From 58b3a577e5386e52ccfade8c5d9c3d5bc36f2839 Mon Sep 17 00:00:00 2001
From: rebortg <github@ghlr.de>
Date: Mon, 9 Nov 2020 21:30:06 +0100
Subject: Bridge: convert address to cmdinclude

---
 docs/_include/interface-address.txt | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 docs/_include/interface-address.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-address.txt b/docs/_include/interface-address.txt
new file mode 100644
index 00000000..1de05c31
--- /dev/null
+++ b/docs/_include/interface-address.txt
@@ -0,0 +1,21 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> address <address | dhcp |
+   dhcpv6>
+
+   Configure interface `<interface>` with one or more interface
+   addresses.
+
+   * **address** can be specified multiple times as IPv4 and/or IPv6
+     address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
+   * **dhcp** interface address is received by DHCP from a DHCP server
+     on this segment.
+   * **dhcpv6** interface address is received by DHCPv6 from a DHCPv6
+     server on this segment.
+
+   Example:
+
+   .. code-block:: none
+
+     set interfaces {{ var0 }} {{ var1 }} address 192.0.2.1/24
+     set interfaces {{ var0 }} {{ var1 }} address 192.0.2.2/24
+     set interfaces {{ var0 }} {{ var1 }} address 2001:db8::ffff/64
+     set interfaces {{ var0 }} {{ var1 }} address 2001:db8:100::ffff/64
\ No newline at end of file
-- 
cgit v1.2.3


From b7e61a03f09b93cdaa91a3c6b13d967621483f5c Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 10 Nov 2020 20:02:47 +0100
Subject: interfaces: extend usage of new cmdinclude directive for bridge,
 bond, eth, peth, vxlan

Commit c46473a ("docs: add ..cmdinclude:: directive") added support for including
common text but only replacing individual labels so there can be source of truth
also for the documentation.
---
 docs/_include/interface-ipv6-addr-autoconf.txt | 20 +++++++++++++
 docs/_include/interface-ipv6-addr-eui64.txt    |  8 +++++
 docs/interfaces/bond.rst                       | 41 ++++++--------------------
 docs/interfaces/bridge.rst                     | 21 ++++---------
 docs/interfaces/common-ip-ipv6-addr.txt        |  8 -----
 docs/interfaces/common-ipv6-addr-autoconf.txt  | 12 --------
 docs/interfaces/ethernet.rst                   | 32 ++++++--------------
 docs/interfaces/pseudo-ethernet.rst            | 23 ++++++---------
 docs/interfaces/vxlan.rst                      | 36 ++++++----------------
 9 files changed, 70 insertions(+), 131 deletions(-)
 create mode 100644 docs/_include/interface-ipv6-addr-autoconf.txt
 create mode 100644 docs/_include/interface-ipv6-addr-eui64.txt
 delete mode 100644 docs/interfaces/common-ip-ipv6-addr.txt
 delete mode 100644 docs/interfaces/common-ipv6-addr-autoconf.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-ipv6-addr-autoconf.txt b/docs/_include/interface-ipv6-addr-autoconf.txt
new file mode 100644
index 00000000..22f9ee59
--- /dev/null
+++ b/docs/_include/interface-ipv6-addr-autoconf.txt
@@ -0,0 +1,20 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> ipv6 address autoconf
+
+
+  :abbr:`SLAAC (Stateless Address Autoconfiguration)`
+  :rfc:`4862`. IPv6 hosts can configure themselves automatically when connected
+  to an IPv6 network using the Neighbor Discovery Protocol via :abbr:`ICMPv6
+  (Internet Control Message Protocol version 6)` router discovery messages.
+  When first connected to a network, a host sends a link-local router
+  solicitation multicast request for its configuration parameters; routers
+  respond to such a request with a router advertisement packet that contains
+  Internet Layer configuration parameters.
+
+  .. note:: This method automatically disables IPv6 traffic forwarding on the
+    interface in question.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} ipv6 address autoconf
diff --git a/docs/_include/interface-ipv6-addr-eui64.txt b/docs/_include/interface-ipv6-addr-eui64.txt
new file mode 100644
index 00000000..40f22e5f
--- /dev/null
+++ b/docs/_include/interface-ipv6-addr-eui64.txt
@@ -0,0 +1,8 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> ipv6 address eui64 <prefix>
+
+   :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
+   :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
+
+   .. code-block:: none
+
+     set interfaces {{ var0 }} {{ var1 }} ipv6 address eui64 2001:db8:beef::/64
diff --git a/docs/interfaces/bond.rst b/docs/interfaces/bond.rst
index 9e67809a..78099f01 100644
--- a/docs/interfaces/bond.rst
+++ b/docs/interfaces/bond.rst
@@ -16,40 +16,17 @@ Configuration
 Address
 -------
 
-.. cfgcmd:: set interfaces bonding <interface> address <address | dhcp | dhcpv6>
+.. cmdinclude:: ../_include/interface-address.txt
+   :var0: bonding
+   :var1: bond0
 
-   Configure interface `<interface>` with one or more interface addresses.
-
-   * **address** can be specified multiple times as IPv4 and/or IPv6 address,
-     e.g. 192.0.2.1/24 and/or 2001:db8::1/64
-   * **dhcp** interface address is received by DHCP from a DHCP server on this
-     segment.
-   * **dhcpv6** interface address is received by DHCPv6 from a DHCPv6 server on
-     this segment.
-
-   Example:
-
-   .. code-block:: none
-
-     set interfaces bonding bond0 address 192.0.2.1/24
-     set interfaces bonding bond0 address 192.0.2.2/24
-     set interfaces bonding bond0 address 2001:db8::ffff/64
-     set interfaces bonding bond0 address 2001:db8:100::ffff/64
-
-
-.. cfgcmd:: set interfaces bonding <interface> ipv6 address autoconf
-
-   .. include:: common-ipv6-addr-autoconf.txt
-
-.. cfgcmd:: set interfaces bonding <interface> ipv6 address eui64 <prefix>
-
-   :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
-   :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
-
-   .. code-block:: none
-
-     set interfaces bonding bond0 ipv6 address eui64 2001:db8:beef::/64
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: bonding
+   :var1: bond0
 
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+   :var0: bonding
+   :var1: bond0
 
 Link Administration
 -------------------
diff --git a/docs/interfaces/bridge.rst b/docs/interfaces/bridge.rst
index 26e67690..aec1c5d8 100644
--- a/docs/interfaces/bridge.rst
+++ b/docs/interfaces/bridge.rst
@@ -24,22 +24,13 @@ Address
    :var0: bridge
    :var1: br0
 
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: bridge
+   :var1: br0
 
-.. cfgcmd:: set interfaces bridge <interface> ipv6 address autoconf
-
-   .. include:: common-ipv6-addr-autoconf.txt
-
-.. cfgcmd:: set interfaces bridge <interface> ipv6 address eui64
-   <prefix>
-
-   :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
-   :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6
-   address.
-
-   .. code-block:: none
-
-     set interfaces bridge br0 ipv6 address eui64 2001:db8:beef::/64
-
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+   :var0: bridge
+   :var1: br0
 
 .. cfgcmd:: set interfaces bridge <interface> aging <time>
 
diff --git a/docs/interfaces/common-ip-ipv6-addr.txt b/docs/interfaces/common-ip-ipv6-addr.txt
deleted file mode 100644
index f53eaeee..00000000
--- a/docs/interfaces/common-ip-ipv6-addr.txt
+++ /dev/null
@@ -1,8 +0,0 @@
-Configure interface `<interface>` with one or more interface addresses.
-
-* **address** can be specified multiple times as IPv4 and/or IPv6 address,
-  e.g. 192.0.2.1/24 and/or 2001:db8::1/64
-* **dhcp** interface address is received by DHCP from a DHCP server on this
-  segment.
-* **dhcpv6** interface address is received by DHCPv6 from a DHCPv6 server on
-  this segment.
diff --git a/docs/interfaces/common-ipv6-addr-autoconf.txt b/docs/interfaces/common-ipv6-addr-autoconf.txt
deleted file mode 100644
index 838b299f..00000000
--- a/docs/interfaces/common-ipv6-addr-autoconf.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-:abbr:`SLAAC (Stateless Address Autoconfiguration)`
-:rfc:`4862`. IPv6 hosts can configure themselves automatically when connected
-to an IPv6 network using the Neighbor Discovery Protocol via :abbr:`ICMPv6
-(Internet Control Message Protocol version 6)` router discovery messages.
-When first connected to a network, a host sends a link-local router
-solicitation multicast request for its configuration parameters; routers
-respond to such a request with a router advertisement packet that contains
-Internet Layer configuration parameters.
-
-.. note:: This method automatically disables IPv6 traffic forwarding on the
-  interface in question.
-
diff --git a/docs/interfaces/ethernet.rst b/docs/interfaces/ethernet.rst
index 95aef851..6d7d049f 100644
--- a/docs/interfaces/ethernet.rst
+++ b/docs/interfaces/ethernet.rst
@@ -10,31 +10,17 @@ Configuration
 Address
 -------
 
-.. cfgcmd:: set interfaces ethernet <interface> address <address | dhcp | dhcpv6>
+.. cmdinclude:: ../_include/interface-address.txt
+   :var0: ethernet
+   :var1: eth0
 
-   .. include:: common-ip-ipv6-addr.txt
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: ethernet
+   :var1: eth0
 
-   Example:
-
-   .. code-block:: none
-
-     set interfaces ethernet eth0 address 192.0.2.1/24
-     set interfaces ethernet eth0 address 192.0.2.2/24
-     set interfaces ethernet eth0 address 2001:db8::ffff/64
-     set interfaces ethernet eth0 address 2001:db8:100::ffff/64
-
-.. cfgcmd:: set interfaces ethernet <interface> ipv6 address autoconf
-
-   .. include:: common-ipv6-addr-autoconf.txt
-
-.. cfgcmd:: set interfaces ethernet <interface> ipv6 address eui64 <prefix>
-
-   :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
-   :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
-
-   .. code-block:: none
-
-     set interfaces ethernet eth0 ipv6 address eui64 2001:db8:beef::/64
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+   :var0: ethernet
+   :var1: eth0
 
 Speed/Duplex
 ------------
diff --git a/docs/interfaces/pseudo-ethernet.rst b/docs/interfaces/pseudo-ethernet.rst
index a2066555..eec28981 100644
--- a/docs/interfaces/pseudo-ethernet.rst
+++ b/docs/interfaces/pseudo-ethernet.rst
@@ -44,22 +44,17 @@ Configuration
 Address
 -------
 
-.. cfgcmd:: set interfaces pseudo-ethernet <interface> address <address | dhcp | dhcpv6>
+.. cmdinclude:: ../_include/interface-address.txt
+   :var0: pseudo-ethernet
+   :var1: peth0
 
-   .. include:: common-ip-ipv6-addr.txt
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: pseudo-ethernet
+   :var1: peth0
 
-   Example:
-
-   .. code-block:: none
-
-     set interfaces pseudo-ethernet peth0 address 192.0.2.1/24
-     set interfaces pseudo-ethernet peth0 address 192.0.2.2/24
-     set interfaces pseudo-ethernet peth0 address 2001:db8::ffff/64
-     set interfaces pseudo-ethernet peth0 address 2001:db8:100::ffff/64
-
-.. cfgcmd:: set interfaces pseudo-ethernet <interface> ipv6 address autoconf
-
-   .. include:: common-ipv6-addr-autoconf.txt
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+   :var0: pseudo-ethernet
+   :var1: peth0
 
 Physical Asignment
 ------------------
diff --git a/docs/interfaces/vxlan.rst b/docs/interfaces/vxlan.rst
index bf3b6dee..dae08508 100644
--- a/docs/interfaces/vxlan.rst
+++ b/docs/interfaces/vxlan.rst
@@ -39,35 +39,17 @@ Configuration
 Address
 -------
 
-.. cfgcmd:: set interfaces vxlan <interface> address <address>
+.. cmdinclude:: ../_include/interface-address.txt
+   :var0: vxlan
+   :var1: vxlan0
 
-   Configure VXLAN interface `<interface>` with one or more interface
-   addresses. Address can be specified multiple times as IPv4 and/or IPv6
-   address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
-
-   Example:
-
-   .. code-block:: none
-
-     set interfaces vxlan vxlan0 address 192.0.2.1/24
-     set interfaces vxlan vxlan0 address 192.0.2.2/24
-     set interfaces vxlan vxlan0 address 2001:db8::ffff/64
-     set interfaces vxlan vxlan0 address 2001:db8:100::ffff/64
-
-
-.. cfgcmd:: set interfaces vxlan <interface> ipv6 address autoconf
-
-   .. include:: common-ipv6-addr-autoconf.txt
-
-.. cfgcmd:: set interfaces vxlan <interface> ipv6 address eui64 <prefix>
-
-   :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
-   :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
-
-   .. code-block:: none
-
-     set interfaces vxlan vxlan0 ipv6 address eui64 2001:db8:beef::/64
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: vxlan
+   :var1: vxlan0
 
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+   :var0: vxlan
+   :var1: vxlan0
 
 .. cfgcmd:: set interfaces vxlan <interface> vni <number>
 
-- 
cgit v1.2.3


From be6c3c1624174c5762a1349e31111d34db642767 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 10 Nov 2020 20:26:15 +0100
Subject: interfaces: add common description include file

---
 docs/_include/interface-address-with-dhcp.txt | 20 ++++++++++++++++++++
 docs/_include/interface-address.txt           | 11 ++---------
 docs/_include/interface-description.txt       | 10 ++++++++++
 docs/interfaces/bond.rst                      | 10 +++++++---
 docs/interfaces/bridge.rst                    | 10 +++++++---
 docs/interfaces/dummy.rst                     | 23 ++++++++---------------
 docs/interfaces/ethernet.rst                  | 10 +++++++---
 docs/interfaces/geneve.rst                    | 21 ++++++++-------------
 docs/interfaces/loopback.rst                  | 14 ++++++++------
 docs/interfaces/macsec.rst                    | 19 +++++++++++++++++++
 docs/interfaces/pseudo-ethernet.rst           | 10 +++++++---
 docs/interfaces/vxlan.rst                     |  8 ++++++--
 docs/interfaces/wirelessmodem.rst             |  7 +++++++
 13 files changed, 116 insertions(+), 57 deletions(-)
 create mode 100644 docs/_include/interface-address-with-dhcp.txt
 create mode 100644 docs/_include/interface-description.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-address-with-dhcp.txt b/docs/_include/interface-address-with-dhcp.txt
new file mode 100644
index 00000000..28968bea
--- /dev/null
+++ b/docs/_include/interface-address-with-dhcp.txt
@@ -0,0 +1,20 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> address <address | dhcp |
+   dhcpv6>
+
+   Configure interface `<interface>` with one or more interface addresses.
+
+   * **address** can be specified multiple times as IPv4 and/or IPv6
+     address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
+   * **dhcp** interface address is received by DHCP from a DHCP server
+     on this segment.
+   * **dhcpv6** interface address is received by DHCPv6 from a DHCPv6
+     server on this segment.
+
+   Example:
+
+   .. code-block:: none
+
+     set interfaces {{ var0 }} {{ var1 }} address 192.0.2.1/24
+     set interfaces {{ var0 }} {{ var1 }} address 2001:db8::1/64
+     set interfaces {{ var0 }} {{ var1 }} dhcp
+     set interfaces {{ var0 }} {{ var1 }} dhcpv6
\ No newline at end of file
diff --git a/docs/_include/interface-address.txt b/docs/_include/interface-address.txt
index 1de05c31..4ca75940 100644
--- a/docs/_include/interface-address.txt
+++ b/docs/_include/interface-address.txt
@@ -1,21 +1,14 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> address <address | dhcp |
-   dhcpv6>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> address <address>
 
    Configure interface `<interface>` with one or more interface
    addresses.
 
