-  set interfaces l2tpv3 l2tpeth0 mtu '1500'
-  set interfaces l2tpv3 l2tpeth0 peer-session-id '110'
-  set interfaces l2tpv3 l2tpeth0 peer-tunnel-id '10'
-  set interfaces l2tpv3 l2tpeth0 remote-ip <peer-ip>
-  set interfaces l2tpv3 l2tpeth0 session-id '110'
-  set interfaces l2tpv3 l2tpeth0 source-port '5000'
-  set interfaces l2tpv3 l2tpeth0 tunnel-id '10'
-
-.. _`Wikipedia L2TPv3`: http://en.wikipedia.org/wiki/L2TPv3
-.. _`RFC3921`: https://tools.ietf.org/html/rfc3931
\ No newline at end of file
diff --git a/docs/interfaces/pppoe.rst b/docs/interfaces/pppoe.rst
deleted file mode 100644
index d8625722..00000000
--- a/docs/interfaces/pppoe.rst
+++ /dev/null
@@ -1,82 +0,0 @@
-.. _pppoe:
-
-
-PPPoE
-=====
-
-There are two main ways to setup VyOS to connect over a PPPoE internet connection. This is due to most ISPs (Internet Service Providers) providing a DSL modem that is also a wireless router.
-
-**First Method:** (Common for Homes)
-
-In this method, the DSL Modem/Router connects to the ISP for you with your credentials preprogrammed into the device.  This gives you an RFC1918_ address, such as 192.168.1.0/24 by default.
-
-For a simple home network using just the ISP's equipment, this is usually desirable.  But if you want to run VyOS as your firewall and router, this will result in having a double NAT and firewall setup. This results in a few extra layers of complexity, particularly if you use some NAT or tunnel features.
-
-**Second Method:** (Common for Businesses)
-
-In order to have full control and make use of multiple static public IP addresses, your VyOS will have to initiate the PPPoE connection and control it.
-In order for this method to work, you will have to figure out how to make your DSL Modem/Router switch into a Bridged Mode so it only acts as a DSL Transceiver device to connect between the Ethernet link of your VyOS and the phone cable.
-Once your DSL Transceiver is in Bridge Mode, you should get no IP address from it.
-Please make sure you connect to the Ethernet Port 1 if your DSL Transeiver has a switch, as some of them only work this way.
-Once you have an Ethernet device connected, i.e. eth0, then you can configure it to open the PPPoE session for you and your DSL Transceiver (Modem/Router) just acts to translate your messages in a way that vDSL/aDSL understands.
-
-**Here is an example configuration:**
-
-.. code-block:: none
-
-  set interface ethernet eth0 description "DSL Modem"
-  set interface ethernet eth0 duplex auto
-  set interface ethernet eth0 smp_affinity auto
-  set interface ethernet eth0 speed auto
-  set interface ethernet eth0 pppoe 0 default-route auto
-  set interface ethernet eth0 pppoe 0 mtu 1492
-  set interface ethernet eth0 pppoe 0 name-server auto
-  set interface ethernet eth0 pppoe 0 user-id <PPPoE Username>
-  set interface ethernet eth0 pppoe 0 password <PPPoE Password>
-
-
-* You should add a firewall to your configuration above as well by assigning it to the pppoe0 itself as shown here:
-
-.. code-block:: none
-
-  set interface ethernet eth0 pppoe 0 firewall in name NET-IN
-  set interface ethernet eth0 pppoe 0 firewall local name NET-LOCAL
-  set interface ethernet eth0 pppoe 0 firewall out name NET-OUT
-
-* You need your PPPoE credentials from your DSL ISP in order to configure this. The usual username is in the form of name@host.net but may vary depending on ISP.
-* The largest MTU size you can use with DSL is 1492 due to PPPoE overhead. If you are switching from a DHCP based ISP like cable then be aware that things like VPN links may need to have their MTU sizes adjusted to work within this limit.
-* With the ``default-route`` option set to ``auto``, VyOS will only add the Default Gateway you receive from your DSL ISP to the routing table if you have no other WAN connections. If you wish to use a Dual WAN connection, change the ``default-route`` option to ``force``.
-
-Handling and troubleshooting
-----------------------------
-
-You can test connecting and disconnecting with the below commands:
-
-.. code-block:: none
-
-  disconnect interface 0
-  connect interface 0
-
-
-You can check the PPPoE connection logs with the following:
-
-This command shows the current statistics, status and some of the settings (i.e. MTU) for the current connection on pppoe0.
-
-.. code-block:: none
-
-  show interfaces pppoe 0
-
-This command shows the entire log for the PPPoE connection starting with the oldest data. Scroll down with the <space> key to reach the end where the current data is.
-
-.. code-block:: none
-
-  show interfaces pppoe 0 log
-
-
-This command shows the same log as without the 'tail' option but only starts with the last few lines and continues to show added lines until you exit with ``Ctrl + x``
-
-.. code-block:: none
-
-  show interfaces pppoe 0 log tail
-
-.. _RFC1918: https://tools.ietf.org/html/rfc1918
diff --git a/docs/interfaces/qinq.rst b/docs/interfaces/qinq.rst
deleted file mode 100644
index 2049f511..00000000
--- a/docs/interfaces/qinq.rst
+++ /dev/null
@@ -1,58 +0,0 @@
-.. _interfaces-qinq:
-
-QinQ
-----
-
-QinQ (802.1ad_) — allows multiple VLAN tags to be inserted into a single frame.
-
-QinQ can be used to tunnel vlans in a vlan.
-
-**vif-s** and **vif-c** stand for the ethertype tags that get set:
-
-The inner tag is the tag which is closest to the payload portion of the frame; it is officially called C-TAG (Customer tag, with ethertype 0x8100).
-The outer tag is the one closer/closest to the Ethernet header; its name is S-TAG (Service tag, ethertype 0x88a8).
-
-Configuration commands:
-
-.. code-block:: none
-
-  interfaces
-      ethernet <eth[0-999]>
-          address <ipv4>
-          address <ipv6>
-          description <txt>
-          disable
-          ip
-              <usual IP options>
-          ipv6
-              <usual IPv6 options>
-          vif-s <[0-4096]>
-              address <ipv4>
-              address <ipv6>
-              description <txt>
-              disable
-              ip
-                  <usual IP options>
-              ipv6
-                  <usual IPv6 options>
-              vif-c <[0-4096]>
-                  address <ipv4>
-                  address <ipv6>
-                  description <txt>
-                  disable
-                  ip
-                      <usual IP options>
-                  ipv6
-                      <usual IPv6 options>
-
-
-Example:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 vif-s 333
-  set interfaces ethernet eth0 vif-s 333 address 192.0.2.10/32
-  set interfaces ethernet eth0 vif-s 333 vif-c 777
-  set interfaces ethernet eth0 vif-s 333 vif-c 777 address 10.10.10.10/24
-
-.. _802.1ad: https://en.wikipedia.org/wiki/IEEE_802.1ad
\ No newline at end of file
diff --git a/docs/interfaces/tunnel.rst b/docs/interfaces/tunnel.rst
deleted file mode 100644
index 43c217a0..00000000
--- a/docs/interfaces/tunnel.rst
+++ /dev/null
@@ -1,237 +0,0 @@
-.. _interfaces-tunnel:
-
-Tunnel Interfaces
-=================
-
-This article touches on 'classic' IP tunneling protocols.
-
-GRE is often seen as a one size fits all solution when it comes to classic IP tunneling protocols, and for a good reason.
-However, there are more specialized options, and many of them are supported by VyOS. There are also rather obscure GRE options that can be useful.
-
-All those protocols are grouped under 'interfaces tunnel' in VyOS. Let's take a closer look at the protocols and options currently supported by VyOS.
-
-IPIP
-----
-
-This is one of the simplest types of tunnels, as defined by RFC2003_.
-It takes an IPv4 packet and sends it as a payload of another IPv4 packet. For this reason, there are no other configuration options for this kind of tunnel.
-
-An example:
-
-.. code-block:: none
-
-  set interfaces tunnel tun0 encapsulation ipip
-  set interfaces tunnel tun0 local-ip 192.0.2.10
-  set interfaces tunnel tun0 remote-ip 203.0.113.20
-  set interfaces tunnel tun0 address 192.168.100.200
-
-IP6IP6
-------
-
-This is the IPv6 counterpart of IPIP. I'm not aware of an RFC that defines this encapsulation specifically, but it's a natural specific case of IPv6 encapsulation mechanisms described in RFC2473_.
-
-It's not likely that anyone will need it any time soon, but it does exist.
-
-An example:
-
-.. code-block:: none
-
-  set interfaces tunnel tun0 encapsulation ipip
-  set interfaces tunnel tun0 local-ip 2001:db8:aa::1/64
-  set interfaces tunnel tun0 remote-ip 2001:db8:aa::2/64
-  set interfaces tunnel tun0 address 2001:db8:bb::1/64
-
-IPIP6
------
-
-In the future this is expected to be a very useful protocol (though there are `other proposals`_).
-
-As the name implies, it's IPv4 encapsulated in IPv6, as simple as that.
-
-An example:
-
-.. code-block:: none
-
-  set interfaces tunnel tun0 encapsulation ipip6
-  set interfaces tunnel tun0 local-ip 2001:db8:aa::1/64
-  set interfaces tunnel tun0 remote-ip 2001:db8:aa::2/64
-  set interfaces tunnel tun0 address 192.168.70.80
-
-6in4 (SIT)
-----------
-
-
-6in4 uses tunneling to encapsulate IPv6 traffic over IPv4 links as defined in RFC4213_.
-The 6in4 traffic is sent over IPv4 inside IPv4 packets whose IP headers have the IP protocol number set to 41.
-This protocol number is specifically designated for IPv6 encapsulation, the IPv4 packet header is immediately followed by the IPv6 packet being carried.
-The encapsulation overhead is the size of the IPv4 header of 20 bytes, therefore with an MTU of 1500 bytes, IPv6 packets of 1480 bytes can be sent without fragmentation. This tunneling technique is frequently used by IPv6 tunnel brokers like `Hurricane Electric`_. 
-
-An example:
-
-.. code-block:: none
-
-  set interfaces tunnel tun0 encapsulation sit
-  set interfaces tunnel tun0 local-ip 192.0.2.10
-  set interfaces tunnel tun0 remote-ip 192.0.2.20
-  set interfaces tunnel tun0 address 2001:db8:bb::1/64
-
-A full example of a Tunnelbroker.net config can be found at :ref:`here <examples-tunnelbroker-ipv6>`.
-
-Generic Routing Encapsulation (GRE)
------------------------------------
-
-A GRE tunnel operates at layer 3 of the OSI model and is repsented by IP protocol 47.  The 
-main benefit of a GRE tunnel is that you are able to route traffic across disparate networks.  
-GRE also supports multicast traffic and supports routing protocols that leverage multicast to 
-form neighbor adjacencies.
-
-Configuration
-^^^^^^^^^^^^^
-
-A basic configuration requires a tunnel source (local-ip), a tunnel destination (remote-ip), 
-an encapsulation type (gre), and an address (ipv4/ipv6).  Below is a configuration example 
-taken from a VyOS router and a Cisco IOS router.  The main difference between these two 
-configurations is that VyOS requires you explicitly configure the encapsulation type.  
-The Cisco router defaults to 'gre ip' otherwise it would have to be configured as well.
-
-**VyOS Router:**
-
-.. code-block:: none
-
-  set interfaces tunnel tun100 address '10.0.0.1/30'
-  set interfaces tunnel tun100 encapsulation 'gre'
-  set interfaces tunnel tun100 local-ip '198.51.100.2'
-  set interfaces tunnel tun100 remote-ip '203.0.113.10'
-
-**Cisco IOS Router:**
-
-.. code-block:: none
-
-  interface Tunnel100
-  ip address 10.0.0.2 255.255.255.252
-  tunnel source 203.0.113.10
-  tunnel destination 198.51.100.2
-
-
-Tunnel keys
-^^^^^^^^^^^
-
-GRE is also the only classic protocol that allows creating multiple tunnels with the same source and destination due to its support for tunnel keys. Despite its name, this feature has nothing to do with security: it's simply an identifier that allows routers to tell one tunnel from another.
-
-An example:
-
-.. code-block:: none
-
-   set interfaces tunnel tun0 local-ip 192.0.2.10
-   set interfaces tunnel tun0 remote-ip 192.0.2.20
-   set interfaces tunnel tun0 address 10.40.50.60/24
-   set interfaces tunnel tun0 parameters ip key 10
-  
-.. code-block:: none
-
-   set interfaces tunnel tun0 local-ip 192.0.2.10
-   set interfaces tunnel tun0 remote-ip 192.0.2.20
-   set interfaces tunnel tun0 address 172.16.17.18/24
-   set interfaces tunnel tun0 parameters ip key 20
-   
-  
-GRE-Bridge
-^^^^^^^^^^
-While normal GRE is for layer 3, GRE-Bridge is for layer 2. GRE-Bridge can encapsulate Ethernet frames, thus it can be bridged with other interfaces to create datalink layer segments that span multiple remote sites.
-
-Layer 2 GRE example:
-
-.. code-block:: none
-
-   set interfaces bridge br0
-   set interfaces tunnel tun0 encapsulation gre-bridge
-   set interfaces tunnel tun0 local-ip 192.0.2.10
-   set interfaces tunnel tun0 remote-ip 192.0.2.20
-   set interfaces tunnel tun0 parameters ip bridge-group bridge br0
-   set interfaces ethernet eth1 bridge-group br0
-   
-As you can see, the bridge-group option for tunnels is in a rather unusual place, different from all other interfaces.
-
-
-Troubleshooting
-^^^^^^^^^^^^^^^
-
-GRE is a well defined standard that is common in most networks.  While not inherently difficult 
-to configure there are a couple of things to keep in mind to make sure the configuration performs 
-as expected.  A common cause for GRE tunnels to fail to come up correctly include ACL or Firewall 
-configurations that are discarding IP protocol 47 or blocking your source/desintation traffic.
-
-**1. Confirm IP connectivity between tunnel local-ip and remote-ip:**
-
-.. code-block:: none
-
-  vyos@vyos:~$ ping 203.0.113.10 interface 198.51.100.2 count 4
-  PING 203.0.113.10 (203.0.113.10) from 198.51.100.2 : 56(84) bytes of data.
-  64 bytes from 203.0.113.10: icmp_seq=1 ttl=254 time=0.807 ms
-  64 bytes from 203.0.113.10: icmp_seq=2 ttl=254 time=1.50 ms
-  64 bytes from 203.0.113.10: icmp_seq=3 ttl=254 time=0.624 ms
-  64 bytes from 203.0.113.10: icmp_seq=4 ttl=254 time=1.41 ms
-
-  --- 203.0.113.10 ping statistics ---
-  4 packets transmitted, 4 received, 0% packet loss, time 3007ms
-  rtt min/avg/max/mdev = 0.624/1.087/1.509/0.381 ms
-
-**2. Confirm the link type has been set to GRE:**
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces tunnel tun100
-  tun100@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1476 qdisc noqueue state UNKNOWN group default qlen 1000
-    link/gre 198.51.100.2 peer 203.0.113.10
-    inet 10.0.0.1/30 brd 10.0.0.3 scope global tun100
-       valid_lft forever preferred_lft forever
-    inet6 fe80::5efe:c612:2/64 scope link
-       valid_lft forever preferred_lft forever
-
-    RX:  bytes    packets     errors    dropped    overrun      mcast
-          2183         27          0          0          0          0
-    TX:  bytes    packets     errors    dropped    carrier collisions
-           836          9          0          0          0          0
-
-**3. Confirm IP connectivity across the tunnel:**
-
-.. code-block:: none
-
-  vyos@vyos:~$ ping 10.0.0.2 interface 10.0.0.1 count 4
-  PING 10.0.0.2 (10.0.0.2) from 10.0.0.1 : 56(84) bytes of data.
-  64 bytes from 10.0.0.2: icmp_seq=1 ttl=255 time=1.05 ms
-  64 bytes from 10.0.0.2: icmp_seq=2 ttl=255 time=1.88 ms
-  64 bytes from 10.0.0.2: icmp_seq=3 ttl=255 time=1.98 ms
-  64 bytes from 10.0.0.2: icmp_seq=4 ttl=255 time=1.98 ms
-
-  --- 10.0.0.2 ping statistics ---
-  4 packets transmitted, 4 received, 0% packet loss, time 3008ms
-  rtt min/avg/max/mdev = 1.055/1.729/1.989/0.395 ms
-
-Virtual Tunnel Interface (VTI)
-------------------------------
-
-Set Virtual Tunnel Interface
-
-.. code-block:: none
-
-  set interfaces vti vti0 address 192.168.2.249/30
-  set interfaces vti vti0 address 2001:db8:2::249/64
-
-Results in:
-
-.. code-block:: none
-
-  vyos@vyos# show interfaces vti
-  vti vti0 {
-      address 192.168.2.249/30
-      address 2001:db8:2::249/64
-      description "Description"
-  }
-
-
-.. _RFC2003: https://tools.ietf.org/html/rfc2003
-.. _RFC2473: https://tools.ietf.org/html/rfc2473
-.. _`other proposals`: https://www.isc.org/downloads/aftr
-.. _RFC4213: https://tools.ietf.org/html/rfc4213
-.. _`Hurricane Electric`: https://tunnelbroker.net/
diff --git a/docs/interfaces/vlan.rst b/docs/interfaces/vlan.rst
deleted file mode 100644
index b2f67108..00000000
--- a/docs/interfaces/vlan.rst
+++ /dev/null
@@ -1,47 +0,0 @@
-VLAN Sub-Interfaces (802.1Q)
-----------------------------
-.. _interfaces-vlan:
-
-802.1Q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The
-term used for this is `vif`. Configuration of a tagged sub-interface is
-accomplished using the configuration command
-`set interfaces ethernet <name> vif <vlan-id>`.
-
-.. code-block:: none
-
-  set interfaces ethernet eth1 vif 100 description 'VLAN 100'
-  set interfaces ethernet eth1 vif 100 address '192.168.100.1/24'
-  set interfaces ethernet eth1 vif 100 address '2001:db8:100::1/64'
-
-Resulting in:
-
-.. code-block:: none
-
-  ethernet eth1 {
-      address 192.168.100.1/24
-      address 2001:db8:100::1/64
-      description INSIDE
-      duplex auto
-      hw-id 00:0c:29:44:3b:19
-      smp_affinity auto
-      speed auto
-      vif 100 {
-          address 192.168.100.1/24
-          description "VLAN 100"
-      }
-  }
-
-VLAN interfaces are shown as `<name>.<vlan-id>`, e.g. `eth1.100`:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             172.16.51.129/24                  u/u  OUTSIDE
-  eth1             192.168.0.1/24                    u/u  INSIDE
-  eth1.100         192.168.100.1/24                  u/u  VLAN 100
-  lo               127.0.0.1/8                       u/u
-                   ::1/128
-
diff --git a/docs/interfaces/vxlan.rst b/docs/interfaces/vxlan.rst
deleted file mode 100644
index e3eb5c43..00000000
--- a/docs/interfaces/vxlan.rst
+++ /dev/null
@@ -1,305 +0,0 @@
-VXLAN
------
-
-VXLAN is an overlaying Ethernet over IP protocol.
-It is described in RFC7348_.
-
-If configuring VXLAN in a VyOS virtual machine, ensure that MAC spoofing
-(Hyper-V) or Forged Transmits (ESX) are permitted, otherwise forwarded frames
-may be blocked by the hypervisor.
-
-Multicast VXLAN
-^^^^^^^^^^^^^^^^
-
-Example Topology:
-
-PC4 - Leaf2 - Spine1 - Leaf3 - PC5
-
-PC4 has IP 10.0.0.4/24 and PC5 has IP 10.0.0.5/24, so they believe they are in
-the same broadcast domain.
-
-Let's assume PC4 on Leaf2 wants to ping PC5 on Leaf3. Instead of setting Leaf3
-as our remote end manually, Leaf2 encapsulates the packet into a UDP-packet and
-sends it to its designated multicast-address via Spine1. When Spine1 receives
-this packet it forwards it to all other Leafs who has joined the same
-multicast-group, in this case Leaf3. When Leaf3 receives the packet it forwards
-it, while at the same time learning that PC4 is reachable behind Leaf2, because
-the encapsulated packet had Leaf2's IP-address set as source IP.
-
-PC5 receives the ping echo, responds with an echo reply that Leaf3 receives and
-this time forwards to Leaf2's unicast address directly because it learned the
-location of PC4 above. When Leaf2 receives the echo reply from PC5 it sees that
-it came from Leaf3 and so remembers that PC5 is reachable via Leaf3.
-
-Thanks to this discovery, any subsequent traffic between PC4 and PC5 will not
-be using the multicast-address between the Leafs as they both know behind which
-Leaf the PCs are connected. This saves traffic as less multicast packets sent
-reduces the load on the network, which improves scalability when more Leafs are
-added.
-
-For optimal scalability Multicast shouldn't be used at all, but instead use BGP
-to signal all connected devices between leafs. Unfortunately, VyOS does not yet
-support this.
-
-Configuration commands
-^^^^^^^^^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  interfaces
-    vxlan <vxlan[0-16777215]>
-      address          # IP address of the VXLAN interface
-      bridge-group     # Configure a L2 bridge-group
-      description      # Description
-      group <ipv4>     # IPv4 Multicast group address (required)
-      ip               # IPv4 routing options
-      ipv6             # IPv6 routing options
-      link <dev>       # IP interface for underlay of this vxlan overlay (optional)
-      mtu              # MTU
-      policy           # Policy routing options
-      remote           # Remote address of the VXLAN tunnel, used for PTP instead of multicast
-      vni <1-16777215> # Virtual Network Identifier (required)
-
-Configuration Example
-^^^^^^^^^^^^^^^^^^^^^
-
-The setup is this:
-
-Leaf2 - Spine1 - Leaf3
-
-Spine1 is a Cisco IOS router running version 15.4, Leaf2 and Leaf3 is each a
-VyOS router running 1.2.
-
-This topology was built using GNS3.
-
-Topology:
-
-.. code-block:: none
-
-  Spine1:
-  fa0/2 towards Leaf2, IP-address: 10.1.2.1/24
-  fa0/3 towards Leaf3, IP-address: 10.1.3.1/24
-
-  Leaf2:
-  Eth0 towards Spine1, IP-address: 10.1.2.2/24
-  Eth1 towards a vlan-aware switch
-
-  Leaf3:
-  Eth0 towards Spine1, IP-address 10.1.3.3/24
-  Eth1 towards a vlan-aware switch
-
-Spine1 Configuration:
-
-.. code-block:: none
-
-  conf t
-  ip multicast-routing
-  !
-  interface fastethernet0/2
-   ip address 10.1.2.1 255.255.255.0
-   ip pim sparse-dense-mode
-  !
-  interface fastethernet0/3
-   ip address 10.1.3.1 255.255.255.0
-   ip pim sparse-dense-mode
-  !
-  router ospf 1
-   network 10.0.0.0 0.255.255.255 area 0
-
-Multicast-routing is required for the leafs to forward traffic between each
-other in a more scalable way. This also requires PIM to be enabled towards the
-Leafs so that the Spine can learn what multicast groups each Leaf expect traffic
-from.
-
-Leaf2 configuration:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address '10.1.2.2/24'
-  set protocols ospf area 0 network '10.0.0.0/8'
-
-  ! Our first vxlan interface
-  set interfaces bridge br241 address '172.16.241.1/24'
-  set interfaces ethernet eth1 vif 241 bridge-group bridge 'br241'
-  set interfaces vxlan vxlan241 bridge-group bridge 'br241'
-  set interfaces vxlan vxlan241 group '239.0.0.241'
-  set interfaces vxlan vxlan241 link 'eth0'
-  set interfaces vxlan vxlan241 vni '241'
-
-  ! Our seconds vxlan interface
-  set interfaces bridge br242 address '172.16.242.1/24'
-  set interfaces ethernet eth1 vif 242 bridge-group bridge 'br242'
-  set interfaces vxlan vxlan242 bridge-group bridge 'br242'
-  set interfaces vxlan vxlan242 group '239.0.0.242'
-  set interfaces vxlan vxlan242 link 'eth0'
-  set interfaces vxlan vxlan242 vni '242'
-
-Leaf3 configuration:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address '10.1.3.3/24'
-  set protocols ospf area 0 network '10.0.0.0/8'
-
-  ! Our first vxlan interface
-  set interfaces bridge br241 address '172.16.241.1/24'
-  set interfaces ethernet eth1 vif 241 bridge-group bridge 'br241'
-  set interfaces vxlan vxlan241 bridge-group bridge 'br241'
-  set interfaces vxlan vxlan241 group '239.0.0.241'
-  set interfaces vxlan vxlan241 link 'eth0'
-  set interfaces vxlan vxlan241 vni '241'
-
-  ! Our seconds vxlan interface
-  set interfaces bridge br242 address '172.16.242.1/24'
-  set interfaces ethernet eth1 vif 242 bridge-group bridge 'br242'
-  set interfaces vxlan vxlan242 bridge-group bridge 'br242'
-  set interfaces vxlan vxlan242 group '239.0.0.242'
-  set interfaces vxlan vxlan242 link 'eth0'
-  set interfaces vxlan vxlan242 vni '242'
-
-As you can see, Leaf2 and Leaf3 configuration is almost identical. There are
-lots of commands above, I'll try to into more detail below, command
-descriptions are placed under the command boxes:
-
-.. code-block:: none
-
-  set interfaces bridge br241 address '172.16.241.1/24'
-
-This commands creates a bridge that is used to bind traffic on eth1 vlan 241
-with the vxlan241-interface. The IP-address is not required. It may however be
-used as a default gateway for each Leaf which allows devices on the vlan to
-reach other subnets. This requires that the subnets are redistributed by OSPF
-so that the Spine will learn how to reach it. To do this you need to change the
-OSPF network from '10.0.0.0/8' to '0.0.0.0/0' to allow 172.16/12-networks to be
-advertised.
-
-.. code-block:: none
-
-  set interfaces ethernet eth1 vif 241 bridge-group bridge 'br241'
-  set interfaces vxlan vxlan241 bridge-group bridge 'br241'
-
-Binds eth1 vif 241 and vxlan241 to each other by putting them in the same
-bridge-group. Internal VyOS requirement.
-
-.. code-block:: none
-
-  set interfaces vxlan vxlan241 group '239.0.0.241'
-
-The multicast-group used by all Leafs for this vlan extension. Has to be the
-same on all Leafs that has this interface.
-
-.. code-block:: none
-
-  set interfaces vxlan vxlan241 link 'eth0'
-
-Sets the interface to listen for multicast packets on. Could be a loopback, not
-yet tested.
-
-.. code-block:: none
-
-  set interfaces vxlan vxlan241 vni '241'
-
-Sets the unique id for this vxlan-interface. Not sure how it correlates with
-multicast-address.
-
-.. code-block:: none
-
-  set interfaces vxlan vxlan241 remote-port 12345
-
-The destination port used for creating a VXLAN interface in Linux defaults to
-its pre-standard value of 8472 to preserve backwards compatibility. A
-configuration directive to support a user-specified destination port to override
-that behavior is available using the above command.
-
-Older Examples
-^^^^^^^^^^^^^^
-
-Example for bridging normal L2 segment and vxlan overlay network, and using a
-vxlan interface as routing interface.
-
-.. code-block:: none
-
-  interfaces {
-       bridge br0 {
-       }
-       ethernet eth0 {
-           address dhcp
-       }
-       loopback lo {
-       }
-       vxlan vxlan0 {
-           bridge-group {
-               bridge br0
-           }
-           group 239.0.0.1
-           vni 0
-       }
-       vxlan vxlan1 {
-           address 192.168.0.1/24
-           link eth0
-           group 239.0.0.1
-           vni 1
-       }
-  }
-
-Here is a working configuration that creates a VXLAN between two routers. Each
-router has a VLAN interface (26) facing the client devices and a VLAN interface
-(30) that connects it to the other routers. With this configuration, traffic
-can flow between both routers' VLAN 26, but can't escape since there is no L3
-gateway. You can add an IP to a bridge-group to create a gateway.
-
-.. code-block:: none
-
-  interfaces {
-       bridge br0 {
-       }
-       ethernet eth0 {
-           duplex auto
-           smp-affinity auto
-           speed auto
-           vif 26 {
-               bridge-group {
-                   bridge br0
-               }
-           }
-           vif 30 {
-               address 10.7.50.6/24
-           }
-       }
-       loopback lo {
-       }
-       vxlan vxlan0 {
-           bridge-group {
-               bridge br0
-           }
-           group 239.0.0.241
-           vni 241
-       }
-  }
-
-Unicast VXLAN
-^^^^^^^^^^^^^
-
-Alternative to multicast, the remote IPv4 address of the VXLAN tunnel can set directly.
-Let's change the Multicast example from above:
-
-
-.. code-block:: none
-
-  # leaf2 and leaf3
-  delete interfaces vxlan vxlan241 group '239.0.0.241'
-  delete interfaces vxlan vxlan241 link 'eth0'
-
-  # leaf2
-  set interface vxlan vxlan241 remote 10.1.3.3
-
-  # leaf3
-  set interface vxlan vxlan241 remote 10.1.2.2
-
-The default port udp is set to 8472. 
-It can be changed with ``set interface vxlan <vxlanN> remote-port <port>``
-
-
-.. target-notes::
-
-.. _RFC7348: https://datatracker.ietf.org/doc/rfc7348/
diff --git a/docs/interfaces/wireless.rst b/docs/interfaces/wireless.rst
deleted file mode 100644
index a7e796e9..00000000
--- a/docs/interfaces/wireless.rst
+++ /dev/null
@@ -1,55 +0,0 @@
-Wireless Interfaces
--------------------
-.. _interfaces-wireless:
-
-Wireless, for example WiFi 802.11 b/g/n, interfaces allow for connection to
-WiFi networks or act as an access-point.
-If your device is configurable it will appear as `wlan` in `show interfaces`.
-
-To be able to use the wireless interfaces you will first need to set a
-regulatory domain with the country code of your locaion.
-
-.. code-block:: none
-
-  set system wifi-regulatory-domain SE
-
-An example on how to set it up as an access point:
-
-.. code-block:: none
-
-  set interfaces wireless wlan0 address '192.168.99.1/24'
-  set interfaces wireless wlan0 type access-point
-  set interfaces wireless wlan0 channel 1
-  set interfaces wireless wlan0 ssid '<your ssid>'
-  set interfaces wireless wlan0 security wpa mode wpa2
-  set interfaces wireless wlan0 security wpa cipher CCMP
-  set interfaces wireless wlan0 security wpa passphrase '<your passphrase>'
-
-Resulting in
-
-.. code-block:: none
-
-  interfaces {
-    [...]
-    wireless wlan0 {
-          address 192.168.99.1/24
-          channel 1
-          mode g
-          security {
-              wpa {
-                  cipher CCMP
-                  mode wpa2
-                  passphrase "<your passphrase>"
-              }
-          }
-          ssid "<your ssid>"
-          type access-point
-      }
-  }
-  system {
-    [...]
-    wifi-regulatory-domain SE
-  }
-
-To get it to work as a access point with this configuration you will need
-to set up a DHCP server to work with that network.
diff --git a/docs/introducing/about.rst b/docs/introducing/about.rst
new file mode 100644
index 00000000..0411344b
--- /dev/null
+++ b/docs/introducing/about.rst
@@ -0,0 +1,27 @@
+.. _about:
+
+#####
+About
+#####
+
+VyOS is an open source network operating system based on Debian GNU/Linux.
+
+VyOS provides a free routing platform that competes directly with other
+commercially available solutions from well known network providers. Because
+VyOS is run on standard amd64, i586 and ARM systems, it is able to be used
+as a router and firewall platform for cloud deployments.
+
+We use multiple live versions of our manual hosted thankfully by
+https://readthedocs.org. We will provide one version of the manual for every
+VyOS major version starting with VyOS 1.2 which will receive Long-term support
+(LTS).
+
+The manual version is selected/specified by it's Git branch name. You can
+switch between versions of the documentation by selecting the appropriate
+branch on the bottom left corner.
+
+VyOS CLI syntax may change between major (and sometimes minor) versions. Please
+always refer to the documentation matching your current, running installation.
+If a change in the CLI is required, VyOS will ship a so called migration script
+which will take care of adjusting the syntax. No action needs to be taken by
+you.
diff --git a/docs/introducing/history.rst b/docs/introducing/history.rst
new file mode 100644
index 00000000..9a13e2b3
--- /dev/null
+++ b/docs/introducing/history.rst
@@ -0,0 +1,47 @@
+.. _history:
+
+#######
+History
+#######
+
+VyOS is a Linux-based network operating system that provides software-based
+network routing, firewall, and VPN functionality.
+
+The VyOS project was started in late 2013 as a community fork of the
+`GPL <https://en.wikipedia.org/wiki/GNU_General_Public_License>`_ portions of
+Vyatta Core 6.6R1 with the goal of maintaining a free and open source network
+operating system in response to the decision to discontinue the community
+edition of Vyatta. Here everyone loves learning, older managers and new users.
+
+VyOS is primarily based on `Debian GNU/Linux <https://www.debian.org/>`_ and
+the `Quagga <http://www.nongnu.org/quagga/>`_ routing engine. Its configuration
+syntax and :ref:`cli` are loosely derived from Juniper JUNOS as modelled by the
+`XORP project <http://www.xorp.org/>`_, which was the original routing engine
+for Vyatta.
+
+In the 4.0 release of Vyatta, the routing engine was changed to Quagga. As of
+VyOS version 1.2, VyOS now uses `FRRouting <https://frrouting.org/>`_ as the
+routing engine.
+
+How is VyOS different from any other router distributions and platform?
+
+- It's more than just a firewall and VPN, VyOS includes extended routing
+  capabilities like OSPFv2, OSPFv3, BGP, VRRP, and extensive route policy
+  mapping and filtering
+- Unified command line interface in the style of hardware routers.
+- Scriptable CLI
+- Stateful configuration system: prepare changes and commit at once or discard,
+  view previous revisions or rollback to them, archive revisions to remote
+  server and execute hooks at commit time
+- Image-based upgrade: keep multiple versions on the same system and revert to
+  previous image if a problem arises
+- Multiple VPN capabilities: OpenVPN, IPSec, Wireguard, DPMVPN, IKEv2 and more
+- DHCP, TFTP, mDNS repeater, broadcast relay and DNS forwarding support
+- Both IPv4 and IPv6 support
+- Runs on physical and virtual platforms alike: small x86 boards, big servers,
+  KVM, Xen, VMware, Hyper-V, and more
+- Completely free and open source, with documented internal APIs and build
+  procedures
+- Community driven. Patches are welcome and all code, bugs, and nightly builds
+  are publicly accessible
+
diff --git a/docs/load-balancing.rst b/docs/load-balancing.rst
deleted file mode 100644
index cae2f6a5..00000000
--- a/docs/load-balancing.rst
+++ /dev/null
@@ -1,263 +0,0 @@
-.. _load-balancing:
-
-WAN load balancing
-==================
-
-Outbound traffic can be balanced between two or more outbound interfaces.
-If a path fails, traffic is balanced across the remaining healthy paths, a recovered path is automatically added back to the routing table and used by the load balancer.
-The load balancer automatically adds routes for each path to the routing table and balances traffic across the configured interfaces, determined by interface health and weight.
-
-
-In a minimal, configuration the following must be provided:
-
- * a interface with a nexthop
- * one rule with a LAN (inbound-interface) and the WAN (interface).
-
-lets assume we have two dhcp WAN interfaces and one LAN (eth2)
-
-.. code-block:: none
-
-    set load-balancing wan interface-health eth0 nexthop 'dhcp'
-    set load-balancing wan interface-health eth1 nexthop 'dhcp'
-    set load-balancing wan rule 1 inbound-interface 'eth2'
-    set load-balancing wan rule 1 interface eth0
-    set load-balancing wan rule 1 interface eth1
-
-Balancing Rules
----------------
-
-Interfaces, their weight and the type of traffic to be balanced are defined in numbered balancing rule sets.
-The rule sets are executed in numerical order against outgoing packets. In case of a match the packet is sent through an interface specified in the matching rule.
-If a packet doesn't match any rule it is sent by using the system routing table. Rule numbers can't be changed.
-
-Create a load balancing rule, rule can be a number between 1 and 9999:
-
-.. code-block:: none
-
-    vyos@vyos# set load-balancing wan rule 1
-    Possible completions:
-    description             Description for this rule
-    > destination           Destination
-    exclude                 Exclude packets matching this rule from wan load balance
-    failover                Enable failover for packets matching this rule from wan load balance
-    inbound-interface       Inbound interface name (e.g., "eth0") [REQUIRED]
-    +> interface            Interface name [REQUIRED]
-    > limit                 Enable packet limit for this rule
-    per-packet-balancing    Option to match traffic per-packet instead of the default, per-flow
-    protocol                Protocol to match
-    > source                Source information
-
-Interface weight
-****************
-
-Let's expand the example from above and add a weight to the interfaces. The bandwidth from eth0 is larger than eth1.
-Per default outbound traffic is distributed randomly across available interfaces. Weights can be assigned to interfaces to influence the balancing.
-
-.. code-block:: none
-
-    set load-balancing wan rule 1 interface eth0 weight 2
-    set load-balancing wan rule 1 interface eth1 weight 1
-
-66% traffic is routed to eth0 and eth1 get 33% of traffic.
-
-Rate limit
-**********
-
-A packet rate limit can be set for a rule to apply the rule to traffic above or below a specified threshold.
-To configure the rate limiting use:
-
-.. code-block:: none
-
-    set load-balancing wan rule <rule> limit <parameter>
-
-* ``burst``: Number of packets allowed to overshoot the limit within ``period``. Default 5.
-* ``period``: Time window for rate calculation. Possible values: ``second`` (one second), ``minute`` (one minute), ``hour`` (one hour). Default is ``second``.
-* ``rate``: Number of packets. Default 5.
-* ``threshold``: ``below`` or ``above`` the specified rate limit.
-
-Flow and packet-based balancing
-*******************************
-
-Outgoing traffic is balanced in a flow-based manner. 
-A connection tracking table is used to track flows by their source address, destination address and port.
-Each flow is assigned to an interface according to the defined balancing rules and subsequent packets are sent through the same interface.
-This has the advantage that packets always arrive in order if links with different speeds are in use.
-
-Packet-based balancing can lead to a better balance across interfaces when out of order packets are no issue. Per-packet-based balancing can be set for a balancing rule with:
-
-.. code-block:: none
-
-    set load-balancing wan rule <rule> per-packet-balancing
-
-Exclude traffic
-***************
-
-To exclude traffic from load balancing, traffic matching an exclude rule is not balanced but routed through the system routing table instead:
-
-.. code-block:: none
-
-    set load-balancing wan rule <rule> exclude
-
-
-Health checks
--------------
-
-The health of interfaces and paths assigned to the load balancer is periodically checked by sending ICMP packets (ping) to remote destinations, a TTL test or the execution of a user defined script.
-If an interface fails the health check it is removed from the load balancer's pool of interfaces. To enable health checking for an interface:
-
-.. code-block:: none
-
-    vyos@vyos# set load-balancing wan interface-health <interface>
-    Possible completions:
-    failure-count    Failure count
-    nexthop          Outbound interface nexthop address. Can be 'dhcp or ip address' [REQUIRED]
-    success-count    Success count
-    +> test          Rule number
-
-Specify nexthop on the path to destination, ``ipv4-address`` can be set to ``dhcp``
-
-.. code-block:: none
-
-    set load-balancing wan interface-health <interface> nexthop <ipv4-address>
-
-Set the number of health check failures before an interface is marked as unavailable, range for number is 1 to 10, default 1.
-Or set the number of successful health checks before an interface is added back to the interface pool, range for number is 1 to 10, default 1.
-
-.. code-block:: none
-
-    set load-balancing wan interface-health <interface> failure-count <number>
-    set load-balancing wan interface-health <interface> success-count <number>
-
-Each health check is configured in its own test, tests are numbered and processed in numeric order.
-For multi target health checking multiple tests can be defined:
-
-.. code-block:: none
-
-    vyos@vyos# set load-balancing wan interface-health eth1 test 0
-    Possible completions:
-    resp-time    Ping response time (seconds)
-    target       Health target address
-    test-script  Path to user defined script
-    ttl-limit    Ttl limit (hop count)
-    type         WLB test type
-
-* ``resp-time``: the maximum response time for ping in seconds. Range 1...30, default 5
-* ``target``: the target to be sent ICMP packets to, address can be an IPv4 address or hostname
-* ``test-script``: A user defined script must return 0 to be considered successful and non-zero to fail. Scripts are located in /config/scripts, for different locations the full path needs to be provided
-* ``ttl-limit``: For the UDP TTL limit test the hop count limit must be specified. The limit must be shorter than the path length, an ICMP time expired message is needed to be returned for a successful test. default 1
-* ``type``: Specify the type of test. type can be ping, ttl or a user defined script
-
-Source NAT rules
-----------------
-
-Per default, interfaces used in a load balancing pool replace the source IP of each outgoing packet with its own address to ensure that replies arrive on the same interface. 
-This works through automatically generated source NAT (SNAT) rules, these rules are only applied to balanced traffic. In cases where this behaviour is not desired, the automatic generation of SNAT rules can be disabled:
-
-.. code-block:: none
-
-    set load-balancing wan disable-source-nat
-
-Sticky Connections
-------------------
-Inbound connections to a WAN interface can be improperly handled when the reply is sent back to the client.
-
-.. image:: /_static/images/sticky-connections.jpg
-   :width: 80%
-   :align: center
-
-
-Upon reception of an incoming packet, when a response is sent, it might be desired to ensure that it leaves from the same interface as the inbound one.
-This can be achieved by enabling sticky connections in the load balancing:
-
-.. code-block:: none
-
-    set load-balancing wan sticky-connections inbound
-
-Failover
---------
-
-In failover mode, one interface is set to be the primary interface and other interfaces are secondary or spare.