    * **address** can be specified multiple times as IPv4 and/or IPv6
      address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
-   * **dhcp** interface address is received by DHCP from a DHCP server
-     on this segment.
-   * **dhcpv6** interface address is received by DHCPv6 from a DHCPv6
-     server on this segment.
 
    Example:
 
    .. code-block:: none
 
      set interfaces {{ var0 }} {{ var1 }} address 192.0.2.1/24
-     set interfaces {{ var0 }} {{ var1 }} address 192.0.2.2/24
-     set interfaces {{ var0 }} {{ var1 }} address 2001:db8::ffff/64
-     set interfaces {{ var0 }} {{ var1 }} address 2001:db8:100::ffff/64
\ No newline at end of file
+     set interfaces {{ var0 }} {{ var1 }} address 2001:db8::1/64
\ No newline at end of file
diff --git a/docs/_include/interface-description.txt b/docs/_include/interface-description.txt
new file mode 100644
index 00000000..992d4945
--- /dev/null
+++ b/docs/_include/interface-description.txt
@@ -0,0 +1,10 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> description <description>
+
+   Set a human readable, descriptive alias for this connection. Alias is used by
+   e.g. the :opcmd:`show interfaces` command or SNMP based monitoring tools.
+
+   Example:
+
+   .. code-block:: none
+
+     set interfaces {{ var0 }} {{ var1 }} description 'This is an awesome interface running on VyOS'
\ No newline at end of file
diff --git a/docs/interfaces/bond.rst b/docs/interfaces/bond.rst
index 78099f01..e23d2c52 100644
--- a/docs/interfaces/bond.rst
+++ b/docs/interfaces/bond.rst
@@ -13,10 +13,14 @@ Additionally, link integrity monitoring may be performed.
 Configuration
 #############
 
-Address
--------
+Common interface configuration
+------------------------------
+
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: bonding
+   :var1: bond0
 
-.. cmdinclude:: ../_include/interface-address.txt
+.. cmdinclude:: ../_include/interface-description.txt
    :var0: bonding
    :var1: bond0
 
diff --git a/docs/interfaces/bridge.rst b/docs/interfaces/bridge.rst
index aec1c5d8..ec946041 100644
--- a/docs/interfaces/bridge.rst
+++ b/docs/interfaces/bridge.rst
@@ -17,10 +17,14 @@ standard.
 Configuration
 #############
 
-Address
--------
+Common interface configuration
+------------------------------
+
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: bridge
+   :var1: br0
 
-.. cmdinclude:: ../_include/interface-address.txt
+.. cmdinclude:: ../_include/interface-description.txt
    :var0: bridge
    :var1: br0
 
diff --git a/docs/interfaces/dummy.rst b/docs/interfaces/dummy.rst
index e452ae73..02680f90 100644
--- a/docs/interfaces/dummy.rst
+++ b/docs/interfaces/dummy.rst
@@ -22,23 +22,16 @@ you can have as many as you want.
 Configuration
 #############
 
-Address
--------
+Common interface configuration
+------------------------------
 
-.. cfgcmd:: set interfaces dummy <interface> address <address | dhcp | dhcpv6>
+.. cmdinclude:: ../_include/interface-address.txt
+   :var0: dummy
+   :var1: dum0
 
-   Configure dummy interface `<interface>` with one or more interface
-   addresses. Address can be specified multiple times as IPv4 and/or IPv6
-   address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
-
-   Example:
-
-   .. code-block:: none
-
-     set interfaces dummy dum10 address 192.0.2.1/24
-     set interfaces dummy dum10 address 192.0.2.2/24
-     set interfaces dummy dum10 address 2001:db8::ffff/64
-     set interfaces dummy dum10 address 2001:db8:100::ffff/64
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: dummy
+   :var1: dum0
 
 Link Administration
 -------------------
diff --git a/docs/interfaces/ethernet.rst b/docs/interfaces/ethernet.rst
index 6d7d049f..424f2766 100644
--- a/docs/interfaces/ethernet.rst
+++ b/docs/interfaces/ethernet.rst
@@ -7,10 +7,14 @@ Ethernet
 Configuration
 #############
 
-Address
--------
+Common interface configuration
+------------------------------
 
-.. cmdinclude:: ../_include/interface-address.txt
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: ethernet
+   :var1: eth0
+
+.. cmdinclude:: ../_include/interface-description.txt
    :var0: ethernet
    :var1: eth0
 
diff --git a/docs/interfaces/geneve.rst b/docs/interfaces/geneve.rst
index a4bc22aa..acd22c84 100644
--- a/docs/interfaces/geneve.rst
+++ b/docs/interfaces/geneve.rst
@@ -35,21 +35,16 @@ Geneve Header:
 Configuration
 =============
 
-.. cfgcmd:: set interfaces geneve gnv0 address <address>
+Common interface configuration
+------------------------------
 
-   Configure interface `<interface>` with one or more interface addresses.
+.. cmdinclude:: ../_include/interface-address.txt
+   :var0: geneve
+   :var1: gnv0
 
-   **address** can be specified multiple times as IPv4 and/or IPv6 address,
-   e.g. 192.0.2.1/24 and/or 2001:db8::1/64
-
-   Example:
-
-   .. code-block:: none
-
-     set interfaces geneve gnv0 address 192.0.2.1/24
-     set interfaces geneve gnv0 address 192.0.2.2/24
-     set interfaces geneve gnv0 address 2001:db8::ffff/64
-     set interfaces geneve gnv0 address 2001:db8:100::ffff/64
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: geneve
+   :var1: gnv0
 
 .. cfgcmd:: set interfaces geneve gnv0 remote <address>
 
diff --git a/docs/interfaces/loopback.rst b/docs/interfaces/loopback.rst
index e15062cf..06486faa 100644
--- a/docs/interfaces/loopback.rst
+++ b/docs/interfaces/loopback.rst
@@ -22,14 +22,16 @@ services on your local machine.
 Configuration
 =============
 
-Address
--------
+Common interface configuration
+------------------------------
 
-.. cfgcmd:: set interfaces loopback lo address <address>
+.. cmdinclude:: ../_include/interface-address.txt
+   :var0: loopback
+   :var1: lo
 
-   Configure Loopback interface `lo` with one or more interface addresses.
-   Address can be specified multiple times as IPv4 and/or IPv6 address, e.g.
-   192.0.2.1/24 and/or 2001:db8::1/64.
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: loopback
+   :var1: lo
 
 Link Administration
 -------------------
diff --git a/docs/interfaces/macsec.rst b/docs/interfaces/macsec.rst
index d7af0c16..8a613709 100644
--- a/docs/interfaces/macsec.rst
+++ b/docs/interfaces/macsec.rst
@@ -16,6 +16,25 @@ used for their own specific use cases.
 Configuration
 #############
 
+Common interface configuration
+------------------------------
+
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: macsec
+   :var1: macsec0
+
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: macsec
+   :var1: macsec0
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: macsec
+   :var1: macsec0
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+   :var0: macsec
+   :var1: macsec0
+
 .. cfgcmd:: set interfaces macsec <interface> security cipher [gcm-aes-128]
 
   Select cipher suite used for cryptographic operations. This setting is
diff --git a/docs/interfaces/pseudo-ethernet.rst b/docs/interfaces/pseudo-ethernet.rst
index eec28981..7564ce76 100644
--- a/docs/interfaces/pseudo-ethernet.rst
+++ b/docs/interfaces/pseudo-ethernet.rst
@@ -41,10 +41,14 @@ Ethernet interfaces:
 Configuration
 =============
 
-Address
--------
+Common interface configuration
+------------------------------
 
-.. cmdinclude:: ../_include/interface-address.txt
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: pseudo-ethernet
+   :var1: peth0
+
+.. cmdinclude:: ../_include/interface-description.txt
    :var0: pseudo-ethernet
    :var1: peth0
 
diff --git a/docs/interfaces/vxlan.rst b/docs/interfaces/vxlan.rst
index dae08508..5229f81c 100644
--- a/docs/interfaces/vxlan.rst
+++ b/docs/interfaces/vxlan.rst
@@ -36,13 +36,17 @@ may be blocked by the hypervisor.
 Configuration
 =============
 
-Address
--------
+Common interface configuration
+------------------------------
 
 .. cmdinclude:: ../_include/interface-address.txt
    :var0: vxlan
    :var1: vxlan0
 
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: vxlan
+   :var1: vxlan0
+
 .. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
    :var0: vxlan
    :var1: vxlan0
diff --git a/docs/interfaces/wirelessmodem.rst b/docs/interfaces/wirelessmodem.rst
index c41e71bf..5e2eac40 100644
--- a/docs/interfaces/wirelessmodem.rst
+++ b/docs/interfaces/wirelessmodem.rst
@@ -11,6 +11,13 @@ The wirelessmodem interface provides access (through a wireless modem/wwan) to
 wireless networks provided by various cellular providers. VyOS uses the
 interfaces wirelessmodem subsystem for configuration.
 
+Common interface configuration
+------------------------------
+
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: wirelessmodem
+   :var1: wlm0
+
 Address
 -------
 
-- 
cgit v1.2.3


From a3b5c8083e6ab28378ba187ec9aa0f3ce3d101df Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 10 Nov 2020 20:39:39 +0100
Subject: interfaces: introduce new common-with|without-dhcp include

Now we have one single include dealing with all the common interface
stuff which is present on every interface.
---
 docs/_include/interface-common-with-dhcp.txt    |  7 +++++++
 docs/_include/interface-common-without-dhcp.txt |  7 +++++++
 docs/_include/interface-common.txt              | 11 +++++++++++
 docs/interfaces/bond.rst                        | 16 ++--------------
 docs/interfaces/bridge.rst                      | 15 +--------------
 docs/interfaces/ethernet.rst                    | 14 +-------------
 docs/interfaces/geneve.rst                      |  6 +-----
 docs/interfaces/macsec.rst                      | 14 +-------------
 docs/interfaces/pseudo-ethernet.rst             | 14 +-------------
 docs/interfaces/vxlan.rst                       | 14 +-------------
 10 files changed, 33 insertions(+), 85 deletions(-)
 create mode 100644 docs/_include/interface-common-with-dhcp.txt
 create mode 100644 docs/_include/interface-common-without-dhcp.txt
 create mode 100644 docs/_include/interface-common.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-common-with-dhcp.txt b/docs/_include/interface-common-with-dhcp.txt
new file mode 100644
index 00000000..34eef941
--- /dev/null
+++ b/docs/_include/interface-common-with-dhcp.txt
@@ -0,0 +1,7 @@
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-common.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
diff --git a/docs/_include/interface-common-without-dhcp.txt b/docs/_include/interface-common-without-dhcp.txt
new file mode 100644
index 00000000..8e995ee1
--- /dev/null
+++ b/docs/_include/interface-common-without-dhcp.txt
@@ -0,0 +1,7 @@
+.. cmdinclude:: ../_include/interface-address.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-common.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
diff --git a/docs/_include/interface-common.txt b/docs/_include/interface-common.txt
new file mode 100644
index 00000000..56d4a22e
--- /dev/null
+++ b/docs/_include/interface-common.txt
@@ -0,0 +1,11 @@
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
diff --git a/docs/interfaces/bond.rst b/docs/interfaces/bond.rst
index e23d2c52..6cdc08ea 100644
--- a/docs/interfaces/bond.rst
+++ b/docs/interfaces/bond.rst
@@ -16,20 +16,8 @@ Configuration
 Common interface configuration
 ------------------------------
 
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
-   :var0: bonding
-   :var1: bond0
-
-.. cmdinclude:: ../_include/interface-description.txt
-   :var0: bonding
-   :var1: bond0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: bonding
-   :var1: bond0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
-   :var0: bonding
+.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
+   :var0: bond
    :var1: bond0
 
 Link Administration
diff --git a/docs/interfaces/bridge.rst b/docs/interfaces/bridge.rst
index ec946041..a880c023 100644
--- a/docs/interfaces/bridge.rst
+++ b/docs/interfaces/bridge.rst
@@ -20,19 +20,7 @@ Configuration
 Common interface configuration
 ------------------------------
 
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
-   :var0: bridge
-   :var1: br0
-
-.. cmdinclude:: ../_include/interface-description.txt
-   :var0: bridge
-   :var1: br0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: bridge
-   :var1: br0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
    :var0: bridge
    :var1: br0
 
@@ -40,7 +28,6 @@ Common interface configuration
 
    MAC address aging `<time`> in seconds (default: 300).
 