-Instead of balancing traffic across all healthy interfaces, only the primary interface is used and in case of failure, a secondary interface selected from the pool of available interfaces takes over.
-The primary interface is selected based on its weight and health, others become secondary interfaces.
-Secondary interfaces to take over a failed primary interface are chosen from the load balancer's interface pool, depending on their weight and health.
-Interface roles can also be selected based on rule order by including interfaces in balancing rules and ordering those rules accordingly. To put the load balancer in failover mode, create a failover rule:
-
-.. code-block:: none
-
-    set load-balancing wan rule <number> failover
-
-Because existing sessions do not automatically fail over to a new path, the session table can be flushed on each connection state change:
-
-.. code-block:: none
-
-    set load-balancing wan flush-connections
-
-.. warning::
-
-    Flushing the session table will cause other connections to fall back from flow-based to packet-based balancing until each flow is reestablished.
-
-Script execution
-----------------
-
-A script can be run when an interface state change occurs. Scripts are run from /config/scripts, for a different location specify the full path:
-
-.. code-block:: none
-
-    set load-balancing wan hook script-name
-
-Two environment variables are available:
-
-* ``WLB_INTERFACE_NAME=[interfacename]``: Interface to be monitored
-* ``WLB_INTERFACE_STATE=[ACTIVE|FAILED]``: Interface state
-
-.. warning::
-
-    Blocking call with no timeout. System will become unresponsive if script does not return!
-
-Handling and monitoring
------------------------
-
-
-Show WAN load balancer information including test types and targets.
-A character at the start of each line depicts the state of the test
-
-* ``+`` successful
-* ``-`` failed
-* a blank indicates that no test has been carried out
-
-.. code-block:: none
-
-    vyos@vyos:~$ show wan-load-balance
-    Interface:  eth0
-    Status:  failed
-    Last Status Change:  Tue Jun 11 20:12:19 2019
-    -Test:  ping  Target:
-        Last Interface Success:  55s
-        Last Interface Failure:  0s
-        # Interface Failure(s):  5
-
-    Interface:  eth1
-    Status:  active
-    Last Status Change:  Tue Jun 11 20:06:42 2019
-    +Test:  ping  Target:
-        Last Interface Success:  0s
-        Last Interface Failure:  6m26s
-        # Interface Failure(s):  0
-
-Show connection data of load balanced traffic:
-
-.. code-block:: none
-
-    vyos@vyos:~$ show wan-load-balance connection
-    conntrack v1.4.2 (conntrack-tools): 3 flow entries have been shown.
-    Type    State           Src                     Dst                     Packets Bytes
-    tcp     TIME_WAIT       10.1.1.13:38040         203.0.113.2:80          203.0.113.2  192.168.188.71
-    udp                     10.1.1.13:41891         198.51.100.3:53         198.51.100.3 192.168.188.71
-    udp                     10.1.1.13:55437         198.51.100.3:53         198.51.100.3 192.168.188.71
-
-Restart
-*******
-
-.. code-block:: none
-
-    restart wan-load-balance
diff --git a/docs/nat.rst b/docs/nat.rst
deleted file mode 100644
index 25e0259b..00000000
--- a/docs/nat.rst
+++ /dev/null
@@ -1,475 +0,0 @@
-.. _nat:
-
-NAT
-===
-
-Source NAT
-----------
-
-Source NAT is typically referred to simply as NAT. To be more correct, what
-most people refer to as NAT is actually the process of **Port Address
-Translation (PAT)**, or **NAT Overload**. The process of having many internal
-host systems communicate to the Internet using a single or subset of IP
-addresses.
-
-To setup SNAT, we need to know:
-
-* The internal IP addresses we want to translate;
-* The outgoing interface to perform the translation on;
-* The external IP address to translate to.
-
-In the example used for the Quick Start configuration above, we demonstrate
-the following configuration:
-
-.. code-block:: none
-
-  set nat source rule 100 outbound-interface 'eth0'
-  set nat source rule 100 source address '192.168.0.0/24'
-  set nat source rule 100 translation address 'masquerade'
-
-Which generates the following configuration:
-
-.. code-block:: none
-
-  rule 100 {
-      outbound-interface eth0
-      source {
-          address 192.168.0.0/24
-      }
-      translation {
-          address masquerade
-      }
-  }
-
-In this example, we use **masquerade** as the translation address instead of
-an IP address. The **masquerade** target is effectively an alias to say "use
-whatever IP address is on the outgoing interface", rather than a statically
-configured IP address. This is useful if you use DHCP for your outgoing
-interface and do not know what the external address will be.
-
-When using NAT for a large number of host systems it recommended that a
-minimum of 1 IP address is used to NAT every 256 host systems. This is due to
-the limit of 65,000 port numbers available for unique translations and a
-reserving an average of 200-300 sessions per host system.
-
-Example: For an ~8,000 host network a source NAT pool of 32 IP addresses is
-recommended.
-
-A pool of addresses can be defined by using a **-** in the 
-`set nat source rule [n] translation address` statement.
-
-.. code-block:: none
-
-  set nat source rule 100 translation address '203.0.113.32-203.0.113.63'
-
-.. note:: Avoiding "leaky" NAT
-
-Linux netfilter will not NAT traffic marked as INVALID. This often confuses
-people into thinking that Linux (or specifically VyOS) has a broken NAT
-implementation because non-NATed traffic is seen leaving an external interface.
-This is actually working as intended, and a packet capture of the "leaky"
-traffic should reveal that the traffic is either an additional TCP "RST",
-"FIN,ACK", or "RST,ACK" sent by client systems after Linux netfilter considers
-the connection closed. The most common is the additional TCP RST some host
-implementations send after terminating a connection (which is implementation-
-specific).
-
-In other words, connection tracking has already observed the connection be
-closed and has transition the flow to INVALID to prevent attacks from
-attempting to reuse the connection.
-
-You can avoid the "leaky" behavior by using a firewall policy that drops
-"invalid" state packets.
-
-Having control over the matching of INVALID state traffic, e.g. the ability to
-selectively log, is an important troubleshooting tool for observing broken
-protocol behavior. For this reason, VyOS does not globally drop invalid state
-traffic, instead allowing the operator to make the determination on how the
-traffic is handled.
-
-NAT Reflection/Hairpin NAT
-^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-.. note:: Avoiding NAT breakage in the absence of split-DNS
-
-A typical problem with using NAT and hosting public servers is the ability for
-internal systems to reach an internal server using it's external IP address.
-The solution to this is usually the use of split-DNS to correctly point host
-systems to the internal address when requests are made internally. Because
-many smaller networks lack DNS infrastructure, a work-around is commonly
-deployed to facilitate the traffic by NATing the request from internal hosts
-to the source address of the internal interface on the firewall. This technique
-is commonly referred to as **NAT Reflection**, or **Hairpin NAT**.
-
-In this example, we will be using the example Quick Start configuration above
-as a starting point.
-
-To setup a NAT reflection rule, we need to create a rule to NAT connections
-from the internal network to the same internal network to use the source
-address of the internal interface.
-
-.. code-block:: none
-
-  set nat source rule 110 description 'NAT Reflection: INSIDE'
-  set nat source rule 110 destination address '192.168.0.0/24'
-  set nat source rule 110 outbound-interface 'eth1'
-  set nat source rule 110 source address '192.168.0.0/24'
-  set nat source rule 110 translation address 'masquerade'
-
-Which results in a configuration of:
-
-.. code-block:: none
-
-  rule 110 {
-      description "NAT Reflection: INSIDE"
-      destination {
-          address 192.168.0.0/24
-      }
-      outbound-interface eth1
-      source {
-          address 192.168.0.0/24
-      }
-      translation {
-          address masquerade
-      }
-  }
-
-Destination NAT
----------------
-
-DNAT is typically referred to as a **Port Forward**. When using VyOS as a NAT
-router and firewall, a common configuration task is to redirect incoming
-traffic to a system behind the firewall.
-
-In this example, we will be using the example Quick Start configuration above
-as a starting point.
-
-To setup a destination NAT rule we need to gather:
-
-* The interface traffic will be coming in on;
-* The protocol and port we wish to forward;
-* The IP address of the internal system we wish to forward traffic to.
-
-In our example, we will be forwarding web server traffic to an internal web
-server on 192.168.0.100. HTTP traffic makes use of the TCP protocol on port 80.
-For other common port numbers, see: http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
-
-Our configuration commands would be:
-
-.. code-block:: none
-
-  set nat destination rule 10 description 'Port Forward: HTTP to 192.168.0.100'
-  set nat destination rule 10 destination port '80'
-  set nat destination rule 10 inbound-interface 'eth0'
-  set nat destination rule 10 protocol 'tcp'
-  set nat destination rule 10 translation address '192.168.0.100'
-
-Which would generate the following NAT destination configuration:
-
-.. code-block:: none
-
-  nat {
-      destination {
-          rule 10 {
-              description "Port Forward: HTTP to 192.168.0.100"
-              destination {
-                  port 80
-              }
-              inbound-interface eth0
-              protocol tcp
-              translation {
-                  address 192.168.0.100
-              }
-          }
-      }
-  }
-
-.. note:: If forwarding traffic to a different port than it is arriving on,
-   you may also configure the translation port using
-   `set nat destination rule [n] translation port`.
-
-This establishes our Port Forward rule, but if we created a firewall policy it
-will likely block the traffic.
-
-It is important to note that when creating firewall rules that the DNAT
-translation occurs **before** traffic traverses the firewall. In other words,
-the destination address has already been translated to 192.168.0.100.
-
-So in our firewall policy, we want to allow traffic coming in on the outside
-interface, destined for TCP port 80 and the IP address of 192.168.0.100.
-
-.. code-block:: none
-
-  set firewall name OUTSIDE-IN rule 20 action 'accept'
-  set firewall name OUTSIDE-IN rule 20 destination address '192.168.0.100'
-  set firewall name OUTSIDE-IN rule 20 destination port '80'
-  set firewall name OUTSIDE-IN rule 20 protocol 'tcp'
-  set firewall name OUTSIDE-IN rule 20 state new 'enable'
-
-This would generate the following configuration:
-
-.. code-block:: none
-
-  rule 20 {
-      action accept
-      destination {
-          address 192.168.0.100
-          port 80
-      }
-      protocol tcp
-      state {
-          new enable
-      }
-  }
-
-.. note::
-
-  If you have configured the `INSIDE-OUT` policy, you will need to add
-  additional rules to permit inbound NAT traffic.
-
-1-to-1 NAT
-----------
-
-Another term often used for DNAT is **1-to-1 NAT**. For a 1-to-1 NAT
-configuration, both DNAT and SNAT are used to NAT all traffic from an external
-IP address to an internal IP address and vice-versa.
-
-Typically, a 1-to-1 NAT rule omits the destination port (all ports) and
-replaces the protocol with either **all** or **ip**.
-
-Then a corresponding SNAT rule is created to NAT outgoing traffic for the
-internal IP to a reserved external IP. This dedicates an external IP address
-to an internal IP address and is useful for protocols which don't have the
-notion of ports, such as GRE.
-
-1-to-1 NAT example
-------------------
-
-Here's an extract of a simple 1-to-1 NAT configuration with one internal and
-one external interface:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address '192.168.1.1/24'
-  set interfaces ethernet eth0 description 'Inside interface'
-  set interfaces ethernet eth1 address '192.0.2.30/24'
-  set interfaces ethernet eth1 description 'Outside interface'
-  set nat destination rule 2000 description '1-to-1 NAT example'
-  set nat destination rule 2000 destination address '192.0.2.30'
-  set nat destination rule 2000 inbound-interface 'eth1'
-  set nat destination rule 2000 translation address '192.168.1.10'
-  set nat source rule 2000 description '1-to-1 NAT example'
-  set nat source rule 2000 outbound-interface 'eth1'
-  set nat source rule 2000 source address '192.168.1.10'
-  set nat source rule 2000 translation address '192.0.2.30'
-
-Firewall rules are written as normal, using the internal IP address as the
-source of outbound rules and the destination of inbound rules.
-
-NPTv6 (RFC6296)
----------------
-
-NPTv6 stands for Network Prefix Translation. It's a form of NAT for IPv6. It's
-described in RFC6296_. NPTv6 is supported in linux kernel since version 3.13.
-
-Usage
-^^^^^
-
-NPTv6 is very useful for IPv6 multihoming. It is also commonly used when the external IPv6 prefix is dynamic,
-as it prevents the need for renumbering of internal hosts when the extern prefix changes.
-
-Let's assume the following network configuration:
-
-* eth0 : LAN
-* eth1 : WAN1, with 2001:db8:e1::/48 routed towards it
-* eth2 : WAN2, with 2001:db8:e2::/48 routed towards it
-
-Regarding LAN hosts addressing, why would you choose 2001:db8:e1::/48 over
-2001:db8:e2::/48? What happens when you get a new provider with a different
-routed IPv6 subnet?
-
-The solution here is to assign to your hosts ULAs_ and to prefix-translate
-their address to the right subnet when going through your router.
-
-* LAN Subnet : fc00:dead:beef::/48
-* WAN 1 Subnet : 2001:db8:e1::/48
-* WAN 2 Subnet : 2001:db8:e2::/48
-
-* eth0 addr : fc00:dead:beef::1/48
-* eth1 addr : 2001:db8:e1::1/48
-* eth2 addr : 2001:db8:e2::1/48
-
-VyOS Support
-^^^^^^^^^^^^
-
-NPTv6 support has been added in VyOS 1.2 (Crux) and is available through
-`nat nptv6` configuration nodes.
-
-.. code-block:: none
-
-  set rule 10 source prefix 'fc00:dead:beef::/48'
-  set rule 10 outbound-interface 'eth1'
-  set rule 10 translation prefix '2001:db8:e1::/48'
-  set rule 20 source prefix 'fc00:dead:beef::/48'
-  set rule 20 outbound-interface 'eth2'
-  set rule 20 translation prefix '2001:db8:e2::/48'
-
-Resulting in the following ip6tables rules:
-
-.. code-block:: none
-
-  Chain VYOS_DNPT_HOOK (1 references)
-   pkts bytes target   prot opt in   out   source              destination
-      0     0 DNPT     all    eth1   any   anywhere            2001:db8:e1::/48  src-pfx 2001:db8:e1::/48 dst-pfx fc00:dead:beef::/48
-      0     0 DNPT     all    eth2   any   anywhere            2001:db8:e2::/48  src-pfx 2001:db8:e2::/48 dst-pfx fc00:dead:beef::/48
-      0     0 RETURN   all    any    any   anywhere            anywhere
-  Chain VYOS_SNPT_HOOK (1 references)
-   pkts bytes target   prot opt in   out   source              destination
-      0     0 SNPT     all    any    eth1  fc00:dead:beef::/48 anywhere          src-pfx fc00:dead:beef::/48 dst-pfx 2001:db8:e1::/48
-      0     0 SNPT     all    any    eth2  fc00:dead:beef::/48 anywhere          src-pfx fc00:dead:beef::/48 dst-pfx 2001:db8:e2::/48
-      0     0 RETURN   all    any    any   anywhere            anywhere
-
-
-NAT before VPN
---------------
-
-Some application service providers (ASPs) operate a VPN gateway to provide access to their internal resources,
-and require that a connecting organisation translate all traffic to the service provider network to a source address provided by the ASP.
-
-Example Network
-^^^^^^^^^^^^^^^
-
-Here's one example of a network environment for an ASP.
-The ASP requests that all connections from this company should come from 172.29.41.89 - an address that is assigned by the ASP and not in use at the customer site.
-
-.. figure:: _static/images/nat_before_vpn_topology.png
-   :scale: 100 %
-   :alt: NAT before VPN Topology
-
-   NAT before VPN Topology
-
-
-Configuration
-^^^^^^^^^^^^^
-
-The required configuration can be broken down into 4 major pieces:
-
-* A dummy interface for the provider-assigned IP;
-* NAT (specifically, Source NAT);
-* IPSec IKE and ESP Groups;
-* IPSec VPN tunnels.
-
-
-Dummy interface
-***************
-
-The dummy interface allows us to have an equivalent of the Cisco IOS Loopback interface - a router-internal interface we can use for IP addresses the router must know about,
-but which are not actually assigned to a real network.
-
-We only need a single step for this interface:
-
-.. code-block:: none
-
-  set interfaces dummy dum0 address '172.29.41.89/32'
-
-NAT Configuration
-*****************
-
-.. code-block:: none
-
-  set nat source rule 110 description 'Internal to ASP'
-  set nat source rule 110 destination address '172.27.1.0/24'
-  set nat source rule 110 outbound-interface 'any'
-  set nat source rule 110 source address '192.168.43.0/24'
-  set nat source rule 110 translation address '172.29.41.89'
-  set nat source rule 120 description 'Internal to ASP'
-  set nat source rule 120 destination address '10.125.0.0/16'
-  set nat source rule 120 outbound-interface 'any'
-  set nat source rule 120 source address '192.168.43.0/24'
-  set nat source rule 120 translation address '172.29.41.89'
-
-IPSec IKE and ESP
-*****************
-
-
-The ASP has documented their IPSec requirements:
-
-* IKE Phase:
-
-  * aes256 Encryption
-  * sha256 Hashes
-
-* ESP Phase:
-
-  * aes256 Encryption
-  * sha256 Hashes
-  * DH Group 14
-
-
-Additionally, we want to use VPNs only on our eth1 interface (the external interface in the image above)
-
-.. code-block:: none
-
-  set vpn ipsec ike-group my-ike ikev2-reauth 'no'
-  set vpn ipsec ike-group my-ike key-exchange 'ikev1'
-  set vpn ipsec ike-group my-ike lifetime '7800'
-  set vpn ipsec ike-group my-ike proposal 1 dh-group '14'
-  set vpn ipsec ike-group my-ike proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group my-ike proposal 1 hash 'sha256'
-
-  set vpn ipsec esp-group my-esp compression 'disable'
-  set vpn ipsec esp-group my-esp lifetime '3600'
-  set vpn ipsec esp-group my-esp mode 'tunnel'
-  set vpn ipsec esp-group my-esp pfs 'disable'
-  set vpn ipsec esp-group my-esp proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group my-esp proposal 1 hash 'sha256'
-
-  set vpn ipsec ipsec-interfaces interface 'eth1'
-
-IPSec VPN Tunnels
-*****************
-
-We'll use the IKE and ESP groups created above for this VPN. 
-Because we need access to 2 different subnets on the far side, we will need two different tunnels.
-If you changed the names of the ESP group and IKE group in the previous step, make sure you use the correct names here too.
-
-.. code-block:: none
-
-  set vpn ipsec site-to-site peer 198.51.100.243 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 198.51.100.243 authentication pre-shared-secret 'PASSWORD IS HERE'
-  set vpn ipsec site-to-site peer 198.51.100.243 connection-type 'initiate'
-  set vpn ipsec site-to-site peer 198.51.100.243 default-esp-group 'my-esp'
-  set vpn ipsec site-to-site peer 198.51.100.243 ike-group 'my-ike'
-  set vpn ipsec site-to-site peer 198.51.100.243 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 198.51.100.243 local-address '203.0.113.46'
-  set vpn ipsec site-to-site peer 198.51.100.243 tunnel 0 local prefix '172.29.41.89/32'
-  set vpn ipsec site-to-site peer 198.51.100.243 tunnel 0 remote prefix '172.27.1.0/24'
-  set vpn ipsec site-to-site peer 198.51.100.243 tunnel 1 local prefix '172.29.41.89/32'
-  set vpn ipsec site-to-site peer 198.51.100.243 tunnel 1 remote prefix '10.125.0.0/16'
-
-Testing and Validation
-^^^^^^^^^^^^^^^^^^^^^^
-
-If you've completed all the above steps you no doubt want to see if it's all working.
-
-Start by checking for IPSec SAs (Security Associations) with:
-
-.. code-block:: none
-
-  $ show vpn ipsec sa
-
-  Peer ID / IP                            Local ID / IP
-  ------------                            -------------
-  198.51.100.243                          203.0.113.46
-
-      Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
-      ------  -----  -------------  -------  ----    -----  ------  ------  -----
-      0       up     0.0/0.0        aes256   sha256  no     1647    3600    all
-      1       up     0.0/0.0        aes256   sha256  no     865     3600    all
-
-That looks good - we defined 2 tunnels and they're both up and running.
-
-
-
-.. _RFC6296: https://tools.ietf.org/html/rfc6296
-.. _ULAs: http://en.wikipedia.org/wiki/Unique_local_address
diff --git a/docs/operation/boot-options.rst b/docs/operation/boot-options.rst
new file mode 100644
index 00000000..1070afa9
--- /dev/null
+++ b/docs/operation/boot-options.rst
@@ -0,0 +1,56 @@
+.. _boot-options:
+
+
+############
+Boot Options
+############
+
+.. warning:: This function may be highly disruptive.
+   It may cause major service interruption, so make sure you really
+   need it and verify your input carefully.
+
+
+
+VyOS has several kernel command line options to modify the normal boot
+process. 
+To add an option, select the desired image in GRUB menu at load
+time, press **e**, edit the first line, and press **Ctrl-x** to boot when
+ready.
+
+.. image:: /_static/images/boot-options.png
+   :width: 80%
+   :align: center
+
+
+Specify custom config file
+==========================
+
+Tells the system to use specified file instead of ``/config/config.boot``.
+If specified file does not exist or is not readable, fall back to
+default config. No additional verification is performed, so make sure
+you specify a valid config file.
+
+.. code-block:: none
+
+   vyos-config=/path/to/file
+
+To load the *factory default* config, use:
+
+.. code-block:: none
+
+   vyos-config=/opt/vyatta/etc/config.boot.default
+
+
+Disable specific boot process steps
+===================================
+
+These options disable some boot steps. Make sure you understand the
+:ref:`boot process <boot-steps>` well before using them!
+
+.. glossary::
+
+    no-vyos-migrate
+      Do not perform config migration.
+
+    no-vyos-firewall
+      Do not initialize default firewall chains, renders any firewall configuration unusable.
diff --git a/docs/operation/index.rst b/docs/operation/index.rst
new file mode 100644
index 00000000..321ae169
--- /dev/null
+++ b/docs/operation/index.rst
@@ -0,0 +1,9 @@
+##############
+Operation Mode
+##############
+
+.. toctree::
+   :maxdepth: 1
+   :includehidden:
+
+   boot-options
\ No newline at end of file
diff --git a/docs/qos.rst b/docs/qos.rst
deleted file mode 100644
index 6826b83c..00000000
--- a/docs/qos.rst
+++ /dev/null
@@ -1,1197 +0,0 @@
-.. _qos:
-
-***
-QoS
-***
-
-The generic name of Quality of Service or Traffic Control involves
-things like shaping traffic, scheduling or dropping packets, which
-are the kind of things you may want to play with when you have, for
-instance, a bandwidth bottleneck in a link and you want to somehow
-prioritize some type of traffic over another.
-
-tc_ is a powerful tool for Traffic Control found at the Linux kernel.
-However, its configuration is often considered a cumbersome task.
-Fortunately, VyOS eases the job through its CLI, while using ``tc`` as
-backend.
-
-
-How to make it work
-===================
-
-In order to have VyOS Traffic Control working you need to follow 2
-steps:
-
- 1. **Create a traffic policy**.
-
- 2. **Apply the traffic policy to an interface ingress or egress**.
-    
-
-But before learning to configure your policy, we will warn you
-about the different units you can use and also show you what *classes*
-are and how they work, as some policies may require you to configure
-them.
-
-
-Units
-=====
-
-When configuring your traffic policy, you will have to set data rate
-values, watch out the units you are managing, it is easy to get confused
-with the different prefixes and suffixes you can use. VyOS will always
-show you the different units you can use.
-
-Prefixes
---------
-
-They can be **decimal** prefixes.
-
-   .. code-block:: none
-
-	kbit  (10^3)    kilobit per second
-	mbit  (10^6)    megabit per second
-	gbit  (10^9)    gigabit per second
- 	tbit  (10^12)   terabit per second
-	
-	kbps  (8*10^3)  kilobyte per second
-	mbps  (8*10^6)  megabyte per second
-	gbps  (8*10^9)  gigabyte per second
-	tbps  (8*10^12) terabyte per second
-
-Or **binary** prefixes.
-
-   .. code-block:: none
-
-	kibit (2^10 = 1024)    kibibit per second
-	mibit (2^20 = 1024^2)  mebibit per second
-	gibit (2^30 = 1024^3)  gibibit per second
-        tbit  (2^40 = 1024^4)  tebibit per second
-
-	kibps (1024*8)	       kibibyte (KiB) per second
-	mibps (1024^2*8)       mebibyte (MiB) per second
-        gibps (1024^3*8)       gibibyte (GiB) per second
-        tibps (1024^4*8)       tebibyte (TiB) per second
-
-
-Suffixes
---------
-
-A *bit* is written as **bit**,
-   
-   .. code-block:: none
-
-        kbit (kilobits per second)
-        mbit (megabits per second)
-        gbit (gigabits per second)
-	tbit (terabits per second)
-
-while a *byte* is written as a single **b**.
-
-   .. code-block:: none
-
-        kbps (kilobytes per second)
-        mbps (megabytes per second)
-        gbps (gigabytes per second)
-
-
-
-
-.. _classes:
-
-Classes
-=======
-
-In the :ref:`creating_a_traffic_policy` section you will see that
-some of the policies use *classes*. Those policies let you distribute
-traffic into different classes according to different parameters you can
-choose. So, a class is just a specific type of traffic you select.
-
-The ultimate goal of classifying traffic is to give each class a
-different treatment.
-
-
-Matching traffic
-----------------
-
-In order to define which traffic goes into which class, you define
-filters (that is, the matching criteria). Packets go through these matching rules
-(as in the rules of a firewall) and, if a packet matches the filter, it
-is assigned to that class.
-
-In VyOS, a class is identified by a number you can choose when
-configuring it.
-
-
-.. note:: The meaning of the Class ID is not the same for every type of
-   policy. Normally policies just need a meaningless number to identify
-   a class (Class ID), but that does not apply to every policy.
-   The the number of a class in a Priority Queue it does not only
-   identify it, it also defines its priority.
-
-
-.. code-block:: none
-
-  set traffic-policy <policy> <policy-name> class <class-ID> match <class-matching-rule-name>
-
-
-In the command above, we set the type of policy we are going to
-work with and the name we choose for it; a class (so that we can
-differentiate some traffic) and an identifiable number for that class;
-then we configure a matching rule (or filter) and a name for it.
-
-A class can have multiple match filters:
-
-.. code-block:: none
-
-  set traffic-policy shaper MY-SHAPER class 30 match HTTP
-  set traffic-policy shaper MY-SHAPER class 30 match HTTPs
-
-A match filter can contain multiple criteria and will match traffic if
-all those criteria are true.
-
-For example:
-
-.. code-block:: none
-
-  set traffic-policy shaper MY-SHAPER class 30 match HTTP ip protocol tcp
-  set traffic-policy shaper MY-SHAPER class 30 match HTTP ip source port 80
-
-This will match TCP traffic with source port 80.
-
-There are many parameters you will be able to use in order to match the
-traffic you want for a class:
-
- - **Ethernet (protocol, destination address or source address)**
- - **Interface name**
- - **IPv4 (DSCP value, maximum packet length, protocol, source address,**
-   **destination address, source port, destination port or TCP flags)**
- - **IPv6 (DSCP value, maximum payload length, protocol, source address,**
-   **destination address, source port, destination port or TCP flags)**
- - **Firewall mark**
- - **VLAN ID**
-
-When configuring your filter, you can use the ``Tab`` key to see the many
-different parameters you can configure.
-
-
-.. code-block:: none
-
-   vyos@vyos# set traffic-policy shaper MY-SHAPER class 30 match MY-FIRST-FILTER 
-   Possible completions:
-      description  Description for this match
-    > ether        Ethernet header match
-      interface    Interface name for this match
-    > ip           Match IP protocol header
-    > ipv6         Match IPV6 header
-      mark         Match on mark applied by firewall
-      vif          Virtual Local Area Network (VLAN) ID for this match
- 
- 
-
-As shown in the example above, one of the possibilities to match packets
-is based on marks done by the firewall, `that can give you a great deal of flexibility`_.
-
-You can also write a description for a filter:
-
-.. code-block:: none
-
-  set traffic-policy shaper MY-SHAPER class 30 match MY-FIRST-FILTER description "My filter description"
-
-
-
-.. note:: An IPv4 TCP filter will only match packets with an IPv4 header length of
-   20 bytes (which is the majority of IPv4 packets anyway).
-
-
-.. note:: IPv6 TCP filters will only match IPv6 packets with no header extension, see
-   https://en.wikipedia.org/wiki/IPv6_packet#Extension_headers
-
-
-Default
--------
-
-Often you will also have to configure your *default* traffic in the same
-way you do with a class. *Default* can be considered a class as it
-behaves like that. It contains any traffic that did not match any
-of the defined classes, so it is like an open class, a class without
-matching filters.
-
-
-Class treatment
----------------
-
-Once a class has a filter configured, you will also have to define what
-you want to do with the traffic of that class, what specific
-Traffic-Control treatment you want to give it. You will have different
-possibilities depending on the Traffic Policy you are configuring.
-
-.. code-block:: none
-
-   vyos@vyos# set traffic-policy shaper MY-SHAPER class 30 
-   Possible completions:
-      bandwidth    Bandwidth used for this class
-      burst        Burst size for this class (default: 15kb)
-      ceiling      Bandwidth limit for this class
-      codel-quantum
-                   fq-codel - Number of bytes used as 'deficit' (default 1514)
-      description  Description for this traffic class
-      flows        fq-codel - Number of flows (default 1024)
-      interval     fq-codel - Interval (milliseconds) used to measure the delay (default 100)
-   +> match        Class matching rule name
-      priority     Priority for usage of excess bandwidth
-      queue-limit  Maximum queue size (packets)
-      queue-type   Queue type for this class
-      set-dscp     Change the Differentiated Services (DiffServ) field in the IP header
-      target       fq-codel - Acceptable minimum queue delay (milliseconds)
-   
-
-For instance, with :code:`set traffic-policy shaper MY-SHAPER class 30 set-dscp EF`
-you would be modifying the DSCP field value of packets in that class to
-Expedite Forwarding.
-
-
-  DSCP values as per :rfc:`2474` and :rfc:`4595`:
-
-  +---------+------------+--------+------------------------------+
-  | Binary  | Configured |  Drop  | Description                  |
-  | value   | value      |  rate  |                              |
-  +=========+============+========+==============================+
-  | 101110  |     46     |   -    | Expedited forwarding (EF)    |
-  +---------+------------+--------+------------------------------+
-  | 000000  |     0      |   -    | Best effort traffic, default |
-  +---------+------------+--------+------------------------------+
-  | 001010  |     10     | Low    | Assured Forwarding(AF) 11    |
-  +---------+------------+--------+------------------------------+
-  | 001100  |     12     | Medium | Assured Forwarding(AF) 12    |
-  +---------+------------+--------+------------------------------+
-  | 001110  |     14     | High   | Assured Forwarding(AF) 13    |
-  +---------+------------+--------+------------------------------+
-  | 010010  |     18     | Low    | Assured Forwarding(AF) 21    |
-  +---------+------------+--------+------------------------------+
-  | 010100  |     20     | Medium | Assured Forwarding(AF) 22    |
-  +---------+------------+--------+------------------------------+
-  | 010110  |     22     | High   | Assured Forwarding(AF) 23    |
-  +---------+------------+--------+------------------------------+
-  | 011010  |     26     | Low    | Assured Forwarding(AF) 31    |
-  +---------+------------+--------+------------------------------+
-  | 011100  |     28     | Medium | Assured Forwarding(AF) 32    |
-  +---------+------------+--------+------------------------------+
-  | 011110  |     30     | High   | Assured Forwarding(AF) 33    |
-  +---------+------------+--------+------------------------------+
-  | 100010  |     34     | Low    | Assured Forwarding(AF) 41    |
-  +---------+------------+--------+------------------------------+
-  | 100100  |     36     | Medium | Assured Forwarding(AF) 42    |
-  +---------+------------+--------+------------------------------+
-  | 100110  |     38     | High   | Assured Forwarding(AF) 43    |
-  +---------+------------+--------+------------------------------+
-
-
-
-
-.. _embed:
-
-Embedding one policy into another one
--------------------------------------
-
-Often we need to embed one policy into another one. It is possible to do
-so on classful policies, by attaching a new policy into a class. For
-instance, you might want to apply different policies to the different
-classes of a Round-Robin policy you have configured.
-
-A common example is the case of some policies which, in order to be
-effective, they need to be applied to an interface that is directly
-connected where the bottleneck is. If your router is not
-directly connected to the bottleneck, but some hop before it, you can
-emulate the bottleneck by embedding your non-shaping policy into a
-classful shaping one so that it takes effect.
-
-You can configure a policy into a class through the ``queue-type``
-setting.
-
-.. code-block:: none
-
-   set traffic-policy shaper FQ-SHAPER bandwidth 4gbit
-   set traffic-policy shaper FQ-SHAPER default bandwidth 100%
-   set traffic-policy shaper FQ-SHAPER default queue-type fq-codel
-
-As shown in the last command of the example above, the `queue-type`
-setting allows these combinations. You will be able to use it
-in many policies.
-
-.. note:: Some policies already include other embedded policies inside.
-   That is the case of Shaper_: each of its classes use fair-queue
-   unless you change it.
-
-.. _creating_a_traffic_policy:
-
-
-Creating a traffic policy
-=========================
-
-VyOS lets you control traffic in many different ways, here we will cover
-every possibility. You can configure as many policies as you want, but
-you will only be able to apply one policy per interface and direction
-(inbound or outbound).
-
-Some policies can be combined, you will be able to embed_ a different
-policy that will be applied to a class of the main policy. 
-
-.. hint:: **If you are looking for a policy for your outbound traffic**
-   but you don't know which one you need and you don't want to go
-   through every possible policy shown here, **our bet is that highly
-   likely you are looking for a** Shaper_ **policy and you want to**
-   :ref:`set its queues <embed>` **as FQ-CoDel**.
-
-Drop Tail
----------
-
-| **Queueing discipline:** PFIFO (Packet First In First Out).
-| **Applies to:** Outbound traffic.
-
-This the simplest queue possible you can apply to your traffic. Traffic
-must go through a finite queue before it is actually sent. You must
-define how many packets that queue can contain.
-
-When a packet is to be sent, it will have to go through that queue, so
-the packet will be placed at the tail of it. When the packet completely
-goes through it, it will be dequeued emptying its place in the queue and
-being eventually handed to the NIC to be actually sent out.
-
-Despite the Drop-Tail policy does not slow down packets, if many packets
-are to be sent, they could get dropped when trying to get enqueued at
-the tail. This can happen if the queue has still not been able to
-release enough packets from its head.
-
-This is the policy that requieres the lowest resources for the same
-amount of traffic. But **very likely you do not need it as you cannot
-get much from it. Sometimes it is used just to enable logging.**
-
-.. cfgcmd:: set traffic-policy drop-tail <policy-name> queue-limit <number-of-packets>
-
-   Use this command to configure a drop-tail policy (PFIFO). Choose a
-   unique name for this policy and the size of the queue by setting the
-   number of packets it can contain (maximum 4294967295).
-
-
-Fair Queue
-----------
-
-| **Queueing discipline:** SFQ (Stochastic Fairness Queuing).
-| **Applies to:** Outbound traffic.
-
-Fair Queue is a work-conserving scheduler which schedules the
-transmission of packets based on flows, that is, it balances traffic
-distributing it through different sub-queues in order to ensure
-fairness so that each flow is able to send data in turn, preventing any
-single one from drowning out the rest.
-
-
-.. cfgcmd:: set traffic-policy fair-queue <policy-name>
-
-   Use this command to create a Fair-Queue policy and give it a name.
-   It is based on the Stochastic Fairness Queueing and can be applied to
-   outbound traffic.
-
-In order to separate traffic, Fair Queue uses a classifier based on
-source address, destination address and source port. The algorithm
-enqueues packets to hash buckets based on those tree parameters.
-Each of these buckets should represent a unique flow. Because multiple
-flows may get hashed to the same bucket, the hashing algorithm is
-perturbed at configurable intervals so that the unfairness lasts only
-for a short while. Perturbation may however cause some inadvertent
-packet reordering to occur. An advisable value could be 10 seconds.
-
-One of the uses of Fair Queue might be the mitigation of Denial of
-Service attacks.
-
-.. cfgcmd:: set traffic-policy fair-queue <policy-name> hash-interval <seconds>`
-
-   Use this command to define a Fair-Queue policy, based on the
-   Stochastic Fairness Queueing, and set the number of seconds at which
-   a new queue algorithm perturbation will occur (maximum 4294967295).
-
-When dequeuing, each hash-bucket with data is queried in a round robin
-fashion. You can configure the length of the queue.
-
-.. cfgcmd:: set traffic-policy fair-queue <policy-name> queue-limit <limit>
-
-   Use this command to define a Fair-Queue policy, based on the
-   Stochastic Fairness Queueing, and set the number of maximum packets
-   allowed to wait in the queue. Any other packet will be dropped.
-
-.. note:: Fair Queue is a non-shaping (work-conserving) policy, so it
-   will only be useful if your outgoing interface is really full. If it
-   is not, VyOS will not own the queue and Fair Queue will have no
-   effect. If there is bandwidth available on the physical link, you can
-   embed_ Fair-Queue into a classful shaping policy to make sure it owns
-   the queue.
-
-
-
-.. _FQ-CoDel:
-
-FQ-CoDel
---------
-
-| **Queueing discipline** Fair/Flow Queue CoDel.
-| **Applies to:** Outbound Traffic.
-
-The FQ-CoDel policy distributes the traffic into 1024 FIFO queues and
-tries to provide good service between all of them. It also tries to keep
-the length of all the queues short.
-
-FQ-CoDel fights bufferbloat and reduces latency without the need of
-complex configurations. It has become the new default Queueing
-Discipline for the interfaces of some GNU/Linux distributions.
-
-It uses a stochastic model to classify incoming packets into
-different flows and is used to provide a fair share of the bandwidth to
-all the flows using the queue. Each flow is managed by the CoDel
-queuing  discipline. Reordering within a flow is avoided since Codel
-internally uses a FIFO queue.
-
-FQ-CoDel is based on a modified Deficit Round Robin (DRR_) queue
-scheduler with the CoDel Active Queue Management (AQM) algorithm
-operating on each queue.
-
-
-.. note:: FQ-Codel is a non-shaping (work-conserving) policy, so it
-   will only be useful if your outgoing interface is really full. If it
-   is not, VyOS will not own the queue and FQ-Codel will have no
-   effect. If there is bandwidth available on the physical link, you can
-   embed_ FQ-Codel into a classful shaping policy to make sure it owns
-   the queue. If you are not sure if you need to embed your FQ-CoDel
-   policy into a Shaper, do it.
-
-
-FQ-CoDel is tuned to run ok with its default parameters at 10Gbit
-speeds. It might work ok too at other speeds without configuring
-anything, but here we will explain some cases when you might want to
-tune its parameters.
-
-When running it at 1Gbit and lower, you may want to reduce the
-`queue-limit` to 1000 packets or less. In rates like 10Mbit, you may
-want to set it to 600 packets.
-
-If you are using FQ-CoDel embedded into Shaper_ and you have large rates
-(100Mbit and above), you may consider increasing `quantum` to 8000 or
-higher so that the scheduler saves CPU.
-
-On low rates (below 40Mbit) you may want to tune `quantum` down to
-something like 300 bytes.
-
-At very low rates (below 3Mbit), besides tuning `quantum` (300 keeps
-being ok) you may also want to increase `target` to something like 15ms
-and increase `interval` to something around 150 ms.
-
-
-.. cfgcmd:: set traffic-policy fq-codel <policy name> codel-quantum <bytes>
-
-   Use this command to configure an fq-codel policy, set its name and
-   the maximum number of bytes (default: 1514) to be dequeued from a
-   queue at once.
-
-.. cfgcmd:: set traffic-policy fq-codel <policy name> flows <number-of-flows>
-
-   Use this command to configure an fq-codel policy, set its name and
-   the number of sub-queues (default: 1024) into which packets are
-   classified.
-
-.. cfgcmd:: set traffic-policy fq-codel <policy name> interval <miliseconds>
-
-   Use this command to configure an fq-codel policy, set its name and
-   the time period used by the control loop of CoDel to detect when a
-   persistent queue is developing, ensuring that the measured minimum
-   delay does not become too stale (default: 100ms).
-
-.. cfgcmd:: set traffic-policy fq-codel <policy-name> queue-limit <number-of-packets>`
-
-   Use this command to configure an fq-codel policy, set its name, and
-   define a hard limit on the real queue size. When this limit is
-   reached, new packets are dropped (default: 10240 packets).
-
-.. cfgcmd:: set traffic-policy fq-codel <policy-name> target <miliseconds>`
-
-   Use this command to configure an fq-codel policy, set its name, and
-   define the acceptable minimum standing/persistent queue delay. This
-   minimum delay is identified by tracking the local minimum queue delay
-   that packets experience (default: 5ms).
-
-
-Example
-^^^^^^^
-
-A simple example of an FQ-CoDel policy working inside a Shaper one.
-
-
-.. code-block:: none
-
-   set traffic-policy shaper FQ-CODEL-SHAPER bandwidth 2gbit
-   set traffic-policy shaper FQ-CODEL-SHAPER default bandwidth 100%
-   set traffic-policy shaper FQ-CODEL-SHAPER default queue-type fq-codel
-
-
-
-Limiter
--------
-
-| **Queueing discipline:** Ingress policer.
-| **Applies to:** Inbound traffic.
-
-Limiter is one of those policies that uses classes_ (Ingress qdisc is
-actually a classless policy but filters do work in it).
-
-The limiter performs basic ingress policing of traffic flows. Multiple
-classes of traffic can be defined and traffic limits can be applied to
-each class. Although the policer uses a token bucket mechanism
-internally, it does not have the capability to delay a packet as a
-shaping mechanism does. Traffic exceeding the defined bandwidth limits
-is directly dropped. A maximum allowed burst can be configured too.