-
 .. cfgcmd:: set interfaces bridge <interface> max-age <time>
 
    Bridge maximum aging `<time>` in seconds (default: 20).
diff --git a/docs/interfaces/ethernet.rst b/docs/interfaces/ethernet.rst
index 424f2766..09c72ec8 100644
--- a/docs/interfaces/ethernet.rst
+++ b/docs/interfaces/ethernet.rst
@@ -10,19 +10,7 @@ Configuration
 Common interface configuration
 ------------------------------
 
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
-   :var0: ethernet
-   :var1: eth0
-
-.. cmdinclude:: ../_include/interface-description.txt
-   :var0: ethernet
-   :var1: eth0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: ethernet
-   :var1: eth0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
    :var0: ethernet
    :var1: eth0
 
diff --git a/docs/interfaces/geneve.rst b/docs/interfaces/geneve.rst
index acd22c84..8518fcf0 100644
--- a/docs/interfaces/geneve.rst
+++ b/docs/interfaces/geneve.rst
@@ -38,11 +38,7 @@ Configuration
 Common interface configuration
 ------------------------------
 
-.. cmdinclude:: ../_include/interface-address.txt
-   :var0: geneve
-   :var1: gnv0
-
-.. cmdinclude:: ../_include/interface-description.txt
+.. cmdinclude:: ../_include/interface-common-without-dhcp.txt
    :var0: geneve
    :var1: gnv0
 
diff --git a/docs/interfaces/macsec.rst b/docs/interfaces/macsec.rst
index 8a613709..242636f1 100644
--- a/docs/interfaces/macsec.rst
+++ b/docs/interfaces/macsec.rst
@@ -19,19 +19,7 @@ Configuration
 Common interface configuration
 ------------------------------
 
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
-   :var0: macsec
-   :var1: macsec0
-
-.. cmdinclude:: ../_include/interface-description.txt
-   :var0: macsec
-   :var1: macsec0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: macsec
-   :var1: macsec0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
    :var0: macsec
    :var1: macsec0
 
diff --git a/docs/interfaces/pseudo-ethernet.rst b/docs/interfaces/pseudo-ethernet.rst
index 7564ce76..4244284b 100644
--- a/docs/interfaces/pseudo-ethernet.rst
+++ b/docs/interfaces/pseudo-ethernet.rst
@@ -44,19 +44,7 @@ Configuration
 Common interface configuration
 ------------------------------
 
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
-   :var0: pseudo-ethernet
-   :var1: peth0
-
-.. cmdinclude:: ../_include/interface-description.txt
-   :var0: pseudo-ethernet
-   :var1: peth0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: pseudo-ethernet
-   :var1: peth0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
    :var0: pseudo-ethernet
    :var1: peth0
 
diff --git a/docs/interfaces/vxlan.rst b/docs/interfaces/vxlan.rst
index 5229f81c..742485dd 100644
--- a/docs/interfaces/vxlan.rst
+++ b/docs/interfaces/vxlan.rst
@@ -39,19 +39,7 @@ Configuration
 Common interface configuration
 ------------------------------
 
-.. cmdinclude:: ../_include/interface-address.txt
-   :var0: vxlan
-   :var1: vxlan0
-
-.. cmdinclude:: ../_include/interface-description.txt
-   :var0: vxlan
-   :var1: vxlan0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: vxlan
-   :var1: vxlan0
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: ../_include/interface-common-without-dhcp.txt
    :var0: vxlan
    :var1: vxlan0
 
-- 
cgit v1.2.3


From 861225aba395884eb91f61117b7a1bcf91d60798 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 10 Nov 2020 20:58:07 +0100
Subject: interfaces: document dhcp-options

---
 docs/_include/interface-common-with-dhcp.txt |  4 +++
 docs/_include/interface-dhcp-options.txt     | 46 ++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 docs/_include/interface-dhcp-options.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-common-with-dhcp.txt b/docs/_include/interface-common-with-dhcp.txt
index 34eef941..585951b3 100644
--- a/docs/_include/interface-common-with-dhcp.txt
+++ b/docs/_include/interface-common-with-dhcp.txt
@@ -2,6 +2,10 @@
    :var0: {{ var0 }}
    :var1: {{ var1 }}
 
+.. cmdinclude:: ../_include/interface-dhcp-options.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+
 .. cmdinclude:: ../_include/interface-common.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
diff --git a/docs/_include/interface-dhcp-options.txt b/docs/_include/interface-dhcp-options.txt
new file mode 100644
index 00000000..da1975fc
--- /dev/null
+++ b/docs/_include/interface-dhcp-options.txt
@@ -0,0 +1,46 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcp-options client-id <description>
+
+  :rfc:`2131` states: The client MAY choose to explicitly provide the identifier
+  through the 'client identifier' option. If the client supplies a 'client
+  identifier', the client MUST use the same 'client identifier' in all
+  subsequent messages, and the server MUST use that identifier to identify the
+  client.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcp-options client-id 'foo-bar'
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcp-options host-name <hostname>
+
+  Instead of sending the real system hostname to the DHCP server, overwrite the
+  host-name with this given-value.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcp-options host-name 'VyOS'
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcp-options vendor-class-id <vendor-id>
+
+  The vendor-class-id option can be used to request a specific class of vendor
+  options from the server.
+
+  Example
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcp-options vendor-class-id 'VyOS'
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcp-options no-default-route
+
+  Only request an address from the DHCP server but do not request a default
+  gateway.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcp-options no-default-route
-- 
cgit v1.2.3


From ab3552884ee1c5560fb37c5deb5e4ee1662f20bc Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 10 Nov 2020 21:29:41 +0100
Subject: interface: document dhcp(v6)-options on CLI

---
 docs/_include/interface-common-with-dhcp.txt | 10 ++-
 docs/_include/interface-dhcpv6-options.txt   | 92 ++++++++++++++++++++++++++++
 docs/interfaces/ethernet.rst                 | 37 -----------
 3 files changed, 101 insertions(+), 38 deletions(-)
 create mode 100644 docs/_include/interface-dhcpv6-options.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-common-with-dhcp.txt b/docs/_include/interface-common-with-dhcp.txt
index 585951b3..1fe38a92 100644
--- a/docs/_include/interface-common-with-dhcp.txt
+++ b/docs/_include/interface-common-with-dhcp.txt
@@ -2,10 +2,18 @@
    :var0: {{ var0 }}
    :var1: {{ var1 }}
 
+.. cmdinclude:: ../_include/interface-common.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+
+**DHCP**
+
 .. cmdinclude:: ../_include/interface-dhcp-options.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-common.txt
+**DHCPv6**
+
+.. cmdinclude:: ../_include/interface-dhcpv6-options.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
diff --git a/docs/_include/interface-dhcpv6-options.txt b/docs/_include/interface-dhcpv6-options.txt
new file mode 100644
index 00000000..7213079a
--- /dev/null
+++ b/docs/_include/interface-dhcpv6-options.txt
@@ -0,0 +1,92 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-options parameters-only
+
+  This statement specifies dhcp6c to only exchange informational configuration
+  parameters with servers. A list of DNS server addresses is an example of such
+  parameters. This statement is useful when the client does not need stateful
+  configuration parameters such as IPv6 addresses or prefixes.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options parameters-only
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-options rapid-commit
+
+  When rapid-commit is specified, dhcp6c will include a rapid-commit option in
+  solicit messages and wait for an immediate reply instead of advertisements.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options rapid-commit
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-options temporary
+
+  Request only a temporary address and not form an IA_NA (Identity Association
+  for Non-temporary Addresses) partnership.
+
+  Example
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options temporary
+
+
+
+
+**DHCPv6-PD**
+
+VyOS 1.3 (equuleus) supports DHCPv6-PD (:rfc:`3633`). DHCPv6 Prefix Delegation
+is supported by most ISPs who provide native IPv6 for consumers on fixed networks.
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> length <length>
+
+   Some ISPs by default only delegate a /64 prefix. To request for a specific
+   prefix size use this option to request for a bigger delegation for this pd
+   `<id>`. This value is in the range from 32 - 64 so you could request up to a
+   /32 prefix (if your ISP allows this) down to a /64 delegation.
+
+   The default value corresponds to 64.
+
+  Example:
+
+  To request a /56 prefix from your ISP use:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options pd 0 length 56
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> interface <delegatee> address <address>
+
+   Specify the interface address used locally on the interfcae where the prefix
+   has been delegated to. ID must be a decimal integer.
+
+   It will be combined with the delegated prefix and the sla-id to form a
+   complete interface address. The default is to use the EUI-64 address of the
+   interface.
+
+   Example: Delegate a /64 prefix to interface eth0.10 which will use a local
+   address on this router of ``<prefix>::ffff``, as the address 65534 will
+   correspond to ``ffff`` in hexadecimal notation.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6-option pd 0 interface eth0.10 address 65534
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> interface <delegatee> sla-id <id>
+
+   Specify the identifier value of the site-level aggregator (SLA) on the
+   interface. ID must be a decimal number greater then 0 which fits in the
+   length of SLA IDs (see below).
+
+   Example: If ID is 1 and the client is delegated an IPv6 prefix
+   2001:db8:ffff::/48, dhcp6c will combine the two values into a single IPv6
+   prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified
+   interface.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6-option pd 0 interface eth0.10 sla-id 1
+
diff --git a/docs/interfaces/ethernet.rst b/docs/interfaces/ethernet.rst
index 09c72ec8..cdf3622c 100644
--- a/docs/interfaces/ethernet.rst
+++ b/docs/interfaces/ethernet.rst
@@ -73,43 +73,6 @@ Link Administration
    Configure :abbr:`MTU (Maximum Transmission Unit)` on given `<interface>`. It
    is the size (in bytes) of the largest ethernet frame sent on this link.
 
-Prefix Delegation (DHCPv6-PD)
------------------------------
-
-VyOS 1.3 (equuleus) supports DHCPv6-PD. DHCPv6 Prefix Delegation is supported
-by most ISPs who provide native IPv6 for consumers on fixed networks.
-
-.. cfgcmd:: set interfaces ethernet <interface> dhcpv6-option pd <id> length <length>
-
-   Some ISPs by default only delegate a /64 prefix. To request for a specific
-   prefix size use this option to request for a bigger delegation for this pd
-   `<id>`. This value
-   is in the range from 32 - 64 so you could request up to /32 down to a /64
-   delegation.
-
-   Default value is 64.
-
-.. cfgcmd:: set interfaces ethernet <interface> dhcpv6-option pd <id> interface <delegatee> address <address>
-
-   Specify the interface address used locally on the interfcae where the prefix
-   has been delegated to. ID must be a decimal integer.
-
-   It will be combined with the delegated prefix and the sla-id to form a complete
-   interface address. The default is to use the EUI-64 address of the interface.
-
-   Example:
-
-   Using ``<id>`` value 65535 will assign IPv6 address ``<prefix>::ffff`` to the
-   interface.
-
-.. cfgcmd:: set interfaces ethernet <interface> dhcpv6-option pd <id> interface <delegatee> sla-id <id>
-
-   Specify the identifier value of the site-level aggregator (SLA) on the
-   interface. ID must be a decimal number greater then 0 which fits in the length
-   of SLA IDs (see below). For example, if ID is 1 and the client is delegated
-   an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two values into a
-   single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on
-   the specified interface.
 
 Operation
 =========
-- 
cgit v1.2.3


From f6ee81e58268ce1a666f68504f327f49c4402130 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 10 Nov 2020 21:42:38 +0100
Subject: interface: move mac and mtu documentation to common file

---
 docs/_include/interface-common.txt  | 12 ++++++++++++
 docs/_include/interface-disable.txt | 10 ++++++++++
 docs/_include/interface-mac.txt     | 10 ++++++++++
 docs/_include/interface-mtu.txt     | 10 ++++++++++
 docs/interfaces/bond.rst            | 16 ----------------
 docs/interfaces/bridge.rst          | 21 ---------------------
 docs/interfaces/dummy.rst           | 13 -------------
 docs/interfaces/ethernet.rst        | 21 ---------------------
 docs/interfaces/loopback.rst        |  8 --------
 docs/interfaces/pseudo-ethernet.rst | 19 -------------------
 docs/interfaces/vxlan.rst           | 21 ---------------------
 docs/interfaces/wirelessmodem.rst   | 18 ------------------
 12 files changed, 42 insertions(+), 137 deletions(-)
 create mode 100644 docs/_include/interface-disable.txt
 create mode 100644 docs/_include/interface-mac.txt
 create mode 100644 docs/_include/interface-mtu.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-common.txt b/docs/_include/interface-common.txt
index 56d4a22e..052088df 100644
--- a/docs/_include/interface-common.txt
+++ b/docs/_include/interface-common.txt
@@ -2,6 +2,18 @@
    :var0: {{ var0 }}
    :var1: {{ var1 }}
 
+.. cmdinclude:: ../_include/interface-disable.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-mac.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-mtu.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+
 .. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
diff --git a/docs/_include/interface-disable.txt b/docs/_include/interface-disable.txt
new file mode 100644
index 00000000..83ef3e53
--- /dev/null
+++ b/docs/_include/interface-disable.txt
@@ -0,0 +1,10 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> disable
+
+   Disable given `<interface>`. It will be placed in administratively down
+   (``A/D``) state.
+
+   Example:
+
+   .. code-block:: none
+
+     set interfaces {{ var0 }} {{ var1 }} disable
\ No newline at end of file
diff --git a/docs/_include/interface-mac.txt b/docs/_include/interface-mac.txt
new file mode 100644
index 00000000..29157555
--- /dev/null
+++ b/docs/_include/interface-mac.txt
@@ -0,0 +1,10 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> mac <xx:xx:xx:xx:xx:xx>
+
+   Configure user defined :abbr:`MAC (Media Access Control)` address on given
+   `<interface>`.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} mac '00:01:02:03:04:05'
\ No newline at end of file
diff --git a/docs/_include/interface-mtu.txt b/docs/_include/interface-mtu.txt
new file mode 100644
index 00000000..e727c3e9
--- /dev/null
+++ b/docs/_include/interface-mtu.txt
@@ -0,0 +1,10 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> mtu <mtu>
+
+  Configure :abbr:`MTU (Maximum Transmission Unit)` on given `<interface>`. It
+  is the size (in bytes) of the largest ethernet frame sent on this link.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} mtu 1450
\ No newline at end of file
diff --git a/docs/interfaces/bond.rst b/docs/interfaces/bond.rst
index 6cdc08ea..4565eafc 100644
--- a/docs/interfaces/bond.rst
+++ b/docs/interfaces/bond.rst
@@ -23,22 +23,6 @@ Common interface configuration
 Link Administration
 -------------------
 
-.. cfgcmd:: set interfaces bonding <interface> description <description>
-
-   Assign given `<description>` to interface. Description will also be passed
-   to SNMP monitoring systems.
-
-
-.. cfgcmd:: set interfaces bonding <interface> disable
-
-   Disable given `<interface>`. It will be placed in administratively down
-   (``A/D``) state.
-
-.. cfgcmd:: set interfaces bonding <interface> mac <mac-address>
-
-   Configure user defined :abbr:`MAC (Media Access Control)` address on given
-   `<interface>`.
-
 .. cfgcmd:: set interfaces bonding <interface> mode <mode>
 
    Specifies one of the bonding policies. The default is 802.3ad. Possible
diff --git a/docs/interfaces/bridge.rst b/docs/interfaces/bridge.rst
index a880c023..8704d334 100644
--- a/docs/interfaces/bridge.rst
+++ b/docs/interfaces/bridge.rst
@@ -39,35 +39,14 @@ Common interface configuration
 Link Administration
 -------------------
 
-.. cfgcmd:: set interfaces bridge <interface> description <description>
-
-   Assign given `<description>` to interface. Description will also be
-   passed to SNMP monitoring systems.
-
-
-.. cfgcmd:: set interfaces bridge <interface> disable
-
-   Disable given `<interface>`. It will be placed in administratively
-   down (``A/D``) state.
-
-
 .. cfgcmd:: set interfaces bridge <interface> disable-flow-control
 
    Disable Ethernet flow control (pause frames).
 