-
-You can configure classes (up to 4090) with different settings and a
-default policy which will be applied to any traffic not matching any of
-the configured classes.
-
-
-.. note:: In the case you want to apply some kind of **shaping** to your
-  **inbound** traffic, check the ingress-shaping_ section.
-
-
-.. cfgcmd:: set traffic-policy limiter <policy-name> class <class ID> match <match-name> description <description>
-
-   Use this command to configure an Ingress Policer, defining its name,
-   a class identifier (1-4090), a class matching rule name and its
-   description.
-
-
-Once the matching rules are set for a class, you can start configuring
-how you want matching traffic to behave.
-
-
-.. cfgcmd:: set traffic-policy limiter <policy-name> class <class-ID> bandwidth <rate>
-
-   Use this command to configure an Ingress Policer, defining its name,
-   a class identifier (1-4090) and the maximum allowed bandwidth for
-   this class.
-
-
-.. cfgcmd:: set traffic-policy limiter <policy-name> class <class-ID> burst <burst-size>
-
-   Use this command to configure an Ingress Policer, defining its name,
-   a class identifier (1-4090) and the burst size in bytes for this
-   class (default: 15).
-
-
-.. cfgcmd:: set traffic-policy limiter <policy-name> default bandwidth <rate>
-
-   Use this command to configure an Ingress Policer, defining its name
-   and the maximum allowed bandwidth for its default policy.
-
-
-.. cfgcmd:: set traffic-policy limiter <policy-name> default burst <burst-size>
-
-   Use this command to configure an Ingress Policer, defining its name
-   and the burst size in bytes (default: 15) for its default policy.
-
-
-.. cfgcmd:: set traffic-policy limiter <policy-name> class <class ID> priority <value>
-
-   Use this command to configure an Ingress Policer, defining its name,
-   a class identifier (1-4090), and the priority (0-20, default 20) in
-   which the rule is evaluated (the lower the number, the higher the
-   priority).
-
- 
-
-Network Emulator
-----------------
-
-| **Queueing discipline:** netem (Network Emulator) + TBF (Token Bucket Filter).
-| **Applies to:** Outbound traffic.
-
-VyOS Network Emulator policy emulates the conditions you can suffer in a
-real network. You will be able to configure things like rate, burst,
-delay, packet loss, packet corruption or packet reordering.
-
-This could be helpful if you want to test how an application behaves
-under certain network conditions.
-
-
-.. cfgcmd:: set traffic-policy network-emulator <policy-name> bandwidth <rate>
-   
-   Use this command to configure the maximum rate at which traffic will
-   be shaped in a Network Emulator policy. Define the name of the policy
-   and the rate.
-
-.. cfgcmd:: set traffic-policy network-emulator <policy-name> burst <burst-size>
-   
-   Use this command to configure the burst size of the traffic in a
-   Network Emulator policy. Define the name of the Network Emulator
-   policy and its traffic burst size (it will be configured through the
-   Token Bucket Filter qdisc). Default:15kb. It will only take effect if
-   you have configured its bandwidth too.
-
-.. cfgcmd:: set traffic-policy network-emulator <policy-name> network-delay <delay>
-   
-   Use this command to configure a Network Emulator policy defining its
-   name and the fixed amount of time you want to add to all packet going
-   out of the interface. The latency will be added through the
-   Token Bucket Filter qdisc. It will only take effect if you have
-   configured its bandwidth too. You can use secs, ms and us. Default:
-   50ms.
-
-.. cfgcmd:: set traffic-policy network-emulator <policy-name> packet-corruption <percent>
-   
-   Use this command to emulate noise in a Network Emulator policy. Set
-   the policy name and the percentage of corrupted packets you want. A
-   random error will be introduced in a random position for the chosen
-   percent of packets.
-
-.. cfgcmd:: set traffic-policy network-emulator <policy-name> packet-loss <percent>`
-   
-   Use this command to emulate packet-loss conditions in a Network
-   Emulator policy. Set the policy name and the percentage of loss
-   packets your traffic will suffer.
-
-.. cfgcmd:: set traffic-policy network-emulator <policy-name> packet-reordering <percent>`
-   
-   Use this command to emulate packet-reordering conditions in a Network
-   Emulator policy. Set the policy name and the percentage of reordered
-   packets your traffic will suffer.
-
-.. cfgcmd:: set traffic-policy network-emulator <policy-name> queue-limit <limit>
-   
-   Use this command to define the length of the queue of your Network
-   Emulator policy. Set the policy name and the maximum number of
-   packets (1-4294967295) the queue may hold queued at a time.
-
-
-
-Priority Queue
---------------
-
-| **Queueing discipline:** PRIO.
-| **Applies to:** Outbound traffic.
-
-
-The Priority Queue is a classful scheduling policy. It does not delay
-packets (Priority Queue is not a shaping policy), it simply dequeues
-packets according to their priority.
-
-.. note:: Priority Queue, as other non-shaping policies, is only useful
-   if your outgoing interface is really full. If it is not, VyOS will
-   not own the queue and Priority Queue will have no effect. If there is
-   bandwidth available on the physical link, you can embed_ Priority
-   Queue into a classful shaping policy to make sure it owns the queue.
-   In that case packets can be prioritized based on DSCP.
-
-Up to seven queues -defined as classes_ with different priorities- can
-be configured. Packets are placed into queues based on associated match
-criteria. Packets are transmitted from the queues in priority order. If
-classes with a higher priority are being filled with packets
-continuously, packets from lower priority classes will only be
-transmitted after traffic volume from higher priority classes decreases.
-
-
-.. note:: In Priority Queue we do not define clases with a meaningless
-   class ID number but with a class priority number (1-7). The lower the
-   number, the higher the priority.
-
-
-As with other policies, you can define different type of matching rules
-for your classes:
-
-.. code-block:: none
-
-   vyos@vyos# set traffic-policy priority-queue MY-PRIO class 3 match MY-MATCH-RULE 
-   Possible completions:
-      description  Description for this match
-    > ether        Ethernet header match
-      interface    Interface name for this match
-    > ip           Match IP protocol header
-    > ipv6         Match IPV6 header
-      mark         Match on mark applied by firewall
-      vif          Virtual Local Area Network (VLAN) ID for this match
-
-
-As with other policies, you can embed_ other policies into the classes 
-(and default) of your Priority Queue policy through the ``queue-type``
-setting:
-
-.. code-block:: none
-
-   vyos@vyos# set traffic-policy priority-queue MY-PRIO class 3 queue-type 
-   Possible completions:
-      fq-codel     Fair Queue Codel
-      fair-queue   Stochastic Fair Queue (SFQ)
-      drop-tail    First-In-First-Out (FIFO)
-      priority     Priority queueing based on DSCP
-      random-detect
-                   Random Early Detection (RED)
-
-
-.. cfgcmd:: set traffic-policy priority-queue <policy-name> class <class-ID>  queue-limit <limit>`
-
-   Use this command to configure a Priority Queue policy, set its name,
-   set a class with a priority from 1 to 7 and define a hard limit on
-   the real queue size. When this limit is reached, new packets are
-   dropped.
-
-
-
-.. _Random-Detect:
-
-Random-Detect
--------------
-
-
-| **Queueing discipline:** Generalized Random Early Drop.
-| **Applies to:** Outbound traffic.
-
-A simple Random Early Detection (RED) policy would start randomly
-dropping packets from a queue before it reaches its queue limit thus
-avoiding congestion. That is good for TCP connections as the gradual
-dropping of packets acts as a signal for the sender to decrease its
-transmission rate.
-
-In contrast to simple RED, VyOS' Random-Detect uses a Generalized Random
-Early Detect policy that provides different virtual queues based on the
-IP Precedence value so that some virtual queues can drop more packets
-than others. 
-
-This is achieved by using the first three bits of the ToS (Type of
-Service) field to categorize data streams and, in accordance with the
-defined precedence parameters, a decision is made.
-
-IP precedence as defined in :rfc:`791`:
-
- +------------+----------------------+
- | Precedence |      Priority        |
- +============+======================+
- |      7     | Network Control      |
- +------------+----------------------+
- |      6     | Internetwork Control |
- +------------+----------------------+
- |      5     | CRITIC/ECP           |
- +------------+----------------------+
- |      4     | Flash Override       |
- +------------+----------------------+
- |      3     | Flash                |
- +------------+----------------------+
- |      2     | Immediate            |
- +------------+----------------------+
- |      1     | Priority             |
- +------------+----------------------+
- |      0     | Routine              |
- +------------+----------------------+
-
-
-Random-Detect could be useful for heavy traffic. One use of this
-algorithm might be to prevent a backbone overload. But only for TCP
-(because dropped packets could be retransmitted), not for UDP.
-
-
-.. cfgcmd:: set traffic-policy random-detect <policy-name> bandwidth <bandwidth>
-
-   Use this command to configure a Random-Detect policy, set its name
-   and set the available bandwidth for this policy. It is used for
-   calculating the average queue size after some idle time. It should be
-   set to the bandwidth of your interface. Random Detect is not a
-   shaping policy, this command will not shape.
-
-.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> average-packet <bytes>
-   
-   Use this command to configure a Random-Detect policy and set its
-   name, then state the IP Precedence for the virtual queue you are
-   configuring and what the size of its average-packet should be
-   (in bytes, default: 1024).
-
-.. note:: When configuring a Random-Detect policy: **the higher the
-   precedence number, the higher the priority**.
-
-.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> mark-probability <value>
-   
-   Use this command to configure a Random-Detect policy and set its
-   name, then state the IP Precedence for the virtual queue you are
-   configuring and what its mark (drop) probability will be. Set the
-   probability by giving the N value of the fraction 1/N (default: 10).
-
-
-.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> maximum-threshold <packets>
-   
-   Use this command to configure a Random-Detect policy and set its
-   name, then state the IP Precedence for the virtual queue you are
-   configuring and what its maximum threshold for random detection will
-   be (from 0 to 4096 packets, default: 18). At this size, the marking
-   (drop) probability is maximal.
-
-.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> minimum-threshold <packets>
-   
-   Use this command to configure a Random-Detect policy and set its
-   name, then state the IP Precedence for the virtual queue you are
-   configuring and what its minimum threshold for random detection will
-   be (from 0 to 4096 packets).  If this value is exceeded, packets
-   start being eligible for being dropped.
-
-
-The default values for the minimum-threshold depend on IP precedence:
-
- +------------+-----------------------+
- | Precedence | default min-threshold |
- +============+=======================+
- |      7     |         16            |
- +------------+-----------------------+
- |      6     |         15            |
- +------------+-----------------------+
- |      5     |         14            |
- +------------+-----------------------+
- |      4     |         13            |
- +------------+-----------------------+
- |      3     |         12            |
- +------------+-----------------------+
- |      2     |         11            |
- +------------+-----------------------+
- |      1     |         10            |
- +------------+-----------------------+
- |      0     |          9            |
- +------------+-----------------------+
-
-
-.. cfgcmd:: set traffic-policy random-detect <policy-name> precedence <IP-precedence-value> queue-limit <packets>
-   
-   Use this command to configure a Random-Detect policy and set its
-   name, then name the IP Precedence for the virtual queue you are
-   configuring and what the maximum size of its queue will be (from 1 to
-   1-4294967295 packets). Packets are dropped when the current queue
-   length reaches this value.
-
-
-If the average queue size is lower than the **min-threshold**, an
-arriving packet will be placed in the queue.
-
-In the case the average queue size is between **min-threshold** and
-**max-threshold**, then an arriving packet would be either dropped or
-placed in the queue, it will depend on the defined **mark-probability**.
-
-If the current queue size is larger than **queue-limit**,
-then packets will be dropped. The average queue size depends on its
-former average size and its current one.
-
-If **max-threshold** is set but **min-threshold is not, then
-**min-threshold** is scaled to 50% of **max-threshold**.
-
-In principle, values must be
-:code:`min-threshold` < :code:`max-threshold` < :code:`queue-limit`.
-
-
-
-
-Rate Control
-------------
-
-| **Queueing discipline:** Tocken Bucket Filter.
-| **Applies to:** Outbound traffic.
-
-Rate-Control is a classless policy that limits the packet flow to a set
-rate. It is a pure shaper, it does not schedule traffic. Traffic is
-filtered based on the expenditure of tokens. Tokens roughly correspond
-to bytes.
-
-Short bursts can be allowed to exceed the limit. On creation, the
-Rate-Control traffic is stocked with tokens which correspond to the
-amount of traffic that can be burst in one go. Tokens arrive at a steady
-rate, until the bucket is full.
-
-.. cfgcmd:: set traffic-policy rate-control <policy-name> bandwidth <rate>
-
-   Use this command to configure a Rate-Control policy, set its name
-   and the rate limit you want to have.
-
-.. cfgcmd:: set traffic-policy rate-control <policy-name> burst <burst-size>
-
-   Use this command to configure a Rate-Control policy, set its name
-   and the size of the bucket in bytes which will be available for
-   burst.
-
-
-As a reference: for 10mbit/s on Intel, you might need at least 10kbyte
-buffer if you want to reach your configured rate.
-
-A very small buffer will soon start dropping packets.
-
-.. cfgcmd:: set traffic-policy rate-control <policy-name> latency 
-
-   Use this command to configure a Rate-Control policy, set its name
-   and the maximum amount of time a packet can be queued (default: 50
-   ms).
-
-
-Rate-Control is a CPU-friendly policy. You might consider using it when
-you just simply want to slow traffic down.
-
-.. _DRR:
-
-Round Robin
------------
-
-| **Queueing discipline:** Deficit Round Robin.
-| **Applies to:** Outbound traffic.
-
-The round-robin policy is a classful scheduler that divides traffic in
-different classes_ you can configure (up to 4096). You can embed_ a
-new policy into each of those classes (default included).
- 
-Each class is assigned a deficit counter (the number of bytes that a
-flow is allowed to transmit when it is its turn) initialized to quantum.
-Quantum is a parameter you configure which acts like a credit of fix
-bytes the counter receives on each round. Then the Round-Robin policy
-starts moving its Round Robin pointer through the queues. If the deficit
-counter is greater than the packet's size at the head of the queue, this
-packet will be sent and the value of the counter will be decremented by
-the packet size. Then, the size of the next packet will be compared to
-the counter value again, repeating the process. Once the queue is empty
-or the value of the counter is insufficient, the Round-Robin pointer
-will move to the next queue. If the queue is empty, the value of the
-deficit counter is reset to 0. 
-
-At every round, the deficit counter adds the quantum so that even large
-packets will have their opportunity to be dequeued.
-
-
-.. cfgcmd:: set traffic-policy round-robin <policy name> class
-   <class-ID> quantum <packets>
-
-   Use this command to configure a Round-Robin policy, set its name, set
-   a class ID, and the quantum for that class. The deficit counter will
-   add that value each round.
-
-.. cfgcmd:: set traffic-policy round-robin <policy name> class
-   <class ID> queue-limit <packets>
-
-   Use this command to configure a Round-Robin policy, set its name, set
-   a class ID, and the queue size in packets.
-
-As with other policies, Round-Robin can embed_ another policy into a
-class through the ``queue-type`` setting.
-
-.. code-block:: none
-
-   vyos@vyos# set traffic-policy round-robin DRR class 10 queue-type 
-   Possible completions:
-      fq-codel     Fair Queue Codel
-      fair-queue   Stochastic Fair Queue (SFQ)
-      drop-tail    First-In-First-Out (FIFO)
-      priority     Priority queueing based on DSCP
-            
-
-
-
-.. _Shaper:
-
-Shaper
-------
-
-| **Queueing discipline:** Hierarchical Token Bucket.
-| **Applies to:** Outbound traffic.
-
-
-The Shaper policy does not guarantee a low delay, but it does guarantee
-bandwidth to different traffic classes and also lets you decide how to
-allocate more traffic once the guarantees are met.
-
-Each class can have a guaranteed part of the total bandwidth defined for
-the whole policy, so all those shares together should not be higher
-than the policy's whole bandwidth.
-
-If guaranteed traffic for a class is met and there is room for more
-traffic, the ceiling parameter can be used to set how much more
-bandwidth could be used. If guaranteed traffic is met and there are
-several classes willing to use their ceilings, the priority parameter
-will establish the order in which that additional traffic will be
-allocated. Priority can be any number from 0 to 7. The lower the number,
-the higher the priority.
-
-
-.. cfgcmd:: set traffic-policy shaper <policy-name> bandwidth <rate>
-
-   Use this command to configure a Shaper policy, set its name
-   and the maximum bandwidth for all combined traffic.
-
-
-.. cfgcmd:: set traffic-policy shaper <policy-name> class <class-ID> bandwidth <rate>
-
-   Use this command to configure a Shaper policy, set its name, define
-   a class and set the guaranteed traffic you want to allocate to that
-   class.
-
-.. cfgcmd:: set traffic-policy shaper <policy-name> class <class-ID> burst <bytes>
-
-   Use this command to configure a Shaper policy, set its name, define
-   a class and set the size of the `tocken bucket`_ in bytes, which will
-   be available to be sent at ceiling speed (default: 15Kb).
-
-.. cfgcmd:: set traffic-policy shaper <policy-name> class <class-ID> ceiling <bandwidth>
-
-   Use this command to configure a Shaper policy, set its name, define
-   a class and set the maximum speed possible for this class. The
-   default ceiling value is the bandwidth value.
-
-.. cfgcmd:: set traffic-policy shaper <policy-name> class <class-ID> priority <0-7>
-
-   Use this command to configure a Shaper policy, set its name, define
-   a class and set the priority for usage of available bandwidth once
-   guarantees have been met. The lower the priority number, the higher
-   the priority. The default priority value is 0, the highest priority.
-
-
-As with other policies, Shaper can embed_ other policies into its
-classes through the ``queue-type`` setting and then configure their
-parameters.
-
-
-.. code-block:: none
-
-   vyos@vyos# set traffic-policy shaper HTB class 10 queue-type 
-   Possible completions:
-      fq-codel     Fair Queue Codel
-      fair-queue   Stochastic Fair Queue (SFQ)
-      drop-tail    First-In-First-Out (FIFO)
-      priority     Priority queueing based on DSCP
-      random-detect
-                   Random Early Detection (RED)
-
-
-.. code-block:: none
-
-   vyos@vyos# set traffic-policy shaper HTB class 10 
-   Possible completions:
-      bandwidth    Bandwidth used for this class
-      burst        Burst size for this class (default: 15kb)
-      ceiling      Bandwidth limit for this class
-      codel-quantum
-                   fq-codel - Number of bytes used as 'deficit' (default 1514)
-      description  Description for this traffic class
-      flows        fq-codel - Number of flows (default 1024)
-      interval     fq-codel - Interval (milliseconds) used to measure the delay (default 100)
-   +> match        Class matching rule name
-      priority     Priority for usage of excess bandwidth
-      queue-limit  Maximum queue size (packets)
-      queue-type   Queue type for this class
-      set-dscp     Change the Differentiated Services (DiffServ) field in the IP header
-      target       fq-codel - Acceptable minimum queue delay (milliseconds)
-
-
-
-.. note:: If you configure a class for **VoIP traffic**, don't give it any
-   *ceiling*, otherwise new VoIP calls could start when the link is
-   available and get suddenly dropped when other classes start using
-   their assigned *bandwidth* share.
-
-
-Example
-^^^^^^^
-
-A simple example of Shaper using priorities.
-
-
-.. code-block:: none
-
-   set traffic-policy shaper MY-HTB bandwidth '50mbit'
-   set traffic-policy shaper MY-HTB class 10 bandwidth '20%'
-   set traffic-policy shaper MY-HTB class 10 match DSCP ip dscp 'EF'
-   set traffic-policy shaper MY-HTB class 10 queue-type 'fq-codel'
-   set traffic-policy shaper MY-HTB class 20 bandwidth '10%'
-   set traffic-policy shaper MY-HTB class 20 ceiling '50%'
-   set traffic-policy shaper MY-HTB class 20 match PORT666 ip destination port '666'
-   set traffic-policy shaper MY-HTB class 20 priority '3'
-   set traffic-policy shaper MY-HTB class 20 queue-type 'fair-queue'
-   set traffic-policy shaper MY-HTB class 30 bandwidth '10%'
-   set traffic-policy shaper MY-HTB class 30 ceiling '50%'
-   set traffic-policy shaper MY-HTB class 30 match ADDRESS30 ip source address '192.168.30.0/24'
-   set traffic-policy shaper MY-HTB class 30 priority '5'
-   set traffic-policy shaper MY-HTB class 30 queue-type 'fair-queue'
-   set traffic-policy shaper MY-HTB default bandwidth '10%'
-   set traffic-policy shaper MY-HTB default ceiling '100%'
-   set traffic-policy shaper MY-HTB default priority '7'
-   set traffic-policy shaper MY-HTB default queue-type 'fair-queue'
-
-
-Applying a traffic policy
-=========================
-
-Once a traffic-policy is created, you can apply it to an interface:
-
-.. code-block:: none
-
-  set interfaces etherhet eth0 traffic-policy out WAN-OUT
-
-You can only apply one policy per interface and direction, but you could
-reuse a policy on different interfaces and directions:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 traffic-policy in WAN-IN
-  set interfaces etherhet eth0 traffic-policy out WAN-OUT
-  set interfaces etherhet eth1 traffic-policy in LAN-IN
-  set interfaces etherhet eth1 traffic-policy out LAN-OUT
-  set interfaces ethernet eth2 traffic-policy in LAN-IN
-  set interfaces ethernet eth2 traffic-policy out LAN-OUT
-  set interfaces etherhet eth3 traffic-policy in TWO-WAY-POLICY
-  set interfaces etherhet eth3 traffic-policy out TWO-WAY-POLICY
-  set interfaces etherhet eth4 traffic-policy in TWO-WAY-POLICY
-  set interfaces etherhet eth4 traffic-policy out TWO-WAY-POLICY
-
-Getting queueing information
-----------------------------
-
-.. opcmd:: show queueing <interface-type> <interface-name>
-
-   Use this command to see the queueing information for an interface.
-   You will be able to see a packet counter (Sent, Dropped, Overlimit
-   and Backlog) per policy and class configured.
-
-
-
-.. _ingress-shaping:
-
-The case of ingress shaping
-===========================
-
-| **Applies to:** Inbound traffic.
-
-For the ingress traffic of an interface, there is only one policy you
-can directly apply, a **Limiter** policy. You cannot apply a shaping
-policy directly to the ingress traffic of any interface because shaping
-only works for outbound traffic.
-
-This workaround lets you apply a shaping policy to the ingress traffic
-by first redirecting it to an in-between virtual interface
-(`Intermediate Functional Block`_). There, in that virtual interface,
-you will be able to apply any of the policies that work for outbound
-traffic, for instance, a shaping one.
-
-That is how it is possible to do the so-called "ingress shaping".
-
-
-.. code-block:: none
-
-   set traffic-policy shaper MY-INGRESS-SHAPING bandwidth 1000kbit
-   set traffic-policy shaper MY-INGRESS-SHAPING default bandwidth 1000kbit
-   set traffic-policy shaper MY-INGRESS-SHAPING default queue-type fair-queue
-   
-   set interfaces input ifb0 traffic-policy out MY-INGRESS-SHAPING
-   set interfaces ethernet eth0 redirect ifb0
-
-.. warning::
-
-  Do not configure IFB as the first step. First create everything else
-  of your traffic-policy, and then you can configure IFB.
-  Otherwise you might get the ``RTNETLINK answer: File exists`` error,
-  which can be solved with ``sudo ip link delete ifb0``.
-
-
-.. _that can give you a great deal of flexibility: https://blog.vyos.io/using-the-policy-route-and-packet-marking-for-custom-qos-matches
-.. _tc: https://en.wikipedia.org/wiki/Tc_(Linux)
-.. _tocken bucket: https://en.wikipedia.org/wiki/Token_bucket
-.. _HFSC: https://en.wikipedia.org/wiki/Hierarchical_fair-service_curve
-.. _Intermediate Functional Block: https://www.linuxfoundation.org/collaborate/workgroups/networking/ifb
diff --git a/docs/routing/arp.rst b/docs/routing/arp.rst
deleted file mode 100644
index 2d08e436..00000000
--- a/docs/routing/arp.rst
+++ /dev/null
@@ -1,34 +0,0 @@
-.. _routing-arp:
-
-Address Resolution Protocol (ARP)
----------------------------------
-
-To manipulate or display ARP_ table entries, the following commands are implemented.
-
-adding a static arp entry
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  set protocols static arp 10.1.1.100 hwaddr 08:00:27:de:23:aa
-  commit
-
-display arp table entries
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  show protocols static arp
-
-  Address                  HWtype  HWaddress           Flags Mask            Iface
-  10.1.1.1                 ether   08:00:27:de:23:2e   C                     eth1
-  10.1.1.100               ether   08:00:27:de:23:aa   CM                    eth1
-
-.. code-block:: none
-
-  show protocols static arp interface eth1
-  Address                  HWtype  HWaddress           Flags Mask            Iface
-  10.1.1.1                 ether   08:00:27:de:23:2e   C                     eth1
-  10.1.1.100               ether   08:00:27:de:23:aa   CM                    eth1
-
-.. _ARP: https://en.wikipedia.org/wiki/Address_Resolution_Protocol
diff --git a/docs/routing/bgp.rst b/docs/routing/bgp.rst
deleted file mode 100644
index f0550fd4..00000000
--- a/docs/routing/bgp.rst
+++ /dev/null
@@ -1,144 +0,0 @@
-.. _routing-bgp:
-
-Border Gateway Protocol (BGP)
------------------------------
-
-IPv4
-^^^^
-
-A simple eBGP configuration:
-
-**Node 1:**
-
-.. code-block:: none
-
-  set protocols bgp 65534 neighbor 192.168.0.2 ebgp-multihop '2'
-  set protocols bgp 65534 neighbor 192.168.0.2 remote-as '65535'
-  set protocols bgp 65534 neighbor 192.168.0.2 update-source '192.168.0.1'
-  set protocols bgp 65534 address-family ipv4-unicast network '172.16.0.0/16'
-  set protocols bgp 65534 parameters router-id '192.168.0.1'
-
-**Node 2:**
-
-.. code-block:: none
-
-  set protocols bgp 65535 neighbor 192.168.0.1 ebgp-multihop '2'
-  set protocols bgp 65535 neighbor 192.168.0.1 remote-as '65534'
-  set protocols bgp 65535 neighbor 192.168.0.1 update-source '192.168.0.2'
-  set protocols bgp 65535 address-family ipv4-unicast network '172.17.0.0/16'
-  set protocols bgp 65535 parameters router-id '192.168.0.2'
-
-
-Don't forget, the CIDR declared in the network statement MUST **exist in your
-routing table (dynamic or static), the best way to make sure that is true is
-creating a static route:**
-
-**Node 1:**
-
-.. code-block:: none
-
-  set protocols static route 172.16.0.0/16 blackhole distance '254'
-
-**Node 2:**
-
-.. code-block:: none
-
-  set protocols static route 172.17.0.0/16 blackhole distance '254'
-
-
-IPv6
-^^^^
-
-A simple BGP configuration via IPv6.
-
-**Node 1:**
-
-.. code-block:: none
-
-  set protocols bgp 65534 neighbor 2001:db8::2 ebgp-multihop '2'
-  set protocols bgp 65534 neighbor 2001:db8::2 remote-as '65535'
-  set protocols bgp 65534 neighbor 2001:db8::2 update-source '2001:db8::1'
-  set protocols bgp 65534 neighbor 2001:db8::2 address-family ipv6-unicast
-  set protocols bgp 65534 address-family ipv6-unicast network '2001:db8:1::/48'
-  set protocols bgp 65534 parameters router-id '10.1.1.1'
-
-**Node 2:**
-
-.. code-block:: none
-
-  set protocols bgp 65535 neighbor 2001:db8::1 ebgp-multihop '2'
-  set protocols bgp 65535 neighbor 2001:db8::1 remote-as '65534'
-  set protocols bgp 65535 neighbor 2001:db8::1 update-source '2001:db8::2'
-  set protocols bgp 65535 neighbor 2001:db8::1 address-family ipv6-unicast
-  set protocols bgp 65535 address-family ipv6-unicast network '2001:db8:2::/48'
-  set protocols bgp 65535 parameters router-id '10.1.1.2'
-
-Don't forget, the CIDR declared in the network statement **MUST exist in your
-routing table (dynamic or static), the best way to make sure that is true is
-creating a static route:**
-
-**Node 1:**
-
-.. code-block:: none
-
-  set protocols static route6 2001:db8:1::/48 blackhole distance '254'
-
-**Node 2:**
-
-.. code-block:: none
-
-  set protocols static route6 2001:db8:2::/48 blackhole distance '254'
-
-Route Filter
-^^^^^^^^^^^^
-
-Route filter can be applied using a route-map:
-
-**Node1:**
-
-.. code-block:: none
-
-  set policy prefix-list AS65535-IN rule 10 action 'permit'
-  set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16'
-  set policy prefix-list AS65535-OUT rule 10 action 'deny'
-  set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16'
-  set policy prefix-list6 AS65535-IN rule 10 action 'permit'
-  set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48'
-  set policy prefix-list6 AS65535-OUT rule 10 action 'deny'
-  set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48'
-  set policy route-map AS65535-IN rule 10 action 'permit'
-  set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN'
-  set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN'
-  set policy route-map AS65535-IN rule 20 action 'deny'
-  set policy route-map AS65535-OUT rule 10 action 'deny'
-  set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT'
-  set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT'
-  set policy route-map AS65535-OUT rule 20 action 'permit'
-  set protocols bgp 65534 neighbor 2001:db8::2 route-map export 'AS65535-OUT'
-  set protocols bgp 65534 neighbor 2001:db8::2 route-map import 'AS65535-IN'
-
-**Node2:**
-
-.. code-block:: none
-
-  set policy prefix-list AS65534-IN rule 10 action 'permit'
-  set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16'
-  set policy prefix-list AS65534-OUT rule 10 action 'deny'
-  set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16'
-  set policy prefix-list6 AS65534-IN rule 10 action 'permit'
-  set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48'
-  set policy prefix-list6 AS65534-OUT rule 10 action 'deny'
-  set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48'
-  set policy route-map AS65534-IN rule 10 action 'permit'
-  set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN'
-  set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN'
-  set policy route-map AS65534-IN rule 20 action 'deny'
-  set policy route-map AS65534-OUT rule 10 action 'deny'
-  set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT'
-  set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT'
-  set policy route-map AS65534-OUT rule 20 action 'permit'
-  set protocols bgp 65535 neighbor 2001:db8::1 route-map export 'AS65534-OUT'
-  set protocols bgp 65535 neighbor 2001:db8::1 route-map import 'AS65534-IN'
-
-We could expand on this and also deny link local and multicast in the rule 20
-action deny.
diff --git a/docs/routing/index.rst b/docs/routing/index.rst
deleted file mode 100644
index dcc67bc7..00000000
--- a/docs/routing/index.rst
+++ /dev/null
@@ -1,22 +0,0 @@
-.. _routing:
-
-Routing
-=======
-
-VyOS is a "router first" network operating system. It supports static routing,
-policy routing, and dynamic routing using standard protocols (RIP, OSPF, and
-BGP).
-
-.. toctree::
-   :maxdepth: 1
-
-   arp
-   bgp
-   ip-commands
-   multicast
-   ospf
-   pbr
-   rip
-   routing-policy
-   static
-   mss-clamp
diff --git a/docs/routing/ip-commands.rst b/docs/routing/ip-commands.rst
deleted file mode 100644
index 60eb582a..00000000
--- a/docs/routing/ip-commands.rst
+++ /dev/null
@@ -1,281 +0,0 @@
-.. _ip-commands:
-
-***********
-IP commands
-***********
-
-
-IPv4
-====
-
-System configuration commands
------------------------------
-
-
-.. cfgcmd:: set system ip disable-forwarding
-
-   Use this command to disable IPv4 forwarding on all interfaces.
-
-
-.. cfgcmd:: set system ip arp table-size <number>
-
-   Use this command to define the maximum number of entries to keep in
-   the ARP cache (1024, 2048, 4096, 8192, 16384, 32768).
-
-
-.. cfgcmd:: set system ip multipath layer4-hashing
-
-   Use this command to use Layer 4 information for IPv4 ECMP hashing.
-
-
-Operational commands
---------------------
-
-
-show commands
-^^^^^^^^^^^^^
-
-See below the different parameters available for the IPv4 **show** command:
-
-.. code-block::
-
-   vyos@vyos:~$ show ip
-   Possible completions:
-     access-list   Show all IP access-lists
-     as-path-access-list
-                   Show all as-path-access-lists
-     bgp           Show Border Gateway Protocol (BGP) information
-     community-list
-                   Show IP community-lists
-     extcommunity-list
-                   Show extended IP community-lists
-     forwarding    Show IP forwarding status
-     groups        Show IP multicast group membership
-     igmp          Show IGMP (Internet Group Management Protocol) information
-     large-community-list
-                   Show IP large-community-lists
-     multicast     Show IP multicast
-     ospf          Show IPv4 Open Shortest Path First (OSPF) routing information
-     pim           Show PIM (Protocol Independent Multicast) information
-     ports         Show IP ports in use by various system services
-     prefix-list   Show all IP prefix-lists
-     protocol      Show IP route-maps per protocol
-     rip           Show Routing Information Protocol (RIP) information
-     route         Show IP routes
-   
-
-reset commands
-^^^^^^^^^^^^^^
-
-And the different IPv4 **reset** commands available:
-
-.. code-block::
-
-   vyos@vyos:~$ reset ip 
-   Possible completions:
-     arp           Reset Address Resolution Protocol (ARP) cache
-     bgp           Clear Border Gateway Protocol (BGP) statistics or status
-     igmp          IGMP clear commands
-     multicast     IP multicast routing table
-     route         Reset IP route
-   
-
-IPv6
-====
-
-System configuration commands
------------------------------
-
-.. cfgcmd:: set system ipv6 disable
-
-   Use this command to disable assignment of IPv6 addresses on all
-   interfaces.
-
-
-.. cfgcmd:: set system ipv6 disable-forwarding
-
-   Use this command to disable IPv6 forwarding on all interfaces.
-
-
-.. cfgcmd:: set system ipv6 neighbor table-size <number>
-
-   Use this command to define the maximum number of entries to keep in
-   the Neighbor cache (1024, 2048, 4096, 8192, 16384, 32768).
-
-
-.. cfgcmd:: set system ipv6 strict-dad
-
-   Use this command to disable IPv6 operation on interface when
-   Duplicate Address Detection fails on Link-Local address.
-
-
-.. cfgcmd:: set system ipv6 multipath layer4-hashing
-
-   Use this command to user Layer 4 information for ECMP hashing.
-
-.. cfgcmd:: set system ipv6 blacklist
-
-   Use this command to prevent the IPv6 kernel module from being loaded.
-
-
-
-Operational commands
---------------------
-
-Show commands
-^^^^^^^^^^^^^
-
-
-.. opcmd:: show ipv6 neighbors
-
-   Use this command to show IPv6 Neighbor Discovery Protocol information.
-
-
-.. opcmd:: show ipv6 groups
-
-   Use this command to show IPv6 multicast group membership.
-
-
-.. opcmd:: show ipv6 forwarding
-  
-   Use this command to show IPv6 forwarding status.
-
-.. opcmd:: show ipv6 route
-
-   Use this command to show IPv6 routes.
-
-
-   Check the many parameters available for the `show ipv6 route` command:
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show ipv6 route 
-      Possible completions:
-        <Enter>       Execute the current command
-        <X:X::X:X>    Show IPv6 routes of given address or prefix
-        <X:X::X:X/M>
-        bgp           Show IPv6 BGP routes
-        cache         Show kernel IPv6 route cache
-        connected     Show IPv6 connected routes
-        forward       Show kernel IPv6 route table
-        isis          Show IPv6 ISIS routes
-        kernel        Show IPv6 kernel routes
-        ospfv3        Show IPv6 OSPF6 routes
-        ripng         Show IPv6 RIPNG routes
-        static        Show IPv6 static routes
-        summary       Show IPv6 routes summary
-        table         Show IP routes in policy table
-      
-
-.. opcmd:: show ipv6 prefix-list
-
-   Use this command to show all IPv6 prefix lists
-
-   There are different parameters for getting prefix-list information:
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show ipv6 prefix-list 
-      Possible completions:
-        <Enter>       Execute the current command
-        <WORD>        Show specified IPv6 prefix-list
-        detail        Show detail of IPv6 prefix-lists
-        summary       Show summary of IPv6 prefix-lists
-      
-.. opcmd:: show ipv6 access-list
-
-   Use this command to show all IPv6 access lists
-
-   You can also specify which IPv6 access-list should be shown:
-
-   .. code-block:: none
-
-      vyos@vyos:~$ show ipv6 access-list 
-      Possible completions:
-        <Enter>       Execute the current command
-        <text>        Show specified IPv6 access-list
-      
-
-
-.. opcmd:: show ipv6 bgp
-
-   Use this command to show IPv6 Border Gateway Protocol information.
-
-
-   In addition, you can specify many other parameters to get BGP
-   information:
-
-   .. code-block:: none
-   
-      vyos@vyos:~$ show ipv6 bgp 
-      Possible completions:
-        <Enter>       Execute the current command
-        <X:X::X:X>    Show BGP information for given address or prefix
-        <X:X::X:X/M>
-        community     Show routes matching the communities
-        community-list
-                      Show routes matching the community-list
-        filter-list   Show routes conforming to the filter-list
-        large-community
-                      Show routes matching the large-community-list
-        large-community-list
-        neighbors     Show detailed information on TCP and BGP neighbor connections
-        prefix-list   Show routes matching the prefix-list
-        regexp        Show routes matching the AS path regular expression
-        summary       Show summary of BGP neighbor status
-      
-      
-
-.. opcmd:: show ipv6 ospfv3
-
-   Use this command to get information about OSPFv3.
-
-   You can get more specific OSPFv3 information by using the parameters
-   shown below:
-   
-   .. code-block:: none
-   
-      vyos@vyos:~$ show ipv6 ospfv3 
-      Possible completions:
-        <Enter>       Execute the current command
-        area          Show OSPFv3 spf-tree information
-        border-routers
-                      Show OSPFv3 border-router (ABR and ASBR) information
-        database      Show OSPFv3 Link state database information
-        interface     Show OSPFv3 interface information
-        linkstate     Show OSPFv3 linkstate routing information
-        neighbor      Show OSPFv3 neighbor information
-        redistribute  Show OSPFv3 redistribute External information
-        route         Show OSPFv3 routing table information
-      
-.. opcmd:: show ipv6 ripng
-
-   Use this command to get information about the RIPNG protocol
-
-.. opcmd:: show ipv6 ripng status
-
-   Use this command to show the status of the RIPNG protocol
-
-
-
-Reset commands
-^^^^^^^^^^^^^^
-
-.. opcmd:: reset ipv6 bgp <address>
-
-   Use this command to clear Border Gateway Protocol statistics or
-   status.
-
-
-.. opcmd:: reset ipv6 neighbors <address | interface>
-
-   Use this command to reset IPv6 Neighbor Discovery Protocol cache for 
-   an address or interface.
-
-.. opcmd:: reset ipv6 route cache
-
-   Use this command to flush the kernel IPv6 route cache.
-   An address can be added to flush it only for that route. 
-
-
-
diff --git a/docs/routing/mss-clamp.rst b/docs/routing/mss-clamp.rst
deleted file mode 100644
index a4edf1c6..00000000
--- a/docs/routing/mss-clamp.rst
+++ /dev/null
@@ -1,64 +0,0 @@
-.. _routing-mss-clamp:
-
-TCP-MSS Clamping
-----------------
-
-As Internet wide PMTU discovery rarely works, we sometimes need to clamp
-our TCP MSS value to a specific value. This is a field in the TCP
-Options part of a SYN packet. By setting the MSS value, you are telling
-the remote side unequivocally 'do not try to send me packets bigger than
-this value'.
-
-Starting with VyOS 1.2 there is a firewall option to clamp your TCP MSS
-value for IPv4 and IPv6.
-
-
-.. note:: MSS value = MTU - 20 (IP header) - 20 (TCP header), resulting
-   in 1452 bytes on a 1492 byte MTU.
-
-
-IPv4
-^^^^
-
-.. cfgcmd:: set firewall options interface <interface> adjust-mss <number-of-bytes>
-
-   Use this command to set the maximum segment size for IPv4 transit
-   packets on a specific interface (500-1460 bytes).
-
-
-Example
-"""""""
-
-Clamp outgoing MSS value in a TCP SYN packet to `1452` for `pppoe0` and
-`1372`
-for your WireGuard `wg02` tunnel.
-
-.. code-block:: none
-
-  set firewall options interface pppoe0 adjust-mss '1452'
-  set firewall options interface wg02 adjust-mss '1372'
-
-IPv6
-^^^^^
-
-.. cfgcmd:: set firewall options interface <interface> adjust-mss6 <number-of-bytes>
-
-   Use this command to set the maximum segment size for IPv6 transit
-   packets on a specific interface (1280-1492 bytes).
-
-
-Example
-"""""""
-
-Clamp outgoing MSS value in a TCP SYN packet to `1280` for both `pppoe0` and
-`wg02` interface.
-
-.. code-block:: none
-
-  set firewall options interface pppoe0 adjust-mss6 '1280'
-  set firewall options interface wg02 adjust-mss6 '1280'
-
-
-
-.. hint:: When doing your byte calculations, you might find useful this
-   `Visual packet size calculator <https://baturin.org/tools/encapcalc/>`_.
diff --git a/docs/routing/multicast.rst b/docs/routing/multicast.rst
deleted file mode 100644
index 421c9f0f..00000000
--- a/docs/routing/multicast.rst
+++ /dev/null
@@ -1,246 +0,0 @@
-.. _multicast:
-
-#########
-Multicast
-#########
-
-VyOS facilitates IP Multicast by supporting **PIM Sparse Mode**,
-**IGMP** and **IGMP-Proxy**.