-
-.. cfgcmd:: set interfaces bridge <interface> mac <mac-address>
-
-   Configure user defined :abbr:`MAC (Media Access Control)` address on
-   given `<interface>`.
-
-
 .. cfgcmd:: set interfaces bridge <interface> igmp querier
 
    Enable IGMP querier
 
-
-
 Member Interfaces
 -----------------
 
diff --git a/docs/interfaces/dummy.rst b/docs/interfaces/dummy.rst
index 02680f90..a3989138 100644
--- a/docs/interfaces/dummy.rst
+++ b/docs/interfaces/dummy.rst
@@ -33,19 +33,6 @@ Common interface configuration
    :var0: dummy
    :var1: dum0
 
-Link Administration
--------------------
-
-.. cfgcmd:: set interfaces dummy <interface> description <description>
-
-   Assign given `<description>` to interface. Description will also be passed
-   to SNMP monitoring systems.
-
-.. cfgcmd:: set interfaces dummy <interface> disable
-
-   Disable given `<interface>`. It will be placed in administratively down
-   state.
-
 Operation
 =========
 
diff --git a/docs/interfaces/ethernet.rst b/docs/interfaces/ethernet.rst
index cdf3622c..578ac517 100644
--- a/docs/interfaces/ethernet.rst
+++ b/docs/interfaces/ethernet.rst
@@ -48,32 +48,11 @@ Speed/Duplex
 Link Administration
 -------------------
 
-.. cfgcmd:: set interfaces ethernet <interface> description <description>
-
-   Assign given `<description>` to interface. Description will also be passed
-   to SNMP monitoring systems.
-
-.. cfgcmd:: set interfaces ethernet <interface> disable
-
-   Disable given `<interface>`. It will be placed in administratively down
-   (``A/D``) state.
-
 .. cfgcmd:: set interfaces ethernet <interface> disable-flow-control
 
    Disable Ethernet flow control (pause frames).
 
 
-.. cfgcmd:: set interfaces ethernet <interface> mac <mac-address>
-
-   Configure user defined :abbr:`MAC (Media Access Control)` address on given
-   `<interface>`.
-
-.. cfgcmd:: set interfaces ethernet <interface> mtu <mtu>
-
-   Configure :abbr:`MTU (Maximum Transmission Unit)` on given `<interface>`. It
-   is the size (in bytes) of the largest ethernet frame sent on this link.
-
-
 Operation
 =========
 
diff --git a/docs/interfaces/loopback.rst b/docs/interfaces/loopback.rst
index 06486faa..ed241eb2 100644
--- a/docs/interfaces/loopback.rst
+++ b/docs/interfaces/loopback.rst
@@ -33,14 +33,6 @@ Common interface configuration
    :var0: loopback
    :var1: lo
 
-Link Administration
--------------------
-
-.. cfgcmd:: set interfaces loopback lo description <description>
-
-   Assign given `<description>` to interface `lo`. Description will also be
-   passed to SNMP monitoring systems.
-
 Operation
 =========
 
diff --git a/docs/interfaces/pseudo-ethernet.rst b/docs/interfaces/pseudo-ethernet.rst
index 4244284b..52ba789b 100644
--- a/docs/interfaces/pseudo-ethernet.rst
+++ b/docs/interfaces/pseudo-ethernet.rst
@@ -55,22 +55,3 @@ Physical Asignment
 
    Specifies the physical `<ethX>` Ethernet interface associated with a Pseudo
    Ethernet `<interface>`.
-
-Link Administration
--------------------
-
-.. cfgcmd:: set interfaces pseudo-ethernet <interface> description <description>
-
-   Assign given `<description>` to interface. Description will also be passed
-   to SNMP monitoring systems.
-
-.. cfgcmd:: set interfaces pseudo-ethernet <interface> disable
-
-   Disable given `<interface>`. It will be placed in administratively down
-   (``A/D``) state.
-
-.. cfgcmd:: set interfaces pseudo-ethernet <interface> mac <mac-address>
-
-   Configure user defined :abbr:`MAC (Media Access Control)` address on given
-   `<interface>`.
-
diff --git a/docs/interfaces/vxlan.rst b/docs/interfaces/vxlan.rst
index 742485dd..5ecfeb0a 100644
--- a/docs/interfaces/vxlan.rst
+++ b/docs/interfaces/vxlan.rst
@@ -90,27 +90,6 @@ L2VVPN / EVPN
    Source IP address used for VXLAN underlay. This is mandatory when using
    VXLAN via L2VPN/EVPN.
 
-
-Link Administration
--------------------
-
-.. cfgcmd:: set interfaces vxlan <interface> description <description>
-
-   Assign given `<description>` to interface. Description will also be passed
-   to SNMP monitoring systems.
-
-.. cfgcmd:: set interfaces vxlan <interface> disable
-
-   Disable given `<interface>`. It will be placed in administratively down
-   (``A/D``) state.
-
-.. cfgcmd:: set interfaces vxlan <interface> mtu <mtu>
-
-   Configure :abbr:`MTU (Maximum Transmission Unit)` on given `<interface>`. It
-   is the size (in bytes) of the largest ethernet frame sent on this link.
-   MTU ranges from 1450 to 9000 bytes. For best performance you should have
-   a MTU > 1550 bytes on your underlay.
-
 Multicast VXLAN
 ===============
 
diff --git a/docs/interfaces/wirelessmodem.rst b/docs/interfaces/wirelessmodem.rst
index 5e2eac40..eabb17b9 100644
--- a/docs/interfaces/wirelessmodem.rst
+++ b/docs/interfaces/wirelessmodem.rst
@@ -51,24 +51,6 @@ Address
    connection is established at boot time and remains up. If the link fails for
    any reason, the link is brought back up immediately.
 
-Link Administration
--------------------
-
-.. cfgcmd:: set interfaces wirelessmodem <interface> description <description>
-
-   Assign given `<description>` to interface. Description will also be passed
-   to SNMP monitoring systems.
-
-.. cfgcmd:: set interfaces wirelessmodem <interface> disable
-
-   Disable given `<interface>`. It will be placed in administratively down
-   state.
-
-.. cfgcmd:: set interfaces wirelessmodem <interface> mtu <mtu>
-
-   Configure :abbr:`MTU (Maximum Transmission Unit)` on given `<interface>`. It
-   is the size (in bytes) of the largest ethernet frame sent on this link.
-
 Example
 =======
 
-- 
cgit v1.2.3


From f0ed78b3ad3a7806b0443a2771cdeb6cbd13ba5a Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 10 Nov 2020 22:57:12 +0100
Subject: interfaces: consolidate vxlan, geneve, wifi, pppoe, wwan to new
 include command syntax

---
 docs/_include/interface-address-with-dhcp.txt      | 26 ++++-----
 docs/_include/interface-address.txt                | 16 ++---
 docs/_include/interface-common-with-dhcp.txt       | 20 +++----
 docs/_include/interface-common-without-dhcp.txt    |  8 +--
 docs/_include/interface-common.txt                 | 37 ++++++++----
 docs/_include/interface-description.txt            | 10 ++--
 docs/_include/interface-dhcpv6-options.txt         | 60 +------------------
 .../interface-dhcpv6-prefix-delegation.txt         | 54 +++++++++++++++++
 docs/_include/interface-disable-flow-control.txt   | 22 +++++++
 docs/_include/interface-disable-link-detect.txt    | 12 ++++
 docs/_include/interface-ipv6-addr-autoconf.txt     | 16 +++--
 docs/_include/interface-ipv6-addr-eui64.txt        |  8 +--
 docs/_include/interface-mac.txt                    |  4 +-
 docs/_include/interface-vlan.txt                   | 50 ++++++++++++++++
 docs/_include/interface-vrf.txt                    | 12 ++++
 docs/interfaces/bond.rst                           | 18 +++---
 docs/interfaces/bridge.rst                         | 45 ++++++--------
 docs/interfaces/dummy.rst                          |  8 +++
 docs/interfaces/ethernet.rst                       | 11 ++--
 docs/interfaces/geneve.rst                         |  7 +--
 docs/interfaces/l2tpv3.rst                         | 13 ++++-
 docs/interfaces/macsec.rst                         | 12 ++--
 docs/interfaces/pppoe.rst                          | 68 +++++++---------------
 docs/interfaces/pseudo-ethernet.rst                |  4 +-
 docs/interfaces/tunnel.rst                         |  7 +++
 docs/interfaces/vxlan.rst                          | 55 +++++++++--------
 docs/interfaces/wireless.rst                       | 26 +++++++--
 docs/interfaces/wirelessmodem.rst                  | 12 +++-
 28 files changed, 381 insertions(+), 260 deletions(-)
 create mode 100644 docs/_include/interface-dhcpv6-prefix-delegation.txt
 create mode 100644 docs/_include/interface-disable-flow-control.txt
 create mode 100644 docs/_include/interface-disable-link-detect.txt
 create mode 100644 docs/_include/interface-vlan.txt
 create mode 100644 docs/_include/interface-vrf.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-address-with-dhcp.txt b/docs/_include/interface-address-with-dhcp.txt
index 28968bea..10838e72 100644
--- a/docs/_include/interface-address-with-dhcp.txt
+++ b/docs/_include/interface-address-with-dhcp.txt
@@ -1,20 +1,20 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> address <address | dhcp |
    dhcpv6>
 
-   Configure interface `<interface>` with one or more interface addresses.
+  Configure interface `<interface>` with one or more interface addresses.
 
-   * **address** can be specified multiple times as IPv4 and/or IPv6
-     address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
-   * **dhcp** interface address is received by DHCP from a DHCP server
-     on this segment.
-   * **dhcpv6** interface address is received by DHCPv6 from a DHCPv6
-     server on this segment.
+  * **address** can be specified multiple times as IPv4 and/or IPv6
+    address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
+  * **dhcp** interface address is received by DHCP from a DHCP server
+    on this segment.
+  * **dhcpv6** interface address is received by DHCPv6 from a DHCPv6
+    server on this segment.
 
-   Example:
+  Example:
 
-   .. code-block:: none
+  .. code-block:: none
 
-     set interfaces {{ var0 }} {{ var1 }} address 192.0.2.1/24
-     set interfaces {{ var0 }} {{ var1 }} address 2001:db8::1/64
-     set interfaces {{ var0 }} {{ var1 }} dhcp
-     set interfaces {{ var0 }} {{ var1 }} dhcpv6
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} address 192.0.2.1/24
+    set interfaces {{ var0 }} {{ var1 }} address 2001:db8::1/64
+    set interfaces {{ var0 }} {{ var1 }} dhcp
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6
\ No newline at end of file
diff --git a/docs/_include/interface-address.txt b/docs/_include/interface-address.txt
index 4ca75940..00a9ec09 100644
--- a/docs/_include/interface-address.txt
+++ b/docs/_include/interface-address.txt
@@ -1,14 +1,14 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> address <address>
 
-   Configure interface `<interface>` with one or more interface
-   addresses.
+  Configure interface `<interface>` with one or more interface
+  addresses.
 
-   * **address** can be specified multiple times as IPv4 and/or IPv6
-     address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
+  * **address** can be specified multiple times as IPv4 and/or IPv6
+    address, e.g. 192.0.2.1/24 and/or 2001:db8::1/64
 
-   Example:
+  Example:
 
-   .. code-block:: none
+  .. code-block:: none
 
-     set interfaces {{ var0 }} {{ var1 }} address 192.0.2.1/24
-     set interfaces {{ var0 }} {{ var1 }} address 2001:db8::1/64
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} address 192.0.2.1/24
+    set interfaces {{ var0 }} {{ var1 }} address 2001:db8::1/64
\ No newline at end of file
diff --git a/docs/_include/interface-common-with-dhcp.txt b/docs/_include/interface-common-with-dhcp.txt
index 1fe38a92..3e1394a3 100644
--- a/docs/_include/interface-common-with-dhcp.txt
+++ b/docs/_include/interface-common-with-dhcp.txt
@@ -1,19 +1,17 @@
 .. cmdinclude:: ../_include/interface-address-with-dhcp.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
 
 .. cmdinclude:: ../_include/interface-common.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
 
-**DHCP**
+**DHCP(v6)**
 
 .. cmdinclude:: ../_include/interface-dhcp-options.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-
-**DHCPv6**
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
 
 .. cmdinclude:: ../_include/interface-dhcpv6-options.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
diff --git a/docs/_include/interface-common-without-dhcp.txt b/docs/_include/interface-common-without-dhcp.txt
index 8e995ee1..d861f003 100644
--- a/docs/_include/interface-common-without-dhcp.txt
+++ b/docs/_include/interface-common-without-dhcp.txt
@@ -1,7 +1,7 @@
 .. cmdinclude:: ../_include/interface-address.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
 
 .. cmdinclude:: ../_include/interface-common.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
diff --git a/docs/_include/interface-common.txt b/docs/_include/interface-common.txt
index 052088df..de29356f 100644
--- a/docs/_include/interface-common.txt
+++ b/docs/_include/interface-common.txt
@@ -1,23 +1,36 @@
 .. cmdinclude:: ../_include/interface-description.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
 
 .. cmdinclude:: ../_include/interface-disable.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-disable-flow-control.txt
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-disable-link-detect.txt
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
 
 .. cmdinclude:: ../_include/interface-mac.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
 
 .. cmdinclude:: ../_include/interface-mtu.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
 
 .. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
 
 .. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-vrf.txt
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
+
diff --git a/docs/_include/interface-description.txt b/docs/_include/interface-description.txt
index 992d4945..1c6a870f 100644
--- a/docs/_include/interface-description.txt
+++ b/docs/_include/interface-description.txt
@@ -1,10 +1,10 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> description <description>
 
-   Set a human readable, descriptive alias for this connection. Alias is used by
-   e.g. the :opcmd:`show interfaces` command or SNMP based monitoring tools.
+  Set a human readable, descriptive alias for this connection. Alias is used by
+  e.g. the :opcmd:`show interfaces` command or SNMP based monitoring tools.
 
-   Example:
+  Example:
 
-   .. code-block:: none
+  .. code-block:: none
 
-     set interfaces {{ var0 }} {{ var1 }} description 'This is an awesome interface running on VyOS'
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} description 'This is an awesome interface running on VyOS'
\ No newline at end of file
diff --git a/docs/_include/interface-dhcpv6-options.txt b/docs/_include/interface-dhcpv6-options.txt
index 7213079a..94e80309 100644
--- a/docs/_include/interface-dhcpv6-options.txt
+++ b/docs/_include/interface-dhcpv6-options.txt
@@ -33,60 +33,6 @@
 
     set interfaces {{ var0 }} {{ var1 }} dhcpv6-options temporary
 
-
-
-
-**DHCPv6-PD**
-
-VyOS 1.3 (equuleus) supports DHCPv6-PD (:rfc:`3633`). DHCPv6 Prefix Delegation
-is supported by most ISPs who provide native IPv6 for consumers on fixed networks.
-
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> length <length>
-
-   Some ISPs by default only delegate a /64 prefix. To request for a specific
-   prefix size use this option to request for a bigger delegation for this pd
-   `<id>`. This value is in the range from 32 - 64 so you could request up to a
-   /32 prefix (if your ISP allows this) down to a /64 delegation.
-
-   The default value corresponds to 64.
-
-  Example:
-
-  To request a /56 prefix from your ISP use:
-
-  .. code-block:: none
-
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options pd 0 length 56
-
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> interface <delegatee> address <address>
-
-   Specify the interface address used locally on the interfcae where the prefix
-   has been delegated to. ID must be a decimal integer.
-
-   It will be combined with the delegated prefix and the sla-id to form a
-   complete interface address. The default is to use the EUI-64 address of the
-   interface.
-
-   Example: Delegate a /64 prefix to interface eth0.10 which will use a local
-   address on this router of ``<prefix>::ffff``, as the address 65534 will
-   correspond to ``ffff`` in hexadecimal notation.
-
-  .. code-block:: none
-
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6-option pd 0 interface eth0.10 address 65534
-
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> interface <delegatee> sla-id <id>
-
-   Specify the identifier value of the site-level aggregator (SLA) on the
-   interface. ID must be a decimal number greater then 0 which fits in the
-   length of SLA IDs (see below).
-
-   Example: If ID is 1 and the client is delegated an IPv6 prefix
-   2001:db8:ffff::/48, dhcp6c will combine the two values into a single IPv6
-   prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified
-   interface.
-
-  .. code-block:: none
-
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6-option pd 0 interface eth0.10 sla-id 1
-
+.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
diff --git a/docs/_include/interface-dhcpv6-prefix-delegation.txt b/docs/_include/interface-dhcpv6-prefix-delegation.txt
new file mode 100644
index 00000000..61e6aaa2
--- /dev/null
+++ b/docs/_include/interface-dhcpv6-prefix-delegation.txt
@@ -0,0 +1,54 @@
+**DHCPv6 Prefix Delegation (PD)**
+
+VyOS 1.3 (equuleus) supports DHCPv6-PD (:rfc:`3633`). DHCPv6 Prefix Delegation
+is supported by most ISPs who provide native IPv6 for consumers on fixed networks.
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> length <length>
+
+   Some ISPs by default only delegate a /64 prefix. To request for a specific
+   prefix size use this option to request for a bigger delegation for this pd
+   `<id>`. This value is in the range from 32 - 64 so you could request up to a
+   /32 prefix (if your ISP allows this) down to a /64 delegation.
+
+   The default value corresponds to 64.
+
+  Example:
+
+  To request a /56 prefix from your ISP use:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options pd 0 length 56
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> interface <delegatee> address <address>
+
+   Specify the interface address used locally on the interfcae where the prefix
+   has been delegated to. ID must be a decimal integer.
+
+   It will be combined with the delegated prefix and the sla-id to form a
+   complete interface address. The default is to use the EUI-64 address of the
+   interface.
+
+   Example: Delegate a /64 prefix to interface eth0.10 which will use a local
+   address on this router of ``<prefix>::ffff``, as the address 65534 will
+   correspond to ``ffff`` in hexadecimal notation.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6-option pd 0 interface eth0.10 address 65534
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> interface <delegatee> sla-id <id>
+
+   Specify the identifier value of the site-level aggregator (SLA) on the
+   interface. ID must be a decimal number greater then 0 which fits in the
+   length of SLA IDs (see below).
+
+   Example: If ID is 1 and the client is delegated an IPv6 prefix
+   2001:db8:ffff::/48, dhcp6c will combine the two values into a single IPv6
+   prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified
+   interface.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} dhcpv6-option pd 0 interface eth0.10 sla-id 1
+
diff --git a/docs/_include/interface-disable-flow-control.txt b/docs/_include/interface-disable-flow-control.txt
new file mode 100644
index 00000000..2b319b22
--- /dev/null
+++ b/docs/_include/interface-disable-flow-control.txt
@@ -0,0 +1,22 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} disable-flow-control
+
+  Ethernet flow control is a mechanism for temporarily stopping the transmission
+  of data on Ethernet family computer networks. The goal of this mechanism is to
+  ensure zero packet loss in the presence of network congestion.
+
+  The first flow control mechanism, the pause frame, was defined by the IEEE
+  802.3x standard.
+
+  A sending station (computer or network switch) may be transmitting data faster
+  than the other end of the link can accept it. Using flow control, the receiving
+  station can signal the sender requesting suspension of transmissions until the
+  receiver catches up.
+
+  Use this command to disable the generation of Ethernet flow control (pause
+  frames).
+
+   Example:
+
+   .. code-block:: none
+
+     set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} disable-flow-control
\ No newline at end of file
diff --git a/docs/_include/interface-disable-link-detect.txt b/docs/_include/interface-disable-link-detect.txt
new file mode 100644
index 00000000..a9c0e85f
--- /dev/null
+++ b/docs/_include/interface-disable-link-detect.txt
@@ -0,0 +1,12 @@
+.. cfgcmd:: set interfaces {{ var0 }} {{ var2 }} {{ var3 }} <interface> disable-link-detect
+
+  Use this command to direct an interface to not detect any physical state
+  changes on a link, for example, when the cable is unplugged.
+
+  Default is to detects physical link state changes.
+
+   Example:
+
+   .. code-block:: none
+
+     set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} disable-link-detect
\ No newline at end of file
diff --git a/docs/_include/interface-ipv6-addr-autoconf.txt b/docs/_include/interface-ipv6-addr-autoconf.txt
index 22f9ee59..e16cff0e 100644
--- a/docs/_include/interface-ipv6-addr-autoconf.txt
+++ b/docs/_include/interface-ipv6-addr-autoconf.txt
@@ -1,14 +1,12 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> ipv6 address autoconf
 
-
-  :abbr:`SLAAC (Stateless Address Autoconfiguration)`
-  :rfc:`4862`. IPv6 hosts can configure themselves automatically when connected
-  to an IPv6 network using the Neighbor Discovery Protocol via :abbr:`ICMPv6
-  (Internet Control Message Protocol version 6)` router discovery messages.
-  When first connected to a network, a host sends a link-local router
-  solicitation multicast request for its configuration parameters; routers
-  respond to such a request with a router advertisement packet that contains
-  Internet Layer configuration parameters.
+  :abbr:`SLAAC (Stateless Address Autoconfiguration)` :rfc:`4862`. IPv6 hosts
+  can configure themselves automatically when connected to an IPv6 network using
+  the Neighbor Discovery Protocol via :abbr:`ICMPv6 (Internet Control Message
+  Protocol version 6)` router discovery messages. When first connected to a
+  network, a host sends a link-local router solicitation multicast request for
+  its configuration parameters; routers respond to such a request with a router
+  advertisement packet that contains Internet Layer configuration parameters.
 
   .. note:: This method automatically disables IPv6 traffic forwarding on the
     interface in question.
diff --git a/docs/_include/interface-ipv6-addr-eui64.txt b/docs/_include/interface-ipv6-addr-eui64.txt
index 40f22e5f..5f32ccad 100644
--- a/docs/_include/interface-ipv6-addr-eui64.txt
+++ b/docs/_include/interface-ipv6-addr-eui64.txt
@@ -1,8 +1,8 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> ipv6 address eui64 <prefix>
 
-   :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
-   :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
+  :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
+  :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
 
-   .. code-block:: none
+  .. code-block:: none
 
-     set interfaces {{ var0 }} {{ var1 }} ipv6 address eui64 2001:db8:beef::/64
+    set interfaces {{ var0 }} {{ var1 }} ipv6 address eui64 2001:db8:beef::/64
diff --git a/docs/_include/interface-mac.txt b/docs/_include/interface-mac.txt
index 29157555..de7f2d83 100644
--- a/docs/_include/interface-mac.txt
+++ b/docs/_include/interface-mac.txt
@@ -1,7 +1,7 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> mac <xx:xx:xx:xx:xx:xx>
 
-   Configure user defined :abbr:`MAC (Media Access Control)` address on given
-   `<interface>`.
+  Configure user defined :abbr:`MAC (Media Access Control)` address on given
+  `<interface>`.
 
   Example:
 
diff --git a/docs/_include/interface-vlan.txt b/docs/_include/interface-vlan.txt
new file mode 100644
index 00000000..c1472018
--- /dev/null
+++ b/docs/_include/interface-vlan.txt
@@ -0,0 +1,50 @@
+IEEE 802.1q, often referred to as Dot1q, is the networking standard that supports
+virtual LANs (VLANs) on an IEEE 802.3 Ethernet network. The standard defines a
+system of VLAN tagging for Ethernet frames and the accompanying procedures to be
+used by bridges and switches in handling such frames. The standard also contains
+provisions for a quality-of-service prioritization scheme commonly known as IEEE
+802.1p and defines the Generic Attribute Registration Protocol.
+
+Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant) can
+include VLAN tags. When a frame enters the VLAN-aware portion of the network, a
+tag is added to represent the VLAN membership. Each frame must be distinguishable
+as being within exactly one VLAN. A frame in the VLAN-aware portion of the network
+that does not contain a VLAN tag is assumed to be flowing on the native VLAN.
+
+The standard was developed by IEEE 802.1, a working group of the IEEE 802
+standards committee, and continues to be actively revised. One of the notable
+revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path Bridging)
+and much of the IEEE 802.1d standard.
+
+802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The
+term used for this is ``vif``.
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> vif <vlan-id>
+
+  Create a new VLAN interface on interface `<interface>` using the VLAN number
+  provided via `<vlan-id>`.
+
+  You can create multiple VLAN interfaces on a physical interface. The VLAN ID
+  range is from 0 to 4094.
+
+  .. note:: Only 802.1Q-tagged packets are accepted on Ethernet vifs.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} vif 10
+
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-common.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
\ No newline at end of file
diff --git a/docs/_include/interface-vrf.txt b/docs/_include/interface-vrf.txt
new file mode 100644
index 00000000..92bfae93
--- /dev/null
+++ b/docs/_include/interface-vrf.txt
@@ -0,0 +1,12 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> vrf <vrf>
+
+  Place interface in given VRF instance.
+
+  .. seealso:: There is an entire chapter about how to configure a :ref:`vrf`,
+    please check this for additional information.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} vrf red
\ No newline at end of file
diff --git a/docs/interfaces/bond.rst b/docs/interfaces/bond.rst
index 4565eafc..859c25c3 100644
--- a/docs/interfaces/bond.rst
+++ b/docs/interfaces/bond.rst
@@ -20,8 +20,15 @@ Common interface configuration
    :var0: bond
    :var1: bond0
 
-Link Administration
--------------------
+Member Interfaces
+-----------------
+
+.. cfgcmd:: set interfaces bonding <interface> member interface <member>
+
+   Enslave `<member>` interface to bond `<interface>`.
+
+Bond options
+------------
 
 .. cfgcmd:: set interfaces bonding <interface> mode <mode>
 
@@ -246,13 +253,6 @@ Link Administration
    The maximum number of targets that can be specified is 16. The default value
    is no IP addresses.
 
-Member Interfaces
------------------
-
-.. cfgcmd:: set interfaces bonding <interface> member interface <member>
-
-   Enslave `<member>` interface to bond `<interface>`.
-
 Example
 -------
 
diff --git a/docs/interfaces/bridge.rst b/docs/interfaces/bridge.rst
index 8704d334..144e5f6d 100644
--- a/docs/interfaces/bridge.rst
+++ b/docs/interfaces/bridge.rst
@@ -24,29 +24,6 @@ Common interface configuration
    :var0: bridge
    :var1: br0
 
-.. cfgcmd:: set interfaces bridge <interface> aging <time>
-
-   MAC address aging `<time`> in seconds (default: 300).
-
-.. cfgcmd:: set interfaces bridge <interface> max-age <time>
-
-   Bridge maximum aging `<time>` in seconds (default: 20).
-
-   If a another bridge in the spanning tree does not send out a hello
-   packet for a long period of time, it is assumed to be dead.
-
-
-Link Administration
--------------------
-
-.. cfgcmd:: set interfaces bridge <interface> disable-flow-control
-
-   Disable Ethernet flow control (pause frames).
-
-.. cfgcmd:: set interfaces bridge <interface> igmp querier
-
-   Enable IGMP querier
-
 Member Interfaces
 -----------------
 
@@ -82,7 +59,6 @@ Member Interfaces
    deciding which link to use. Faster interfaces should have lower
    costs.
 