-
-
-************
-PIM and IGMP
-************
-
-PIM (Protocol Independent Multicast) must be configured in every
-interface of every participating router. Every router must also have the
-location of the Rendevouz Point manually configured. Then,
-unidirectional shared trees rooted at the Rendevouz Point will
-automatically be built for multicast distribution. 
-
-Traffic from multicast sources will go to the Rendezvous Point, and
-receivers will pull it from a shared tree using IGMP (Internet Group
-Management Protocol).
-
-Multicast receivers will talk IGMP to their local router, so, besides
-having PIM configured in every router, IGMP must also be configured in
-any router where there could be a multicast receiver locally connected. 
-
-VyOS supports both IGMP version 2 and version 3 (which allows
-source-specific multicast).
-
-
-Example
-=======
-
-In the following example we can see a basic multicast setup:
-
-.. image:: /_static/images/multicast-basic.png
-   :width: 90%
-   :align: center
-   :alt: Network Topology Diagram
-
-
-
-**Router 1**
-
-.. code-block:: none
-
-   set interfaces ethernet eth2 address '172.16.0.2/24'
-   set interfaces ethernet eth1 address '100.64.0.1/24'
-   set protocols ospf area 0 network '172.16.0.0/24'
-   set protocols ospf area 0 network '100.64.0.0/24'
-   set protocols igmp interface eth1
-   set protocols pim interface eth1
-   set protocols pim interface eth2
-   set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'
-   
-**Router 3**
-
-.. code-block:: none
-
-   set interfaces dummy dum0 address '172.16.255.1/24'
-   set interfaces ethernet eth0 address '172.16.0.1/24'
-   set interfaces ethernet eth1 address '172.16.1.1/24'
-   set protocols ospf area 0 network '172.16.0.0/24'
-   set protocols ospf area 0 network '172.16.255.0/24'
-   set protocols ospf area 0 network '172.16.1.0/24'
-   set protocols pim interface dum0
-   set protocols pim interface eth0
-   set protocols pim interface eth1
-   set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'
-   
-**Router 2**
-
-.. code-block:: none
-
-   set interfaces ethernet eth1 address '10.0.0.1/24'
-   set interfaces ethernet eth2 address '172.16.1.2/24'
-   set protocols ospf area 0 network '10.0.0.0/24'
-   set protocols ospf area 0 network '172.16.1.0/24'
-   set protocols pim interface eth1
-   set protocols pim interface eth2
-   set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'
-   
-
-
-
-
-Basic commands
-==============
-
-These are the commands for a basic setup.
-
-.. cfgcmd:: set protocols pim interface <interface-name>
-
-   Use this command to enable PIM in the selected interface so that it
-   can communicate with PIM neighbors.
-
-
-.. cfgcmd:: set protocols pim rp address <address> group <multicast-address/mask-bits>
-
-   Use this comand to manually configure a Rendevouz Point for PIM so
-   that join messages can be sent there. Set the Rendevouz Point address
-   and the matching prefix of group ranges covered. These values must
-   be shared with every router participating in the PIM network.
- 
-
-.. cfgcmd:: set protocols igmp interface eth1
-
-   Use this command to configure an interface with IGMP so that PIM can
-   receive IGMP reports and query on the selected interface. By defaul
-   IGMP version 3 will be used.
-
-
-
-Tuning commands
-===============
-
-You can also tune multicast with the following commands.
-
-.. cfgcmd:: set protocols pim interface <interface> dr-priority <value>
-
-   Use this PIM command in the selected interface to set the priority
-   (1-4294967295) you want to influence in the election of a node to
-   become the Designated Router for a LAN segment. The default priority
-   is 1, set a  higher value to give the router more preference in the
-   DR election process.
-
-
-.. cfgcmd:: set protocols pim int <interface> hello <seconds>
-
-   Use this command to configure the PIM hello interval in seconds
-   (1-180) for the selected interface.
-
-
-.. cfgcmd:: set protocols pim rp keep-alive-timer <seconds>
-
-   Use this PIM command to modify the the time out value (31-60000
-   seconds) for an `(S,G) <https://tools.ietf.org/html/rfc7761#section-4.1>`_
-   flow. 31 seconds is chosen for a lower bound as some hardware
-   platforms cannot see data flowing in better than 30 second chunks.
-
-
-.. cfgcmd:: set protocols igmp interface <interface> join <multicast-address> source <IP-address>
-
-   Use this command to allow the selected interface join a multicast
-   group defining the multicast address you want to join and the source
-   IP address too.
-
-
-.. cfgcmd:: set protocols igmp interface <interface query-interval <seconds>
-
-   Use this command to configure in the selected interface the IGMP
-   host query interval (1-1800) in seconds that PIM will use.
-
-
-.. cfgcmd:: set protocols igmp interface <interface query-max-response-time <deciseconds>
-
-   Use this command to configure in the selected interface the IGMP
-   query response timeout value (10-250) in deciseconds. If a report is
-   not returned in the specified time, it will be asumed the `(S,G) or
-   (*,G) state <https://tools.ietf.org/html/rfc7761#section-4.1>`_ has
-   timed out.
-
-
-.. cfgcmd:: set protocols igmp interface <interface> version <version-number> 
-
-   Use this command to define in the selected interface whether you
-   choose IGMP version 2 or 3. The default value is 3.
-
-
-
-**********
-IGMP Proxy
-**********
-
-:abbr:`IGMP (Internet Group Management Protocol)` proxy sends IGMP host
-messages on behalf of a connected client. The configuration must define
-one, and only one upstream interface, and one or more downstream
-interfaces.
-
-Configuration
-=============
-
-.. cfgcmd:: set protocols igmp-proxy interface <interface> role <upstream | downstream>
-
-   * **upstream:** The upstream network interface is the outgoing interface
-     which is responsible for communicating to available multicast data sources.
-     There can only be one upstream interface.
-
-   * **downstream:** Downstream network interfaces are the distribution
-     interfaces to the destination networks, where multicast clients can join
-     groups and receive multicast data. One or more downstream interfaces must
-     be configured.
-
-.. cfgcmd:: set protocols igmp-proxy interface <interface> alt-subnet <network>
-
-   Defines alternate sources for multicasting and IGMP data. The network address
-   must be on the following format 'a.b.c.d/n'. By default the router will
-   accept data from sources on the same network as configured on an interface.
-   If the multicast source lies on a remote network, one must define from where
-   traffic should be accepted.
-
-   This is especially useful for the upstream interface, since the source for
-   multicast traffic is often from a remote location.
-
-   This option can be supplied multiple times.
-
-.. cfgcmd:: set protocols igmp-proxy disable-quickleave
-
-   Disables quickleave mode. In this mode the daemon will not send a Leave IGMP
-   message upstream as soon as it receives a Leave message for any downstream
-   interface. The daemon will not ask for Membership reports on the downstream
-   interfaces, and if a report is received the group is not joined again
-   upstream.
-
-   If it's vital that the daemon should act exactly as a real multicast client
-   on the upstream interface, this function should be enabled.
-
-   Enabling this function increases the risk of bandwidth saturation.
-
-.. cfgcmd:: set protocols igmp-proxy disable
-
-   Disable this service.
-
-Example
--------
-
-Interface `eth1` LAN is behind NAT. In order to subscribe `10.0.0.0/23`
-subnet multicast which is in `eth0` WAN we need to configure igmp-proxy.
-
-.. code-block:: none
-
-  set protocols igmp-proxy interface eth0 role upstream
-  set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23
-  set protocols igmp-proxy interface eth1 role downstream
-
-Operation
-=========
-
-.. opcmd:: restart igmp-proxy
-
-   Restart the IGMP proxy process.
-
-
-
diff --git a/docs/routing/ospf.rst b/docs/routing/ospf.rst
deleted file mode 100644
index 1e70f644..00000000
--- a/docs/routing/ospf.rst
+++ /dev/null
@@ -1,139 +0,0 @@
-.. _routing-ospf:
-
-Open Shortest Path First (OSPF)
--------------------------------
-
-Open Shortest Path First (OSPF) is a routing protocol for Internet Protocol
-(IP) networks. It uses a link state routing (LSR) algorithm and falls into the
-group of interior gateway protocols (IGPs), operating within a single autonomous
-system (AS). It is defined as OSPF Version 2 in RFC2328_ (1998) for IPv4. Updates
-for IPv6 are specified as OSPF Version 3 in RFC5340_ (2008). OSPF supports the
-Classless Inter-Domain Routing (CIDR) addressing model.
-
-OSPF is a widely used IGP in large enterprise networks.
-
-OSPFv2 (IPv4)
-^^^^^^^^^^^^^
-
-In order to have a VyOS system exchanging routes with OSPF neighbors, you will at least need to configure the area and a network,
-
-.. code-block:: none
-
-  set protocols ospf area 0 network 192.168.0.0/24
-
-as well as the router ID.
-
-.. code-block:: none
-
-  set protocols ospf parameters router-id 10.1.1.1
- 
-That is the minimum configuration you will need.
-
-Below you can see a typical configuration using 2 nodes, redistribute loopback address and the node 1 sending the default route:
-
-**Node 1**
-
-.. code-block:: none
-
-  set interfaces loopback lo address 10.1.1.1/32
-  set protocols ospf area 0 network 192.168.0.0/24
-  set protocols ospf default-information originate always
-  set protocols ospf default-information originate metric 10
-  set protocols ospf default-information originate metric-type 2
-  set protocols ospf log-adjacency-changes
-  set protocols ospf parameters router-id 10.1.1.1
-  set protocols ospf redistribute connected metric-type 2
-  set protocols ospf redistribute connected route-map CONNECT
-
-  set policy route-map CONNECT rule 10 action permit
-  set policy route-map CONNECT rule 10 match interface lo
-
-**Node 2**
-
-.. code-block:: none
-
-  set interfaces loopback lo address 10.2.2.2/32
-  set protocols ospf area 0 network 192.168.0.0/24
-  set protocols ospf log-adjacency-changes
-  set protocols ospf parameters router-id 10.2.2.2
-  set protocols ospf redistribute connected metric-type 2
-  set protocols ospf redistribute connected route-map CONNECT
-
-  set policy route-map CONNECT rule 10 action permit
-  set policy route-map CONNECT rule 10 match interface lo
-
-OSPFv3 (IPv6)
-^^^^^^^^^^^^^
-
-A typical configuration using 2 nodes.
-
-**Node 1:**
-
-.. code-block:: none
-
-  set protocols ospfv3 area 0.0.0.0 interface eth1
-  set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64
-  set protocols ospfv3 parameters router-id 192.168.1.1
-  set protocols ospfv3 redistribute connected
-
-**Node 2:**
-
-.. code-block:: none
-
-  set protocols ospfv3 area 0.0.0.0 interface eth1
-  set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64
-  set protocols ospfv3 parameters router-id 192.168.2.1
-  set protocols ospfv3 redistribute connected
-
-.. note:: You can not easily redistribute IPv6 routes via OSPFv3 on a WireGuard
-   interface link. This requires you to configure link-local addresses manually
-   on the WireGuard interfaces, see Phabricator task T1483_.
-
-Example configuration for WireGuard interfaces:
-
-**Node 1**
-
-.. code-block:: none
-
-  set interfaces wireguard wg01 address 'fe80::216:3eff:fe51:fd8c/64'
-  set interfaces wireguard wg01 address '192.168.0.1/24'
-  set interfaces wireguard wg01 peer ospf02 allowed-ips '::/0'
-  set interfaces wireguard wg01 peer ospf02 allowed-ips '0.0.0.0/0'
-  set interfaces wireguard wg01 peer ospf02 endpoint '10.1.1.101:12345'
-  set interfaces wireguard wg01 peer ospf02 pubkey 'ie3...='
-  set interfaces wireguard wg01 port '12345'
-  set protocols ospfv3 parameters router-id 192.168.1.1
-  set protocols ospfv3 area 0.0.0.0 interface 'wg01'
-  set protocols ospfv3 area 0.0.0.0 interface 'lo'
-
-**Node 2**
-
-.. code-block:: none
-
-  set interfaces wireguard wg01 address 'fe80::216:3eff:fe0a:7ada/64'
-  set interfaces wireguard wg01 address '192.168.0.2/24'
-  set interfaces wireguard wg01 peer ospf01 allowed-ips '::/0'
-  set interfaces wireguard wg01 peer ospf01 allowed-ips '0.0.0.0/0'
-  set interfaces wireguard wg01 peer ospf01 endpoint '10.1.1.100:12345'
-  set interfaces wireguard wg01 peer ospf01 pubkey 'NHI...='
-  set interfaces wireguard wg01 port '12345'
-  set protocols ospfv3 parameters router-id 192.168.1.2
-  set protocols ospfv3 area 0.0.0.0 interface 'wg01'
-  set protocols ospfv3 area 0.0.0.0 interface 'lo'
-
-**Status**
-
-.. code-block:: none
-
-  vyos@ospf01:~$ sh ipv6 ospfv3 neighbor
-  Neighbor ID     Pri    DeadTime    State/IfState         Duration I/F[State]
-  192.168.0.2       1    00:00:37     Full/PointToPoint    00:18:03 wg01[PointToPoint]
-
-  vyos@ospf02# run sh ipv6 ospfv3 neighbor
-  Neighbor ID     Pri    DeadTime    State/IfState         Duration I/F[State]
-  192.168.0.1       1    00:00:39     Full/PointToPoint    00:19:44 wg01[PointToPoint]
-
-.. _RFC2328: https://tools.ietf.org/html/rfc2328
-.. _RFC5340: https://tools.ietf.org/html/rfc2340
-.. _T1483: https://phabricator.vyos.net/T1483
-
diff --git a/docs/routing/pbr.rst b/docs/routing/pbr.rst
deleted file mode 100644
index b86e1c0b..00000000
--- a/docs/routing/pbr.rst
+++ /dev/null
@@ -1,98 +0,0 @@
-.. _routing-pbr:
-
-Policy-Based Routing (PBR)
---------------------------
-
-VyOS supports Policy Routing, allowing traffic to be assigned to a different
-routing table. Traffic can be matched using standard 5-tuple matching (source
-address, destination address, protocol, source port, destination port).
-
-Transparent Proxy
-^^^^^^^^^^^^^^^^^
-
-The following example will show how VyOS can be used to redirect web traffic to
-an external transparent proxy:
-
-.. code-block:: none
-
-  set policy route FILTER-WEB rule 1000 destination port 80
-  set policy route FILTER-WEB rule 1000 protocol tcp
-  set policy route FILTER-WEB rule 1000 set table 100
-
-This creates a route policy called FILTER-WEB with one rule to set the routing
-table for matching traffic (TCP port 80) to table ID 100 instead of the
-default routing table.
-
-To create routing table 100 and add a new default gateway to be used by
-traffic matching our route policy:
-
-.. code-block:: none
-
-  set protocols static table 100 route 0.0.0.0/0 next-hop 10.255.0.2
-
-This can be confirmed using the show ip route table 100 operational command.
-
-Finally, to apply the policy route to ingress traffic on our LAN interface,
-we use:
-
-.. code-block:: none
-
-  set interfaces ethernet eth1 policy route FILTER-WEB
-
-
-Multiple Uplinks
-^^^^^^^^^^^^^^^^
-
-VyOS Policy-Based Routing (PBR) works by matching source IP address ranges and
-forwarding the traffic using different routing tables.
-
-Routing tables that will be used in this example are:
-
-* ``table 10`` Routing tabled used for VLAN 10 (192.168.188.0/24)
-* ``table 11`` Routing tabled used for VLAN 11 (192.168.189.0/24)
-* ``main`` Routing table used by VyOS and other interfaces not paritipating in PBR
-
-.. figure:: ../_static/images/pbr_example_1.png
-   :scale: 80 %
-   :alt: PBR multiple uplinks
-
-   Policy-Based Routing with multiple ISP uplinks (source ./draw.io/pbr_example_1.drawio)
-
-Add default routes for routing ``table 10`` and ``table 11``
-
-.. code-block:: none
-
-  set protocols static table 10 route 0.0.0.0/0 next-hop 192.0.1.1
-  set protocols static table 11 route 0.0.0.0/0 next-hop 192.0.2.2
-
-Add policy route matching VLAN source addresses
-
-.. code-block:: none
-
-  set policy route PBR rule 20 set table '10'
-  set policy route PBR rule 20 description 'Route VLAN10 traffic to table 10'
-  set policy route PBR rule 20 source address '192.168.188.0/24'
-
-  set policy route PBR rule 30 set table '11'
-  set policy route PBR rule 30 description 'Route VLAN11 traffic to table 11'
-  set policy route PBR rule 30 source address '192.168.189.0/24'
-
-Apply routing policy to **inbound** direction of out VLAN interfaces
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 vif 10 policy route 'PBR'
-  set interfaces ethernet eth0 vif 11 policy route 'PBR'
-
-
-**OPTIONAL:** Exclude Inter-VLAN traffic (between VLAN10 and VLAN11) from PBR
-
-.. code-block:: none
-
-  set policy route PBR rule 10 description 'VLAN10 <-> VLAN11 shortcut'
-  set policy route PBR rule 10 destination address '192.168.188.0/24'
-  set policy route PBR rule 10 destination address '192.168.189.0/24'
-  set policy route PBR rule 10 set table 'main'
-
-.. note:: Allows the VLAN10 and VLAN20 hosts to communicate with each other using the
-   main routing table.
diff --git a/docs/routing/rip.rst b/docs/routing/rip.rst
deleted file mode 100644
index da00e7b1..00000000
--- a/docs/routing/rip.rst
+++ /dev/null
@@ -1,22 +0,0 @@
-.. _routing-rip:
-
-Routing Information Protocol (RIP)
-----------------------------------
-
-Simple RIP configuration using 2 nodes and redistributing connected interfaces.
-
-**Node 1:**
-
-.. code-block:: none
-
-  set interfaces loopback address 10.1.1.1/32
-  set protocols rip network 192.168.0.0/24
-  set protocols rip redistribute connected
-
-**Node 2:**
-
-.. code-block:: none
-
-  set interfaces loopback address 10.2.2.2/32
-  set protocols rip network 192.168.0.0/24
-  set protocols rip redistribute connected
diff --git a/docs/routing/routing-policy.rst b/docs/routing/routing-policy.rst
deleted file mode 100644
index 847f3574..00000000
--- a/docs/routing/routing-policy.rst
+++ /dev/null
@@ -1,59 +0,0 @@
-
-Routing-policy
---------------
-
-Routing Policies could be used to tell the router (self or neighbors) what routes and their attributes needs to be put into the routing table.
-
-There could be a wide range of routing policies. Some examples are below:
-
-  * Set some metric to routes learned from a particular neighbor
-  * Set some attributes (like AS PATH or Community value) to advertised routes to neighbors
-  * Prefer a specific routing protocol routes over another routing protocol running on the same router
-
-Routing Policy Example
-~~~~~~~~~~~~~~~~~~~~~~
-
-**Policy definition:**
-
-.. code-block:: none
-
-  #Create policy
-  set policy route-map setmet rule 2 action 'permit'
-  set policy route-map setmet rule 2 set as-path-prepend '2 2 2'  
-  
-  #Apply policy to BGP
-  set protocols bgp 1 neighbor 1.1.1.2 address-family ipv4-unicast route-map import 'setmet'
-  set protocols bgp 1 neighbor 1.1.1.2 address-family ipv4-unicast soft-reconfiguration 'inbound' <<<< *** 
-  
-  *** get policy update without bouncing the neighbor
-
-**Routes learned before routing policy applied:**
-
-.. code-block:: none
-
-  vyos@vos1:~$ show ip bgp
-  BGP table version is 0, local router ID is 192.168.56.101
-  Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
-                r RIB-failure, S Stale, R Removed
-  Origin codes: i - IGP, e - EGP, ? - incomplete
-  
-     Network          Next Hop            Metric LocPrf Weight Path
-  *> 22.22.22.22/32   1.1.1.2                  1             0 2 i  < Path 
-  
-  Total number of prefixes 1
-
-**Routes learned after routing policy applied:**
-
-.. code-block:: none
-
-  vyos@vos1:~$ sho ip b
-  BGP table version is 0, local router ID is 192.168.56.101
-  Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
-                r RIB-failure, S Stale, R Removed
-  Origin codes: i - IGP, e - EGP, ? - incomplete
-  
-     Network          Next Hop            Metric LocPrf Weight Path
-  *> 22.22.22.22/32   1.1.1.2                  1             0 2 2 2 2 i < longer AS_path length
-  
-  Total number of prefixes 1
-  vyos@vos1:~$ 
diff --git a/docs/routing/static.rst b/docs/routing/static.rst
deleted file mode 100644
index 01e88988..00000000
--- a/docs/routing/static.rst
+++ /dev/null
@@ -1,30 +0,0 @@
-.. _routing-static:
-
-Static
-------
-
-Static routes are manually configured network routes.
-
-A typical use for a static route is a static default route for systems that do
-not make use of DHCP or dynamic routing protocols:
-
-.. code-block:: none
-
-  set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 distance '1'
-
-Another common use of static routes is to blackhole (drop) traffic. In the
-example below, RFC1918_ networks are set as blackhole routes. 
-
-This prevents these networks leaking out public interfaces, but it does not prevent
-them from being used as the most specific route has the highest priority.
-
-.. code-block:: none
-
-  set protocols static route 10.0.0.0/8 blackhole distance '254'
-  set protocols static route 172.16.0.0/12 blackhole distance '254'
-  set protocols static route 192.168.0.0/16 blackhole distance '254'
-
-.. note:: Routes with a distance of 255 are effectively disabled and not
-   installed into the kernel.
-
-.. _RFC1918: https://tools.ietf.org/html/rfc1918
diff --git a/docs/services/conntrack.rst b/docs/services/conntrack.rst
deleted file mode 100644
index 28f16d54..00000000
--- a/docs/services/conntrack.rst
+++ /dev/null
@@ -1,178 +0,0 @@
-Conntrack
----------
-
-One of the important features built on top of the Netfilter framework is
-connection tracking. Connection tracking allows the kernel to keep track of all
-logical network connections or sessions, and thereby relate all of the packets
-which may make up that connection. NAT relies on this information to translate
-all related packets in the same way, and iptables can use this information to
-act as a stateful firewall.
-
-The connection state however is completely independent of any upper-level
-state, such as TCP's or SCTP's state. Part of the reason for this is that when
-merely forwarding packets, i.e. no local delivery, the TCP engine may not
-necessarily be invoked at all. Even connectionless-mode transmissions such as
-UDP, IPsec (AH/ESP), GRE and other tunneling protocols have, at least, a pseudo
-connection state. The heuristic for such protocols is often based upon a preset
-timeout value for inactivity, after whose expiration a Netfilter connection is
-dropped.
-
-Each Netfilter connection is uniquely identified by a (layer-3 protocol, source
-address, destination address, layer-4 protocol, layer-4 key) tuple. The layer-4
-key depends on the transport protocol; for TCP/UDP it is the port numbers, for
-tunnels it can be their tunnel ID, but otherwise is just zero, as if it were
-not part of the tuple. To be able to inspect the TCP port in all cases, packets
-will be mandatorily defragmented.
-
-Configuration
-^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  # Protocols only for which local conntrack entries will be synced (tcp, udp, icmp, sctp)
-  set service conntrack-sync accept-protocol
-
-  # Queue size for listening to local conntrack events (in MB)
-  set service conntrack-sync event-listen-queue-size <int>
-
-  # Protocol for which expect entries need to be synchronized. (all, ftp, h323, nfs, sip, sqlnet)
-  set service conntrack-sync expect-sync
-
-  # Failover mechanism to use for conntrack-sync [REQUIRED]
-  set service conntrack-sync failover-mechanism
-
-  set service conntrack-sync cluster group <string>
-  set service conntrack-sync vrrp sync-group <1-255>
-
-  # IP addresses for which local conntrack entries will not be synced
-  set service conntrack-sync ignore-address ipv4 <x.x.x.x>
-
-  # Interface to use for syncing conntrack entries [REQUIRED]
-  set service conntrack-sync interface <ifname>
-
-  # Multicast group to use for syncing conntrack entries
-  set service conntrack-sync mcast-group <x.x.x.x>
-
-  # Queue size for syncing conntrack entries (in MB)
-  set service conntrack-sync sync-queue-size <size>
-
-Example
-^^^^^^^
-The next exemple is a simple configuration of conntrack-sync.
-
-
-.. figure:: /_static/images/service_conntrack_sync-schema.png
-   :scale: 60 %
-   :alt: Conntrack Sync Example
-
-   Conntrack Sync Example
-
-First of all, make sure conntrack is enabled by running
-
-.. code-block:: none
-
-  show conntrack table ipv4
-
-If the table is empty and you have a warning message, it means conntrack is not
-enabled. To enable conntrack, just create a NAT or a firewall rule.
-
-.. code-block:: none
-
-  set firewall state-policy established action accept
-
-You now should have a conntrack table
-
-.. code-block:: none
-
-  $ show conntrack table ipv4
-  TCP state codes: SS - SYN SENT, SR - SYN RECEIVED, ES - ESTABLISHED,
-                   FW - FIN WAIT, CW - CLOSE WAIT, LA - LAST ACK,
-                   TW - TIME WAIT, CL - CLOSE, LI - LISTEN
-
-  CONN ID    Source                 Destination            Protocol         TIMEOUT
-  1015736576 10.35.100.87:58172     172.31.20.12:22        tcp [6] ES       430279
-  1006235648 10.35.101.221:57483    172.31.120.21:22       tcp [6] ES       413310
-  1006237088 10.100.68.100          172.31.120.21          icmp [1]         29
-  1015734848 10.35.100.87:56282     172.31.20.12:22        tcp [6] ES       300
-  1015734272 172.31.20.12:60286     239.10.10.14:694       udp [17]         29
-  1006239392 10.35.101.221          172.31.120.21          icmp [1]         29
-
-Now configure conntrack-sync service on ``router1`` **and** ``router2``
-
-.. code-block:: none
-
-  set service conntrack-sync accept-protocol 'tcp,udp,icmp'
-  set service conntrack-sync event-listen-queue-size '8'
-  set service conntrack-sync failover-mechanism cluster group 'GROUP' # Or VRRP
-  set service conntrack-sync interface 'eth0'
-  set service conntrack-sync mcast-group '225.0.0.50'
-  set service conntrack-sync sync-queue-size '8'
-
-On the active router, you should have informations in the internal-cache of
-conntrack-sync. The same current active connections number should be shown in
-the external-cache of the standby router
-
-On active router run:
-
-
-.. code-block:: none
-
-  $ show conntrack-sync statistics
-
-  Main Table Statistics:
-
-  cache internal:
-  current active connections:               10
-  connections created:                    8517    failed:            0
-  connections updated:                     127    failed:            0
-  connections destroyed:                  8507    failed:            0
-
-  cache external:
-  current active connections:                0
-  connections created:                       0    failed:            0
-  connections updated:                       0    failed:            0
-  connections destroyed:                     0    failed:            0
-
-  traffic processed:
-                     0 Bytes                         0 Pckts
-
-  multicast traffic (active device=eth0):
-                868780 Bytes sent               224136 Bytes recv
-                 20595 Pckts sent                14034 Pckts recv
-                     0 Error send                    0 Error recv
-
-  message tracking:
-                     0 Malformed msgs                    0 Lost msgs
-
-
-
-  On standby router run:
-
-
-  $ show conntrack-sync statistics
-
-  Main Table Statistics:
-
-  cache internal:
-  current active connections:                0
-  connections created:                       0    failed:            0
-  connections updated:                       0    failed:            0
-  connections destroyed:                     0    failed:            0
-
-  cache external:
-  current active connections:               10
-  connections created:                     888    failed:            0
-  connections updated:                     134    failed:            0
-  connections destroyed:                   878    failed:            0
-
-  traffic processed:
-                     0 Bytes                         0 Pckts
-
-  multicast traffic (active device=eth0):
-                234184 Bytes sent               907504 Bytes recv
-                 14663 Pckts sent                21495 Pckts recv
-                     0 Error send                    0 Error recv
-
-  message tracking:
-                     0 Malformed msgs                    0 Lost msgs
-
diff --git a/docs/services/dhcp-relay.rst b/docs/services/dhcp-relay.rst
deleted file mode 100644
index 0b838442..00000000
--- a/docs/services/dhcp-relay.rst
+++ /dev/null
@@ -1,165 +0,0 @@
-
-
-DHCP Relay
-----------
-
-If you want your router to forward DHCP requests to an external DHCP server
-you can configure the system to act as a DHCP relay agent. The DHCP relay
-agent works with IPv4 and IPv6 addresses.
-
-All interfaces used for the DHCP relay must be configured. See
-https://wiki.vyos.net/wiki/Network_address_setup.
-
-DHCP relay example
-^^^^^^^^^^^^^^^^^^
-
-.. figure:: /_static/images/service_dhcp-relay01.png
-   :scale: 80 %
-   :alt: DHCP relay example
-
-   DHCP relay example
-
-In this example the interfaces used for the DHCP relay are eth1 and eth2. The
-router receives DHCP client requests on eth1 and relays them through eth2 to
-the DHCP server at 10.0.1.4.
-
-Configuration
-^^^^^^^^^^^^^
-
-Enable DHCP relay for eth1 and eth2:
-
-.. code-block:: none
-
-  set service dhcp-relay interface eth1
-  set service dhcp-relay interface eth2
-
-Set the IP address of the DHCP server:
-
-.. code-block:: none
-
-  set service dhcp-relay server 10.0.1.4
-
-The router should discard DHCP packages already containing relay agent
-information to ensure that only requests from DHCP clients are forwarded:
-
-.. code-block:: none
-
-  set service dhcp-relay relay-options relay-agents-packets discard
-
-Commit the changes and show the results:
-
-.. code-block:: none
-
-  commit
-  show service dhcp-relay
-      interface eth1
-      interface eth2
-      server 10.0.1.4
-      relay-options {
-         relay-agents-packets discard
-      }
-
-The DHCP relay agent can be restarted with:
-
-.. code-block:: none
-
-  restart dhcp relay-agent
-
-DHCPv6 relay example
-^^^^^^^^^^^^^^^^^^^^
-
-.. figure:: /_static/images/service_dhcpv6-relay01.png
-   :scale: 80 %
-   :alt: DHCPv6 relay example
-
-   DHCPv6 relay example
-
-In this example DHCPv6 requests are received by the router on eth1
-(`listening interface`) and forwarded through eth2 (`upstream interface`) to
-the external DHCPv6 server at 2001:db8:100::4.
-
-Configuration
-*************
-
-Set eth1 to be the listening interface for the DHCPv6 relay:
-
-.. code-block:: none
-
-  set service dhcpv6-relay listen-interface eth1
-
-Set eth2 to be the upstream interface and specify the IPv6 address of
-the DHCPv6 server:
-
-.. code-block:: none
-
-  set service dhcpv6-relay upstream-interface eth2 address 2001:db8:100::4
-
-Commit the changes and show results:
-
-.. code-block:: none
-
-  commit
-  show service dhcpv6-relay
-      listen-interface eth1 {
-      }
-      upstream-interface eth2 {
-         address 2001:db8:100::4
-      }
-
-Show the current status of the DHCPv6 relay agent:
-
-.. code-block:: none
-
-  show dhcpv6 relay-agent status
-
-The DHCPv6 relay agent can be restarted with:
-
-.. code-block:: none
-
-  restart dhcpv6 relay-agent
-
-Additional parameters
-^^^^^^^^^^^^^^^^^^^^^
-
-DHCP relay agent options
-************************
-
-Set the maximum hop count before packets are discarded. Range 0...255,
-default 10.
-
-* :code:`set service dhcp-relay relay-options hop-count 'count'`
-
-Set maximum size of DHCP packets including relay agent information. If a
-DHCP packet size surpasses this value it will be forwarded without appending
-relay agent information. Range 64...1400, default 576.
-
-* :code:`set service dhcp-relay relay-options max-size 'size'`
-
-Four policies for reforwarding DHCP packets exist:
-
-* **append:** The relay agent is allowed to append its own relay information
-  to a received DHCP packet, disregarding relay information already present in
-  the packet.
-
-* **discard:** Received packets which already contain relay information will
-  be discarded.
-
-* **forward:** All packets are forwarded, relay information already present
-  will be ignored.
-
-* **replace:** Relay information already present in a packet is stripped and
-  replaced with the router's own relay information set.
-
-* :code:`set service dhcp-relay relay-options relay-agents-packet 'policy'`
-
-DHCPv6 relay agent options
-**************************
-
-Set maximum hop count before packets are discarded. Default: 10.
-
-* :code:`set service dhcpv6-relay max-hop-count 'count'`
-
-If this is set the relay agent will insert the interface ID. This option is
-set automatically if more than one listening interfaces are in use.
-
-* :code:`set service dhcpv6-relay use-interface-id-option`
diff --git a/docs/services/dhcp.rst b/docs/services/dhcp.rst
deleted file mode 100644
index f11d9a7e..00000000
--- a/docs/services/dhcp.rst
+++ /dev/null
@@ -1,138 +0,0 @@
-
-DHCP Server
------------
-
-Multiple DHCP Servers can be run from a single machine. Each DHCP service is
-identified by a `shared-network-name`.
-
-DHCP Server Example
-^^^^^^^^^^^^^^^^^^^
-
-In this example, we are offering address space in the 172.16.17.0/24 network,
-which is on eth1, and pppoe0 is our connection to the internet. We are using
-the network name `dhcpexample`.
-
-Prerequisites
-^^^^^^^^^^^^^
-
-Configuring the PPPoE interface is assumed to be done already, and appears
-on `pppoe0`
-
-Interface Configuration
-^^^^^^^^^^^^^^^^^^^^^^^
-
-.. code-block:: none
-
- set interface ethernet eth1 address 172.16.17.1/24
-
-Multiple ranges can be defined and can contain holes.
-
-.. code-block:: none
-
-  set service dhcp-server shared-network-name dhcpexample authoritative
-  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 default-router 172.16.17.1
-  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 dns-server 172.16.17.1
-  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 lease 86400
-  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 range 0 start 172.16.17.100
-  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 range 0 stop 172.16.17.199
-
-
-Explanation
-^^^^^^^^^^^
-
-* :code:`set service dhcp-server shared-network-name dhcpexample authoritative`
-
-  This says that this device is the only DHCP server for this network. If other
-  devices are trying to offer DHCP leases, this machine will send 'DHCPNAK' to
-  any device trying to request an IP address that is
-  not valid for this network.
-
-* :code:`set service dhcp-server shared-network-name dhcpexample subnet
-  172.16.17.0/24 default-router 172.16.17.1`
-
-  This is a configuration parameter for the subnet, saying that as part of the
-  response, tell the client that I am the default router for this network
-
-* :code:`set service dhcp-server shared-network-name dhcpexample subnet
-  172.16.17.0/24 dns-server 172.16.17.1`
-
-  This is a configuration parameter for the subnet, saying that as part of the
-  response, tell the client that I am the DNS server for this network. If you
-  do not want to run a DNS server, you could also provide one of the public
-  DNS servers, such as google's. You can add multiple entries by repeating the
-  line.
-
-* :code:`set service dhcp-server shared-network-name dhcpexample subnet
-  172.16.17.0/24 lease 86400`
-
-  Assign the IP address to this machine for 24 hours. It is unlikely you'd need
-  to shorten this period, unless you are running a network with lots of devices
-  appearing and disappearing.
-
-
-* :code:`set service dhcp-server shared-network-name dhcpexample subnet
-  172.16.17.0/24 range 0 start 172.16.17.100`
-
-  Make a range of addresses available for clients starting from .100 [...]
-
-* :code:`set service dhcp-server shared-network-name dhcpexample subnet
-  172.16.17.0/24 range 0 stop 172.16.17.199`
-
-  [...] and ending at .199
-
-
-Failover
-^^^^^^^^
-
-VyOS provides support for DHCP failover:
-
-.. code-block:: none
-
-  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover local-address '192.168.0.1'
-  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover name 'foo'
-  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover peer-address '192.168.0.2'
-
-.. note:: `name` must be identical on both sides!
-
-The primary and secondary statements determines whether the server is
-primary or secondary
-
-.. code-block:: none
-
-  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover status 'primary'
-
-or
-
-.. code-block:: none
-
-  set service dhcp-server shared-network-name 'LAN' subnet '192.168.0.0/24' failover status 'secondary'
-
-.. note:: In order for the primary and the secondary DHCP server to keep
-   their lease tables in sync, they must be able to reach each other on TCP
-   port 647. If you have firewall rules in effect, adjust them accordingly.
-
-Static mappings MAC/IP
-^^^^^^^^^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 static-mapping static-mapping-01 ip-address 172.16.17.10
-  set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 static-mapping static-mapping-01 mac-address ff:ff:ff:ff:ff:ff
-
-DHCP server options
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-default-router (DHCP option 003)
-  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 default-router <ROUTER-IP>`
-
-dns-server (DHCP option 006)
-  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 dns-server <DNS-SERVER-IP>`
-
-domain-name  Client domain name (DHCP option 015)
-  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 domain-name "<DOMAIN-NAME>"`
-
-domain-search (DHCP option 119)
-  This option can be given multiple times if you need multiple search domains
-  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 domain-search "<DOMAIN_NAME_1>"`
-  :code:`set service dhcp-server shared-network-name dhcpexample subnet 172.16.17.0/24 domain-search "<DOMAIN_NAME_2>"`
-
diff --git a/docs/services/dhcpv6.rst b/docs/services/dhcpv6.rst
deleted file mode 100644
index db566d5f..00000000
--- a/docs/services/dhcpv6.rst
+++ /dev/null
@@ -1,305 +0,0 @@
-
-DHCPv6 server
--------------
-
-VyOS provides DHCPv6 server functionality which is described in this section.
-In order to use the DHCPv6 server it has to be enabled first:
-
-.. code-block:: none
-
-  set service dhcpv6-server
-
-To restart the DHCPv6 server (operational mode):
-
-.. code-block:: none
-
-  restart dhcpv6 server
-
-To show the current status of the DHCPv6 server use:
-
-.. code-block:: none
-
-  show dhcpv6 server status
-
-Show statuses of all assigned leases:
-
-.. code-block:: none
-
-  show dhcpv6 server leases
-
-DHCPv6 server options
-^^^^^^^^^^^^^^^^^^^^^
-
-DHCPv6 server preference value
-******************************
-
-Clients receiving advertise messages from multiple servers choose the server
-with the highest preference value. The range for this value is `0...255`. Set
-a preference value for the DHCPv6 server:
-
-.. code-block:: none
-
-  set service dhcpv6-server preference <preference value>
-
-Delete a preference:
-
-.. code-block:: none
-
-  set service dhcpv6-server preference
-
-Show current preference:
-
-.. code-block:: none
-
-  show service dhcpv6-server preference
-
-Specify address lease time
-**************************
-
-The default lease time for DHCPv6 leases is 24 hours. This can be changed by
-supplying a `default-time`, `maximum-time` and `minimum-time` (all values in
-seconds):
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> lease-time {default <default-time> | maximum <maximum-time> | minimum <minimum-time>}
-
-Reset the custom lease times:
-
-.. code-block:: none
-
-  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> lease-time {default | maximum | minimum}
-
-Show the current configuration:
-
-.. code-block:: none
-
-  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> lease-time {default | maximum | minimum}
-
-Specify NIS domain
-******************
-
-A Network Information (NIS) domain can be set to be used for DHCPv6 clients:
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-domain <nis-domain-name>
-
-To Delete the NIS domain:
-
-.. code-block:: none
-
-  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-domain <nis-domain-name>
-
-Show a configured NIS domain:
-
-.. code-block:: none
-
-  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-domain <nis-domain-name>
-
-Specify NIS+ domain
-*******************
-
-The procedure to specify a Network Information Service Plus (NIS+) domain is
-similar to the NIS domain one:
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-domain <nisplus-domain-name>
-
-To Delete the NIS+ domain:
-
-.. code-block:: none
-
-  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-domain <nisplus-domain-name>
-
-Show a configured NIS domain:
-
- # show service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-domain <nisplus-domain-name>
-
-Specify NIS server address
-**************************
-
-To specify a NIS server address for DHCPv6 clients:
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-server <IPv6 address>
-
-Delete a specified NIS server address:
-
-.. code-block:: none
-
-  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-server <IPv6 address>
-
-Show specified NIS server addresses:
-
-.. code-block:: none
-
-  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> nis-server
-
-Specify NIS+ server address
-***************************
-
-To specify a NIS+ server address for DHCPv6 clients:
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-server <IPv6 address>
-
-Delete a specified NIS+ server address:
-
-.. code-block:: none
-
-  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-server <IPv6 address>
-
-Show specified NIS+ server addresses:
-
-.. code-block:: none
-
-  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> nisplus-server
-
-Specify a SIP server address for DHCPv6 clients
-***********************************************
-
-By IPv6 address
-###############
-
-
-A Session Initiation Protocol (SIP) server address can be specified
-for DHCPv6 clients:
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-address <IPv6 address>
-
-Delete a specified SIP server address:
-
-.. code-block:: none
-
-  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-address <IPv6 address>
-
-Show specified SIP server addresses:
-
-.. code-block:: none
-
-  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-address
-
-By FQDN
-#######
-
-A name for SIP server can be specified:
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-name <sip-server-name>
-
-Delete a specified SIP server name:
-
-.. code-block:: none
-
-  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-name <sip-server-name>
-
-Show specified SIP server names:
-
-.. code-block:: none
-
-  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> sip-server-name
-
-Simple Network Time Protocol (SNTP) server address for DHCPv6 clients
-*********************************************************************
-
-A SNTP server address can be specified for DHCPv6 clients:
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name <name> subnet <ipv6net> sntp-server-address <IPv6 address>
-
-Delete a specified SNTP server address:
-
-.. code-block:: none
-
-  delete service dhcpv6-server shared-network-name <name> subnet <ipv6net> sntp-server-address <IPv6 address>
-
-Show specified SNTP server addresses:
-
-.. code-block:: none
-
-  show service dhcpv6-server shared-network-name <name> subnet <ipv6net> sntp-server-address
-
-DHCPv6 address pools
-^^^^^^^^^^^^^^^^^^^^
-
-DHCPv6 address pools must be configured for the system to act as a DHCPv6
-server. The following example describes a common scenario.
-
-Example 1: DHCPv6 address pool
-******************************
-
-A shared network named `NET1` serves subnet `2001:db8:100::/64` which is
-connected to `eth1`, a DNS server at `2001:db8:111::111` is used for name
-services. The range of the address pool shall be `::100` through `::199`. The
-lease time will be left at the default value which is 24 hours.
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name NET1 subnet 2001:db8:100::/64 address-range start 2001:db8:100::100 stop 2001:db8:100::199
-  set service dhcpv6-server shared-network-name NET1 subnet 2001:db8:100::/64 name-server 2001:db8:111::111
-
-Commit the changes and show the configuration:
-
-.. code-block:: none
-
-  commit
-  show service dhcpv6-server
-      shared-network-name NET1 {
-          subnet 2001:db8:100::/64 {
-             address-range {
-                start 2001:db8:100::100 {
-                   stop 2001:db8:100::199
-                }
-             }
-             name-server 2001:db8:111::111
-          }
-      }
-
-Static mappings
-^^^^^^^^^^^^^^^
-
-In order to map specific IPv6 addresses to specific hosts static mappings can
-be created. The following example explains the process.
-
-Example 1: Static IPv6 MAC-based mapping
-****************************************
-
-IPv6 address `2001:db8:100::101` shall be statically mapped to a device with
-MAC address `00:15:c5:b7:5e:23`, this host-specific mapping shall be named
-`client1`.
-
-.. note:: The MAC address identifier is defined by the last 4 byte of the
-   MAC address.
-
-.. code-block:: none
-
-  set service dhcpv6-server shared-network-name NET1 subnet 2001:db8:100::/64 static-mapping client1 ipv6-address 2001:db8:100::101
-  set service dhcpv6-server shared-network-name NET1 subnet 2001:db8:100::/64 static-mapping client1 identifier c5b75e23
-
-Commit the changes and show the configuration:
-
-.. code-block:: none
-
-  show service dhcp-server shared-network-name NET1
-     shared-network-name NET1 {
-         subnet 2001:db8:100::/64 {
-            name-server 2001:db8:111::111
-            address-range {
-                start 2001:db8:100::100 {
-                   stop 2001:db8:100::199 {
-                }
-            }
-            static-mapping client1 {
-               ipv6-address 2001:db8:100::101
-               identifier c5b75e23
-            }
-         }
-      }
diff --git a/docs/services/dns-forwarding.rst b/docs/services/dns-forwarding.rst
deleted file mode 100644
index 84e4fc93..00000000
--- a/docs/services/dns-forwarding.rst
+++ /dev/null
@@ -1,72 +0,0 @@
-DNS Forwarding
---------------
-
-Use DNS forwarding if you want your router to function as a DNS server for the
-local network. There are several options, the easiest being 'forward all
-traffic to the system DNS server(s)' (defined with set system name-server):
-
-.. code-block:: none
-
-  set service dns forwarding system
-
-Manually setting DNS servers for forwarding:
-
-.. code-block:: none
-
-  set service dns forwarding name-server 8.8.8.8
-  set service dns forwarding name-server 8.8.4.4
-
-Manually setting DNS servers with IPv6 connectivity:
-
-.. code-block:: none
-
-  set service dns forwarding name-server 2001:4860:4860::8888
-  set service dns forwarding name-server 2001:4860:4860::8844
-
-Setting a forwarding DNS server for a specific domain:
-
-.. code-block:: none
-
-  set service dns forwarding domain example.com server 192.0.2.1
-  
-Set which networks or clients are allowed to query the DNS Server. Allow from all:
-
-.. code-block:: none
-
-  set service dns forwarding allow-from 0.0.0.0/0
-
-Example 1
-^^^^^^^^^
-
-Router with two interfaces eth0 (WAN link) and eth1 (LAN). Split DNS for example.com.
-
-* DNS request for a local domain (example.com) get forwarded to 192.0.2.1
-* Other DNS requests are forwarded to Google's DNS servers.
-* The IP address for the LAN interface is 192.168.0.1.
-
-.. code-block:: none
-
-  set service dns forwarding domain example.com server 192.0.2.1
-  set service dns forwarding name-server 8.8.8.8
-  set service dns forwarding name-server 8.8.4.4
-  set service dns forwarding listen-address 192.168.0.1
-  set service dns forwarding allow-from 0.0.0.0/0
-
-Example 2
-^^^^^^^^^
-
-Same as example 1 but with additional IPv6 addresses for Google's public DNS
-servers.
-
-The IP addresses for the LAN interface are 192.168.0.1 and 2001:db8::1
-
-.. code-block:: none
-
-  set service dns forwarding domain example.com server 192.0.2.1
-  set service dns forwarding name-server 8.8.8.8
-  set service dns forwarding name-server 8.8.4.4
-  set service dns forwarding name-server 2001:4860:4860::8888
-  set service dns forwarding name-server 2001:4860:4860::8844
-  set service dns forwarding listen-address 2001:db8::1
-  set service dns forwarding listen-address 192.168.0.1 
-  set service dns forwarding allow-from 0.0.0.0/0
diff --git a/docs/services/dynamic-dns.rst b/docs/services/dynamic-dns.rst
deleted file mode 100644
index 6a3c6e28..00000000
--- a/docs/services/dynamic-dns.rst
+++ /dev/null
@@ -1,152 +0,0 @@
-Dynamic DNS
------------
-
-VyOS is able to update a remote DNS record when an interface gets a new IP
-address. In order to do so, VyOS includes ddclient_, a perl script written for
-this exact purpose.
-
-ddclient_ uses two methods to update a DNS record. The first one will send
-updates directly to the DNS daemon, in compliance with RFC2136_. The second
-one involves a third party service, like DynDNS.com or any other similar
-website. This method uses HTTP requests to transmit the new IP address. You
-can configure both in VyOS.
-
-VyOS CLI and RFC2136
-^^^^^^^^^^^^^^^^^^^^
-
-First, create an RFC2136_ config node :
-
-.. code-block:: none
-
-  edit service dns dynamic interface eth0 rfc2136 <confignodename>
-
-Present your RNDC key to ddclient :
-
-.. code-block:: none
-
-  set key /config/dyndns/mydnsserver.rndc.key
-
-Set the DNS server IP/FQDN :
-
-.. code-block:: none
-
-  set server dns.mydomain.com
-
-Set the NS zone to be updated :
-
-.. code-block:: none
-
-  set zone mydomain.com
-
-Set the records to be updated :
-
-.. code-block:: none
-
-  set record dyn
-  set record dyn2
-
-You can optionally set a TTL (note : default value is 600 seconds) :
-
-.. code-block:: none
-
-  set ttl 600
-
-This will generate the following ddclient config blocks:
-
-.. code-block:: none
-
-  server=dns.mydomain.com
-  protocol=nsupdate
-  password=/config/dyndns/mydnsserver.rndc.key
-  ttl=600
-  zone=mydomain.com
-  dyn
-  server=dns.mydomain.com
-  protocol=nsupdate
-  password=/config/dyndns/mydnsserver.rndc.key
-  ttl=600
-  zone=mydomain.com
-  dyn2
-
-You can also keep a different dns zone updated. Just create a new config node:
-
-.. code-block:: none
-
-  edit service dns dynamic interface eth0 rfc2136 <confignode2>
-
-VyOS CLI and HTTP dynamic DNS services
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-VyOS is also able to use any service relying on protocols supported
-by ddclient.
-
-To use such a service, you must define a login, a password, one or multiple
-hostnames, a protocol and a server.
-
-.. code-block:: none
-
-  edit service dns dynamic interface eth0 service HeNet
-  set login my-login # set password my-password
-  set host-name my-tunnel-id
-  set protocol dyndns2
-  set server ipv4.tunnelbroker.net
-
-VyOS is also shipped with a list of known services. You don't need to set the
-protocol and server value as VyOS has defaults provided for those. These are
-the services VyOS knows about:
-
-* afraid
-* changeip
-* dnspark
-* dslreports
-* dyndns
-* easydns
-* namecheap
-* noip
-* zoneedit
-
-To use DynDNS for example:
-
-.. code-block:: none
-
-  edit service dns dynamic interface eth0 service dyndns
-  set login my-login
-  set password my-password
-  set host-name my-dyndns-hostname
-
-It's possible to use multiple services :
-
-.. code-block:: none
-
-  edit service dns dynamic interface eth0 service dyndns
-  set login my-login
-  set password my-password
-  set host-name my-dyndns-hostname
-  edit service dns dynamic interface eth0 service HeNet
-  set login my-login
-  set password my-password
-  set host-name my-tunnel-id
-  set protocol dyndns2
-  set server ipv4.tunnelbroker.net
-
-ddclient behind NAT
-^^^^^^^^^^^^^^^^^^^
-
-By default, ddclient will update a dynamic dns record using the IP address
-directly attached to the interface. If your VyOS instance is behind NAT, your
-record will be updated to point to your internal IP.
-
-ddclient_ has another way to determine the WAN IP address. This is controlled
-by these two options:
-
-.. code-block:: none
-
-  set service dns dynamic interface eth0 use-web url
-  set service dns dynamic interface eth0 use-web skip
-
-ddclient_ will load the webpage at `[url]` and will try to extract an IP
-address for the response. ddclient_ will skip any address located before the
-string set in `[skip]`.
-
-
-.. include:: references.rst
diff --git a/docs/services/index.rst b/docs/services/index.rst
deleted file mode 100644
index dbfcfce2..00000000
--- a/docs/services/index.rst
+++ /dev/null
@@ -1,27 +0,0 @@
-.. _services:
-
-.. include:: references.rst
-
-Services
-========
-
-This chapter describes the available system/network services provided by VyOS.
-
-.. toctree::
-   :maxdepth: 1
-
-   conntrack
-   dhcp
-   dhcpv6
-   dhcp-relay
-   dns-forwarding
-   dynamic-dns
-   lldp
-   mdns-repeater
-   ipoe-server
-   pppoe-server
-   udp-broadcast-relay
-   snmp
-   ssh
-   tftp
-   webproxy
diff --git a/docs/services/ipoe-server.rst b/docs/services/ipoe-server.rst
deleted file mode 100644
index eed4cced..00000000
--- a/docs/services/ipoe-server.rst
+++ /dev/null
@@ -1,129 +0,0 @@
-IPoE server
-------------
-
-VyOS utilizes `accel-ppp`_ to provide IPoE server functionality. It can be
-used with local authentication (mac-address) or a connected RADIUS server.
-
-.. note:: **Please be aware, due to an upstream bug, config changes/commits
-   will restart the ppp daemon and will reset existing IPoE sessions,
-   in order to become effective.**
-
-Configuration
-^^^^^^^^^^^^^
-
-IPoE can be configure on different interfaces, it will depend on each specific situation which interface will provide IPoE to clients.
-The clients mac address and the incoming interface is being used as control parameter, to authenticate a client.
-
-The example configuration below will assign an IP to the client on the incoming interface eth2 with the client mac address 08:00:27:2f:d8:06.
-Other DHCP discovery requests will be ignored, unless the client mac has been enabled in the configuration.
-
-.. code-block:: none
-
-  set service ipoe-server authentication interface eth2 mac-address 08:00:27:2f:d8:06
-  set service ipoe-server authentication mode 'local'
-  set service ipoe-server dns-server server-1 '8.8.8.8'
-  set service ipoe-server dns-server server-2 '8.8.4.4'
-  set service ipoe-server interface eth2 client-subnet '192.168.0.0/24'
-
-
-The first address of the parameter ``client-subnet``, will be used as the default gateway. 
-Connected sessions can be checked via the ``show ipoe-server sessions`` command.
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ipoe-server sessions
-
-  ifname | called-sid |    calling-sid    |     ip      | ip6 | ip6-dp | rate-limit | state  |  uptime  |        sid
-  -------+------------+-------------------+-------------+-----+--------+------------+--------+----------+------------------
-  ipoe0  | eth2       | 08:00:27:2f:d8:06 | 192.168.0.2 |     |        |            | active | 00:45:05 | dccc870fd3134612
-
-
-IPv6 SLAAC and IA-PD
-====================
-
-To configure IPv6 assignments for clients, two options need to be configured. A global prefix which is terminated on the clients cpe and a delegated prefix, the client can use
-for devices routed via the clients cpe.
-
-IPv6 DNS addresses are optional.
-
-.. code-block:: none
-
-  set service ipoe-server authentication interface eth3 mac-address 08:00:27:2F:D8:06
-  set service ipoe-server authentication mode 'local'
-  set service ipoe-server client-ipv6-pool delegate-prefix '2001:db8:1::/48,56'
-  set service ipoe-server client-ipv6-pool prefix '2001:db8::/48,64'
-  set service ipoe-server dnsv6-server server-1 '2001:db8::'
-  set service ipoe-server dnsv6-server server-2 '2001:db8:aaa::'
-  set service ipoe-server dnsv6-server server-3 '2001:db8:bbb::'
-  set service ipoe-server interface eth3 client-subnet '192.168.1.0/24'
-
-.. code-block:: none
-
-  vyos@ipoe-server# run sh ipoe-server sessions 
-  ifname | called-sid |    calling-sid    |     ip      |               ip6               | ip6-dp          | rate-limit | state  |  uptime  |        sid       
-  -------+------------+-------------------+-------------+---------------------------------+-----------------+------------+--------+----------+------------------
-  ipoe0  | eth3       | 08:00:27:2f:d8:06 | 192.168.1.2 | 2001:db8::a00:27ff:fe2f:d806/64 | 2001:db8:1::/56 |            | active | 01:02:59 | 4626faf71b12cc25  
-
-
-The clients cpe can now communicate via IPv4 or IPv6. All devices behind ``2001:db8::a00:27ff:fe2f:d806/64`` can use addresses from ``2001:db8:1::/56`` and can
-globally communicate without the need of any NAT rules.
-
-
-Automatic VLAN creation
-=======================
-
-To create VLANs per user during runtime, the following settings are required on a per interface basis. VLAN ID and VLAN range can be present in the configuration at the same time.
-
-.. code-block:: none
-
-  set service ipoe-server interface eth2 network vlan
-  set service ipoe-server interface eth2 vlan-id 100
-  set service ipoe-server interface eth2 vlan-id 200
-  set service ipoe-server interface eth2 vlan-range 1000-2000
-  set service ipoe-server interface eth2 vlan-range 2500-2700
-
-
-RADIUS Setup
-^^^^^^^^^^^^
-
-To use a RADIUS server for authentication and bandwidth-shaping, the following example configuration can be used.
-
-.. code-block:: none
-
-  set service ipoe-server authentication mode 'radius'
-  set service ipoe-server authentication radius-server 10.100.100.1 secret 'password'
-
-
-Bandwidth Shaping
-^^^^^^^^^^^^^^^^^
-
-Bandwidth rate limits can be set for local users within the configuration or via RADIUS based attributes.
-
-
-Bandwidth Shaping for local users 
-=================================
-
-The rate-limit is set in kbit/sec.
-
-.. code-block:: none
-
-  set service ipoe-server authentication interface eth2 mac-address 08:00:27:2f:d8:06 rate-limit download '500'
-  set service ipoe-server authentication interface eth2 mac-address 08:00:27:2f:d8:06 rate-limit upload '500'
-  set service ipoe-server authentication mode 'local'
-  set service ipoe-server dns-server server-1 '8.8.8.8'
-  set service ipoe-server dns-server server-2 '8.8.4.4'
-  set service ipoe-server interface eth2 client-subnet '192.168.0.0/24'
-
-
-.. code-block:: none
-
-  vyos@vyos# run show ipoe-server sessions 
-
-  ifname | called-sid |    calling-sid    |     ip      | ip6 | ip6-dp | rate-limit | state  |  uptime  |        sid       
-  -------+------------+-------------------+-------------+-----+--------+------------+--------+----------+------------------
-  ipoe0  | eth2       | 08:00:27:2f:d8:06 | 192.168.0.2 |     |        | 500/500    | active | 00:00:05 | dccc870fd31349fb
-
-
-
-
-.. _`accel-ppp`: https://accel-ppp.org/
diff --git a/docs/services/lldp.rst b/docs/services/lldp.rst
deleted file mode 100644
index dccd68fa..00000000
--- a/docs/services/lldp.rst
+++ /dev/null
@@ -1,97 +0,0 @@
-LLDP
-----
-
-The Link Layer Discovery Protocol (LLDP) is a vendor-neutral
-link layer protocol in the Internet Protocol Suite used by network devices for
-advertising their identity, capabilities, and neighbors on an IEEE 802 local
-area network, principally wired Ethernet.[1] The protocol is formally referred
-to by the IEEE as Station and Media Access Control Connectivity Discovery
-specified in IEEE 802.1AB and IEEE 802.3-2012 section 6 clause 79.
-
-LLDP performs functions similar to several proprietary protocols, such as
-`Cisco Discovery Protocol`_, `Foundry Discovery Protocol`_,
-Nortel Discovery Protocol and Link Layer Topology Discovery.
-
-Information gathered
-^^^^^^^^^^^^^^^^^^^^
-
-Information gathered with LLDP is stored in the device as a management
-information database (MIB_) and can be queried with the Simple Network
-Management Protocol (SNMP_) as specified in RFC 2922. The topology of an
-LLDP-enabled network can be discovered by crawling the hosts and querying this
-database. Information that may be retrieved include:
-
-* System name and description
-* Port name and description
-* VLAN name
-* IP management address
-* System capabilities (switching, routing, etc.)
-* MAC/PHY information
-* MDI power
-* Link aggregation
-
-Configuration
-^^^^^^^^^^^^^
-
-* Enable service with:
-
-  :code:`set service lldp`
-
-Options
-*******
-
-* Configure a Define management-address:
-
-  :code:`set service lldp management-address <x.x.x.x>`
-
-* Define listening interfaces
-
-  :code:`set service lldp interface <all|interface name>`
-
-* LLDPd also implements an SNMP subagent. To Enable SNMP queries of the LLDP
-  database:
-
-  :code:`set service lldp snmp enable`
-
-* Enable optional/other protocols
-
-  :code:`set service lldp legacy-protocols cdp`
-
-  Supported legacy protocols:
-
- * ``cdp`` - Listen for CDP for Cisco routers/switches
- * ``edp`` - Listen for EDP for Extreme routers/switches
- * ``fdp`` - Listen for FDP for Foundry routers/switches
- * ``sonmp`` - Listen for SONMP for Nortel routers/switches
-
-
-Display neighbors
-^^^^^^^^^^^^^^^^^
-
-* Display with:
-
-``show lldp neighbors``
-
-Exemple:
-
-.. code-block:: none
-
-  vyos@vyos:~# show lldp neighbors
-  Capability Codes: R - Router, B - Bridge, W - Wlan r - Repeater, S - Station
-                   D - Docsis, T - Telephone, O - Other
-  Device ID                 Local  Proto  Cap   Platform             Port ID
-  ---------                 -----  -----  ---   --------             -------
-  swA309                    eth0   LLDP   ?     Cisco IOS Software,  GigE0/33
-
-
-* Options:
-
- * ``detail`` - Show lldp neighbors detail
- * ``interface`` - Show LLDP for specified interface
-
-Troubleshooting
-^^^^^^^^^^^^^^^
-
-Use operational command ``show log lldp`` to display logs.
-
-.. include:: references.rst
diff --git a/docs/services/mdns-repeater.rst b/docs/services/mdns-repeater.rst
deleted file mode 100644
index 22e824ba..00000000
--- a/docs/services/mdns-repeater.rst
+++ /dev/null
@@ -1,30 +0,0 @@
-mDNS Repeater
--------------
-
-Starting with VyOS 1.2 a `Multicast DNS`_ (mDNS) repeater functionality is
-provided.
-
-Multicast DNS uses the 224.0.0.51 address, which is "administratively scoped"
-and does not leave the subnet. It re-broadcast mDNS packets from one interface
-to other interfaces. This enables support for e.g. Apple Airplay devices across
-multiple VLANs.
-
-To enable mDNS repeater you need to configure at least two interfaces. To re-
-broadcast all mDNS packets from `eth0` to `eth1` and vice versa run:
-
-.. code-block:: none
-
-  set service mdns repeater interface eth0
-  set service mdns repeater interface eth1
-
-mDNS repeater can be temporarily disabled without deleting the service using
-
-.. code-block:: none
-
-  set service mdns repeater disable
-
-.. note:: You can not run this in a VRRP setup, if multiple mDNS repeaters
-   are launched in a subnet you will experience the mDNS packet storm death!
-
-
-.. _`Multicast DNS`: https://en.wikipedia.org/wiki/Multicast_DNS
diff --git a/docs/services/pppoe-server.rst b/docs/services/pppoe-server.rst
deleted file mode 100644
index 8e37a068..00000000
--- a/docs/services/pppoe-server.rst
+++ /dev/null
@@ -1,217 +0,0 @@
-PPPoE server
-------------
-
-VyOS utilizes `accel-ppp`_ to provide PPPoE server functionality. It can be
-used with local authentication or a connected RADIUS server.
-
-.. note:: **Please be aware, due to an upstream bug, config changes/commits
-   will restart the ppp daemon and will reset existing PPPoE connections from
-   connected users, in order to become effective.**
-
-Configuration
-^^^^^^^^^^^^^
-
-The example below uses ACN as access-concentrator name, assigns an address
-from the pool 10.1.1.100-111, terminates at the local endpoint 10.1.1.1 and
-serves requests only on eth1.
-
-.. code-block:: none
-
-  set service pppoe-server access-concentrator 'ACN'
-  set service pppoe-server authentication local-users username foo password 'bar'
-  set service pppoe-server authentication mode 'local'
-  set service pppoe-server client-ip-pool start '10.1.1.100'
-  set service pppoe-server client-ip-pool stop '10.1.1.111'
-  set service pppoe-server dns-servers server-1 '10.100.100.1'
-  set service pppoe-server dns-servers server-2 '10.100.200.1'
-  set service pppoe-server interface 'eth1'
-  set service pppoe-server local-ip '10.1.1.2'
-
-
-Connections can be locally checked via the command
-
-.. code-block:: none
-
-  show pppoe-server sessions
-  ifname | username |     ip     |    calling-sid    | rate-limit  | state  |  uptime  | rx-bytes | tx-bytes 
-  -------+----------+------------+-------------------+-------------+--------+----------+----------+----------
-  ppp0   | foo      | 10.1.1.100 | 08:00:27:ba:db:15 | 20480/10240 | active | 00:00:11 | 214 B    | 76 B     
-
-
-Client IP address pools
-=======================
-
-To automatically assign the client an IP address as tunnel endpoint, a client IP pool is needed. The source can be either RADIUS or a local subnet or IP range definition.
-
-Once the local tunnel endpoint ``set service pppoe-server local-ip '10.1.1.2'`` has been defined, the client IP pool can be either defined as a range or as subnet using CIDR notation.
-If the CIDR notation is used, multiple subnets can be setup which are used sequentially.
-
-**Client IP address via IP range definition**
-
-.. code-block:: none
-
-  set service pppoe-server client-ip-pool start '10.1.1.100'
-  set service pppoe-server client-ip-pool stop '10.1.1.111'
-
-
-**Client IP subnets via CIDR notation**
-
-.. code-block:: none
-
-  set service pppoe-server client-ip-pool subnet '10.1.1.0/24'
-  set service pppoe-server client-ip-pool subnet '10.1.2.0/24'
-  set service pppoe-server client-ip-pool subnet '10.1.3.0/24'
-
-
-
-**RADIUS based IP pools (Framed-IP-Address)**
-
-To use a radius server, you need to switch to authentication mode radius and
-of course need to specify an IP for the server. You can have multiple RADIUS
-server configured, if you wish to achieve redundancy.
-
-.. code-block:: none
-
-  set service pppoe-server access-concentrator 'ACN'
-  set service pppoe-server authentication mode 'radius'
-  set service pppoe-server authentication radius-server 10.1.100.1 secret 'secret'
-  set service pppoe-server interface 'eth1'
-  set service pppoe-server local-ip '10.1.1.2'
-
-RADIUS provides the IP addresses in the example above via Framed-IP-Address.
-
-**RADIUS sessions management DM/CoA**
-
-For remotely disconnect sessions and change some authentication parameters you can configure dae-server
-
-.. code-block:: none
-
-  set service pppoe-server authentication radius-settings dae-server ip-address '10.1.1.2'
-  set service pppoe-server authentication radius-settings dae-server port '3799'
-  set service pppoe-server authentication radius-settings dae-server secret 'secret123'
-
-Example, from radius-server send command for disconnect client with username test
-
-.. code-block:: none
-
-  root@radius-server:~# echo "User-Name=test" | radclient -x 10.1.1.2:3799 disconnect secret123
-  
-You can also use another attributes for identify client for disconnect, like Framed-IP-Address, Acct-Session-Id, etc.
-Result commands appears in log
-
-.. code-block:: none
-
-  show log | match Disconnect*
-
-Example for changing rate-limit via RADIUS CoA
-
-.. code-block:: none
-
-  echo "User-Name=test,Filter-Id=5000/4000" | radclient 10.1.1.2:3799 coa secret123
-
-Filter-Id=5000/4000 (means 5000Kbit down-stream rate and 4000Kbit up-stream rate)
-If attribute Filter-Id redefined, replace it in radius coa request
-
-
-Automatic VLAN creation
-=======================
-
-VLAN's can be created by accel-ppp on the fly if via the use of the kernel module vlan_mon, which is monitoring incoming vlans and creates the necessary VLAN if required and allowed.
-VyOS supports the use of either VLAN ID's or entire ranges, both values can be defined at the same time for an interface.
-
-.. code-block:: none
-
-  set service pppoe-server interface eth3 vlan-id 100
-  set service pppoe-server interface eth3 vlan-id 200
-  set service pppoe-server interface eth3 vlan-range 500-1000
-  set service pppoe-server interface eth3 vlan-range 2000-3000
-
-
-The pppoe-server will now create these VLANs if required and once the user session has been cancelled, and the VLAN is not necessary anymore, it will remove it again.
-
-
-
-Bandwidth Shaping
-^^^^^^^^^^^^^^^^^
-
-Bandwidth rate limits can be set for local users or RADIUS based attributes.
-
-Bandwidth Shaping for local users 
-=================================
-
-The rate-limit is set in kbit/sec.
-
-.. code-block:: none
-
-  set service pppoe-server access-concentrator 'ACN'
-  set service pppoe-server authentication local-users username foo password 'bar'
-  set service pppoe-server authentication local-users username foo rate-limit download '20480'
-  set service pppoe-server authentication local-users username foo rate-limit upload '10240'
-  set service pppoe-server authentication mode 'local'
-  set service pppoe-server client-ip-pool start '10.1.1.100'
-  set service pppoe-server client-ip-pool stop '10.1.1.111'
-  set service pppoe-server dns-servers server-1 '10.100.100.1'
-  set service pppoe-server dns-servers server-2 '10.100.200.1'
-  set service pppoe-server interface 'eth1'
-  set service pppoe-server local-ip '10.1.1.2'
-
-
-Once the user is connected, the user session is using the set limits and can be displayed via 'show pppoe-server sessions'.
-
-.. code-block:: none
-
-  show pppoe-server sessions
-  ifname | username |     ip     |    calling-sid    | rate-limit  | state  |  uptime  | rx-bytes | tx-bytes
-  -------+----------+------------+-------------------+-------------+--------+----------+----------+----------
-  ppp0   | foo      | 10.1.1.100 | 08:00:27:ba:db:15 | 20480/10240 | active | 00:00:11 | 214 B    | 76 B
-
-
-RADIUS based shaper setup
-=========================
-
-The current attribute 'Filter-Id' is being used as default and can be setup within RADIUS:
-
-Filter-Id=2000/3000 (means 2000Kbit down-stream rate and 3000Kbit up-stream rate)
-
-The command below enables it, assuming the RADIUS connection has been setup and is working.
-
-.. code-block:: none
-
-  set service pppoe-server authentication radius-settings rate-limit enable
-
-Other attributes can be used, but they have to be in one of the dictionaries in /usr/share/accel-ppp/radius.
-
-
-
-Practical Configuration Examples
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Dual-stack provisioning with IPv6 PD via pppoe
-==============================================
-
-The example below covers a dual-stack configuration via pppoe-server.
-
-.. code-block:: none
-
-  set service pppoe-server authentication local-users username test password 'test'
-  set service pppoe-server authentication mode 'local'
-  set service pppoe-server client-ip-pool start '192.168.0.1'
-  set service pppoe-server client-ip-pool stop '192.168.0.10'
-  set service pppoe-server client-ipv6-pool delegate-prefix '2001:db8:8003::1/48,56'
-  set service pppoe-server client-ipv6-pool prefix '2001:db8:8002::1/48,64'
-  set service pppoe-server dns-servers server-1 '8.8.8.8'
-  set service pppoe-server dnsv6-servers server-1 '2001:4860:4860::8888'
-  set service pppoe-server interface 'eth2'
-  set service pppoe-server local-ip '10.100.100.1'
-
-
-The client, once successfully authenticated, will receive an IPv4 and an IPv6 /64 address, to terminate the pppoe endpoint on the client side and a /56 subnet for the clients internal use.
-
-.. code-block:: none
-
-  vyos@pppoe-server:~$ sh pppoe-server sessions 
-   ifname | username |     ip      |            ip6           |       ip6-dp        |    calling-sid    | rate-limit | state  |  uptime  | rx-bytes | tx-bytes 
-  --------+----------+-------------+--------------------------+---------------------+-------------------+------------+--------+----------+----------+----------
-   ppp0   | test     | 192.168.0.1 | 2001:db8:8002:0:200::/64 | 2001:db8:8003::1/56 | 08:00:27:12:42:eb |            | active | 00:00:49 | 875 B    | 2.1 KiB
-
-.. _`accel-ppp`: https://accel-ppp.org/
diff --git a/docs/services/references.rst b/docs/services/references.rst
deleted file mode 100644
index bee936d7..00000000
--- a/docs/services/references.rst
+++ /dev/null
@@ -1,15 +0,0 @@
-.. _`Cisco Discovery Protocol`: https://en.wikipedia.org/wiki/Cisco_Discovery_Protocol
-.. _ddclient: http://github.com/ddclient/ddclient
-.. _`Foundry Discovery Protocol`: https://en.wikipedia.org/wiki/Foundry_Discovery_Protocol
-.. _MIB: https://en.wikipedia.org/wiki/Management_information_base
-.. _RFC2136: https://www.ietf.org/rfc/rfc2136.txt
-.. _SNMP: https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
-.. _SNMPv2: https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol#Version_2
-.. _SNMPv3: https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol#Version_3
-.. _SSH: https://en.wikipedia.org/wiki/Secure_Shell
-.. _Squid3: http://www.squid-cache.org/
-.. _Squidguard: http://www.squidguard.org/
-.. _TFTP: https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol
-.. _`arbitrary extension commands`: http://net-snmp.sourceforge.net/docs/man/snmpd.conf.html#lbAZ
-.. _`accel-ppp`: https://accel-ppp.org/
-.. _`Secure Socket Tunneling Protocol`: https://en.wikipedia.org/wiki/Secure_Socket_Tunneling_Protocol
diff --git a/docs/services/snmp.rst b/docs/services/snmp.rst
deleted file mode 100644
index 6418a516..00000000
--- a/docs/services/snmp.rst
+++ /dev/null
@@ -1,245 +0,0 @@
-SNMP
-----
-
-Simple Network Management Protocol (SNMP_) is an Internet Standard protocol
-for collecting and organizing information about managed devices on IP networks
-and for modifying that information to change device behavior. Devices that
-typically support SNMP include cable modems, routers, switches, servers,
-workstations, printers, and more.
-
-SNMP is widely used in network management for network monitoring. SNMP exposes
-management data in the form of variables on the managed systems organized in
-a management information base (MIB_) which describe the system status and
-configuration. These variables can then be remotely queried (and, in some
-circumstances, manipulated) by managing applications.
-
-Three significant versions of SNMP have been developed and deployed. SNMPv1 is
-the original version of the protocol. More recent versions, SNMPv2c and SNMPv3,
-feature improvements in performance, flexibility and security.
-
-SNMP is a component of the Internet Protocol Suite as defined by the Internet
-Engineering Task Force (IETF). It consists of a set of standards for network
-management, including an application layer protocol, a database schema, and a
-set of data objects.
-
-Overview and basic concepts
-^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-In typical uses of SNMP, one or more administrative computers called managers
-have the task of monitoring or managing a group of hosts or devices on a
-computer network. Each managed system executes a software component called an
-agent which reports information via SNMP to the manager.
-
-An SNMP-managed network consists of three key components:
-
-* Managed devices
-* Agent - software which runs on managed devices
-* Network management station (NMS) - software which runs on the manager
-
-A managed device is a network node that implements an SNMP interface that
-allows unidirectional (read-only) or bidirectional (read and write) access to
-node-specific information. Managed devices exchange node-specific information
-with the NMSs. Sometimes called network elements, the managed devices can be
-any type of device, including, but not limited to, routers, access servers,
-switches, cable modems, bridges, hubs, IP telephones, IP video cameras,
-computer hosts, and printers.
-
-An agent is a network-management software module that resides on a managed
-device. An agent has local knowledge of management information and translates
-that information to or from an SNMP-specific form.
-
-A network management station executes applications that monitor and control
-managed devices. NMSs provide the bulk of the processing and memory resources
-required for network management. One or more NMSs may exist on any managed
-network.
-
-.. figure:: /_static/images/service_snmp_communication_principles_diagram.png
-   :scale: 20 %
-   :alt: Principle of SNMP Communication
-
-   Image thankfully borrowed from
-   https://en.wikipedia.org/wiki/File:SNMP_communication_principles_diagram.PNG
-   which is under the GNU Free Documentation License
-
-.. note:: VyOS SNMP supports both IPv4 and IPv6.
-
-SNMP protocol versions
-^^^^^^^^^^^^^^^^^^^^^^
-
-VyOS itself supports SNMPv2_ (version 2) and SNMPv3_ (version 3) where the
-later is recommended because of improved security (optional authentication and
-encryption).
-
-SNMPv2
-^^^^^^
-
-SNMPv2 is the original and most commonly used version. For authorizing clients,
-SNMP uses the concept of communities. Communities may have authorization set
-to read only (this is most common) or to read and write (this option is not
-actively used in VyOS).
-
-SNMP can work synchronously or asynchronously. In synchronous communication,
-the monitoring system queries the router periodically. In asynchronous, the
-router sends notification to the "trap" (the monitoring host).
-
-SNMPv2 does not support any authentication mechanisms, other than client source
-address, so you should specify addresses of clients allowed to monitor the
-router. Note that SNMPv2 also supports no encryption and always sends data in
-plain text.
-
-Example
-*******
-
-.. code-block:: none
-
-  # Define a community
-  set service snmp community routers authorization ro
-
-  # Allow monitoring access from the entire network
-  set service snmp community routers network 192.0.2.0/24
-  set service snmp community routers network 2001::db8:ffff:eeee::/64
-
-  # Allow monitoring access from specific addresses
-  set service snmp community routers client 203.0.113.10
-  set service snmp community routers client 203.0.113.20
-
-  # Define optional router information
-  set service snmp location "UK, London"
-  set service snmp contact "admin@example.com"
-
-  # Trap target if you want asynchronous communication
-  set service snmp trap-target 203.0.113.10
-
-  # Listen only on specific IP addresses (port defaults to 161)
-  set service snmp listen-address 172.16.254.36 port 161
-  set service snmp listen-address 2001:db8::f00::1
-
-
-SNMPv3
-^^^^^^
-
-SNMPv3 (version 3 of the SNMP protocol) introduced a whole slew of new security
-related features that have been missing from the previous versions. Security
-was one of the biggest weakness of SNMP until v3. Authentication in SNMP
-Versions 1 and 2 amounts to nothing more than a password (community string)
-sent in clear text between a manager and agent. Each SNMPv3 message contains
-security parameters which are encoded as an octet string. The meaning of these
-security parameters depends on the security model being used.
-
-The securityapproach in v3 targets:
-
-* Confidentiality – Encryption of packets to prevent snooping by an
-  unauthorized source.
-
-* Integrity – Message integrity to ensure that a packet has not been tampered
-  while in transit including an optional packet replay protection mechanism.
-
-* Authentication – to verify that the message is from a valid source.
-
-Example
-*******
-
-.. code-block:: none
-
-  set service snmp v3 engineid '0x0aa0d6c6f450'
-  set service snmp v3 group defaultgroup mode 'ro'
-  set service snmp v3 group defaultgroup seclevel 'priv'
-  set service snmp v3 group defaultgroup view 'defaultview'
-  set service snmp v3 view defaultview oid '1'
-
-  set service snmp v3 user testUser1 auth plaintext-key testUserKey1
-  set service snmp v3 user testUser1 auth type 'md5'
-  set service snmp v3 user testUser1 engineid '0x0aa0d6c6f450'
-  set service snmp v3 user testUser1 group 'defaultgroup'
-  set service snmp v3 user testUser1 mode 'ro'
-  set service snmp v3 user testUser1 privacy type aes
-  set service snmp v3 user testUser1 privacy plaintext-key testUserKey1
-
-After commit the resulting configuration will look like:
-
-.. note:: SNMPv3 keys won't we stored in plaintext. On ``commit`` the keys
-   will be encrypted and the encrypted key is based on the engineid!
-
-.. code-block:: none
-
-  vyos@vyos# show service snmp
-   v3 {
-       engineid 0x0aa0d6c6f450
-       group defaultgroup {
-           mode ro
-           seclevel priv
-           view defaultview
-       }
-       user testUser1 {
-           auth {
-               encrypted-key 0x3b68d4162c2c817b8e9dfb6f08583e5d
-               type md5
-           }
-           engineid 0x0aa0d6c6f450
-           group defaultgroup
-           mode ro
-           privacy {
-               encrypted-key 0x3b68d4162c2c817b8e9dfb6f08583e5d
-               type aes
-           }
-       }
-       view defaultview {
-           oid 1 {
-           }
-       }
-   }
-
-SNMP Extensions
-^^^^^^^^^^^^^^^
-
-To extend SNMP agent functionality, custom scripts can be executed every time
-the agent is being called. This can be achieved by using ``arbitrary extension
-commands``_. The first step is to create a functional script of course, then
-upload it to your VyOS instance via the command ``scp your_script.sh
-vyos@your_router:/config/user-data``. Once the script is uploaded, it needs to
-be configured via the command below.
-
-
-.. code-block:: none
-
-  set service snmp script-extensions extension-name my-extension script your_script.sh
-  commit
-
-
-The OID ``.1.3.6.1.4.1.8072.1.3.2.3.1.1.4.116.101.115.116``, once called, will
-contain the output of the extension.
-
-.. code-block:: none
-
-  root@vyos:/home/vyos# snmpwalk -v2c  -c public 127.0.0.1 nsExtendOutput1
-  NET-SNMP-EXTEND-MIB::nsExtendOutput1Line."my-extension" = STRING: hello
-  NET-SNMP-EXTEND-MIB::nsExtendOutputFull."my-extension" = STRING: hello
-  NET-SNMP-EXTEND-MIB::nsExtendOutNumLines."my-extension" = INTEGER: 1
-  NET-SNMP-EXTEND-MIB::nsExtendResult."my-extension" = INTEGER: 0
-
-SolarWinds
-^^^^^^^^^^
-
-If you happen to use SolarWinds Orion as NMS you can also use the Device
-Templates Management. A template for VyOS can be easily imported.
-
-Create a file named ``VyOS-1.3.6.1.4.1.44641.ConfigMgmt-Commands`` using the
-following content:
-
-.. code-block:: none
-
-  <Configuration-Management Device="VyOS" SystemOID="1.3.6.1.4.1.44641">
-      <Commands>
-          <Command Name="Reset" Value="set terminal width 0${CRLF}set terminal length 0"/>
-          <Command Name="Reboot" Value="reboot${CRLF}Yes"/>
-          <Command Name="EnterConfigMode" Value="configure"/>
-          <Command Name="ExitConfigMode" Value="commit${CRLF}exit"/>
-          <Command Name="DownloadConfig" Value="show configuration commands"/>
-          <Command Name="SaveConfig" Value="commit${CRLF}save"/>
-          <Command Name="Version" Value="show version"/>
-          <Command Name="MenuBased" Value="False"/>
-          <Command Name="VirtualPrompt" Value=":~"/>
-      </Commands>
-  </Configuration-Management>
-
-.. include:: references.rst
diff --git a/docs/services/ssh.rst b/docs/services/ssh.rst
deleted file mode 100644
index 3af71899..00000000
--- a/docs/services/ssh.rst
+++ /dev/null
@@ -1,150 +0,0 @@
-SSH
----
-
-Secure Shell (SSH_) is a cryptographic network protocol for operating network
-services securely over an unsecured network.[1] The standard TCP port for SSH
-is 22. The best known example application is for remote login to computer
-systems by users.
-
-SSH provides a secure channel over an unsecured network in a client-server
-architecture, connecting an SSH client application with an SSH server. Common
-applications include remote command-line login and remote command execution,
-but any network service can be secured with SSH. The protocol specification
-distinguishes between two major versions, referred to as SSH-1 and SSH-2.
-
-The most visible application of the protocol is for access to shell accounts
-on Unix-like operating systems, but it sees some limited use on Windows as
-well. In 2015, Microsoft announced that they would include native support for
-SSH in a future release.
-
-SSH was designed as a replacement for Telnet and for unsecured remote shell
-protocols such as the Berkeley rlogin, rsh, and rexec protocols.
-Those protocols send information, notably passwords, in plaintext,
-rendering them susceptible to interception and disclosure using packet
-analysis. The encryption used by SSH is intended to provide confidentiality
-and integrity of data over an unsecured network, such as the Internet.
-
-Configuration
-^^^^^^^^^^^^^
-
-Enabling SSH only requires you to add ``service ssh port NN``, where 'NN' is
-the port you want SSH to listen on. By default, SSH runs on port 22.