-
 .. _stp:
 
 STP Parameter
@@ -118,9 +94,26 @@ links providing fault tolerance if an active link fails.
    Designated Bridges. Hello packets are used to communicate information
    about the topology throughout the entire Bridged Local Area Network.
 
+Additional Bridge Options
+-------------------------
+
+.. cfgcmd:: set interfaces bridge <interface> aging <time>
+
+   MAC address aging `<time`> in seconds (default: 300).
+
+.. cfgcmd:: set interfaces bridge <interface> max-age <time>
+
+   Bridge maximum aging `<time>` in seconds (default: 20).
+
+   If a another bridge in the spanning tree does not send out a hello
+   packet for a long period of time, it is assumed to be dead.
+
+.. cfgcmd:: set interfaces bridge <interface> igmp querier
+
+   Enable IGMP querier
 
 Example
--------
+#######
 
 Creating a bridge interface is very simple. In this example we will
 have:
@@ -155,7 +148,7 @@ This results in the active configuration:
 
 
 Operation
-=========
+#########
 
 .. opcmd:: show bridge
 
diff --git a/docs/interfaces/dummy.rst b/docs/interfaces/dummy.rst
index a3989138..e0557d1d 100644
--- a/docs/interfaces/dummy.rst
+++ b/docs/interfaces/dummy.rst
@@ -33,6 +33,14 @@ Common interface configuration
    :var0: dummy
    :var1: dum0
 
+.. cmdinclude:: ../_include/interface-disable.txt
+   :var0: dummy
+   :var1: dum0
+
+.. cmdinclude:: ../_include/interface-vrf.txt
+   :var0: dummy
+   :var1: dum0
+
 Operation
 =========
 
diff --git a/docs/interfaces/ethernet.rst b/docs/interfaces/ethernet.rst
index 578ac517..1d3aeda3 100644
--- a/docs/interfaces/ethernet.rst
+++ b/docs/interfaces/ethernet.rst
@@ -45,13 +45,12 @@ Speed/Duplex
 
    VyOS default will be `auto`.
 
-Link Administration
--------------------
-
-.. cfgcmd:: set interfaces ethernet <interface> disable-flow-control
-
-   Disable Ethernet flow control (pause frames).
+VLAN (802.1q) configuration
+---------------------------
 
+.. cmdinclude:: ../_include/interface-vlan.txt
+   :var0: ethernet
+   :var1: eth0
 
 Operation
 =========
diff --git a/docs/interfaces/geneve.rst b/docs/interfaces/geneve.rst
index 8518fcf0..b59bb311 100644
--- a/docs/interfaces/geneve.rst
+++ b/docs/interfaces/geneve.rst
@@ -42,6 +42,9 @@ Common interface configuration
    :var0: geneve
    :var1: gnv0
 
+GENEVE specific options
+-----------------------
+
 .. cfgcmd:: set interfaces geneve gnv0 remote <address>
 
    Configure GENEVE tunnel far end/remote tunnel endpoint.
@@ -55,7 +58,3 @@ Common interface configuration
    decisions or MAY be used as a mechanism to distinguish between overlapping
    address spaces contained in the encapsulated packet when load balancing
    across CPUs.
-
-.. cfgcmd:: set interfaces geneve gnv0 mtu <mtu>
-
-   Set interface :abbr:`MTU (Maximum Transfer Unit)` size.
diff --git a/docs/interfaces/l2tpv3.rst b/docs/interfaces/l2tpv3.rst
index ea540c01..c456a58e 100644
--- a/docs/interfaces/l2tpv3.rst
+++ b/docs/interfaces/l2tpv3.rst
@@ -2,8 +2,9 @@
 
 .. _l2tpv3-interface:
 
+######
 L2TPv3
-------
+######
 
 L2TPv3 is a pseudowire protocol, you can read more about on `Wikipedia L2TPv3`_
 or in :rfc:`3921`
@@ -11,6 +12,16 @@ or in :rfc:`3921`
 L2TPv3 can transport any traffic including ethernet frames. L2TPv2 is limited
 to PPP.
 
+Configuration
+#############
+
+Common interface configuration
+------------------------------
+
+.. cmdinclude:: ../_include/interface-common-without-dhcp.txt
+   :var0: l2tpv3
+   :var1: l2tpeth0
+
 Over IP
 ^^^^^^^
 
diff --git a/docs/interfaces/macsec.rst b/docs/interfaces/macsec.rst
index 242636f1..f841e17d 100644
--- a/docs/interfaces/macsec.rst
+++ b/docs/interfaces/macsec.rst
@@ -23,6 +23,9 @@ Common interface configuration
    :var0: macsec
    :var1: macsec0
 
+MACsec specific options
+-----------------------
+
 .. cfgcmd:: set interfaces macsec <interface> security cipher [gcm-aes-128]
 
   Select cipher suite used for cryptographic operations. This setting is
@@ -41,9 +44,8 @@ Common interface configuration
   A physical interface is required to connect this MACsec instance to. Traffic
   leaving this interfac will now be authenticated/encrypted.
 
-
 Key Management
---------------
+^^^^^^^^^^^^^^
 
 :abbr:`MKA (MACsec Key Agreement protocol)` is used to synchronize keys between
 individual peers.
@@ -63,7 +65,7 @@ individual peers.
   distributing SAKs.
 
 Replay protection
------------------
+^^^^^^^^^^^^^^^^^
 
 .. cfgcmd:: set interfaces macsec <interface> security replay-window <window>
 
@@ -75,7 +77,7 @@ Replay protection
   - ``1-4294967295``: Number of packets that could be misordered
 
 Operation
-=========
+#########
 
 .. opcmd:: run generate macsec mka-cak
 
@@ -122,7 +124,7 @@ Operation
         TXSC: 005056bfefaa0001 on SA 0
 
 Examples
-========
+########
 
 * Two routers connected both via eth1 through an untrusted switch
 * R1 has 192.0.2.1/24 & 2001:db8::1/64
diff --git a/docs/interfaces/pppoe.rst b/docs/interfaces/pppoe.rst
index 8fa35492..e85c16aa 100644
--- a/docs/interfaces/pppoe.rst
+++ b/docs/interfaces/pppoe.rst
@@ -54,6 +54,24 @@ vDSL/aDSL understands.
 Configuration
 =============
 
+Common interface configuration
+------------------------------
+
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: pppoe
+   :var1: pppoe0
+
+.. cmdinclude:: ../_include/interface-disable.txt
+   :var0: pppoe
+   :var1: pppoe0
+
+.. cmdinclude:: ../_include/interface-vrf.txt
+   :var0: pppoe
+   :var1: pppoe0
+
+PPPoE specific configuration
+----------------------------
+
 .. cfgcmd:: set interfaces pppoe <interface> access-concentrator <name>
 
    Use this command to restrict the PPPoE session on a given access
@@ -102,16 +120,6 @@ Configuration
    **default:** A default route to the remote endpoint is automatically added
    when the link comes up (i.e. auto).
 
-.. cfgcmd:: set interfaces pppoe <interface> description
-
-   Assign given `<description>` to interface. Description will also be passed
-   to SNMP monitoring systems.
-
-.. cfgcmd:: set interfaces pppoe <interface> disable
-
-   Disable given `<interface>`. It will be placed in administratively down
-   (``A/D``) state.
-
 .. cfgcmd:: set interfaces pppoe <interface> idle-timeout <time>
 
    Use this command to set the idle timeout interval to be used with on-demand
@@ -167,43 +175,9 @@ IPv6
    Use this command to enable acquisition of IPv6 address using stateless
    autoconfig (SLAAC).
 
-Prefix Delegation (DHCPv6-PD)
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-VyOS 1.3 (equuleus) supports DHCPv6-PD. DHCPv6 Prefix Delegation is supported
-by most ISPs who provide native IPv6 for consumers on fixed networks.
-
-.. cfgcmd:: set interfaces pppoe <interface> dhcpv6-option pd <id> length <length>
-
-   Some ISPs by default only delegate a /64 prefix. To request for a specific
-   prefix size use this option to request for a bigger delegation for this pd
-   `<id>`. This value
-   is in the range from 32 - 64 so you could request up to /32 down to a /64
-   delegation.
-
-   Default value is 64.
-
-.. cfgcmd:: set interfaces pppoe <interface> dhcpv6-option pd <id> interface <delegatee> address <address>
-
-   Specify the interface address used locally on the interfcae where the prefix
-   has been delegated to. ID must be a decimal integer.
-
-   It will be combined with the delegated prefix and the sla-id to form a complete
-   interface address. The default is to use the EUI-64 address of the interface.
-
-   Example:
-
-   Using ``<id>`` value 65535 will assign IPv6 address ``<prefix>::ffff`` to the
-   interface.
-
-.. cfgcmd:: set interfaces pppoe <interface> dhcpv6-option pd <id> interface <delegatee> sla-id <id>
-
-   Specify the identifier value of the site-level aggregator (SLA) on the
-   interface. ID must be a decimal number greater then 0 which fits in the length
-   of SLA IDs (see below). For example, if ID is 1 and the client is delegated
-   an IPv6 prefix 2001:db8:ffff::/48, dhcp6c will combine the two values into a
-   single IPv6 prefix, 2001:db8:ffff:1::/64, and will configure the prefix on
-   the specified interface.
+.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+  :var0: pppoe
+  :var1: pppoe0
 
 Operation
 =========
diff --git a/docs/interfaces/pseudo-ethernet.rst b/docs/interfaces/pseudo-ethernet.rst
index 52ba789b..26d8a364 100644
--- a/docs/interfaces/pseudo-ethernet.rst
+++ b/docs/interfaces/pseudo-ethernet.rst
@@ -48,8 +48,8 @@ Common interface configuration
    :var0: pseudo-ethernet
    :var1: peth0
 
-Physical Asignment
-------------------
+Pseudo Ethernet/MACVLAN specific options
+----------------------------------------
 
 .. cfgcmd:: set interfaces pseudo-ethernet <interface> source-interface <ethX>
 
diff --git a/docs/interfaces/tunnel.rst b/docs/interfaces/tunnel.rst
index f20127f5..9674b0a8 100644
--- a/docs/interfaces/tunnel.rst
+++ b/docs/interfaces/tunnel.rst
@@ -13,6 +13,13 @@ GRE options that can be useful.
 All those protocols are grouped under ``interfaces tunnel`` in VyOS. Let's take
 a closer look at the protocols and options currently supported by VyOS.
 
+Common interface configuration
+------------------------------
+
+.. cmdinclude:: ../_include/interface-common-without-dhcp.txt
+   :var0: tunnel
+   :var1: tun0
+
 IPIP
 ----
 
diff --git a/docs/interfaces/vxlan.rst b/docs/interfaces/vxlan.rst
index 5ecfeb0a..40dc5400 100644
--- a/docs/interfaces/vxlan.rst
+++ b/docs/interfaces/vxlan.rst
@@ -40,55 +40,54 @@ Common interface configuration
 ------------------------------
 
 .. cmdinclude:: ../_include/interface-common-without-dhcp.txt
-   :var0: vxlan
-   :var1: vxlan0
+  :var0: vxlan
+  :var1: vxlan0
 
-.. cfgcmd:: set interfaces vxlan <interface> vni <number>
-
-   Each VXLAN segment is identified through a 24-bit segment ID, termed the
-   :abbr:`VNI (VXLAN Network Identifier (or VXLAN Segment ID))`, This allows
-   up to 16M VXLAN segments to coexist within the same administrative domain.
+VXLAN specific options
+-----------------------
 
-Multicast
-^^^^^^^^^
+.. cfgcmd:: set interfaces vxlan <interface> vni <number>
 
-.. cfgcmd:: set interfaces vxlan <interface> source-interface <interface>
+  Each VXLAN segment is identified through a 24-bit segment ID, termed the
+  :abbr:`VNI (VXLAN Network Identifier (or VXLAN Segment ID))`, This allows
+  up to 16M VXLAN segments to coexist within the same administrative domain.
 
-   Interface used for VXLAN underlay. This is mandatory when using VXLAN via
-   a multicast network. VXLAN traffic will always enter and exit this interface.
+.. cfgcmd:: set interfaces vxlan <interface> port <port>
 
+  Configure port number of remote VXLAN endpoint.
 
-.. cfgcmd:: set interfaces vxlan <interface> group <address>
+  .. note:: As VyOS is Linux based the default port used is not using 4789
+     as the default IANA-assigned destination UDP port number. Instead VyOS
+     uses the Linux default port of 8472.
 
-   Multicast group address for VXLAN interface. VXLAN tunnels can be built
-   either via Multicast or via Unicast.
+.. cfgcmd:: set interfaces vxlan <interface> source-address <interface>
 
-   Both IPv4 and IPv6 multicast is possible.
+  Source IP address used for VXLAN underlay. This is mandatory when using VXLAN
+  via L2VPN/EVPN.
 
 Unicast
 ^^^^^^^
 
 .. cfgcmd:: set interfaces vxlan <interface> remote <address>
 
-   IPv4/IPv6 remote address of the VXLAN tunnel. Alternative to multicast, the
-   remote IPv4/IPv6 address can set directly.
+  IPv4/IPv6 remote address of the VXLAN tunnel. Alternative to multicast, the
+  remote IPv4/IPv6 address can set directly.
 
+Multicast
+^^^^^^^^^
 
-.. cfgcmd:: set interfaces vxlan <interface> port <port>
+.. cfgcmd:: set interfaces vxlan <interface> source-interface <interface>
 
-    Configure port number of remote VXLAN endpoint.
+  Interface used for VXLAN underlay. This is mandatory when using VXLAN via
+  a multicast network. VXLAN traffic will always enter and exit this interface.
 
-    .. note:: As VyOS is Linux based the default port used is not using 4789
-       as the default IANA-assigned destination UDP port number. Instead VyOS
-       uses the Linux default port of 8472.
 