-
-.. code-block:: none
-
-  set service ssh port 22
-
-Options
-*******
-
-* Listening address - Specify the IPv4/IPv6 listening address for connection
-  requests. Multiple ``listen-address`` nodes can be defined.
-
-  :code:`set service ssh listen-address <address>`
-
-* Allow ``root`` login, this can be set to allow ``root`` logins on SSH
-  connections, however it is not advisable to use this setting as this bears
-  serious security risks. The default system user possesses all required
-  privileges.
-
-  :code:`set service ssh allow-root`
-
-* Allowed ciphers - A number of allowed ciphers can be specified, use multiple
-  occurrences to allow multiple ciphers.
-
-  :code:`set service ssh ciphers <cipher>`
-
-  Available ciphers:
-
- * `3des-cbc`
- * `aes128-cbc`
- * `aes192-cbc`
- * `aes256-cbc`
- * `aes128-ctr`
- * `aes192-ctr`
- * `aes256-ctr`
- * `arcfour128`
- * `arcfour256`
- * `arcfour`
- * `blowfish-cbc`
- * `cast128-cbc`
-
-* Disable password authentication - If SSH key authentication is set up,
-  password-based user authentication can be disabled. This hardens security!
-
-  :code:`set service ssh disable-password-authentication`
-
-* Disable host validation - Disable the host validation through reverse DNS
-  lookups.
-
-  :code:`set service ssh disable-host-validation`
-
-* MAC algorithms - Specifies the available MAC (message authentication code)
-  algorithms. The MAC algorithm is used in protocol version 2 for data
-  integrity protection. Multiple algorithms can be entered.
-
-  :code:`set service ssh macs <macs>`
-
-  Supported MACs:
-
- * `hmac-md5`
- * `hmac-md5-96`
- * `hmac-ripemd160`
- * `hmac-sha1`
- * `hmac-sha1-96`
- * `hmac-sha2-256`
- * `hmac-sha2-512`
- * `umac-64@openssh.com`
- * `umac-128@openssh.com`
- * `hmac-md5-etm@openssh.com`
- * `hmac-md5-96-etm@openssh.com`
- * `hmac-ripemd160-etm@openssh.com`
- * `hmac-sha1-etm@openssh.com`
- * `hmac-sha1-96-etm@openssh.com`
- * `hmac-sha2-256-etm@openssh.com`
- * `hmac-sha2-512-etm@openssh.com`
- * `umac-64-etm@openssh.com`
- * `umac-128-etm@openssh.com`
-
-
-Key Authentication
-##################
-
-It is highly recommended to use SSH Key authentication. By default there is
-only one user (``vyos``), and you can assign any number of keys to that user.
-You can generate a ssh key with the ``ssh-keygen`` command on your local
-machine, which will (by default) save it as ``~/.ssh/id_rsa.pub`` which is in
-three parts:
-
- ``ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAA...VByBD5lKwEWB username@host.example.com``
-
-Only the type (``ssh-rsa``) and the key (``AAAB3N...``) are used. Note that
-the key will usually be several hundred characters long, and you will need to
-copy and paste it. Some terminal emulators may accidentally split this over
-several lines. Be attentive when you paste it that it only pastes as a single
-line. The third part is simply an identifier, and is for your own reference.
-
-
-**Assign SSH Key to user**
-
-Under the user (in this example, ``vyos``), add the public key and the type.
-The `identifier` is simply a string that is relevant to you.
-
-.. code-block:: none
-
-  set system login user vyos authentication public-keys 'identifier' key "AAAAB3Nz...."
-  set system login user vyos authentication public-keys 'identifier' type ssh-rsa"
-
-You can assign multiple keys to the same user by changing the identifier. In
-the following example, both Unicron and xrobau will be able to SSH into VyOS
-as the ``vyos`` user using their own keys.
-
-.. code-block:: none
-
-  set system login user vyos authentication public-keys 'Unicron' key "AAAAB3Nz...."
-  set system login user vyos authentication public-keys 'Unicron' type ssh-rsa
-  set system login user vyos authentication public-keys 'xrobau' key "AAAAQ39x...."
-  set system login user vyos authentication public-keys 'xrobau' type ssh-rsa
-
-
-
diff --git a/docs/services/tftp.rst b/docs/services/tftp.rst
deleted file mode 100644
index 9ce46b02..00000000
--- a/docs/services/tftp.rst
+++ /dev/null
@@ -1,42 +0,0 @@
-TFTP
-----
-
-Trivial File Transfer Protocol (TFTP_) is a simple lockstep File Transfer
-Protocol which allows a client to get a file from or put a file onto a remote
-host. One of its primary uses is in the early stages of nodes booting from a
-local area network. TFTP has been used for this application because it is very
-simple to implement.
-
-Example
-^^^^^^^
-
-.. code-block:: none
-
-  # If you want to enable uploads, else TFTP server will act as read-only (optional)
-  set service tftp-server allow-upload
-
-  # Directory for TFTP server content
-  set service tftp-server directory '/config/tftpboot'
-
-  # On which addresses we want to listen for incoming TFTP connections? (mandatory)
-  set service tftp-server listen-address '2001:db8:ffee::1'
-  set service tftp-server listen-address '10.10.1.1'
-
-.. note:: Choose your ``directory`` location carefully or you will loose the
-   content on image upgrades. Any directory under ``/config`` is save at this
-   will be migrated.
-
-.. note:: Configuring a listen-address is essential for the service to work.
-
-The resulting configuration will look like:
-
-.. code-block:: none
-
-  vyos@vyos# show service
-   tftp-server {
-      allow-upload
-      directory /config/tftpboot
-      listen-address 2001:db8:ffee::1
-      listen-address 10.10.1.1
-   }
-
diff --git a/docs/services/udp-broadcast-relay.rst b/docs/services/udp-broadcast-relay.rst
deleted file mode 100644
index 40f738e6..00000000
--- a/docs/services/udp-broadcast-relay.rst
+++ /dev/null
@@ -1,53 +0,0 @@
-UDP broadcast relay
--------------------
-
-Certain vendors use broadcasts to identify their equipemnt within one ethernet
-segment. Unfortunately if you split your network with multiple VLANs you loose
-the ability of identifying your equiment.
-
-This is where "UDP broadcast relay" comes into play! It will forward received
-broadcasts to other configured networks.
-
-Every UDP port which will be forward requires one unique ID. Currently we
-support 99 IDs!
-
-Example #1: To forward all broadcast packets received on `UDP port 1900` on
-`eth3`, `eth4` or `eth5` to all other interfaces in this configuration.
-
-.. code-block:: none
-
-  set service broadcast-relay id 1 description 'SONOS'
-  set service broadcast-relay id 1 interface 'eth3'
-  set service broadcast-relay id 1 interface 'eth4'
-  set service broadcast-relay id 1 interface 'eth5'
-  set service broadcast-relay id 1 port '1900'
-
-Example #2: To Forward all broadcasts packets received on `UDP port 6969` on
-`eth3` or `eth4` to the other interface in this configuration.
-
-.. code-block:: none
-
-  set service broadcast-relay id 2 description 'SONOS MGMT'
-  set service broadcast-relay id 2 interface 'eth3'
-  set service broadcast-relay id 2 interface 'eth4'
-  set service broadcast-relay id 2 port '6969'
-
-Disable Instance(s)
-^^^^^^^^^^^^^^^^^^^
-
-Each broadcast relay instance can be individually disabled without deleting the
-configured node by using the following command:
-
-.. code-block:: none
-
-  set service broadcast-relay id <n> disable
-
-In addition you can also disable the whole service without removing the
-configuration by:
-
-.. code-block:: none
-
-  set service broadcast-relay disable
-
-.. note:: You can run the UDP broadcast relay service on multiple routers
-   connected to a subnet. There is **NO** UDP broadcast relay packet storm!
diff --git a/docs/services/webproxy.rst b/docs/services/webproxy.rst
deleted file mode 100644
index 61546cda..00000000
--- a/docs/services/webproxy.rst
+++ /dev/null
@@ -1,152 +0,0 @@
-Webproxy
---------
-
-The proxy service in VyOS is based on Squid3 and some related modules.
-
-Squid is a caching and forwarding HTTP web proxy. It has a wide variety of
-uses, including speeding up a web server by caching repeated requests,
-caching web, DNS and other computer network lookups for a group of people
-sharing network resources, and aiding security by filtering traffic. Although
-primarily used for HTTP and FTP, Squid includes limited support for several
-other protocols including Internet Gopher, SSL,[6] TLS and HTTPS. Squid does
-not support the SOCKS protocol.
-
-All examples here assumes that your inside ip address is ``192.168.0.1``.
-Replace with your own where applicable.
-
-URL Filtering is provided by Squidguard_.
-
-Configuration
-^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  # Enable proxy service
-  set service webproxy listen-address 192.168.0.1
-
-  # By default it will listen to port 3128. If you wan't something else you have to define that.
-  set service webproxy listen-address 192.168.0.1 port 2050
-
-  # By default the transparent proxy on that interface is enabled. To disable that you simply
-  set service webproxy listen-address 192.168.0.1 disable-transparent
-
-  # Block specific urls
-  set service webproxy url-filtering squidguard local-block myspace.com
-
-  # If you want to you can log these blocks
-  set service webproxy url-filtering squidguard log local-block
-
-
-Options
-*******
-
-Filtering by category
-^^^^^^^^^^^^^^^^^^^^^
-
-If you wan't to use existing blacklists you have to create/download a database
-first. Otherwise you will not be able to commit the config changes.
-
-.. code-block:: none
-
-  vyos@vyos# commit
-  [ service webproxy ]
-  Warning: no blacklists installed
-  Unknown block-category [ads] for policy [default]
-
-  [[service webproxy]] failed
-  Commit failed
-
-* Download/Update complete blacklist
-
-  :code:`update webproxy blacklists`
-
-* Download/Update partial blacklist
-
-  :code:`update webproxy blacklists category ads`
-
-  Use tab completion to get a list of categories.
-
-* To auto update the blacklist files
-
-  :code:`set service webproxy url-filtering squidguard auto-update update-hour 23`
-
-* To configure blocking add the following to the configuration
-
-  :code:`set service webproxy url-filtering squidguard block-category ads`
-
-  :code:`set service webproxy url-filtering squidguard block-category malware`
-
-Authentication
-^^^^^^^^^^^^^^
-
-The embedded Squid proxy can use LDAP to authenticate users against a company
-wide directory. The following configuration is an example of how to use Active
-Directory as authentication backend. Queries are done via LDAP.
-
-.. code-block:: none
-
-  vyos@vyos# show service webproxy
-   authentication {
-       children 5
-       credentials-ttl 60
-       ldap {
-           base-dn DC=example,DC=local
-           bind-dn CN=proxyuser,CN=Users,DC=example,DC=local
-           filter-expression (cn=%s)
-           password Qwert1234
-           server ldap.example.local
-           username-attribute cn
-       }
-       method ldap
-       realm "VyOS Webproxy"
-   }
-   cache-size 100
-   default-port 3128
-   listen-address 192.168.188.103 {
-       disable-transparent
-   }
-  
-* ``base-dn`` set the base directory for the search
-* ``bind-dn`` and ``password``: set the user, which is used for the ldap search 
-* ``filter-expression``: set the exact filter which a authorized user match in a ldap-search. In this example every User is able to authorized.
-
-You can find more about the ldap authentication `here <http://www.squid-cache.org/Versions/v3/3.2/manuals/basic_ldap_auth.html>`_
-
-Adjusting cache size
-^^^^^^^^^^^^^^^^^^^^
-
-The size of the proxy cache can be adjusted by the user.
-
-.. code-block:: none
-
-  set service webproxy cache-size
-   Possible completions:
-     <0-4294967295>
-                  Disk cache size in MB (default 100)
-     0            Disable disk caching
-     100
-
-Bypassing the webproxy
-^^^^^^^^^^^^^^^^^^^^^^
-
-Some services don't work correctly when being handled via a web proxy.
-So sometimes it is useful to bypass a transparent proxy:
-
-* To bypass the proxy for every request that is directed to a specific
-  destination:
-
-  :code:`set service webproxy whitelist destination-address 198.51.100.33`
-
-  :code:`set service webproxy whitelist destination-address 192.0.2.0/24`
-
-
-* To bypass the proxy for every request that is coming from a specific source:
-
-  :code:`set service webproxy whitelist source-address 192.168.1.2`
-
-  :code:`set service webproxy whitelist source-address 192.168.2.0/24`
-
-  (This can be useful when a called service has many and/or often changing
-  destination addresses - e.g. Netflix.)
-
-.. include:: references.rst
diff --git a/docs/system/boot-options.rst b/docs/system/boot-options.rst
deleted file mode 100644
index 1070afa9..00000000
--- a/docs/system/boot-options.rst
+++ /dev/null
@@ -1,56 +0,0 @@
-.. _boot-options:
-
-
-############
-Boot Options
-############
-
-.. warning:: This function may be highly disruptive.
-   It may cause major service interruption, so make sure you really
-   need it and verify your input carefully.
-
-
-
-VyOS has several kernel command line options to modify the normal boot
-process. 
-To add an option, select the desired image in GRUB menu at load
-time, press **e**, edit the first line, and press **Ctrl-x** to boot when
-ready.
-
-.. image:: /_static/images/boot-options.png
-   :width: 80%
-   :align: center
-
-
-Specify custom config file
-==========================
-
-Tells the system to use specified file instead of ``/config/config.boot``.
-If specified file does not exist or is not readable, fall back to
-default config. No additional verification is performed, so make sure
-you specify a valid config file.
-
-.. code-block:: none
-
-   vyos-config=/path/to/file
-
-To load the *factory default* config, use:
-
-.. code-block:: none
-
-   vyos-config=/opt/vyatta/etc/config.boot.default
-
-
-Disable specific boot process steps
-===================================
-
-These options disable some boot steps. Make sure you understand the
-:ref:`boot process <boot-steps>` well before using them!
-
-.. glossary::
-
-    no-vyos-migrate
-      Do not perform config migration.
-
-    no-vyos-firewall
-      Do not initialize default firewall chains, renders any firewall configuration unusable.
diff --git a/docs/system/eventhandler.rst b/docs/system/eventhandler.rst
deleted file mode 100644
index 4421e79c..00000000
--- a/docs/system/eventhandler.rst
+++ /dev/null
@@ -1,48 +0,0 @@
-.. _event-handler:
-
-Event Handler
--------------
-
-Event handler allows you to execute scripts when a string that matches a regex appears in a text stream (e.g. log file).
-
-It uses "feeds" (output of commands, or a named pipes) and "policies" that define what to execute if a regex is matched.
-
-.. code-block:: none
-
-  system
-  event-handler
-      feed <name>
-      description <feed description>
-      policy <policy name>
-      source
-          preset
-          syslog # Use the syslog logs for feed
-          custom
-          command <command to execute> # E.g. "tail -f /var/log/somelogfile"
-          named-pipe <path to a names pipe>
-      policy <policy name>
-      description <policy description>
-      event <event name>
-          description <event description>
-          pattern <regex>
-          run <command to run>
-
-In this small example a script runs every time a login failed and an interface goes down
-
-.. code-block:: none
-
-  vyos@vyos# show system event-handler 
-  feed Syslog {
-      policy MyPolicy
-      source {
-          preset syslog
-      }
-  }
-  policy MyPolicy {
-      description "Test policy"
-      event BadThingsHappened {
-          pattern "authentication failure"
-          pattern "interface \.* index \d+ .* DOWN.*"
-          run /config/scripts/email-to-admin 
-      }
-  }
\ No newline at end of file
diff --git a/docs/system/flowaccounting.rst b/docs/system/flowaccounting.rst
deleted file mode 100644
index 9c876001..00000000
--- a/docs/system/flowaccounting.rst
+++ /dev/null
@@ -1,81 +0,0 @@
-.. _flow-accounting:
-
-NetFlow is a feature that was introduced on Cisco routers around 1996 that
-provides the ability to collect IP network traffic as it enters or exits an
-interface. By analyzing the data provided by NetFlow, a network administrator
-can determine things such as the source and destination of traffic, class of
-service, and the causes of congestion. A typical flow monitoring setup (using
-NetFlow) consists of three main components:
-
-* Flow exporter: aggregates packets into flows and exports flow records towards
-  one or more flow collectors
-* Flow collector: responsible for reception, storage and pre-processing of flow
-  data received from a flow exporter
-* Analysis application: analyzes received flow data in the context of intrusion
-  detection or traffic profiling, for example
-
-For connectionless protocols as like ICMP and UDP, a flow is considered complete
-once no more packets for this flow appear after configurable timeout.
-
-NetFlow is usually enabled on a per-interface basis to limit load on the router
-components involved in NetFlow, or to limit the amount of NetFlow records
-exported.
-
-VyOS supports flow accounting through NetFlow (version 5, 9 and 10) or sFlow.
-
-Flow Accounting
----------------
-
-In order for flow accounting information to be collected and displayed for an
-interface, the interface must be configured for flow accounting. The following
-example shows how to configure ``eth0`` and ``bond3`` for flow accounting.
-
-.. code-block:: none
-
-  set system flow-accounting interface eth0
-  set system flow-accounting interface bond3
-
-
-NetFlow is a protocol originating from Cisco Systems. It works on level3.
-VyOS supports version 5, 9 and 10 (IPFIX - IP Flow Information Export)
-
-NetFlow v5 example:
-
-.. code-block:: none
-
-  set system flow-accounting netflow engine-id 100
-  set system flow-accounting netflow version 5
-  set system flow-accounting netflow server 192.168.2.10 port 2055
-
-Displaying Flow Accounting Information
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Once flow accounting is configured on an interfaces it provides the ability to
-display captured network traffic information for all configured interfaces.
-
-The following op-mode command shows flow accounting for eth0.
-
-.. code-block:: none
-
-  vyos@vyos:~$ show flow-accounting interface eth0
-  flow-accounting for [eth0]
-  Src Addr        Dst Addr        Sport Dport Proto    Packets      Bytes   Flows
-  0.0.0.0         192.0.2.50      811   811     udp       7733     591576       0
-  0.0.0.0         192.0.2.50      811   811     udp       7669     586558       1
-  192.0.2.200     192.0.2.51      56188 22      tcp        586      36504       1
-  192.0.2.99      192.0.2.51      61636 161     udp         46       6313       4
-  192.0.2.99      192.0.2.51      61638 161     udp         42       5364       9
-  192.0.2.99      192.0.2.51      61640 161     udp         42       5111       3
-  192.0.2.200     192.0.2.51      54702 22      tcp         86       4432       1
-  192.0.2.99      192.0.2.51      62509 161     udp         24       3540       1
-  192.0.2.99      192.0.2.51      0     0      icmp         49       2989       8
-  192.0.2.99      192.0.2.51      54667 161     udp         18       2658       1
-  192.0.2.99      192.0.2.51      54996 161     udp         18       2622       1
-  192.0.2.99      192.0.2.51      63708 161     udp         18       2622       1
-  192.0.2.99      192.0.2.51      62111 161     udp         18       2622       1
-  192.0.2.99      192.0.2.51      61646 161     udp         16       1977       4
-  192.0.2.99      192.0.2.51      56038 161     udp         10       1256       1
-  192.0.2.99      192.0.2.51      55570 161     udp          6       1146       1
-  192.0.2.99      192.0.2.51      54599 161     udp          6       1134       1
-  192.0.2.99      192.0.2.51      56304 161     udp          8       1029       1
-
diff --git a/docs/system/host-information.rst b/docs/system/host-information.rst
deleted file mode 100644
index 71209412..00000000
--- a/docs/system/host-information.rst
+++ /dev/null
@@ -1,175 +0,0 @@
-.. _host-information:
-
-Host Information
-----------------
-
-This section describes the system's host information and how to configure them,
-it covers the following topics:
-
-* Host name
-* Domain
-* IP address
-* Default gateway
-* Aliases
-
-Host Name
-^^^^^^^^^
-
-A hostname is the label (name) assigned to a network device (a host) on a
-network and is used to distinguish one device from another on specific networks
-or over the internet.
-
-Set a system host name:
-
-.. code-block:: none
-
-  set system host-name <hostname>
-
-.. note:: Only letters, numbers and hyphens are allowed.
-
-Show host name:
-
-.. code-block:: none
-
-  show system host-name
-
-Delete host name:
-
-.. code-block:: none
-
-  delete system host-name <hostname>
-
-Example: Set system hostname to 'RT01':
-
-.. code-block:: none
-
-  set system host-name RT01
-  commit
-  show system host-name
-    host-name RT01
-
-Domain Name
-^^^^^^^^^^^
-
-A domain name is the label (name) assigned to a computer network and is thus
-unique.
-
-Set the system's domain:
-
-.. code-block:: none
-
-  set system domain-name <domain>
-
-.. note:: Only letters, numbers, hyphens and periods are allowed.
-
-Show domain:
-
-.. code-block:: none
-
-  show system domain-name
-
-Remove domain name:
-
-.. code-block:: none
-
-  set system delete domain-name <domain>
-
-Example: Set system domain to example.com:
-
-.. code-block:: none
-
-  set system domain-name example.com
-  commit
-  show system domain-name
-    domain-name example.com
-
-Static host mappings
-^^^^^^^^^^^^^^^^^^^^
-
-How to assign IPs to interfaces is described in chapter
-:ref:`interfaces-addresses`. This section shows how to statically map a system
-IP to its host name for local (meaning on this VyOS instance) DNS resolution:
-
-.. code-block:: none
-
-  set system static-host-mapping host-name <hostname> inet <IP address>
-
-Show static mapping:
-
-.. code-block:: none
-
-  show system static-host-mapping
-
-Example: Create a static mapping between the system's hostname `RT01` and
-IP address `10.20.30.41`:
-
-.. code-block:: none
-
-  set system static-host-mapping host-name RT01 inet 10.20.30.41
-  commit
-  show system static-host-mapping
-    host-name RT01 {
-        inet 10.20.30.41
-    }
-
-Aliases
-*******
-
-One or more system aliases (static mappings) can be defined:
-
-.. code-block:: none
-
-  set system static-host-mapping host-name <hostname> alias <alias>
-
-Show aliases:
-
-.. code-block:: none
-
-  show system static-mapping
-
-Delete alias:
-
-.. code-block:: none
-
-  delete system static-host-mapping host-name <hostname> alias <alias>
-
-Example: Set alias `router1` for system with hostname `RT01`:
-
-.. code-block:: none
-
-  set system static-host-mapping host-name RT01 alias router1
-  commit
-  show system static-host-mapping
-    host-name RT01 {
-        alias router1
-        inet 10.20.30.41
-    }
-
-Default Gateway/Route
-^^^^^^^^^^^^^^^^^^^^^
-
-In the past (VyOS 1.1.8) used a gateway-address configured in the system tree
-(`set system gateway-address <IP address>`) this is no longer supported and
-existing configurations are migrated to the new CLI commands.
-
-It is replaced by inserting a static route into the routing table using:
-
-.. code-block:: none
-
-  set protocols static route 0.0.0.0/0 next-hop <gateway ip>
-
-Delete the default route from the system
-
-.. code-block:: none
-
-  delete protocols static route 0.0.0.0/0
-
-Show default route:
-
-.. code-block:: none
-
-  vyos@vyos$ show ip route 0.0.0.0
-  Routing entry for 0.0.0.0/0
-    Known via "static", distance 1, metric 0, best
-    Last update 3d00h23m ago
-    * 172.16.34.6, via eth1
diff --git a/docs/system/index.rst b/docs/system/index.rst
deleted file mode 100644
index a0d470aa..00000000
--- a/docs/system/index.rst
+++ /dev/null
@@ -1,25 +0,0 @@
-.. _system:
-
-System
-======
-
-After a basic system setup by setting up :ref:`interfaces-addresses`, VyOS
-should be ready for further configuration which is described in this chapter.
-
-
-.. toctree::
-   :maxdepth: 2
-   :hidden:
-
-   eventhandler
-   flowaccounting
-   host-information
-   login-users
-   ntp
-   proxy
-   serialconsole
-   syslog
-   system-dns
-   task-scheduler
-   time-zone
-   boot-options
diff --git a/docs/system/login-users.rst b/docs/system/login-users.rst
deleted file mode 100644
index c34e41a0..00000000
--- a/docs/system/login-users.rst
+++ /dev/null
@@ -1,129 +0,0 @@
-.. _systemusers:
-
-Login
------
-
-The default VyOS user account (`vyos`), as well as newly created user accounts,
-have all capabilities to configure the system. All accounts have sudo capabilities
-and therefore can operate as root on the system. Setting the level to admin is
-optional, all accounts on the system will have admin privileges.
-
-Both local administered and remote administered RADIUS (Remote Authentication
-Dial-In User Service) accounts are supported.
-
-Local
-^^^^^
-
-Create user account `jsmith` and the password `mypassword`.
-
-.. code-block:: none
-
-  set system login user jsmith full-name "Johan Smith"
-  set system login user jsmith authentication plaintext-password mypassword
-
-The command:
-
-.. code-block:: none
-
-  show system login
-
-will show the contents of :code:`system login` configuration node:
-
-.. code-block:: none
-
-  user jsmith {
-      authentication {
-          encrypted-password $6$0OQHjuQ8M$AYXVn7jufdfqPrSk4/XXsDBw99JBtNsETkQKDgVLptXogHA2bU9BWlvViOFPBoFxIi.iqjqrvsQdQ./cfiiPT.
-          plaintext-password ""
-      }
-      full-name "Johan Smith"
-      level admin
-  }
-
-SSH with Public Keys
-********************
-
-The following command will load the public key `dev.pub` for user `jsmith`
-
-.. code-block:: none
-
-  loadkey jsmith dev.pub
-
-.. note:: This requires uploading the `dev.pub` public key to the VyOS router
-   first. As an alternative you can also load the SSH public key directly
-   from a remote system:
-
-.. code-block:: none
-
-  loadkey jsmith scp://devuser@dev001.vyos.net/home/devuser/.ssh/dev.pub
-
-In addition SSH public keys can be fully added using the CLI. Each key can be
-given a unique identifier, `calypso` is used oin the example below to id an SSH
-key.
-
-.. code-block:: none
-
-  set system login user jsmith authentication public-keys callisto key 'AAAAB3Hso...Q=='
-  set system login user jsmith authentication public-keys callisto type 'ssh-rsa'
-
-RADIUS
-^^^^^^
-
-VyOS supports using one or more RADIUS servers as backend for user authentication.
-
-The following command sets up two servers for RADIUS authentication, one with a
-discrete timeout of `5` seconds and a discrete port of `1812` and the other using
-a default timeout and port.
-
-.. code-block:: none
-
-  set system login radius-server 192.168.1.2 secret 's3cr3t0815'
-  set system login radius-server 192.168.1.2 timeout '5'
-  set system login radius-server 192.168.1.2 port '1812'
-  set system login radius-server 192.168.1.3 secret 's3cr3t0816'
-
-This configuration results in:
-
-.. code-block:: none
-
-  show system login
-   radius-server 192.168.1.2 {
-       secret s3cr3t0815
-       timeout 5
-       port 1812
-   }
-   radius-server 192.168.1.3 {
-       secret s3cr3t0816
-   }
-
-.. note:: If you wan't to have admin users to authenticate via RADIUS it is
-   essential to sent the ``Cisco-AV-Pair shell:priv-lvl=15`` attribute. Without
-   the attribute you will only get regular, non privilegued, system users.
-
-Source Address
-**************
-
-RADIUS servers could be hardened by only allowing certain IP addresses to connect.
-As of this the source address of each RADIUS query can be configured. If this is
-not set incoming connections to the RADIUS server will use the nearest interface
-address pointing towards the RADIUS server - making it error prone on e.g. OSPF
-networks when a link fails.
-
-.. code-block:: none
-
-  set system login radius-source-address 192.168.1.254
-
-Login Banner
-^^^^^^^^^^^^
-
-You are able to set post-login or pre-login messages with the following lines:
-
-.. code-block:: none
-
-  set system login banner pre-login "UNAUTHORIZED USE OF THIS SYSTEM IS PROHIBITED\n"
-  set system login banner post-login "Welcome to VyOS"
-
-the **\\n** create a newline.
-
-
-
diff --git a/docs/system/ntp.rst b/docs/system/ntp.rst
deleted file mode 100644
index 95ff0692..00000000
--- a/docs/system/ntp.rst
+++ /dev/null
@@ -1,19 +0,0 @@
-.. _ntp:
-
-NTP
-===
-
-there are 3 default NTP server set. You are able to change them.
-
-.. code-block:: none
-
-  set system ntp server 0.pool.ntp.org
-  set system ntp server 1.pool.ntp.org
-  set system ntp server 2.pool.ntp.org
-
-To set up VyOS as an NTP responder, you must specify the listen address and optionally the permitted clients.
-
-.. code-block:: none
-
-  set system ntp listen-address 192.168.199.1
-  set system ntp allow-clients address 192.168.199.0/24
diff --git a/docs/system/proxy.rst b/docs/system/proxy.rst
deleted file mode 100644
index f89794dd..00000000
--- a/docs/system/proxy.rst
+++ /dev/null
@@ -1,28 +0,0 @@
-.. _proxy:
-
-System Proxy
-============
-
-Some IT environments require the use of a proxy to connect to the Internet.
-The option allowes to set a HTTP proxy and if necessary, supports `basic auth`_.  
-
-The code example below sets a proxy for all HTTP, HTTPS and FTP (anonymous ftp) connections, initiated by vyos. 
-
-.. code-block:: none
-
-  set system proxy url http://10.100.100.1
-  set system proxy port 8080
-
-That enables the update of a system image if the vyos system operates behind a proxy.
-
-.. code-block:: none
-
-  vyos@vyos:~$ add system image https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
-  Trying to fetch ISO file from https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
-  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
-                                 Dload  Upload   Total   Spent    Left  Speed
-  1  413M    1 4479k    0     0   995k      0  0:07:04  0:00:04  0:07:00  995k
-
-
-
-.. _`basic auth`: https://tools.ietf.org/html/rfc7617
diff --git a/docs/system/serialconsole.rst b/docs/system/serialconsole.rst
deleted file mode 100644
index 730c9da1..00000000
--- a/docs/system/serialconsole.rst
+++ /dev/null
@@ -1,17 +0,0 @@
-.. _serial-console:
-
-Serial console
-==============
-
-
-
-Configuring Console
--------------------
-
-.. code-block:: none
-
-  vyos@vyos# set system console
-  Possible completions:
-  +> device       Serial console device name
-  +> network      Network based console logging
-     powersave    Enable screen blank powersaving on VGA console
\ No newline at end of file
diff --git a/docs/system/syslog.rst b/docs/system/syslog.rst
deleted file mode 100644
index 9f3e1a28..00000000
--- a/docs/system/syslog.rst
+++ /dev/null
@@ -1,224 +0,0 @@
-.. _syslog:
-
-######
-Syslog
-######
-
-Per default VyOSs has minimal syslog logging enabled which is stored and
-rotated locally. Errors will be always logged to a local file, which includes
-`local7` error messages, emergency messages will be sent to the console, too.
-
-To configure syslog, you need to switch into configuration mode.
-
-Logging
-=======
-
-Syslog supports logging to multiple targets, those targets could be a plain
-file on your VyOS installation itself, a serial console or a remote syslog
-server which is reached via :abbr:`IP (Internet Protocol)` UDP/TCP.
-
-Console
--------
-
-.. cfgcmd:: set system syslog console facility <keyword> level <keyword>
-
-Log syslog messages to ``/dev/console``, for an explanation on
-:ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords
-see tables below.
-
-
-Custom File
------------
-
-.. cfgcmd:: set system syslog file <filename> facility <keyword> level <keyword>
-
-Log syslog messages to file specified via `<filename>`, for en explanation on
-:ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords see
-tables below.
-
-.. cfgcmd:: set system syslog file <filename> archive size <size>
-
-Syslog will write `<size>` kilobytes into the file specified by `<filename>`.
-After this limit has been reached, the custom file is "rotated" by logrotate
-and a new custom file is created.
-
-.. cfgcmd:: set system syslog file <filename> archive file <number>
-
-Syslog uses logrotate to rotate logiles after a number of gives bytes. We keep
-as many as `<number>` rotated file before they are deleted on the system.
-
-
-Remote Host
------------
-
-Logging to a remote host leaves the local logging configuration intact, it
-can be configured in parallel to a custom file or console logging. You can log
-to multiple hosts at the same time, using either TCP or UDP. The default is
-sending the messages via port 514/UDP.
-
-
-.. cfgcmd:: set system syslog host <address> facility <keyword> level <keyword>
-
-Log syslog messages to remote host specified by `<address>`. The address can be
-specified by either FQDN or IP address. For en explanation on
-:ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords see
-tables below.
-
-
-.. cfgcmd:: set system syslog host <address> facility <keyword> protocol <udp|tcp>
-
-Configure protocol used for communication to remote syslog host. This can be
-either UDP or TCP.
-
-
-Local User Account
-------------------
-
-.. cfgcmd:: set system syslog user <username> facility <keyword> level <keyword>
-
-If logging to a local user account is configured, all defined log messages are
-display on the console if the local user is logged in, if the user is not
-logged in, no messages are being displayed. For en explanation on
-:ref:`syslog_facilities` keywords and :ref:`syslog_severity_level` keywords see
-tables below.
-
-.. _syslog_facilities:
-
-Facilities
-==========
-
-List of facilities used by syslog. Most facilities names are self explanatory.
-Facilities local0 - local7 common usage is f.e. as network logs facilities for
-nodes and network equipment. Generally it depends on the situation how to
-classify logs and put them to facilities. See facilities more as a tool rather
-than a directive to follow.
-
-Facilities can be adjusted to meet the needs of the user:
-
-+----------+----------+----------------------------------------------------+
-| Facility | Keyword  | Description                                        |
-| Code     |          |                                                    |
-+==========+==========+====================================================+
-|          | all      | All facilities                                     |
-+----------+----------+----------------------------------------------------+
-| 0        | kern     | Kernel messages                                    |
-+----------+----------+----------------------------------------------------+
-| 1        | user     | User-level messages                                |
-+----------+----------+----------------------------------------------------+
-| 2        | mail     | Mail system                                        |
-+----------+----------+----------------------------------------------------+
-| 3        | daemon   | System daemons                                     |
-+----------+----------+----------------------------------------------------+
-| 4        | auth     | Security/authentication messages                   |
-+----------+----------+----------------------------------------------------+
-| 5        | syslog   | Messages generated internally by syslogd           |
-+----------+----------+----------------------------------------------------+
-| 6        | lpr      | Line printer subsystem                             |
-+----------+----------+----------------------------------------------------+
-| 7        | news     | Network news subsystem                             |
-+----------+----------+----------------------------------------------------+
-| 8        | uucp     | UUCP subsystem                                     |
-+----------+----------+----------------------------------------------------+
-| 9        | cron     | Clock daemon                                       |
-+----------+----------+----------------------------------------------------+
-| 10       | security | Security/authentication messages                   |
-+----------+----------+----------------------------------------------------+
-| 11       | ftp      | FTP daemon                                         |
-+----------+----------+----------------------------------------------------+
-| 12       | ntp      | NTP subsystem                                      |
-+----------+----------+----------------------------------------------------+
-| 13       | logaudit | Log audit                                          |
-+----------+----------+----------------------------------------------------+
-| 14       | logalert | Log alert                                          |
-+----------+----------+----------------------------------------------------+
-| 15       | clock    | clock daemon (note 2)                              |
-+----------+----------+----------------------------------------------------+
-| 16       | local0   | local use 0 (local0)                               |
-+----------+----------+----------------------------------------------------+
-| 17       | local1   | local use 1 (local1)                               |
-+----------+----------+----------------------------------------------------+
-| 18       | local2   | local use 2 (local2)                               |
-+----------+----------+----------------------------------------------------+
-| 19       | local3   | local use 3 (local3)                               |
-+----------+----------+----------------------------------------------------+
-| 20       | local4   | local use 4 (local4)                               |
-+----------+----------+----------------------------------------------------+
-| 21       | local5   | local use 5 (local5)                               |
-+----------+----------+----------------------------------------------------+
-| 22       | local6   |  use 6 (local6)                                    |
-+----------+----------+----------------------------------------------------+
-| 23       | local7   | local use 7 (local7)                               |
-+----------+----------+----------------------------------------------------+
-
-.. _syslog_severity_level:
-
-Severity Level
-==============
-
-+-------+---------------+---------+-------------------------------------------+
-| Value | Severity      | Keyword | Description                               |
-+=======+===============+=========+===========================================+
-|       |               | all     | Log everything                            |
-+-------+---------------+---------+-------------------------------------------+
-| 0     | Emergency     | emerg   | System is unusable - a panic condition    |
-+-------+---------------+---------+-------------------------------------------+
-| 1     | Alert         | alert   | Action must be taken immediately - A      |
-|       |               |         | condition that should be corrected        |
-|       |               |         | immediately, such as a corrupted system   |
-|       |               |         | database.                                 |
-+-------+---------------+---------+-------------------------------------------+
-| 2     | Critical      | crit    | Critical conditions - e.g. hard drive     |
-|       |               |         | errors.                                   |
-+-------+---------------+---------+-------------------------------------------+
-| 3     | Error         | err     | Error conditions                          |
-+-------+---------------+---------+-------------------------------------------+
-| 4     | Warning       | warning | Warning conditions                        |
-+-------+---------------+---------+-------------------------------------------+
-| 5     | Notice        | notice  | Normal but significant conditions -       |
-|       |               |         | conditions that are not error conditions, |
-|       |               |         | but that may require special handling.    |
-+-------+---------------+---------+-------------------------------------------+
-| 6     | Informational | info    | Informational messages                    |
-+-------+---------------+---------+-------------------------------------------+
-| 7     | Debug         | debug   | Debug-level messages - Messages that      |
-|       |               |         | contain information normally of use only  |
-|       |               |         | when debugging a program.                 |
-+-------+---------------+---------+-------------------------------------------+
-
-
-Display Logs
-============
-
-.. opcmd:: show log [all | authorization | cluster | conntrack-sync | ...]
-
-Display log files of given category on the console. Use tab completion to get
-a list of available categories. Thos categories could be: all, authorization,
-cluster, conntrack-sync, dhcp, directory, dns, file, firewall, https, image
-lldp, nat, openvpn, snmp, tail, vpn, vrrp
-
-If no option is specified, this defaults to `all`.
-
-.. opcmd:: show log image <name> [all | authorization | directory | file <file name> | tail <lines>]
-
-Log messages from a specified image can be displayed on the console. Details of
-allowed parameters:
-
-.. list-table::
-   :widths: 25 75
-   :header-rows: 0
-
-   * - all
-     - Display contents of all master log files of the specified image
-   * - authorization
-     - Display all authorization attempts of the specified image
-   * - directory
-     - Display list of all user-defined log files of the specified image
-   * - file <file name>
-     - Display contents of a specified user-defined log file of the specified image
-   * - tail
-     - Display last lines of the system log of the specified image
-   * - <lines>
-     - Number of lines to be displayed, default 10
-
-When no options/parameters are used, the contents of the main syslog file are
-displayed.
diff --git a/docs/system/system-dns.rst b/docs/system/system-dns.rst
deleted file mode 100644
index 70848f6d..00000000
--- a/docs/system/system-dns.rst
+++ /dev/null
@@ -1,68 +0,0 @@
-.. _system-dns:
-
-##########
-System DNS
-##########
-
-
-This section describes configuring DNS on the system, namely:
-
- * DNS name servers
- * Domain search order
-
-
-DNS name servers
-================
-
-.. cfgcmd:: set system name-server <address>
-
-   Use this command to specify a DNS server for the system to be used
-   for DNS lookups. More than one DNS server can be added, configuring
-   one at a time. Both IPv4 and IPv6 addresses are supported.
-
-
-
-Example
--------
-
-In this example, some *OpenNIC* servers are used, two IPv4 addresses
-and two IPv6 addresses:
-
-
-.. code-block:: none
-
-   set system name-server 176.9.37.132
-   set system name-server 195.10.195.195
-   set system name-server 2a01:4f8:161:3441::1
-   set system name-server 2a00:f826:8:2::195
-
-
-Domain search order
-===================
-
-In order for the system to use and complete unqualified host names, a
-list can be defined which will be used for domain searches.
-
-
-.. cfgcmd:: set system domain-search domain <domain>
-
-   Use this command to define domains, one at a time, so that the system
-   uses them to complete unqualified host names. Maximum: 6 entries.
-
-
-.. note:: Domain names can include letters, numbers, hyphens and periods
-   with a maximum length of 253 characters.
-
-
-Example
--------
-
-The system is configured to attempt domain completion in the following
-order: vyos.io (first), vyos.net (second) and vyos.network (last):
-
-
-.. code-block:: none
-
-   set system domain-search domain vyos.io
-   set system domain-search domain vyos.net
-   set system domain-search domain vyos.network
diff --git a/docs/system/task-scheduler.rst b/docs/system/task-scheduler.rst
deleted file mode 100644
index 7fe49988..00000000
--- a/docs/system/task-scheduler.rst
+++ /dev/null
@@ -1,60 +0,0 @@
-.. _task-scheduler:
-
-
-Task scheduler
---------------
-
-| Task scheduler — allows scheduled task execution. Note that scripts excecuted this way are executed as root user - this may be dangerous.
-| Together with :ref:`commandscripting` this can be used for automating configuration.
-
-.. code-block:: none
-
-  system
-      task-scheduler
-          task <name>
-              cron-spec <UNIX cron time spec>
-              executable
-                  arguments <arguments string>
-                  path <path to executable>
-              interval
-                  <int32>[mhd]
-
-Interval
-********
-
-You are able to set the time as an time interval.
-
-.. code-block:: none
-
-  set system task-scheduler task <name> interval <value><suffix>
-
-Sets the task to execute every N minutes, hours, or days. Suffixes:
-
- * m — minutes
- * h — hours
- * d — days
-
-If suffix is omitted, minutes are implied.
-
-Or set the execution time in common cron time.