-L2VVPN / EVPN
-^^^^^^^^^^^^^
+.. cfgcmd:: set interfaces vxlan <interface> group <address>
 
-.. cfgcmd:: set interfaces vxlan <interface> source-address <interface>
+  Multicast group address for VXLAN interface. VXLAN tunnels can be built
+  either via Multicast or via Unicast.
 
-   Source IP address used for VXLAN underlay. This is mandatory when using
-   VXLAN via L2VPN/EVPN.
+  Both IPv4 and IPv6 multicast is possible.
 
 Multicast VXLAN
 ===============
diff --git a/docs/interfaces/wireless.rst b/docs/interfaces/wireless.rst
index 8b1195fa..b146a21b 100644
--- a/docs/interfaces/wireless.rst
+++ b/docs/interfaces/wireless.rst
@@ -1,7 +1,10 @@
+.. include:: ../_include/need_improvement.txt
+
 .. _wireless-interface:
 
+###################
 Wireless LAN (WiFi)
--------------------
+###################
 
 :abbr:`WLAN (Wireless LAN)` interface provide 802.11 (a/b/g/n/ac) wireless
 support (commonly referred to as Wi-Fi) by means of compatible hardware. If your
@@ -22,17 +25,30 @@ If the system detects an unconfigured wireless device, it will be automatically
 added the configuration tree, specifying any detected settings (for example,
 its MAC address) and configured to run in monitor mode.
 
+Configuration
+#############
+
+Common interface configuration
+------------------------------
+
+.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
+   :var0: wireless
+   :var1: wlan0
+
+Wireless specific options
+-------------------------
+
+Configuring Access-Point
+^^^^^^^^^^^^^^^^^^^^^^^^
+
 To be able to use the wireless interfaces you will first need to set a
 regulatory domain with the country code of your location.
 
-.. cfgcmd:: set system wifi-regulatory-domain DE
+.. cfgcmd:: set interfaces wireless <interface> country-code <cc>
 
    Configure system wide Wi-Fi regulatory domain. A reboot is required for this
    change to be enabled.
 
-Configuring Access-Point
-^^^^^^^^^^^^^^^^^^^^^^^^
-
 The following example creates a WAP. When configuring multiple WAP interfaces,
 you must specify unique IP addresses, channels, Network IDs commonly referred
 to as :abbr:`SSID (Service Set Identifier)`, and MAC addresses.
diff --git a/docs/interfaces/wirelessmodem.rst b/docs/interfaces/wirelessmodem.rst
index eabb17b9..4590a3bb 100644
--- a/docs/interfaces/wirelessmodem.rst
+++ b/docs/interfaces/wirelessmodem.rst
@@ -18,8 +18,16 @@ Common interface configuration
    :var0: wirelessmodem
    :var1: wlm0
 
-Address
--------
+.. cmdinclude:: ../_include/interface-disable.txt
+   :var0: wirelessmodem
+   :var1: wlm0
+
+.. cmdinclude:: ../_include/interface-vrf.txt
+   :var0: wirelessmodem
+   :var1: wlm0
+
+WWAN specific options
+---------------------
 
 .. cfgcmd:: set interfaces wirelessmodem <interface> apn <apn>
 
-- 
cgit v1.2.3


From 6588e905512e80e6038fd210837b52f43a7632ad Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Mon, 23 Nov 2020 17:32:11 +0100
Subject: interfaces: add generic VLAN documentation

---
 docs/_include/interface-address-with-dhcp.txt   | 10 ++--
 docs/_include/interface-description.txt         |  4 +-
 docs/_include/interface-disable-link-detect.txt |  2 +-
 docs/_include/interface-disable.txt             | 12 ++---
 docs/_include/interface-ipv6-addr-autoconf.txt  |  4 +-
 docs/_include/interface-ipv6-addr-eui64.txt     |  4 +-
 docs/_include/interface-mac.txt                 |  4 +-
 docs/_include/interface-mtu.txt                 |  4 +-
 docs/_include/interface-vlan.txt                | 53 +++++++++++++++++++--
 docs/_include/interface-vrf.txt                 |  4 +-
 docs/interfaces/bond.rst                        |  7 +++
 docs/interfaces/bridge.rst                      | 61 +++++++------------------
 docs/interfaces/ethernet.rst                    |  7 +++
 docs/interfaces/pseudo-ethernet.rst             |  7 +++
 docs/interfaces/wireless.rst                    |  8 +++-
 15 files changed, 116 insertions(+), 75 deletions(-)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-address-with-dhcp.txt b/docs/_include/interface-address-with-dhcp.txt
index 10838e72..45bc9b03 100644
--- a/docs/_include/interface-address-with-dhcp.txt
+++ b/docs/_include/interface-address-with-dhcp.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> address <address | dhcp |
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} address <address | dhcp |
    dhcpv6>
 
   Configure interface `<interface>` with one or more interface addresses.
@@ -14,7 +14,7 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} address 192.0.2.1/24
-    set interfaces {{ var0 }} {{ var1 }} address 2001:db8::1/64
-    set interfaces {{ var0 }} {{ var1 }} dhcp
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} address 192.0.2.1/24
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} address 2001:db8::1/64
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6
\ No newline at end of file
diff --git a/docs/_include/interface-description.txt b/docs/_include/interface-description.txt
index 1c6a870f..50c08d45 100644
--- a/docs/_include/interface-description.txt
+++ b/docs/_include/interface-description.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> description <description>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} description <description>
 
   Set a human readable, descriptive alias for this connection. Alias is used by
   e.g. the :opcmd:`show interfaces` command or SNMP based monitoring tools.
@@ -7,4 +7,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} description 'This is an awesome interface running on VyOS'
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} description 'This is an awesome interface running on VyOS'
\ No newline at end of file
diff --git a/docs/_include/interface-disable-link-detect.txt b/docs/_include/interface-disable-link-detect.txt
index a9c0e85f..1cc97146 100644
--- a/docs/_include/interface-disable-link-detect.txt
+++ b/docs/_include/interface-disable-link-detect.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} {{ var2 }} {{ var3 }} <interface> disable-link-detect
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} disable-link-detect
 
   Use this command to direct an interface to not detect any physical state
   changes on a link, for example, when the cable is unplugged.
diff --git a/docs/_include/interface-disable.txt b/docs/_include/interface-disable.txt
index 83ef3e53..f0d22563 100644
--- a/docs/_include/interface-disable.txt
+++ b/docs/_include/interface-disable.txt
@@ -1,10 +1,10 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> disable
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} disable
 
-   Disable given `<interface>`. It will be placed in administratively down
-   (``A/D``) state.
+  Disable given `<interface>`. It will be placed in administratively down
+  (``A/D``) state.
 
-   Example:
+  Example:
 
-   .. code-block:: none
+  .. code-block:: none
 
-     set interfaces {{ var0 }} {{ var1 }} disable
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} disable
\ No newline at end of file
diff --git a/docs/_include/interface-ipv6-addr-autoconf.txt b/docs/_include/interface-ipv6-addr-autoconf.txt
index e16cff0e..c0c5650d 100644
--- a/docs/_include/interface-ipv6-addr-autoconf.txt
+++ b/docs/_include/interface-ipv6-addr-autoconf.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> ipv6 address autoconf
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} ipv6 address autoconf
 
   :abbr:`SLAAC (Stateless Address Autoconfiguration)` :rfc:`4862`. IPv6 hosts
   can configure themselves automatically when connected to an IPv6 network using
@@ -15,4 +15,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} ipv6 address autoconf
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} ipv6 address autoconf
diff --git a/docs/_include/interface-ipv6-addr-eui64.txt b/docs/_include/interface-ipv6-addr-eui64.txt
index 5f32ccad..2e044b9d 100644
--- a/docs/_include/interface-ipv6-addr-eui64.txt
+++ b/docs/_include/interface-ipv6-addr-eui64.txt
@@ -1,8 +1,8 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> ipv6 address eui64 <prefix>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} ipv6 address eui64 <prefix>
 
   :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
   :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} ipv6 address eui64 2001:db8:beef::/64
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} ipv6 address eui64 2001:db8:beef::/64
diff --git a/docs/_include/interface-mac.txt b/docs/_include/interface-mac.txt
index de7f2d83..ca2b71e6 100644
--- a/docs/_include/interface-mac.txt
+++ b/docs/_include/interface-mac.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> mac <xx:xx:xx:xx:xx:xx>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} mac <xx:xx:xx:xx:xx:xx>
 
   Configure user defined :abbr:`MAC (Media Access Control)` address on given
   `<interface>`.
@@ -7,4 +7,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} mac '00:01:02:03:04:05'
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} mac '00:01:02:03:04:05'
\ No newline at end of file
diff --git a/docs/_include/interface-mtu.txt b/docs/_include/interface-mtu.txt
index e727c3e9..fd232f5d 100644
--- a/docs/_include/interface-mtu.txt
+++ b/docs/_include/interface-mtu.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> mtu <mtu>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} mtu <mtu>
 
   Configure :abbr:`MTU (Maximum Transmission Unit)` on given `<interface>`. It
   is the size (in bytes) of the largest ethernet frame sent on this link.
@@ -7,4 +7,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} mtu 1450
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} mtu 1450
\ No newline at end of file
diff --git a/docs/_include/interface-vlan.txt b/docs/_include/interface-vlan.txt
index c1472018..7b87c3eb 100644
--- a/docs/_include/interface-vlan.txt
+++ b/docs/_include/interface-vlan.txt
@@ -29,20 +29,63 @@ term used for this is ``vif``.
 
   .. note:: Only 802.1Q-tagged packets are accepted on Ethernet vifs.
 
-  Example:
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
 
-  .. code-block:: none
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
 
-    set interfaces {{ var0 }} {{ var1 }} vif 10
+.. cmdinclude:: ../_include/interface-disable.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
 
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+.. cmdinclude:: ../_include/interface-disable-link-detect.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-mac.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-mtu.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-common.txt
+.. cmdinclude:: ../_include/interface-vrf.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
diff --git a/docs/_include/interface-vrf.txt b/docs/_include/interface-vrf.txt
index 92bfae93..ca715fb2 100644
--- a/docs/_include/interface-vrf.txt
+++ b/docs/_include/interface-vrf.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> vrf <vrf>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} vrf <vrf>
 
   Place interface in given VRF instance.
 
@@ -9,4 +9,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} vrf red
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} vrf red
\ No newline at end of file
diff --git a/docs/interfaces/bond.rst b/docs/interfaces/bond.rst
index 21088c02..eea35e2c 100644
--- a/docs/interfaces/bond.rst
+++ b/docs/interfaces/bond.rst
@@ -256,6 +256,13 @@ Bond options
    The maximum number of targets that can be specified is 16. The default value
    is no IP addresses.
 
+VLAN
+====
+
+.. cmdinclude:: ../_include/interface-vlan.txt
+   :var0: bond
+   :var1: bond0
+
 *******
 Example
 *******
diff --git a/docs/interfaces/bridge.rst b/docs/interfaces/bridge.rst
index 058d7b01..045ae2a8 100644
--- a/docs/interfaces/bridge.rst
+++ b/docs/interfaces/bridge.rst
@@ -113,56 +113,27 @@ links providing fault tolerance if an active link fails.
    Designated Bridges. Hello packets are used to communicate information
    about the topology throughout the entire Bridged Local Area Network.
 
-Enable VLAN-aware bridge
--------------------------
+VLAN
+====
 
-.. cfgcmd:: set interfaces bridge <interface> member interface <member> native-vlan <vlan-id>
-
-   Set the native VLAN ID flag of the interface. When a data packet without a VLAN tag enters
-   the port, the data packet will be forced to add a tag of a specific vlan id. When the vlan 
-   id flag flows out, the tag of the vlan id will be stripped
-
-.. cfgcmd:: set interfaces bridge <interface> member interface <member> allowed-vlan <vlan-id>
-
-   Allows specific VLAN IDs to pass through the bridge member interface
-
-.. cfgcmd:: set interfaces bridge <interface> member interface <member> allowed-vlan <n-m>
-
-   `n` and `m` represent a VLAN ID, which identifies a VLAN ID range and allows all VLAN IDS in this range to pass through the bridge member interface
-
-VLAN (802.1q) configuration
----------------------------
-
-IEEE 802.1q, often referred to as Dot1q, is the networking standard that supports
-virtual LANs (VLANs) on an IEEE 802.3 Ethernet network. The standard defines a
-system of VLAN tagging for Ethernet frames and the accompanying procedures to be
-used by bridges and switches in handling such frames. The standard also contains
-provisions for a quality-of-service prioritization scheme commonly known as IEEE
-802.1p and defines the Generic Attribute Registration Protocol.
-
-Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant) can
-include VLAN tags. When a frame enters the VLAN-aware portion of the network, a
-tag is added to represent the VLAN membership. Each frame must be distinguishable
-as being within exactly one VLAN. A frame in the VLAN-aware portion of the network
-that does not contain a VLAN tag is assumed to be flowing on the native VLAN.
-
-The standard was developed by IEEE 802.1, a working group of the IEEE 802
-standards committee, and continues to be actively revised. One of the notable
-revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path Bridging)
-and much of the IEEE 802.1d standard.
-
-802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The
-term used for this is ``vif``.
+.. cmdinclude:: ../_include/interface-vlan.txt
+   :var0: bridge
+   :var1: br0
 
-.. cfgcmd:: set interfaces bridge <interface> vif <vlan-id>
+.. cfgcmd:: set interfaces bridge <interface> member interface <member>
+   native-vlan <vlan-id>
 
-  Create a new VLAN interface on interface `<interface>` using the VLAN number
-  provided via `<vlan-id>`.
+   Set the native VLAN ID flag of the interface. When a data packet without a
+   VLAN tag enters the port, the data packet will be forced to add a tag of a
+   specific vlan id. When the vlan id flag flows out, the tag of the vlan id
+   will be stripped
 
-  You can create multiple VLAN interfaces on a physical interface. The VLAN ID
-  range is from 1 to 4094.
+.. cfgcmd:: set interfaces bridge <interface> member interface <member>
+   allowed-vlan <vlan-id>
 
-  .. note:: Only 802.1Q-tagged packets are accepted on Bridge vifs.
+   Allows specific VLAN IDs to pass through the bridge member interface. This
+   can either be an individual VLAN id or a range of VLAN ids delimited by a
+   hyphen.
 