-
-.. code-block:: none
-
-  set system task-scheduler task TEST crontab-spec "* * * 1 *"
-
-Example
-*******
-
-.. code-block:: none
-
-  system
-      task-scheduler
-          task mytask
-              interval 2h
-              executable
-                  path /config/scripts/mytask
-                  arguments "arg1 arg2 arg3"
-          task anothertask
-              cron-spec "* * * 1 *"
-              executable
-                  path /config/scripts/anothertask
\ No newline at end of file
diff --git a/docs/system/time-zone.rst b/docs/system/time-zone.rst
deleted file mode 100644
index 9e1690e8..00000000
--- a/docs/system/time-zone.rst
+++ /dev/null
@@ -1,11 +0,0 @@
-.. _timezone:
-
-Time Zone
-=========
-
-To set the system time zone type:
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# set system time-zone [time-zone]
\ No newline at end of file
diff --git a/docs/troubleshooting/index.rst b/docs/troubleshooting/index.rst
new file mode 100644
index 00000000..a965dbe6
--- /dev/null
+++ b/docs/troubleshooting/index.rst
@@ -0,0 +1,459 @@
+.. _troubleshooting:
+
+###############
+Troubleshooting
+###############
+
+Sometimes things break or don't work as expected. This section describes
+several troubleshooting tools provided by VyOS that can help when something
+goes wrong.
+
+******************
+Connectivity Tests
+******************
+
+Basic Connectivity Tests
+========================
+
+Verifying connectivity can be done with the familiar `ping` and `traceroute`
+commands. The options for each are shown (the options for each command were
+displayed using the built-in help as described in the :ref:`cli`
+section and are omitted from the output here):
+
+.. opcmd:: ping <destination>
+
+   Send ICMP echo requests to destination host. There are multiple options to
+   ping, inkl. VRF support.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ ping 10.1.1.1
+     Possible completions:
+       <Enter>       Execute the current command
+       adaptive      Ping options
+       allow-broadcast
+       audible
+       bypass-route
+       count
+       deadline
+       flood
+       interface
+       interval
+       mark
+       no-loopback
+       numeric
+       pattern
+       quiet
+       record-route
+       size
+       timestamp
+       tos
+       ttl
+       verbose
+       vrf
+
+
+.. opcmd:: traceroute <destination>
+
+   Trace path to target.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ traceroute
+     Possible completions:
+       <hostname>    Track network path to specified node
+       <x.x.x.x>
+       <h:h:h:h:h:h:h:h>
+       ipv4          Track network path to <hostname|IPv4 address>
+       ipv6          Track network path to <hostname|IPv6 address>
+
+
+Advanced Connectivity Tests
+===========================
+
+.. opcmd:: monitor traceroute <destination>
+
+   However, another helper is available which combines ping and traceroute
+   into a single tool. An example of its output is shown:
+
+   .. code-block:: none
+
+     vyos@vyos:~$ mtr 10.62.212.12
+
+                                My traceroute  [v0.85]
+     vyos (0.0.0.0)
+     Keys:  Help   Display mode   Restart statistics   Order of fields   quit
+                                       Packets               Pings
+     Host                            Loss%   Snt   Last   Avg  Best  Wrst StDev
+     1. 10.11.110.4                   0.0%    34    0.5   0.5   0.4   0.8   0.1
+     2. 10.62.255.184                 0.0%    34    1.1   1.0   0.9   1.4   0.1
+     3. 10.62.255.71                  0.0%    34    1.4   1.4   1.3   2.0   0.1
+     4. 10.62.212.12                  0.0%    34    1.6   1.6   1.6   1.7   0.0
+
+   .. note:: The output consumes the screen and will replace your command
+      prompt.
+
+   Several options are available for changing the display output. Press `h` to
+   invoke the built in help system. To quit, just press `q` and you'll be
+   returned to the VyOS command prompt.
+
+IPv6 Topology Discovery
+=======================
+
+IPv6 uses different techniques to discover its Neighbors/topology.
+
+Router Discovery
+----------------
+
+.. opcmd:: force ipv6-rd interface <interface> [address <ipv6-address>]
+
+   Discover routers via eth0.
+
+   Example:
+
+   .. code-block:: none
+
+     vyos@vyos:~$ force ipv6-rd interface eth0
+     Soliciting ff02::2 (ff02::2) on eth0...
+
+     Hop limit                 :           60 (      0x3c)
+     Stateful address conf.    :           No
+     Stateful other conf.      :           No
+     Mobile home agent         :           No
+     Router preference         :         high
+     Neighbor discovery proxy  :           No
+     Router lifetime           :         1800 (0x00000708) seconds
+     Reachable time            :  unspecified (0x00000000)
+     Retransmit time           :  unspecified (0x00000000)
+      Prefix                   : 240e:fe:8ca7:ea01::/64
+       On-link                 :          Yes
+       Autonomous address conf.:          Yes
+       Valid time              :      2592000 (0x00278d00) seconds
+       Pref. time              :        14400 (0x00003840) seconds
+      Prefix                   : fc00:470:f1cd:101::/64
+       On-link                 :          Yes
+       Autonomous address conf.:          Yes
+       Valid time              :      2592000 (0x00278d00) seconds
+       Pref. time              :        14400 (0x00003840) seconds
+      Recursive DNS server     : fc00:470:f1cd::ff00
+       DNS server lifetime     :          600 (0x00000258) seconds
+      Source link-layer address: 00:98:2B:F8:3F:11
+      from fe80::298:2bff:fef8:3f11
+
+Neighbor Discovery
+------------------
+
+.. opcmd:: force ipv6-nd interface <interface> address <ipv6-address>
+
+
+   Example:
+
+   .. code-block:: none
+
+     vyos@vyos:~$ force ipv6-nd interface eth0 address fc00:470:f1cd:101::1
+
+     Soliciting fc00:470:f1cd:101::1 (fc00:470:f1cd:101::1) on eth0...
+     Target link-layer address: 00:98:2B:F8:3F:11 from fc00:470:f1cd:101::1
+
+
+***************
+Interface names
+***************
+
+If you find the names of your interfaces have changed, this could be because
+your MAC addresses have changed.
+
+* For example, you have a VyOS VM with 4 Ethernet interfaces named
+  eth0, eth1, eth2 and eth3. Then, you migrate your VyOS VM to a different
+  host and find your interfaces now are eth4, eth5, eth6 and eth7.
+
+  One way to fix this issue **taking control of the MAC addresses** is:
+
+  Log into VyOS and run this command to display your interface settings.
+
+  .. code-block:: none
+
+     show interfaces detail
+
+  Take note of MAC addresses.
+
+  Now, in order to update a MAC address in the configuration, run this command
+  specifying the interface name and MAC address you want.
+
+  .. code-block:: none
+
+     set interfaces eth0 hw-id 00:0c:29:da:a4:fe
+
+  If it is a VM, go into the settings of the host and set the MAC address to
+  the settings found in the config.boot file. You can also set the MAC to
+  static if the host allows so.
+
+
+* Another example could be when cloning VyOS VMs in GNS3 and you get into the
+  same issue: interface names have changed.
+  
+  And **a more generic way to fix it** is just deleting every MAC address at
+  the configuration file of the cloned machine. They will be correctly
+  regenerated automatically.
+
+
+**********
+Monitoring
+**********
+
+VyOS features several monitoring tools.
+
+.. code-block:: none
+
+  vyos@vyos:~$ monitor
+  Possible completions:
+    bandwidth     Monitor interface bandwidth in real time
+    bandwidth-test
+                  Initiate or wait for bandwidth test
+    cluster       Monitor clustering service
+    command       Monitor an operational mode command (refreshes every 2 seconds)
+    conntrack-sync
+                  Monitor conntrack-sync
+    content-inspection
+                  Monitor Content-Inspection
+    dhcp          Monitor Dynamic Host Control Protocol (DHCP)
+    dns           Monitor a Domain Name Service (DNS) daemon
+    firewall      Monitor Firewall
+    https         Monitor the Secure Hypertext Transfer Protocol (HTTPS) service
+    lldp          Monitor Link Layer Discovery Protocol (LLDP) daemon
+    log           Monitor last lines of messages file
+    nat           Monitor network address translation (NAT)
+    ndp           Monitor the NDP information received by the router through the device
+    openvpn       Monitor OpenVPN
+    protocol      Monitor routing protocols
+    snmp          Monitor Simple Network Management Protocol (SNMP) daemon
+    stop-all      Stop all current background monitoring processes
+    traceroute    Monitor the path to a destination in realtime
+    traffic       Monitor traffic dumps
+    vpn           Monitor VPN
+    vrrp          Monitor Virtual Router Redundancy Protocol (VRRP)
+    webproxy      Monitor Webproxy service
+
+
+Traffic Dumps
+=============
+
+To monitor interface traffic, issue the :code:`monitor traffic interface <name>`
+command, replacing `<name>` with your chosen interface.
+
+.. code-block:: none
+
+  vyos@vyos:~$ monitor traffic interface eth0
+  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
+  listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
+  15:54:28.581601 IP 192.168.0.1 > vyos: ICMP echo request, id 1870, seq 3848, length 64
+  15:54:28.581660 IP vyos > 192.168.0.1: ICMP echo reply, id 1870, seq 3848, length 64
+  15:54:29.583399 IP 192.168.0.1 > vyos: ICMP echo request, id 1870, seq 3849, length 64
+  15:54:29.583454 IP vyos > 192.168.0.1: ICMP echo reply, id 1870, seq 3849, length 64
+  ^C
+  4 packets captured
+  4 packets received by filter
+  0 packets dropped by kernel
+  vyos@vyos:~$
+
+To quit monitoring, press `Ctrl-c` and you'll be returned to the VyOS command
+prompt.
+
+Traffic can be filtered and saved.
+
+.. code-block:: none
+
+  vyos@vyos:~$ monitor traffic interface eth0
+  Possible completions:
+    <Enter>       Execute the current command
+    filter        Monitor traffic matching filter conditions
+    save          Save traffic dump from an interface to a file
+
+
+Interface Bandwidth Usage
+=========================
+
+to take a quick view on the used bandwidth of an interface use the ``monitor
+bandwidth`` command
+
+.. code-block:: none
+
+  vyos@vyos:~$ monitor bandwidth interface eth0
+
+show the following:
+
+.. code-block:: none
+
+         B                      (RX Bytes/second)
+    198.00 .|....|.....................................................
+    165.00 .|....|.....................................................
+    132.00 ||..|.|.....................................................
+     99.00 ||..|.|.....................................................
+     66.00 |||||||.....................................................
+     33.00 |||||||.....................................................
+           1   5   10   15   20   25   30   35   40   45   50   55   60
+
+       KiB                      (TX Bytes/second)
+      3.67 ......|.....................................................
+      3.06 ......|.....................................................
+      2.45 ......|.....................................................
+      1.84 ......|.....................................................
+      1.22 ......|.....................................................
+      0.61 :::::||.....................................................
+           1   5   10   15   20   25   30   35   40   45   50   55   60
+
+Interface Performance
+=====================
+
+To take a look on the network bandwidth between two nodes, the ``monitor
+bandwidth-test`` command is used to run iperf.
+
+.. code-block:: none
+
+  vyos@vyos:~$ monitor bandwidth-test
+  Possible completions:
+    accept        Wait for bandwidth test connections (port TCP/5001)
+    initiate      Initiate a bandwidth test
+
+* The ``accept`` command opens a listening iperf server on TCP Port 5001
+* The ``initiate`` command connects to that server to perform the test.
+
+.. code-block:: none
+
+  vyos@vyos:~$ monitor bandwidth-test initiate
+  Possible completions:
+    <hostname>    Initiate a bandwidth test to specified host (port TCP/5001)
+    <x.x.x.x>
+    <h:h:h:h:h:h:h:h>
+
+
+Monitor command
+===============
+
+The ``monitor command`` command allows you to repeatedly run a command to view
+a continuously refreshed output. The command is run and output every 2 seconds,
+allowing you to monitor the output continuously without having to re-run the
+command. This can be useful to follow routing adjacency formation.
+
+.. code-block:: none
+
+  vyos@router:~$ monitor command "show interfaces"
+
+Will clear the screen and show you the output of ``show interfaces`` every
+2 seconds.
+
+.. code-block:: none
+
+  Every 2.0s: /opt/vyatta/bin/vyatta-op-cmd-wrapper    Sun Mar 26 02:49:46 2019
+
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             192.168.1.1/24                    u/u
+  eth0.5           198.51.100.4/24                   u/u  WAN
+  lo               127.0.0.1/8                       u/u
+                   ::1/128
+  vti0             172.25.254.2/30                   u/u
+  vti1             172.25.254.9/30                   u/u
+
+****************
+Terminal/Console
+****************
+
+Sometimes you need to clear counters or statistics to troubleshoot better.
+
+To do this use the ``clear`` command in Operational mode.
+
+to clear the console output
+
+.. code-block:: none
+
+  vyos@vyos:~$ clear console
+
+to clear interface counters
+
+.. code-block:: none
+
+  # clear all interfaces
+  vyos@vyos:~$ clear interface ethernet counters
+  # clear specific interface
+  vyos@vyos:~$ clear interface ehternet eth0 counters
+
+The command follow the same logic as the ``set`` command in configuration mode.
+
+.. code-block:: none
+
+  # clear all counters of a interface type
+  vyos@vyos:~$ clear interface <interface_type> counters
+  # clear counter of a interface in interface_type
+  vyos@vyos:~$ clear interface <interface_type> <interace_name> counters
+
+
+to clear counters on firewall rulesets or single rules
+
+.. code-block:: none
+
+  vyos@vyos:~$ clear firewall name <ipv4 ruleset name> counters
+  vyos@vyos:~$ clear firewall name <ipv4 ruleset name> rule <rule#> counters
+
+  vyos@vyos:~$ clear firewall ipv6-name <ipv6 ruleset name> counters
+  vyos@vyos:~$ clear firewall ipv6-name <ipv6 ruleset name> rule <rule#> counters
+
+
+******************
+System Information
+******************
+
+.. _boot-steps:
+
+Boot Steps
+==========
+
+VyOS 1.2 uses `Debian Jessie`_ as the base Linux operating system. Jessie was
+the first version of Debian that uses systemd_ as the default init system.
+
+These are the boot steps for VyOS 1.2
+
+1. The BIOS loads Grub (or isolinux for the Live CD)
+2. Grub then starts the Linux boot and loads the Linux Kernel ``/boot/vmlinuz``
+3. Kernel Launches Systemd ``/lib/systemd/systemd``
+4. Systemd loads the VyOS service file
+   ``/lib/systemd/system/vyos-router.service``
+5. The service file launches the VyOS router init script
+   ``/usr/libexec/vyos/init/vyos-router`` - this is part of the vyatta-cfg_
+   Debian package
+
+  1. Starts FRR_ - successor to `GNU Zebra`_ and Quagga_
+
+  2. Initialises the boot configuration file - copies over
+     ``config.boot.default`` if there is no configuration
+  3. Runs the configuration migration, if the configuration is for an older
+     version of VyOS
+  4. Runs The pre-config script, if there is one
+     ``/config/scripts/vyos-preconfig-bootup.script``
+  5. If the config file was upgraded, runs any post upgrade scripts
+     ``/config/scripts/post-upgrade.d``
+  6. Starts ``rl-system`` and ``firewall``
+  7. Mounts the ``/boot`` partition
+  8. The boot configuration file is then applied by ``/opt/vyatta/sbin/
+     vyatta-boot-config-loader/opt/vyatta/etc/config/config.boot``
+
+    1. The config loader script writes log entries to
+       ``/var/log/vyatta-config-loader.log``
+
+  10. Runs ``telinit q`` to tell the init system to reload ``/etc/inittab``
+  11. Finally it runs the post-config script
+      ``/config/scripts/vyos-postconfig-bootup.script``
+
+.. stop_vyoslinter
+
+.. _Quagga: https://www.quagga.net/
+.. _`GNU Zebra`: https://www.gnu.org/software/zebra/
+.. _FRR: https://frrouting.org/
+.. _vyatta-cfg: https://github.com/vyos/vyatta-cfg
+.. _systemd: https://freedesktop.org/wiki/Software/systemd/
+.. _`Debian Jessie`: https://www.debian.org/releases/jessie/
+.. _tshark: https://www.wireshark.org/docs/man-pages/tshark.html
+.. _`PCAP filter expressions`: http://www.tcpdump.org/manpages/pcap-filter.7.html
+
+.. start_vyoslinter
diff --git a/docs/vpn/dmvpn.rst b/docs/vpn/dmvpn.rst
deleted file mode 100644
index 9da6dde2..00000000
--- a/docs/vpn/dmvpn.rst
+++ /dev/null
@@ -1,420 +0,0 @@
-.. _vpn-dmvpn:
-
-DMVPN
------
-
-**D** ynamic **M** ultipoint **V** irtual **P** rivate **N** etworking
-
-DMVPN is a dynamic VPN technology originally developed by Cisco. While their
-implementation was somewhat proprietary, the underlying technologies are
-actually standards based. The three technologies are:
-
-* **NHRP** - NBMA Next Hop Resolution Protocol RFC2332_
-* **mGRE** - Multipoint Generic Routing Encapsulation / mGRE RFC1702_
-* **IPSec** - IP Security (too many RFCs to list, but start with RFC4301_)
-
-NHRP provides the dynamic tunnel endpoint discovery mechanism (endpoint
-registration, and endpoint discovery/lookup), mGRE provides the tunnel
-encapsulation itself, and the IPSec protocols handle the key exchange, and
-crypto mechanism.
-
-In short, DMVPN provides the capability for creating a dynamic-mesh VPN
-network without having to pre-configure (static) all possible tunnel end-point
-peers.
-
-.. note:: DMVPN only automates the tunnel endpoint discovery and setup. A
-   complete solution also incorporates the use of a routing protocol. BGP is
-   particularly well suited for use with DMVPN.
-
-Baseline Configuration:
-
-**STEPS:**
-
-#. Create tunnel config (`interfaces tunnel`)
-#. Create nhrp (`protocols nhrp`)
-#. Create ipsec vpn (optional, but recommended for security) (`vpn ipsec`)
-
-The tunnel will be set to mGRE if for encapsulation `gre` is set, and no
-`remote-ip` is set. If the public ip is provided by DHCP the tunnel `local-ip`
-can be set to "0.0.0.0". If you do set the `remote-ip` directive at any point, the interface will need to be `delete`'d from the config and recreated without the `remote-ip` config ever being set.
-
-.. figure:: ../_static/images/vpn_dmvpn_topology01.png
-   :scale: 40 %
-   :alt: Baseline DMVPN topology
-
-   Baseline DMVPN topology
-
-HUB Configuration
-^^^^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  interfaces
-      tunnel <tunN> {
-          address <ipv4>
-          encapsulation gre
-          local-ip <public ip>
-          multicast enable
-          description <txt>
-          parameters {
-              ip {
-                  <usual IP options>
-              }
-          }
-      }
-  }
-  protocols {
-      nhrp {
-          tunnel <tunN> {
-              cisco-authentication <key phrase>
-              holding-time <seconds>
-              multicast dynamic
-              redirect
-          }
-      }
-  }
-  vpn {
-      ipsec {
-          esp-group <text> {
-              lifetime <30-86400>
-              mode tunnel
-              pfs enable
-              proposal <1-65535> {
-                  encryption aes256
-                  hash sha1
-              }
-              proposal <1-65535> {
-                  encryption 3des
-                  hash md5
-              }
-          }
-          ike-group <text> {
-              key-exchange ikev1
-              lifetime <30-86400>
-              proposal <1-65535> {
-                  encryption aes256
-                  hash sha1
-              }
-              proposal <1-65535> {
-                  encryption aes128
-                  hash sha1
-              }
-          }
-          ipsec-interfaces {
-              interface <ethN>
-          }
-          profile <text> {
-              authentication {
-                  mode pre-shared-secret
-                  pre-shared-secret <key phrase>
-              }
-              bind {
-                  tunnel <tunN>
-              }
-              esp-group <text>
-              ike-group <text>
-          }
-      }
-  }
-
-HUB Example Configuration:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address '198.51.100.41/30'
-  set interfaces ethernet eth1 address '192.168.1.1/24'
-  set system host-name 'HUB'
-
-  set interfaces tunnel tun0 address 10.0.0.1/24
-  set interfaces tunnel tun0 encapsulation gre
-  set interfaces tunnel tun0 local-ip 198.51.100.41
-  set interfaces tunnel tun0 multicast enable
-  set interfaces tunnel tun0 parameters ip key 1
-
-  set protocols nhrp tunnel tun0 cisco-authentication SECRET
-  set protocols nhrp tunnel tun0 holding-time  300
-  set protocols nhrp tunnel tun0 multicast dynamic
-  set protocols nhrp tunnel tun0 redirect
-
-  set vpn ipsec ipsec-interfaces interface eth0
-  set vpn ipsec ike-group IKE-HUB proposal 1
-  set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256
-  set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1
-  set vpn ipsec ike-group IKE-HUB proposal 2 encryption aes128
-  set vpn ipsec ike-group IKE-HUB proposal 2 hash sha1
-  set vpn ipsec ike-group IKE-HUB lifetime 3600
-  set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256
-  set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1
-  set vpn ipsec esp-group ESP-HUB proposal 2 encryption 3des
-  set vpn ipsec esp-group ESP-HUB proposal 2 hash md5
-  set vpn ipsec esp-group ESP-HUB lifetime 1800
-  set vpn ipsec esp-group ESP-HUB pfs dh-group2
-
-  set vpn ipsec profile NHRPVPN
-  set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
-  set vpn ipsec profile NHRPVPN authentication pre-shared-secret SECRET
-  set vpn ipsec profile NHRPVPN bind tunnel tun0
-  set vpn ipsec profile NHRPVPN esp-group ESP-HUB
-  set vpn ipsec profile NHRPVPN ike-group IKE-HUB
-
-  set protocols static route 0.0.0.0/0 next-hop 1.1.1.2
-  set protocols static route 192.168.2.0/24 next-hop 10.0.0.2
-  set protocols static route 192.168.3.0/24 next-hop 10.0.0.3
-  
-HUB on AWS Configuration Specifics
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Setting this up on AWS will require a "Custom Protocol Rule" for protocol number "47" (GRE) Allow Rule in TWO places. Firstly on the VPC Network ACL, and secondly on the security group network ACL attached to the EC2 instance. This has been tested as working for the offical AMI image on the AWS Marketplace. (Locate the correct VPC and security group by navigating through the details pane below your EC2 instance in the AWS console)
-
-SPOKE Configuration
-^^^^^^^^^^^^^^^^^^^
-
-SPOKE1 Configuration:
-
-.. code-block:: none
-
-  interfaces
-      tunnel <tunN> {
-          address <ipv4>
-          encapsulation gre
-          local-ip <public ip>
-          multicast enable
-          description <txt>
-          parameters {
-              ip {
-                  <usual IP options>
-              }
-          }
-      }
-  }
-  protocols {
-      nhrp {
-          tunnel <tunN> {
-              cisco-authentication <key phrase>
-              map <ipv4/net> {
-                  nbma-address <ipv4>
-                  register
-              }
-              holding-time <seconds>
-              multicast nhs
-              redirect
-              shortcut
-          }
-      }
-  }
-  vpn {
-      ipsec {
-          esp-group <text> {
-              lifetime <30-86400>
-              mode tunnel
-              pfs enable
-              proposal <1-65535> {
-                  encryption aes256
-                  hash sha1
-              }
-              proposal <1-65535> {
-                  encryption 3des
-                  hash md5
-              }
-          }
-          ike-group <text> {
-              key-exchange ikev1
-              lifetime <30-86400>
-              proposal <1-65535> {
-                  encryption aes256
-                  hash sha1
-              }
-              proposal <1-65535> {
-                  encryption aes128
-                  hash sha1
-              }
-          }
-          ipsec-interfaces {
-              interface <ethN>
-          }
-          profile <text> {
-              authentication {
-                  mode pre-shared-secret
-                  pre-shared-secret <key phrase>
-              }
-              bind {
-                  tunnel <tunN>
-              }
-              esp-group <text>
-              ike-group <text>
-          }
-      }
-  }
-
-SPOKE1 Example Configuration
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address 'dhcp'
-  set interfaces ethernet eth1 address '192.168.2.1/24'
-  set system host-name 'SPOKE1'
-
-  set interfaces tunnel tun0 address 10.0.0.2/24
-  set interfaces tunnel tun0 encapsulation gre
-  set interfaces tunnel tun0 local-ip 0.0.0.0
-  set interfaces tunnel tun0 multicast enable
-  set interfaces tunnel tun0 parameters ip key 1
-
-  set protocols nhrp tunnel tun0 cisco-authentication 'SECRET'
-  set protocols nhrp tunnel tun0 map 10.0.0.1/24 nbma-address 198.51.100.41
-  set protocols nhrp tunnel tun0 map 10.0.0.1/24 'register'
-  set protocols nhrp tunnel tun0 multicast 'nhs'
-  set protocols nhrp tunnel tun0 'redirect'
-  set protocols nhrp tunnel tun0 'shortcut'
-
-  set vpn ipsec ipsec-interfaces interface eth0
-  set vpn ipsec ike-group IKE-SPOKE proposal 1
-  set vpn ipsec ike-group IKE-SPOKE proposal 1 encryption aes256
-  set vpn ipsec ike-group IKE-SPOKE proposal 1 hash sha1
-  set vpn ipsec ike-group IKE-SPOKE proposal 2 encryption aes128
-  set vpn ipsec ike-group IKE-SPOKE proposal 2 hash sha1
-  set vpn ipsec ike-group IKE-SPOKE lifetime 3600
-  set vpn ipsec esp-group ESP-SPOKE proposal 1 encryption aes256
-  set vpn ipsec esp-group ESP-SPOKE proposal 1 hash sha1
-  set vpn ipsec esp-group ESP-SPOKE proposal 2 encryption 3des
-  set vpn ipsec esp-group ESP-SPOKE proposal 2 hash md5
-  set vpn ipsec esp-group ESP-SPOKE lifetime 1800
-  set vpn ipsec esp-group ESP-SPOKE pfs dh-group2
-
-  set vpn ipsec profile NHRPVPN
-  set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
-  set vpn ipsec profile NHRPVPN authentication pre-shared-secret SECRET
-  set vpn ipsec profile NHRPVPN bind tunnel tun0
-  set vpn ipsec profile NHRPVPN esp-group ESP-SPOKE
-  set vpn ipsec profile NHRPVPN ike-group IKE-SPOKE
-
-  set protocols static route 192.168.1.0/24 next-hop 10.0.0.1
-  set protocols static route 192.168.3.0/24 next-hop 10.0.0.3
-
-
-SPOKE2 Configuration
-
-.. code-block:: none
-
-  interfaces
-      tunnel <tunN> {
-          address <ipv4>
-          encapsulation gre
-          local-ip <public ip>
-          multicast enable
-          description <txt>
-          parameters {
-              ip {
-                  <usual IP options>
-              }
-          }
-      }
-  }
-  protocols {
-      nhrp {
-          tunnel <tunN> {
-              cisco-authentication <key phrase>
-              map <ipv4/net> {
-                  nbma-address <ipv4>
-                  register
-              }
-              holding-time <seconds>
-              multicast nhs
-              redirect
-              shortcut
-          }
-      }
-  }
-  vpn {
-      ipsec {
-          esp-group <text> {
-              lifetime <30-86400>
-              mode tunnel
-              pfs enable
-              proposal <1-65535> {
-                  encryption aes256
-                  hash sha1
-              }
-              proposal <1-65535> {
-                  encryption 3des
-                  hash md5
-              }
-          }
-          ike-group <text> {
-              key-exchange ikev1
-              lifetime <30-86400>
-              proposal <1-65535> {
-                  encryption aes256
-                  hash sha1
-              }
-              proposal <1-65535> {
-                  encryption aes128
-                  hash sha1
-              }
-          }
-          ipsec-interfaces {
-              interface <ethN>
-          }
-          profile <text> {
-              authentication {
-                  mode pre-shared-secret
-                  pre-shared-secret <key phrase>
-              }
-              bind {
-                  tunnel <tunN>
-              }
-              esp-group <text>
-              ike-group <text>
-          }
-      }
-  }
-
-SPOKE2 Example Configuration
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address 'dhcp'
-  set interfaces ethernet eth1 address '192.168.3.1/24'
-  set system host-name 'SPOKE2'
-
-  set interfaces tunnel tun0 address 10.0.0.3/24
-  set interfaces tunnel tun0 encapsulation gre
-  set interfaces tunnel tun0 local-ip 0.0.0.0
-  set interfaces tunnel tun0 multicast enable
-  set interfaces tunnel tun0 parameters ip key 1
-
-  set protocols nhrp tunnel tun0 cisco-authentication SECRET
-  set protocols nhrp tunnel tun0 map 10.0.0.1/24 nbma-address 198.51.100.41
-  set protocols nhrp tunnel tun0 map 10.0.0.1/24 register
-  set protocols nhrp tunnel tun0 multicast nhs
-  set protocols nhrp tunnel tun0 redirect
-  set protocols nhrp tunnel tun0 shortcut
-
-  set vpn ipsec ipsec-interfaces interface eth0
-  set vpn ipsec ike-group IKE-SPOKE proposal 1
-  set vpn ipsec ike-group IKE-SPOKE proposal 1 encryption aes256
-  set vpn ipsec ike-group IKE-SPOKE proposal 1 hash sha1
-  set vpn ipsec ike-group IKE-SPOKE proposal 2 encryption aes128
-  set vpn ipsec ike-group IKE-SPOKE proposal 2 hash sha1
-  set vpn ipsec ike-group IKE-SPOKE lifetime 3600
-  set vpn ipsec esp-group ESP-SPOKE proposal 1 encryption aes256
-  set vpn ipsec esp-group ESP-SPOKE proposal 1 hash sha1
-  set vpn ipsec esp-group ESP-SPOKE proposal 2 encryption 3des
-  set vpn ipsec esp-group ESP-SPOKE proposal 2 hash md5
-  set vpn ipsec esp-group ESP-SPOKE lifetime 1800
-  set vpn ipsec esp-group ESP-SPOKE pfs dh-group2
-
-  set vpn ipsec profile NHRPVPN
-  set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
-  set vpn ipsec profile NHRPVPN authentication pre-shared-secret SECRET
-  set vpn ipsec profile NHRPVPN bind tunnel tun0
-  set vpn ipsec profile NHRPVPN esp-group ESP-SPOKE
-  set vpn ipsec profile NHRPVPN ike-group IKE-SPOKE
-
-  set protocols static route 192.168.1.0/24 next-hop 10.0.0.1
-  set protocols static route 192.168.2.0/24 next-hop 10.0.0.2
-
-
-.. _RFC2332: https://tools.ietf.org/html/rfc2332
-.. _RFC1702: https://tools.ietf.org/html/rfc1702
-.. _RFC4301: https://tools.ietf.org/html/rfc4301
diff --git a/docs/vpn/gre-ipsec.rst b/docs/vpn/gre-ipsec.rst
deleted file mode 100644
index 38849f67..00000000
--- a/docs/vpn/gre-ipsec.rst
+++ /dev/null
@@ -1,190 +0,0 @@
-.. _gre-ipsec:
-
-GRE/IPsec
----------
-
-Generic Routing Encapsulation (GRE), GRE/IPsec (or IPIP/IPsec, SIT/IPsec, or any
-other stateless tunnel protocol over IPsec) is the usual way to protect the
-traffic inside a tunnel.
-
-An advantage of this scheme is that you get a real interface with its own
-address, which makes it easier to setup static routes or use dynamic routing
-protocols without having to modify IPsec policies. The other advantage is that
-it greatly simplifies router to router communication, which can be tricky with
-plain IPsec because the external outgoing address of the router usually doesn't
-match the IPsec policy of typical site-to-site setup and you need to add special
-configuration for it, or adjust the source address for outgoing traffic of your
-applications. GRE/IPsec has no such problem and is completely transparent for
-the applications.
-
-GRE/IPIP/SIT and IPsec are widely accepted standards, which make this scheme
-easy to implement between VyOS and virtually any other router.
-
-For simplicity we'll assume that the protocol is GRE, it's not hard to guess
-what needs to be changed to make it work with a different protocol. We assume
-that IPsec will use pre-shared secret authentication and will use AES128/SHA1
-for the cipher and hash. Adjust this as necessary.
-
-.. NOTE:: VMWare users should ensure that VMXNET3 adapters used, e1000 adapters
-   have known issue with GRE processing
-
-IPsec policy matching GRE
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The first and arguably cleaner option is to make your IPsec policy match GRE
-packets between external addresses of your routers. This is the best option if
-both routers have static external addresses.
-
-Suppose the LEFT router has external address 192.0.2.10 on its eth0 interface,
-and the RIGHT router is 203.0.113.45
-
-On the LEFT:
-
-.. code-block:: none
-
-  # GRE tunnel
-  set interfaces tunnel tun0 encapsulation gre
-  set interfaces tunnel tun0 local-ip 192.0.2.10
-  set interfaces tunnel tun0 remote-ip 203.0.113.45
-  set interfaces tunnel tun0 address 10.10.10.1/30
-
-  ## IPsec
-  set vpn ipsec ipsec-interfaces interface eth0
-
-  # IKE group
-  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '2'
-  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes128'
-  set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha1'
-
-  # ESP group
-  set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes128'
-  set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha1'
-
-  # IPsec tunnel
-  set vpn ipsec site-to-site peer 203.0.113.45 authentication mode pre-shared-secret
-  set vpn ipsec site-to-site peer 203.0.113.45 authentication pre-shared-secret MYSECRETKEY
-
-  set vpn ipsec site-to-site peer 203.0.113.45 ike-group MyIKEGroup
-  set vpn ipsec site-to-site peer 203.0.113.45 default-esp-group MyESPGroup
-
-  set vpn ipsec site-to-site peer 203.0.113.45 local-address 192.0.2.10
-
-  # This will match all GRE traffic to the peer
-  set vpn ipsec site-to-site peer 203.0.113.45 tunnel 1 protocol gre
-
-On the RIGHT, setup by analogy and swap local and remote addresses.
-
-
-Source tunnel from loopbacks
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The scheme above doesn't work when one of the routers has a dynamic external
-address though. The classic workaround for this is to setup an address on a
-loopback interface and use it as a source address for the GRE tunnel, then setup
-an IPsec policy to match those loopback addresses.
-
-We assume that the LEFT router has static 192.0.2.10 address on eth0, and the
-RIGHT router has a dynamic address on eth0.
-
-**Setting up the GRE tunnel**
-
-On the LEFT:
-
-.. code-block:: none
-
-  set interfaces loopback lo address 192.168.99.1/32
-
-  set interfaces tunnel tun0 encapsulation gre
-  set interfaces tunnel tun0 address 10.10.10.1/30
-  set interfaces tunnel tun0 local-ip 192.168.99.1
-  set interfaces tunnel tun0 remote-ip 192.168.99.2
-
-On the RIGHT:
-
-.. code-block:: none
-
-  set interfaces loopback lo address 192.168.99.2/32
-
-  set interfaces tunnel tun0 encapsulation gre
-  set interfaces tunnel tun0 address 10.10.10.2/30
-  set interfaces tunnel tun0 local-ip 192.168.99.2
-  set interfaces tunnel tun0 remote-ip 192.168.99.1
-
-**Setting up IPSec**
-
-However, now you need to make IPsec work with dynamic address on one side. The
-tricky part is that pre-shared secret authentication doesn't work with dynamic
-address, so we'll have to use RSA keys.
-
-First, on both routers run the operational command "generate vpn rsa-key bits
-2048". You may choose different length than 2048 of course.
-
-.. code-block:: none
-
-  vyos@left# run generate vpn rsa-key bits 2048
-  Generating rsa-key to /config/ipsec.d/rsa-keys/localhost.key
-
-  Your new local RSA key has been generated
-  The public portion of the key is:
-
-  0sAQO2335[long string here]
-
-Then on the opposite router, add the RSA key to your config.
-
-.. code-block:: none
-
-  set vpn rsa-keys rsa-key-name LEFT rsa-key KEYGOESHERE
-
-Now you are ready to setup IPsec. You'll need to use an ID instead of address
-for the peer on the dynamic side.
-
-On the LEFT (static address):
-
-.. code-block:: none
-
-  set vpn rsa-keys rsa-key-name RIGHT rsa-key <PUBLIC KEY FROM THE RIGHT>
-
-  set vpn ipsec ipsec-interfaces interface eth0
-
-  set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128
-  set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1
-
-  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2
-  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
-  set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1
-
-  set vpn ipsec site-to-site peer @RIGHT authentication mode rsa
-  set vpn ipsec site-to-site peer @RIGHT authentication rsa-key-name RIGHT
-  set vpn ipsec site-to-site peer @RIGHT default-esp-group MyESPGroup
-  set vpn ipsec site-to-site peer @RIGHT ike-group MyIKEGroup
-  set vpn ipsec site-to-site peer @RIGHT local-address 192.0.2.10
-  set vpn ipsec site-to-site peer @RIGHT connection-type respond
-  set vpn ipsec site-to-site peer @RIGHT tunnel 1 local prefix 192.168.99.1/32  # Additional loopback address on the local
-  set vpn ipsec site-to-site peer @RIGHT tunnel 1 remote prefix 192.168.99.2/32 # Additional loopback address on the remote
-
-
-On the RIGHT (dynamic address):
-
-.. code-block:: none
-
-  set vpn rsa-keys rsa-key-name LEFT rsa-key <PUBLIC KEY FROM THE LEFT>
-
-  set vpn ipsec ipsec-interfaces interface eth0
-
-  set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128
-  set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1
-
-  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2
-  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
-  set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1
-
-  set vpn ipsec site-to-site peer 192.0.2.10 authentication id @RIGHT
-  set vpn ipsec site-to-site peer 192.0.2.10 authentication mode rsa
-  set vpn ipsec site-to-site peer 192.0.2.10 authentication rsa-key-name LEFT
-  set vpn ipsec site-to-site peer 192.0.2.10 remote-id @LEFT
-  set vpn ipsec site-to-site peer 192.0.2.10 connection-type initiate
-  set vpn ipsec site-to-site peer 192.0.2.10 default-esp-group MyESPGroup
-  set vpn ipsec site-to-site peer 192.0.2.10 ike-group MyIKEGroup
-  set vpn ipsec site-to-site peer 192.0.2.10 local-address any
-  set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 local prefix 192.168.99.2/32  # Additional loopback address on the local
-  set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 remote prefix 192.168.99.1/32 # Additional loopback address on the remote
diff --git a/docs/vpn/index.rst b/docs/vpn/index.rst
deleted file mode 100644
index 055a2d5c..00000000
--- a/docs/vpn/index.rst
+++ /dev/null
@@ -1,19 +0,0 @@
-.. _vpn:
-
-.. include:: references.rst
-
-VPN
-===
-
-This chapter describes the available VPN services provided by VyOS.
-
-.. toctree::
-   :hidden:
-
-   openvpn
-   l2tp
-   site2site_ipsec
-   gre-ipsec
-   dmvpn
-   pptp
-   wireguard
diff --git a/docs/vpn/l2tp.rst b/docs/vpn/l2tp.rst
deleted file mode 100644
index 64223475..00000000
--- a/docs/vpn/l2tp.rst
+++ /dev/null
@@ -1,131 +0,0 @@
-.. _l2tp:
-
-L2TP over IPsec
----------------
-
-Example for configuring a simple L2TP over IPsec VPN for remote access (works
-with native Windows and Mac VPN clients):
-
-.. code-block:: none
-
-  set vpn ipsec ipsec-interfaces interface eth0
-  set vpn ipsec nat-traversal enable
-  set vpn ipsec nat-networks allowed-network 0.0.0.0/0
-
-  set vpn l2tp remote-access outside-address 203.0.113.2
-  set vpn l2tp remote-access client-ip-pool start 192.168.255.1
-  set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
-  set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
-  set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret <secret>
-  set vpn l2tp remote-access authentication mode local
-  set vpn l2tp remote-access authentication local-users username <username> password <password>
-
-In the example above an external IP of 203.0.113.2 is assumed.
-
-If a local firewall policy is in place on your external interface you will need
-to open:
-
-* UDP port 500 (IKE)
-* IP protocol number 50 (ESP)
-* UDP port 1701 for IPsec
-
-In addition when NAT is detected by the VPN client ESP is encapsulated in UDP
-for NAT-traversal:
-
-* UDP port 4500 (NAT-T)
-
-Example:
-
-.. code-block:: none
-
-  set firewall name OUTSIDE-LOCAL rule 40 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 40 protocol 'esp'
-  set firewall name OUTSIDE-LOCAL rule 41 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 41 destination port '500'
-  set firewall name OUTSIDE-LOCAL rule 41 protocol 'udp'
-  set firewall name OUTSIDE-LOCAL rule 42 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 42 destination port '4500'
-  set firewall name OUTSIDE-LOCAL rule 42 protocol 'udp'
-  set firewall name OUTSIDE-LOCAL rule 43 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 43 destination port '1701'
-  set firewall name OUTSIDE-LOCAL rule 43 ipsec 'match-ipsec'
-  set firewall name OUTSIDE-LOCAL rule 43 protocol 'udp'
-
-Also note that if you wish to allow the VPN to be used for external access you
-will need to add the appropriate source NAT rules to your configuration.
-
-.. code-block:: none
-
-  set nat source rule 110 outbound-interface 'eth0'
-  set nat source rule 110 source address '192.168.255.0/24'
-  set nat source rule 110 translation address masquerade
-
-To be able to resolve when connected to the VPN, the following DNS rules are
-needed as well.
-
-.. code-block:: none
-
-  set vpn l2tp remote-access dns-servers server-1 '8.8.8.8'
-  set vpn l2tp remote-access dns-servers server-2 '8.8.4.4'
-
-.. note:: Those are the `Google public DNS`_ servers. You can also use the
-   public available servers from Quad9_ (9.9.9.9) or Cloudflare_ (1.1.1.1).
-
-Established sessions can be viewed using the **show vpn remote-access**
-operational command.
-
-.. code-block:: none
-
-  vyos@vyos:~$ show vpn remote-access
-  Active remote access VPN sessions:
-  User            Proto Iface     Tunnel IP       TX byte RX byte  Time
-  ----            ----- -----     ---------       ------- -------  ----
-  vyos            L2TP  l2tp0     192.168.255.1      3.2K    8.0K  00h06m13s
-
-RADIUS authentication
-^^^^^^^^^^^^^^^^^^^^^
-
-The above configuration made use of local accounts on the VyOS router for
-authenticating L2TP/IPSec clients. In bigger environments usually something
-like RADIUS_ (FreeRADIUS_ or Microsoft `Network Policy Server`_, NPS) is used.
-
-VyOS supports either `local` or `radius` user authentication:
-
-.. code-block:: none
-
-  set vpn l2tp remote-access authentication mode <local|radius>
-
-In addition one or more RADIUS_ servers can be configured to server for user
-authentication. This is done using the `radius server` and `radius server key`
-nodes:
-
-.. code-block:: none
-
-  set vpn l2tp remote-access authentication radius server 1.1.1.1 key 'foo'
-  set vpn l2tp remote-access authentication radius server 2.2.2.2 key 'foo'
-
-.. note:: Some RADIUS_ severs make use of an access control list who is allowed
-   to query the server. Please configure your VyOS router in the allowed client
-   list.
-
-RADIUS source address
-*********************
-
-If you are using e.g. OSPF as IGP always the nearest interface facing the RADIUS
-server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests to a
-single source IP e.g. the loopback interface.
-
-.. code-block:: none
-
-  set vpn l2tp remote-access authentication radius source-address 3.3.3.3
-
-Above command will use `3.3.3.3` as source IPv4 address for all RADIUS queries
-on this NAS.
-
-
-.. _`Google Public DNS`: https://developers.google.com/speed/public-dns
-.. _Quad9: https://quad9.net
-.. _CloudFlare: https://blog.cloudflare.com/announcing-1111
-.. _RADIUS: https://en.wikipedia.org/wiki/RADIUS
-.. _FreeRADIUS: https://freeradius.org
-.. _`Network Policy Server`: https://en.wikipedia.org/wiki/Network_Policy_Server
diff --git a/docs/vpn/openvpn.rst b/docs/vpn/openvpn.rst
deleted file mode 100644
index 1462e202..00000000
--- a/docs/vpn/openvpn.rst
+++ /dev/null
@@ -1,467 +0,0 @@
-.. _openvpn:
-
-OpenVPN
--------
-
-Traditionally hardware routers implement IPsec exclusively due to relative
-ease of implementing it in hardware and insufficient CPU power for doing
-encryption in software. Since VyOS is a software router, this is less of a
-concern. OpenVPN has been widely used on UNIX platform for a long time and is
-a popular option for remote access VPN, though it's also capable of
-site-to-site connections.
-
-Advantages of OpenVPN are:
-
-* It uses a single TCP or UDP connection and does not rely on packet source
-  addresses, so it will work even through a double NAT: perfect for public
-  hotspots and such
-
-* It's easy to setup and offers very flexible split tunneling
-
-* There's a variety of client GUI frontends for any platform
-
-Disadvantages are:
-
-* It's slower than IPsec due to higher protocol overhead and the fact it runs
-  in user mode while IPsec, on Linux, is in kernel mode
-
-* None of the operating systems have client software installed by default
-
-In the VyOS CLI, a key point often overlooked is that rather than being
-configured using the `set vpn` stanza, OpenVPN is configured as a network
-interface using `set interfaces openvpn`.
-
-OpenVPN Site-To-Site
-^^^^^^^^^^^^^^^^^^^^
-
-While many are aware of OpenVPN as a Client VPN solution, it is often
-overlooked as a site-to-site VPN solution due to lack of support for this mode
-in many router platforms.
-
-Site-to-site mode supports x.509 but doesn't require it and can also work with
-static keys, which is simpler in many cases. In this example, we'll configure
-a simple site-to-site OpenVPN tunnel using a 2048-bit pre-shared key.
-
-First, one one of the systems generate the key using the operational command
-`generate openvpn key <filename>`. This will generate a key with the name
-provided in the `/config/auth/` directory. Once generated, you will need to
-copy this key to the remote router.
-
-In our example, we used the filename `openvpn-1.key` which we will reference
-in our configuration.
-
-* The public IP address of the local side of the VPN will be 198.51.100.10
-* The remote will be 203.0.113.11
-* The tunnel will use 10.255.1.1 for the local IP and 10.255.1.2 for the remote.
-* OpenVPN allows for either TCP or UDP. UDP will provide the lowest latency,
-  while TCP will work better for lossy connections; generally UDP is preferred
-  when possible.
-* The official port for OpenVPN is 1194, which we reserve for client VPN; we
-  will use 1195 for site-to-site VPN.
-* The `persistent-tunnel` directive will allow us to configure tunnel-related
-  attributes, such as firewall policy as we would on any normal network
-  interface.
-* If known, the IP of the remote router can be configured using the
-  `remote-host` directive; if unknown, it can be omitted. We will assume a
-  dynamic IP for our remote router.
-
-Local Configuration:
-
-.. code-block:: none
-
-  set interfaces openvpn vtun1 mode site-to-site
-  set interfaces openvpn vtun1 protocol udp
-  set interfaces openvpn vtun1 persistent-tunnel
-  set interfaces openvpn vtun1 local-host '198.51.100.10'
-  set interfaces openvpn vtun1 local-port '1195'
-  set interfaces openvpn vtun1 remote-port '1195'
-  set interfaces openvpn vtun1 shared-secret-key-file '/config/auth/openvpn-1.key'
-  set interfaces openvpn vtun1 local-address '10.255.1.1'
-  set interfaces openvpn vtun1 remote-address '10.255.1.2'
-
-Remote Configuration:
-
-.. code-block:: none
-
-  set interfaces openvpn vtun1 mode site-to-site
-  set interfaces openvpn vtun1 protocol udp
-  set interfaces openvpn vtun1 persistent-tunnel
-  set interfaces openvpn vtun1 remote-host '198.51.100.10'
-  set interfaces openvpn vtun1 local-port '1195'
-  set interfaces openvpn vtun1 remote-port '1195'
-  set interfaces openvpn vtun1 shared-secret-key-file '/config/auth/openvpn-1.key'
-  set interfaces openvpn vtun1 local-address '10.255.1.2'
-  set interfaces openvpn vtun1 remote-address '10.255.1.1'
-
-The configurations above will default to using 128-bit Blowfish in CBC mode
-for encryption and SHA-1 for HMAC authentication. These are both considered
-weak, but a number of other encryption and hashing algorithms are available:
-
-For Encryption:
-
-.. code-block:: none
-
-  vyos@vyos# set interfaces openvpn vtun1 encryption
-  Possible completions:
-    des          DES algorithm
-    3des         DES algorithm with triple encryption
-    bf128        Blowfish algorithm with 128-bit key
-    bf256        Blowfish algorithm with 256-bit key
-    aes128       AES algorithm with 128-bit key
-    aes192       AES algorithm with 192-bit key
-    aes256       AES algorithm with 256-bit key
-
-For Hashing:
-
-.. code-block:: none
-
-  vyos@vyos# set interfaces openvpn vtun1 hash
-  Possible completions:
-    md5          MD5 algorithm
-    sha1         SHA-1 algorithm
-    sha256       SHA-256 algorithm
-    sha512       SHA-512 algorithm
-
-If you change the default encryption and hashing algorithms, be sure that the
-local and remote ends have matching configurations, otherwise the tunnel will
-not come up.
-
-Static routes can be configured referencing the tunnel interface; for example,
-the local router will use a network of 10.0.0.0/16, while the remote has a
-network of 10.1.0.0/16:
-
-Local Configuration:
-
-.. code-block:: none
-
-  set protocols static interface-route 10.1.0.0/16 next-hop-interface vtun1
-
-Remote Configuration:
-
-.. code-block:: none
-
-  set protocols static interface-route 10.0.0.0/16 next-hop-interface vtun1
-
-Firewall policy can also be applied to the tunnel interface for `local`, `in`,
-and `out` directions and function identically to ethernet interfaces.
-
-If making use of multiple tunnels, OpenVPN must have a way to distinguish
-between different tunnels aside from the pre-shared-key. This is either by
-referencing IP address or port number. One option is to dedicate a public IP
-to each tunnel. Another option is to dedicate a port number to each tunnel
-(e.g. 1195,1196,1197...).
-
-OpenVPN status can be verified using the `show openvpn` operational commands.
-See the built-in help for a complete list of options.
-
-OpenVPN Server
-^^^^^^^^^^^^^^
-
-Multi-client server is the most popular OpenVPN mode on routers. It always uses
-x.509 authentication and therefore requires a PKI setup. This guide assumes you
-have already setup a PKI and have a CA certificate, a server certificate and
-key, a certificate revocation list, a Diffie-Hellman key exchange parameters
-file. You do not need client certificates and keys for the server setup.
-
-In this example we will use the most complicated case: a setup where each
-client is a router that has its own subnet (think HQ and branch offices), since
-simpler setups are subsets of it.
-
-Suppose you want to use 10.23.1.0/24 network for client tunnel endpoints and
-all client subnets belong to 10.23.0.0/20. All clients need access to the
-192.168.0.0/16 network.
-
-First we need to specify the basic settings. 1194/UDP is the default. The
-`persistent-tunnel` option is recommended, it prevents the TUN/TAP device from
-closing on connection resets or daemon reloads.
-
-
-.. note:: Using **openvpn-option -reneg-sec** can be tricky. This option is used to renegotiate data channel after n seconds. When used at both server and client, the lower value will trigger the renegotiation. If you set it to 0 on one side of the connection (to disable it), the chosen value on the other side will determine when the renegotiation will occur.
-
-
-.. code-block:: none
-
-  set interfaces openvpn vtun10 mode server
-  set interfaces openvpn vtun10 local-port 1194
-  set interfaces openvpn vtun10 persistent-tunnel
-  set interfaces openvpn vtun10 protocol udp
-
-Then we need to specify the location of the cryptographic materials. Suppose
-you keep the files in `/config/auth/openvpn`
-
-.. code-block:: none
-
-  set interfaces openvpn vtun10 tls ca-cert-file /config/auth/openvpn/ca.crt
-  set interfaces openvpn vtun10 tls cert-file /config/auth/openvpn/server.crt
-  set interfaces openvpn vtun10 tls key-file /config/auth/openvpn/server.key
-  set interfaces openvpn vtun10 tls crl-file /config/auth/openvpn/crl.pem
-  set interfaces openvpn vtun10 tls dh-file /config/auth/openvpn/dh2048.pem
-
-Now we need to specify the server network settings. In all cases we need to
-specify the subnet for client tunnel endpoints. Since we want clients to access
-a specific network behind out router, we will use a push-route option for
-installing that route on clients.
-
-.. code-block:: none
-
-  set interfaces openvpn vtun10 server push-route 192.168.0.0/16
-  set interfaces openvpn vtun10 server subnet 10.23.1.0/24
-
-Since it's a HQ and branch offices setup, we will want all clients to have
-fixed addresses and we will route traffic to specific subnets through them. We
-need configuration for each client to achieve this.
-
-.. note:: Clients are identified by the CN field of their x.509 certificates,
-   in this example the CN is ``client0``:
-
-.. code-block:: none
-
-  set interfaces openvpn vtun10 server client client0 ip 10.23.1.10
-  set interfaces openvpn vtun10 server client client0 subnet 10.23.2.0/25
-
-OpenVPN **will not** automatically create routes in the kernel for client
-subnets when they connect and will only use client-subnet association
-internally, so we need to create a route to the 10.23.0.0/20 network ourselves:
-
-.. code-block:: none
-
-  set protocols static interface-route 10.23.0.0/20 next-hop-interface vtun10
-
-
-Client Authentication
-*********************
-
-OpenLDAP
-========
-
-Enterprise installations usually ship a kind of directory service which is used
-to have a single password store for all employees. VyOS and OpenVPN support using
-LDAP/AD as single user backend.
-
-Authentication is done by using the ``openvpn-auth-ldap.so`` plugin which is
-shipped with every VyOS installation. A dedicated configuration file is required.
-It is best practise to store it in ``/config`` to survive image updates
-
-.. code-block:: none
-
-  set interfaces openvpn vtun0 openvpn-option "--plugin /usr/lib/openvpn/openvpn-auth-ldap.so /config/auth/ldap-auth.config"
-
-The required config file may look like:
-
-.. code-block:: none
-
-  <LDAP>
-  # LDAP server URL
-  URL             ldap://ldap.example.com
-  # Bind DN (If your LDAP server doesn't support anonymous binds)
-  BindDN          cn=LDAPUser,dc=example,dc=com
-  # Bind Password password
-  Password        S3cr3t
-  # Network timeout (in seconds)
-  Timeout         15
-  </LDAP>
-
-  <Authorization>
-  # Base DN
-  BaseDN          "ou=people,dc=example,dc=com"
-  # User Search Filter
-  SearchFilter    "(&(uid=%u)(objectClass=shadowAccount))"
-  # Require Group Membership - allow all users
-  RequireGroup    false
-  </Authorization>
-
-Active Directory
-================
-
-Despite the fact that AD is a superset of LDAP
-
-.. code-block:: none
-
-  <LDAP>
-    # LDAP server URL
-    URL ldap://dc01.example.com
-    # Bind DN (If your LDAP server doesn’t support anonymous binds)
-    BindDN CN=LDAPUser,DC=example,DC=com
-    # Bind Password
-    Password mysecretpassword
-    # Network timeout (in seconds)
-    Timeout  15
-    # Enable Start TLS
-    TLSEnable no
-    # Follow LDAP Referrals (anonymously)
-    FollowReferrals no
-  </LDAP>
-
-  <Authorization>
-    # Base DN
-    BaseDN        "DC=example,DC=com"
-    # User Search Filter, user must be a member of the VPN AD group
-    SearchFilter  "(&(sAMAccountName=%u)(memberOf=CN=VPN,OU=Groups,DC=example,DC=com))"
-    # Require Group Membership
-    RequireGroup    false # already handled by SearchFilter
-    <Group>
-      BaseDN        "OU=Groups,DC=example,DC=com"
-      SearchFilter  "(|(cn=VPN))"
-      MemberAttribute  memberOf
-    </Group>
-  </Authorization>
-
-If you only want to check if the user account is enabled and can authenticate
-(against the primary group) the following snipped is sufficient:
-
-.. code-block:: none
-
-  <LDAP>
-    URL ldap://dc01.example.com
-    BindDN CN=SA_OPENVPN,OU=ServiceAccounts,DC=example,DC=com
-    Password ThisIsTopSecret
-    Timeout  15
-    TLSEnable no
-    FollowReferrals no
-  </LDAP>
-
-  <Authorization>
-    BaseDN          "DC=example,DC=com"
-    SearchFilter    "sAMAccountName=%u"
-    RequireGroup    false
-  </Authorization>
-
-A complete LDAP auth OpenVPN configuration could look like the following example:
-
-.. code-block:: none
-
-  vyos@vyos# show interfaces openvpn
-   openvpn vtun0 {
-       mode server
-       openvpn-option "--tun-mtu 1500 --fragment 1300 --mssfix"
-       openvpn-option "--plugin /usr/lib/openvpn/openvpn-auth-ldap.so /config/auth/ldap-auth.config"
-       openvpn-option "--push redirect-gateway"
-       openvpn-option --duplicate-cn
-       openvpn-option --client-cert-not-required
-       openvpn-option --comp-lzo
-       openvpn-option --persist-key
-       openvpn-option --persist-tun
-       server {
-           domain-name example.com
-           max-connections 5
-           name-server 1.1.1.1
-           name-server 9.9.9.9
-           subnet 172.18.100.128/29
-       }
-       tls {
-           ca-cert-file /config/auth/ca.crt
-           cert-file /config/auth/server.crt
-           dh-file /config/auth/dh1024.pem
-           key-file /config/auth/server.key
-       }
-   }
-
-OpenVPN Client
-^^^^^^^^^^^^^^
-
-VyOS can not only act as an OpenVPN site-to-site or Server for multiple clients.
-You can indeed also configure any VyOS OpenVPN interface as an OpenVPN client
-connecting to a VyOS OpenVPN server or any other OpenVPN server.
-
-Given the following example we have one VyOS router acting as OpenVPN server
-and another VyOS router acting as OpenVPN client. The Server also pushes a
-static client IP address to the OpenVPN client. Remember, clients are identified
-using their CN attribute in the SSL certificate.
-
-
-Server
-******
-
-.. code-block:: none
-
-  set interfaces openvpn vtun10 encryption 'aes256'
-  set interfaces openvpn vtun10 hash 'sha512'
-  set interfaces openvpn vtun10 local-host '172.18.201.10'
-  set interfaces openvpn vtun10 local-port '1194'
-  set interfaces openvpn vtun10 mode 'server'
-  set interfaces openvpn vtun10 persistent-tunnel
-  set interfaces openvpn vtun10 protocol 'udp'
-  set interfaces openvpn vtun10 server client client1 ip '10.10.0.10'
-  set interfaces openvpn vtun10 server domain-name 'vyos.net'
-  set interfaces openvpn vtun10 server max-connections '250'
-  set interfaces openvpn vtun10 server name-server '172.16.254.30'
-  set interfaces openvpn vtun10 server subnet '10.10.0.0/24'
-  set interfaces openvpn vtun10 server topology 'subnet'
-  set interfaces openvpn vtun10 tls ca-cert-file '/config/auth/ca.crt'
-  set interfaces openvpn vtun10 tls cert-file '/config/auth/server.crt'
-  set interfaces openvpn vtun10 tls dh-file '/config/auth/dh.pem'
-  set interfaces openvpn vtun10 tls key-file '/config/auth/server.key'
-  set interfaces openvpn vtun10 use-lzo-compression
-
-Client
-******
-
-.. code-block:: none
-
-  set interfaces openvpn vtun10 encryption 'aes256'
-  set interfaces openvpn vtun10 hash 'sha512'
-  set interfaces openvpn vtun10 mode 'client'
-  set interfaces openvpn vtun10 persistent-tunnel
-  set interfaces openvpn vtun10 protocol 'udp'
-  set interfaces openvpn vtun10 remote-host '172.18.201.10'
-  set interfaces openvpn vtun10 remote-port '1194'
-  set interfaces openvpn vtun10 tls ca-cert-file '/config/auth/ca.crt'
-  set interfaces openvpn vtun10 tls cert-file '/config/auth/client1.crt'
-  set interfaces openvpn vtun10 tls key-file '/config/auth/client1.key'
-  set interfaces openvpn vtun10 use-lzo-compression
-
-Options
-^^^^^^^
-
-We do not have CLI nodes for every single OpenVPN options. If an option is
-missing, a feature request should be opened at https://phabricator.vyos.net so
-all users can benefit from it.
-
-If you are a hacker or want to try on your own we support passing raw OpenVPN
-options to OpenVPN.
-
-.. code-block:: none
-
-  set interfaces openvpn vtun10 openvpn-option 'persistent-key'
-
-Will add `persistent-key` at the end of the generated OpenVPN configuration.
-Please use this only as last resort - things might break and OpenVPN won't start
-if you pass invalid options/syntax.
-
-Troubleshooting
-===============
-
-VyOS provides some operational commands on OpenVPN.
-
-Check status
-------------
-
-The following commands let you check tunnel status.
-
-.. opcmd:: show openvpn client status
-
-   Use this command to check the tunnel status for OpenVPN client.
-
-.. opcmd:: show openvpn server status
-
-   Use this command to check the tunnel status for OpenVPN server.
-
-.. opcmd:: show openvpn site-to-site status
-
-   Use this command to check the tunnel status for OpenVPN site-to-site.
-
-
-Reset OpenVPN
--------------
-
-The following commands let you reset OpenVPN.
-
-.. opcmd:: reset openvpn client <text>
-
-   Use this command to reset specified OpenVPN client.
-
-.. opcmd:: reset openvpn interface <interface>
-
-   Uset this command to reset the OpenVPN process on a specific interface.
-
-
diff --git a/docs/vpn/pptp.rst b/docs/vpn/pptp.rst
deleted file mode 100644
index 72b3feb0..00000000
--- a/docs/vpn/pptp.rst
+++ /dev/null
@@ -1,47 +0,0 @@
-.. _pptp:
-
-PPTP-Server
------------
-
-The Point-to-Point Tunneling Protocol (PPTP_) has been implemented in VyOS only for backwards compatibility.
-PPTP has many well known security issues and you should use one of the many other new VPN implementations.
-
-As per default and if not otherwise defined, mschap-v2 is being used for authentication and mppe 128-bit (stateless) for encryption.
-If no gateway-address is set within the configuration, the lowest IP out of the /24 client-ip-pool is being used. For instance, in the example below it would be 192.168.0.1.
-
-server example
-^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  set vpn pptp remote-access authentication local-users username test password 'test'
-  set vpn pptp remote-access authentication mode 'local'
-  set vpn pptp remote-access client-ip-pool start '192.168.0.10'
-  set vpn pptp remote-access client-ip-pool stop '192.168.0.15'
-  set vpn pptp remote-access gateway-address '10.100.100.1'
-  set vpn pptp remote-access outside-address '10.1.1.120'
-
-
-client example (debian 9)
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Install the client software via apt and execute pptpsetup to generate the configuration.
-
-
-.. code-block:: none
-
-  apt-get install pptp-linux
-  pptpsetup --create TESTTUNNEL --server 10.1.1.120 --username test --password test --encrypt
-  pon TESTTUNNEL
-
-The command pon TESTUNNEL establishes the PPTP tunnel to the remote system.
-
-
-All tunnel sessions can be checked via:
-
-.. code-block:: none
-
-  run sh pptp-server sessions
-   ifname | username | calling-sid |      ip      | type | comp | state  |  uptime
-  --------+----------+-------------+--------------+------+------+--------+----------
-   ppp0   | test     | 10.1.1.99   | 192.168.0.10 | pptp | mppe | active | 00:00:58
diff --git a/docs/vpn/references.rst b/docs/vpn/references.rst
deleted file mode 100644
index 49b65cb0..00000000
--- a/docs/vpn/references.rst
+++ /dev/null
@@ -1,10 +0,0 @@
-.. _`Google Public DNS`: https://developers.google.com/speed/public-dns
-.. _Quad9: https://quad9.net
-.. _CloudFlare: https://blog.cloudflare.com/announcing-1111
-.. _RADIUS: https://en.wikipedia.org/wiki/RADIUS
-.. _FreeRADIUS: https://freeradius.org
-.. _`Network Policy Server`: https://en.wikipedia.org/wiki/Network_Policy_Server
-.. _RFC2332: https://tools.ietf.org/html/rfc2332
-.. _RFC1702: https://tools.ietf.org/html/rfc1702
-.. _RFC4301: https://tools.ietf.org/html/rfc4301
-.. _PPTP: https://en.wikipedia.org/wiki/Point-to-Point_Tunneling_Protocol
diff --git a/docs/vpn/site2site_ipsec.rst b/docs/vpn/site2site_ipsec.rst
deleted file mode 100644
index bdafd6ce..00000000
--- a/docs/vpn/site2site_ipsec.rst
+++ /dev/null
@@ -1,299 +0,0 @@
-.. _size2site_ipsec:
-
-Site-to-Site
-============
-
-Site-to-site mode provides a way to add remote peers, which could be configured to exchange encrypted information between them and VyOS itself or connected/routed networks.
-
-To configure site-to-site connection you need to add peers with the ``set vpn ipsec site-to-site`` command.
-
-You can identify a remote peer with:
-
-* IPv4 or IPv6 address. This mode is easiest for configuration and mostly used when a peer has a public static IP address;
-* Hostname. This mode is similar to IP address, only you define DNS name instead of an IP. Could be used when a peer has a public IP address and DNS name, but an IP address could be changed from time to time;
-* Remote ID of the peer. In this mode, there is no predefined remote address nor DNS name of the peer. This mode is useful when a peer doesn't have a publicly available IP address (NAT between it and VyOS), or IP address could be changed.
-
-Each site-to-site peer has the next options:
-
-* ``authentication`` - configure authentication between VyOS and a remote peer. Suboptions:
-
- * ``id`` - ID for the local VyOS router. If defined, during the authentication it will be send to remote peer;
-
- * ``mode`` - mode for authentication between VyOS and remote peer:
-
-  * ``pre-shared-secret`` - use predefined shared secret phrase, must be the same for local and remote side;
-
-  * ``rsa`` - use simple shared RSA key. The key must be defined in the ``set vpn rsa-keys`` section;
-
-  * ``x509`` - use certificates infrastructure for authentication.
-
- * ``pre-shared-secret`` - predefined shared secret. Used if configured ``mode pre-shared-secret``;
-
- * ``remote-id`` - define an ID for remote peer, instead of using peer name or address. Useful in case if the remote peer is behind NAT or if ``mode x509`` is used;
-
- * ``rsa-key-name`` - shared RSA key for authentication. The key must be defined in the ``set vpn rsa-keys`` section;
-
- * ``use-x509-id`` - use local ID from x509 certificate. Cannot be used when ``id`` is defined;
-
- * ``x509`` - options for x509 authentication mode:
-
-  * ``ca-cert-file`` - CA certificate file. Using for authenticating remote peer;
-
-  * ``cert-file`` - certificate file, which will be used for authenticating local router on remote peer;
-
-  * ``crl-file`` - file with the Certificate Revocation List. Using to check if a certificate for the remote peer is valid or revoked;
-
-  * ``key`` - a private key, which will be used for authenticating local router on remote peer:
-
-   * ``file`` - path to the key file;
-
-   * ``password`` - passphrase private key, if needed.
-
-* ``connection-type`` - how to handle this connection process. Possible variants:
-
- * ``initiate`` - do initial connection to remote peer immediately after configuring and after boot. In this mode the connection will not be restarted in case of disconnection, therefore should be used only together with DPD or another session tracking methods;
-
- * ``respond`` - do not try to initiate a connection to a remote peer. In this mode, the IPSec session will be established only after initiation from a remote peer. Could be useful when there is no direct connectivity to the peer due to firewall or NAT in the middle of the local and remote side.
-
-* ``default-esp-group`` - ESP group to use by default for traffic encryption. Might be overwritten by individual settings for tunnel or VTI interface binding;
-
-* ``description`` - description for this peer;
-
-* ``dhcp-interface`` - use an IP address, received from DHCP for IPSec connection with this peer, instead of ``local-address``;
-
-* ``force-encapsulation`` - force encapsulation of ESP into UDP datagrams. Useful in case if between local and remote side is firewall or NAT, which not allows passing plain ESP packets between them;
-
-* ``ike-group`` - IKE group to use for key exchanges;
-
-* ``ikev2-reauth`` - reauthenticate remote peer during the rekeying process. Can be used only with IKEv2:
-
- * ``yes`` - create a new IKE_SA from the scratch and try to recreate all IPsec SAs;
-
- * ``no`` - rekey without uninstalling the IPsec SAs;
-
- * ``inherit`` - use default behavior for the used IKE group.
-
-* ``local-address`` - local IP address for IPSec connection with this peer. If defined ``any``, then an IP address which configured on interface with default route will be used;
-
-* ``tunnel`` - define criteria for traffic to be matched for encrypting and send it to a peer:
-
- * ``disable`` - disable this tunnel;
-
- * ``esp-group`` - define ESP group for encrypt traffic, defined by this tunnel;
-
- * ``local`` - define a local source for match traffic, which should be encrypted and send to this peer:
-
-  * ``port`` - define port. Have effect only when used together with ``prefix``;
-
-  * ``prefix`` - IP network at local side.
-
- * ``protocol`` - define the protocol for match traffic, which should be encrypted and send to this peer;
-
- * ``remote`` - define the remote destination for match traffic, which should be encrypted and send to this peer:
-
-  * ``port`` - define port. Have effect only when used together with ``prefix``;
-
-  * ``prefix`` - IP network at remote side.
-
-* ``vti`` - use a VTI interface for traffic encryption. Any traffic, which will be send to VTI interface will be encrypted and send to this peer. Using VTI makes IPSec configuration much flexible and easier in complex situation, and allows to dynamically add/delete remote networks, reachable via a peer, as in this mode router don't need to create additional SA/policy for each remote network:
-
- * ``bind`` - select a VTI interface to bind to this peer;
-
- * ``esp-group`` - define ESP group for encrypt traffic, passed this VTI interface.
-
-Examples:
-------------------
-
-IKEv1
-^^^^^
-
-Example:
-
-* WAN interface on `eth1`
-* left subnet: `192.168.0.0/24` site1, server side (i.e. locality, actually
-  there is no client or server roles)
-* left local_ip: `198.51.100.3` # server side WAN IP
-* right subnet: `10.0.0.0/24` site2,remote office side
-* right local_ip: `203.0.113.2` # remote office side WAN IP
-
-.. code-block:: none
-
-  # server config
-  set vpn ipsec esp-group office-srv-esp compression 'disable'
-  set vpn ipsec esp-group office-srv-esp lifetime '1800'
-  set vpn ipsec esp-group office-srv-esp mode 'tunnel'
-  set vpn ipsec esp-group office-srv-esp pfs 'enable'
-  set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
-  set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
-  set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
-  set vpn ipsec ike-group office-srv-ike lifetime '3600'
-  set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
-  set vpn ipsec ipsec-interfaces interface 'eth1'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'SomePreSharedKey'
-  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'office-srv-ike'
-  set vpn ipsec site-to-site peer 203.0.113.2 local-address '198.51.100.3'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 allow-nat-networks 'disable'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 allow-public-networks 'disable'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 esp-group 'office-srv-esp'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 local prefix '192.168.0.0/24'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 remote prefix '10.0.0.0/21'
-
-  # remote office config
-  set vpn ipsec esp-group office-srv-esp compression 'disable'
-  set vpn ipsec esp-group office-srv-esp lifetime '1800'
-  set vpn ipsec esp-group office-srv-esp mode 'tunnel'
-  set vpn ipsec esp-group office-srv-esp pfs 'enable'
-  set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
-  set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
-  set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
-  set vpn ipsec ike-group office-srv-ike lifetime '3600'
-  set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
-  set vpn ipsec ipsec-interfaces interface 'eth1'
-  set vpn ipsec site-to-site peer 198.51.100.3 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 198.51.100.3 authentication pre-shared-secret 'SomePreSharedKey'
-  set vpn ipsec site-to-site peer 198.51.100.3 ike-group 'office-srv-ike'
-  set vpn ipsec site-to-site peer 198.51.100.3 local-address '203.0.113.2'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 allow-nat-networks 'disable'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 allow-public-networks 'disable'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 esp-group 'office-srv-esp'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 local prefix '10.0.0.0/21'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 remote prefix '192.168.0.0/24'
-
-Show status of new setup:
-
-.. code-block:: none
-
-  vyos@srv-gw0:~$ show vpn ike sa
-  Peer ID / IP                            Local ID / IP
-  ------------                            -------------
-  203.0.113.2                                 198.51.100.3
-     State  Encrypt  Hash    D-H Grp  NAT-T  A-Time  L-Time
-     -----  -------  ----    -------  -----  ------  ------
-     up     aes256   sha1    5        no     734     3600
-
-  vyos@srv-gw0:~$ show vpn ipsec sa
-  Peer ID / IP                            Local ID / IP
-  ------------                            -------------
-  203.0.113.2                                 198.51.100.3
-     Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
-     ------  -----  -------------  -------  ----    -----  ------  ------  -----
-     0       up     7.5M/230.6K    aes256   sha1    no     567     1800    all
-
-If there is SNAT rules on eth1, need to add exclude rule
-
-.. code-block:: none
-
-  # server side
-  set nat source rule 10 destination address '10.0.0.0/24'
-  set nat source rule 10 'exclude'
-  set nat source rule 10 outbound-interface 'eth1'
-  set nat source rule 10 source address '192.168.0.0/24'
-
-  # remote office side
-  set nat source rule 10 destination address '192.168.0.0/24'
-  set nat source rule 10 'exclude'
-  set nat source rule 10 outbound-interface 'eth1'
-  set nat source rule 10 source address '10.0.0.0/24'
-
-To allow traffic to pass through to clients, you need to add the following
-rules. (if you used the default configuration at the top of this page)
-
-.. code-block:: none
-
-  # server side
-  set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 32 source address '10.0.0.0/24'
-
-  # remote office side
-  set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 32 source address '192.168.0.0/24'
-
-IKEv2
-^^^^^
-
-Imagine the following topology
-
-.. figure:: ../_static/images/vpn_s2s_ikev2.png
-   :scale: 50 %
-   :alt: IPSec IKEv2 site2site VPN
-
-   IPSec IKEv2 site2site VPN (source ./draw.io/vpn_s2s_ikev2.drawio)
-
-
-.. note:: Don't get confused about the used /31 tunnel subnet. RFC3031_ gives
-   you additional information for using /31 subnets on point-to-point links.
-
-**left**
-
-.. code-block:: none
-
-  set interfaces vti vti10 address '10.0.0.2/31'
-
-  set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
-  set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
-  set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
-  set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
-  set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
-  set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'hold'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
-  set vpn ipsec ike-group IKEv2_DEFAULT ikev2-reauth 'no'
-  set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
-  set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
-  set vpn ipsec ike-group IKEv2_DEFAULT mobike 'disable'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
-  set vpn ipsec ipsec-interfaces interface 'eth0.201'
-  set vpn ipsec site-to-site peer 172.18.202.10 authentication id '172.18.201.10'
-  set vpn ipsec site-to-site peer 172.18.202.10 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 172.18.202.10 authentication pre-shared-secret 'secretkey'
-  set vpn ipsec site-to-site peer 172.18.202.10 authentication remote-id '172.18.202.10'
-  set vpn ipsec site-to-site peer 172.18.202.10 connection-type 'initiate'
-  set vpn ipsec site-to-site peer 172.18.202.10 ike-group 'IKEv2_DEFAULT'
-  set vpn ipsec site-to-site peer 172.18.202.10 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 172.18.202.10 local-address '172.18.201.10'
-  set vpn ipsec site-to-site peer 172.18.202.10 vti bind 'vti10'
-  set vpn ipsec site-to-site peer 172.18.202.10 vti esp-group 'ESP_DEFAULT'
-
-**right**
-
-.. code-block:: none
-
-  set interfaces vti vti10 address '10.0.0.3/31'
-
-  set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
-  set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
-  set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
-  set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
-  set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
-  set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'hold'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
-  set vpn ipsec ike-group IKEv2_DEFAULT ikev2-reauth 'no'
-  set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
-  set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
-  set vpn ipsec ike-group IKEv2_DEFAULT mobike 'disable'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
-  set vpn ipsec ipsec-interfaces interface 'eth0.202'
-  set vpn ipsec site-to-site peer 172.18.201.10 authentication id '172.18.202.10'
-  set vpn ipsec site-to-site peer 172.18.201.10 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 172.18.201.10 authentication pre-shared-secret 'secretkey'
-  set vpn ipsec site-to-site peer 172.18.201.10 authentication remote-id '172.18.201.10'
-  set vpn ipsec site-to-site peer 172.18.201.10 connection-type 'initiate'
-  set vpn ipsec site-to-site peer 172.18.201.10 ike-group 'IKEv2_DEFAULT'
-  set vpn ipsec site-to-site peer 172.18.201.10 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 172.18.201.10 local-address '172.18.202.10'
-  set vpn ipsec site-to-site peer 172.18.201.10 vti bind 'vti10'
-  set vpn ipsec site-to-site peer 172.18.201.10 vti esp-group 'ESP_DEFAULT'
-
-.. _RFC3031:  https://tools.ietf.org/html/rfc3021
diff --git a/docs/vpn/wireguard.rst b/docs/vpn/wireguard.rst
deleted file mode 100644
index a7241613..00000000
--- a/docs/vpn/wireguard.rst
+++ /dev/null
@@ -1,148 +0,0 @@
-.. _wireguard:
-
-WireGuard VPN Interface
------------------------
-
-WireGuard is an extremely simple yet fast and modern VPN that utilizes
-state-of-the-art cryptography. See https://www.wireguard.com for more
-information.
-
-Configuration
-^^^^^^^^^^^^^
-
-Wireguard requires the generation of a keypair, a private key which will decrypt
-incoming traffic and a public key, which the peer(s) will use to encrypt traffic.
-
-Generate a keypair
-~~~~~~~~~~~~~~~~~~
-
-Generate the keypair, which creates a public and private part and stores it
-within VyOS.
-It will be used per default on any configured wireguard interface, even if
-multiple interfaces are being configured.
-
-.. code-block:: none
-
-  wg01:~$ configure
-  wg01# run generate wireguard keypair
-
-The public key is being shared with your peer(s), your peer will encrypt all
-traffic to your system using this public key.
-
-.. code-block:: none
-
-  wg01# run show wireguard pubkey
-  u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk=
-
-Wireguard Interface configuration
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The next step is to configure your local side as well as the policy based
-trusted destination addresses. If you only initiate a connection, the listen
-port and endpoint is optional, if you however act as a server and endpoints
-initiate the connections to your system, you need to define a port your clients
-can connect to, otherwise it's randomly chosen and may make it difficult with
-firewall rules, since the port may be a different one when you reboot your
-system.
-
-You will also need the public key of your peer as well as the network(s) you
-want to tunnel (allowed-ips) to configure a wireguard tunnel. The public key
-below is always the public key from your peer, not your local one.
-
-**local side**
-
-.. code-block:: none
-
-  set interfaces wireguard wg01 address '10.1.0.1/24'
-  set interfaces wireguard wg01 description 'VPN-to-wg02'
-  set interfaces wireguard wg01 peer to-wg02 allowed-ips '10.2.0.0/24'
-  set interfaces wireguard wg01 peer to-wg02 endpoint '192.168.0.142:12345'
-  set interfaces wireguard wg01 peer to-wg02 pubkey 'XMrlPykaxhdAAiSjhtPlvi30NVkvLQliQuKP7AI7CyI='
-  set interfaces wireguard wg01 port '12345'
-  set protocols static interface-route 10.2.0.0/24 next-hop-interface wg01
-
-.. note:: The `endpoint` must be an IP and not a fully qualified domain name (FQDN). Using a FQDN will result in unexpected behavior.
-
-The last step is to define an interface route for 10.2.0.0/24 to get through
-the wireguard interface `wg01`. Multiple IPs or networks can be defined and
-routed, the last check is allowed-ips which either prevents or allows the
-traffic.
-
-**remote side**
-
-.. code-block:: none
-
-  set interfaces wireguard wg01 address '10.2.0.1/24'
-  set interfaces wireguard wg01 description 'VPN-to-wg01'
-  set interfaces wireguard wg01 peer to-wg02 allowed-ips '10.1.0.0/24'
-  set interfaces wireguard wg01 peer to-wg02 endpoint '192.168.0.124:12345'
-  set interfaces wireguard wg01 peer to-wg02 pubkey 'u41jO3OF73Gq1WARMMFG7tOfk7+r8o8AzPxJ1FZRhzk='
-  set interfaces wireguard wg01 port '12345'
-  set protocols static interface-route 10.1.0.0/24 next-hop-interface wg01
-
-Assure that your firewall rules allow the traffic, in which case you have a
-working VPN using wireguard.
-
-.. code-block:: none
-
-  wg01# ping 10.2.0.1
-  PING 10.2.0.1 (10.2.0.1) 56(84) bytes of data.
-  64 bytes from 10.2.0.1: icmp_seq=1 ttl=64 time=1.16 ms
-  64 bytes from 10.2.0.1: icmp_seq=2 ttl=64 time=1.77 ms
-
-  wg02# ping 10.1.0.1
-  PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
-  64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=4.40 ms
-  64 bytes from 10.1.0.1: icmp_seq=2 ttl=64 time=1.02 ms
-
-An additional layer of symmetric-key crypto can be used on top of the
-asymmetric crypto, which is optional.
-
-.. code-block:: none
-
-  wg01# run generate wireguard preshared-key
-  rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc=
-
-Copy the key, as it is not stored on the local file system. Make sure you
-distribute that key in a safe manner, it's a symmetric key, so only you and
-your peer should have knowledge of its content.
-
-.. code-block:: none
-
-  wg01# set interfaces wireguard wg01 peer to-wg02 preshared-key 'rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc='
-  wg02# set interfaces wireguard wg01 peer to-wg01 preshared-key 'rvVDOoc2IYEnV+k5p7TNAmHBMEGTHbPU8Qqg8c/sUqc='
-
-Operational commands
-^^^^^^^^^^^^^^^^^^^^
-
-**Show interface status**
-
-.. code-block:: none
-
-  vyos@wg01# run show interfaces wireguard wg01
-
-  interface: wg01
-  public key: xHvgSJC8RTClfvjc0oX6OALxU6GGLapjthjw7x82CSw=
-  private key: (hidden)
-  listening port: 12345
-
-  peer: 9Ek3R30mG6Vk+GHsENtPF0b9Ul+ftxx4dDBa1bdBxX8=
-  endpoint: 192.168.0.142:12345
-  allowed ips: 10.2.0.0/24
-  latest handshake: 4 minutes, 22 seconds ago
-  transfer: 860 B received, 948 B sent
-
-**Show public key of the default key**
-
-.. code-block:: none
-
-  vyos@wg01# run show wireguard keypair pubkey default
-  FAXCPb6EbTlSH5200J5zTopt9AYXneBthAySPBLbZwM=
-
-
-**Delete wireguard keypairs**
-
-.. code-block:: none
-
-  vyos@wg01# wireguard keypair default
-
diff --git a/vale.ini b/vale.ini
new file mode 100644
index 00000000..b7dde1d8
--- /dev/null
+++ b/vale.ini
@@ -0,0 +1,16 @@
+StylesPath = .github/styles
+MinAlertLevel = suggestion
+
+SkippedScopes = script, style, pre, figure, img, a, code
+
+
+[*.rst]
+BasedOnStyles = VyOS, Google
+
+Google.DateFormat = YES
+vale.GenderBias = NO
+vale.Hedging = NO
+vale.Redundancy = NO
+vale.Repetition = YES
+vale.Uncomparables = NO
+proselint.GenderBias = NO
\ No newline at end of file
-- 
cgit v1.2.3