 *******
 Example
diff --git a/docs/interfaces/ethernet.rst b/docs/interfaces/ethernet.rst
index 71a340b1..343a7d59 100644
--- a/docs/interfaces/ethernet.rst
+++ b/docs/interfaces/ethernet.rst
@@ -49,6 +49,13 @@ Ethernet options
 
    VyOS default will be `auto`.
 
+VLAN
+====
+
+.. cmdinclude:: ../_include/interface-vlan.txt
+   :var0: ethernet
+   :var1: eth0
+
 *********
 Operation
 *********
diff --git a/docs/interfaces/pseudo-ethernet.rst b/docs/interfaces/pseudo-ethernet.rst
index b373a617..d4eb8eff 100644
--- a/docs/interfaces/pseudo-ethernet.rst
+++ b/docs/interfaces/pseudo-ethernet.rst
@@ -56,3 +56,10 @@ Pseudo Ethernet/MACVLAN options
 
    Specifies the physical `<ethX>` Ethernet interface associated with a Pseudo
    Ethernet `<interface>`.
+
+VLAN
+====
+
+.. cmdinclude:: ../_include/interface-vlan.txt
+   :var0: pseudo-ethernet
+   :var1: peth0
diff --git a/docs/interfaces/wireless.rst b/docs/interfaces/wireless.rst
index 75c42f29..b51eb274 100644
--- a/docs/interfaces/wireless.rst
+++ b/docs/interfaces/wireless.rst
@@ -274,7 +274,6 @@ VHT (Very High Throughput) capabilities (802.11ac)
 
   Station supports receiving VHT variant HT Control field
 
-
 Wireless options (Station/Client)
 =================================
 
@@ -373,6 +372,13 @@ Resulting in
   }
 
 
+VLAN
+====
+
+.. cmdinclude:: ../_include/interface-vlan.txt
+   :var0: wireless
+   :var1: wlan0
+
 *********
 Operation
 *********
-- 
cgit v1.2.3


From cdb3550aaf1beb0d2069f33c5e66a232f7cbdee1 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Mon, 23 Nov 2020 21:19:44 +0100
Subject: interfaces: vlan: remove wrong arg in cmd headline

---
 docs/_include/interface-address-with-dhcp.txt      |  2 +-
 docs/_include/interface-description.txt            |  2 +-
 docs/_include/interface-dhcp-options.txt           | 22 +++++----
 docs/_include/interface-dhcpv6-options.txt         | 24 ++++-----
 .../interface-dhcpv6-prefix-delegation.txt         | 57 +++++++++++-----------
 docs/_include/interface-disable-link-detect.txt    |  9 ++--
 docs/_include/interface-disable.txt                |  2 +-
 docs/_include/interface-ipv6-addr-autoconf.txt     |  3 +-
 docs/_include/interface-ipv6-addr-eui64.txt        |  3 +-
 docs/_include/interface-mac.txt                    |  3 +-
 docs/_include/interface-mtu.txt                    |  3 +-
 docs/_include/interface-vlan.txt                   | 16 ++++++
 docs/_include/interface-vrf.txt                    |  3 +-
 13 files changed, 88 insertions(+), 61 deletions(-)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-address-with-dhcp.txt b/docs/_include/interface-address-with-dhcp.txt
index 45bc9b03..20cd53ac 100644
--- a/docs/_include/interface-address-with-dhcp.txt
+++ b/docs/_include/interface-address-with-dhcp.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} address <address | dhcp |
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} address <address | dhcp |
    dhcpv6>
 
   Configure interface `<interface>` with one or more interface addresses.
diff --git a/docs/_include/interface-description.txt b/docs/_include/interface-description.txt
index 50c08d45..4347b837 100644
--- a/docs/_include/interface-description.txt
+++ b/docs/_include/interface-description.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} description <description>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} description <description>
 
   Set a human readable, descriptive alias for this connection. Alias is used by
   e.g. the :opcmd:`show interfaces` command or SNMP based monitoring tools.
diff --git a/docs/_include/interface-dhcp-options.txt b/docs/_include/interface-dhcp-options.txt
index da1975fc..2bc23efc 100644
--- a/docs/_include/interface-dhcp-options.txt
+++ b/docs/_include/interface-dhcp-options.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcp-options client-id <description>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+   dhcp-options client-id <description>
 
   :rfc:`2131` states: The client MAY choose to explicitly provide the identifier
   through the 'client identifier' option. If the client supplies a 'client
@@ -10,9 +11,10 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcp-options client-id 'foo-bar'
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp-options client-id 'foo-bar'
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcp-options host-name <hostname>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  dhcp-options host-name <hostname>
 
   Instead of sending the real system hostname to the DHCP server, overwrite the
   host-name with this given-value.
@@ -21,20 +23,22 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcp-options host-name 'VyOS'
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp-options host-name 'VyOS'
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcp-options vendor-class-id <vendor-id>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  dhcp-options vendor-class-id <vendor-id>
 
   The vendor-class-id option can be used to request a specific class of vendor
   options from the server.
 
-  Example
+  Example:
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcp-options vendor-class-id 'VyOS'
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp-options vendor-class-id 'VyOS'
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcp-options no-default-route
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  dhcp-options no-default-route
 
   Only request an address from the DHCP server but do not request a default
   gateway.
@@ -43,4 +47,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcp-options no-default-route
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp-options no-default-route
diff --git a/docs/_include/interface-dhcpv6-options.txt b/docs/_include/interface-dhcpv6-options.txt
index 94e80309..00b5e817 100644
--- a/docs/_include/interface-dhcpv6-options.txt
+++ b/docs/_include/interface-dhcpv6-options.txt
@@ -1,38 +1,38 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-options parameters-only
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  dhcpv6-options parameters-only
 
   This statement specifies dhcp6c to only exchange informational configuration
   parameters with servers. A list of DNS server addresses is an example of such
   parameters. This statement is useful when the client does not need stateful
   configuration parameters such as IPv6 addresses or prefixes.
 
-  Example:
-
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options parameters-only
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-options parameters-only
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-options rapid-commit
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  dhcpv6-options rapid-commit
 
   When rapid-commit is specified, dhcp6c will include a rapid-commit option in
   solicit messages and wait for an immediate reply instead of advertisements.
 
-  Example:
-
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options rapid-commit
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-options rapid-commit
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-options temporary
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  dhcpv6-options temporary
 
   Request only a temporary address and not form an IA_NA (Identity Association
   for Non-temporary Addresses) partnership.
 
-  Example
-
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options temporary
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-options temporary
 
 .. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
+  :var2: {{ var2 }}
+  :var3: {{ var3 }}
+  :var4: {{ var4 }}
diff --git a/docs/_include/interface-dhcpv6-prefix-delegation.txt b/docs/_include/interface-dhcpv6-prefix-delegation.txt
index 61e6aaa2..21721400 100644
--- a/docs/_include/interface-dhcpv6-prefix-delegation.txt
+++ b/docs/_include/interface-dhcpv6-prefix-delegation.txt
@@ -3,52 +3,53 @@
 VyOS 1.3 (equuleus) supports DHCPv6-PD (:rfc:`3633`). DHCPv6 Prefix Delegation
 is supported by most ISPs who provide native IPv6 for consumers on fixed networks.
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> length <length>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  dhcpv6-option pd <id> length <length>
 
-   Some ISPs by default only delegate a /64 prefix. To request for a specific
-   prefix size use this option to request for a bigger delegation for this pd
-   `<id>`. This value is in the range from 32 - 64 so you could request up to a
-   /32 prefix (if your ISP allows this) down to a /64 delegation.
+  Some ISPs by default only delegate a /64 prefix. To request for a specific
+  prefix size use this option to request for a bigger delegation for this pd
+  `<id>`. This value is in the range from 32 - 64 so you could request up to a
+  /32 prefix (if your ISP allows this) down to a /64 delegation.
 
-   The default value corresponds to 64.
-
-  Example:
+  The default value corresponds to 64.
 
   To request a /56 prefix from your ISP use:
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6-options pd 0 length 56
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-options pd 0 length 56
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> interface <delegatee> address <address>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  dhcpv6-option pd <id> interface <delegatee> address <address>
 
-   Specify the interface address used locally on the interfcae where the prefix
-   has been delegated to. ID must be a decimal integer.
+  Specify the interface address used locally on the interfcae where the prefix
+  has been delegated to. ID must be a decimal integer.
 
-   It will be combined with the delegated prefix and the sla-id to form a
-   complete interface address. The default is to use the EUI-64 address of the
-   interface.
+  It will be combined with the delegated prefix and the sla-id to form a
+  complete interface address. The default is to use the EUI-64 address of the
+  interface.
 
-   Example: Delegate a /64 prefix to interface eth0.10 which will use a local
-   address on this router of ``<prefix>::ffff``, as the address 65534 will
-   correspond to ``ffff`` in hexadecimal notation.
+  Example: Delegate a /64 prefix to interface eth8 which will use a local
+  address on this router of ``<prefix>::ffff``, as the address 65534 will
+  correspond to ``ffff`` in hexadecimal notation.
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6-option pd 0 interface eth0.10 address 65534
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-option pd 0 interface eth8 address 65534
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> dhcpv6-option pd <id> interface <delegatee> sla-id <id>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  dhcpv6-option pd <id> interface <delegatee> sla-id <id>
 
-   Specify the identifier value of the site-level aggregator (SLA) on the
-   interface. ID must be a decimal number greater then 0 which fits in the
-   length of SLA IDs (see below).
+  Specify the identifier value of the site-level aggregator (SLA) on the
+  interface. ID must be a decimal number greater then 0 which fits in the
+  length of SLA IDs (see below).
 
-   Example: If ID is 1 and the client is delegated an IPv6 prefix
-   2001:db8:ffff::/48, dhcp6c will combine the two values into a single IPv6
-   prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified
-   interface.
+  Example: If ID is 1 and the client is delegated an IPv6 prefix
+  2001:db8:ffff::/48, dhcp6c will combine the two values into a single IPv6
+  prefix, 2001:db8:ffff:1::/64, and will configure the prefix on the specified
+  interface.
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} dhcpv6-option pd 0 interface eth0.10 sla-id 1
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-option pd 0 interface eth8 sla-id 1
 
diff --git a/docs/_include/interface-disable-link-detect.txt b/docs/_include/interface-disable-link-detect.txt
index 1cc97146..efd45e46 100644
--- a/docs/_include/interface-disable-link-detect.txt
+++ b/docs/_include/interface-disable-link-detect.txt
@@ -1,12 +1,13 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} disable-link-detect
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  disable-link-detect
 
   Use this command to direct an interface to not detect any physical state
   changes on a link, for example, when the cable is unplugged.
 
   Default is to detects physical link state changes.
 
-   Example:
+  Example:
 
-   .. code-block:: none
+  .. code-block:: none
 
-     set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} disable-link-detect
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} disable-link-detect
\ No newline at end of file
diff --git a/docs/_include/interface-disable.txt b/docs/_include/interface-disable.txt
index f0d22563..a9511d8e 100644
--- a/docs/_include/interface-disable.txt
+++ b/docs/_include/interface-disable.txt
@@ -1,4 +1,4 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} disable
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} disable
 
   Disable given `<interface>`. It will be placed in administratively down
   (``A/D``) state.
diff --git a/docs/_include/interface-ipv6-addr-autoconf.txt b/docs/_include/interface-ipv6-addr-autoconf.txt
index c0c5650d..e349a730 100644
--- a/docs/_include/interface-ipv6-addr-autoconf.txt
+++ b/docs/_include/interface-ipv6-addr-autoconf.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} ipv6 address autoconf
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  ipv6 address autoconf
 
   :abbr:`SLAAC (Stateless Address Autoconfiguration)` :rfc:`4862`. IPv6 hosts
   can configure themselves automatically when connected to an IPv6 network using
diff --git a/docs/_include/interface-ipv6-addr-eui64.txt b/docs/_include/interface-ipv6-addr-eui64.txt
index 2e044b9d..10732bf3 100644
--- a/docs/_include/interface-ipv6-addr-eui64.txt
+++ b/docs/_include/interface-ipv6-addr-eui64.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} ipv6 address eui64 <prefix>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  ipv6 address eui64 <prefix>
 
   :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
   :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
diff --git a/docs/_include/interface-mac.txt b/docs/_include/interface-mac.txt
index ca2b71e6..2daeaccf 100644
--- a/docs/_include/interface-mac.txt
+++ b/docs/_include/interface-mac.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} mac <xx:xx:xx:xx:xx:xx>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  mac <xx:xx:xx:xx:xx:xx>
 
   Configure user defined :abbr:`MAC (Media Access Control)` address on given
   `<interface>`.
diff --git a/docs/_include/interface-mtu.txt b/docs/_include/interface-mtu.txt
index fd232f5d..8509779b 100644
--- a/docs/_include/interface-mtu.txt
+++ b/docs/_include/interface-mtu.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} mtu <mtu>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  mtu <mtu>
 
   Configure :abbr:`MTU (Maximum Transmission Unit)` on given `<interface>`. It
   is the size (in bytes) of the largest ethernet frame sent on this link.
diff --git a/docs/_include/interface-vlan.txt b/docs/_include/interface-vlan.txt
index 7b87c3eb..f1948e84 100644
--- a/docs/_include/interface-vlan.txt
+++ b/docs/_include/interface-vlan.txt
@@ -86,6 +86,22 @@ term used for this is ``vif``.
    :var4: 10
 
 .. cmdinclude:: ../_include/interface-vrf.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+**DHCP(v6)**
+
+.. cmdinclude:: ../_include/interface-dhcp-options.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-dhcpv6-options.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
diff --git a/docs/_include/interface-vrf.txt b/docs/_include/interface-vrf.txt
index ca715fb2..450c82aa 100644
--- a/docs/_include/interface-vrf.txt
+++ b/docs/_include/interface-vrf.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} {{ var4 }} vrf <vrf>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  vrf <vrf>
 
   Place interface in given VRF instance.
 
-- 
cgit v1.2.3


From 7399b53b9d09ef07219631f79aeebd87c1b98d1e Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 24 Nov 2020 19:38:52 +0100
Subject: interfaces: add generic QinQ VLAN documentation

---
 docs/_include/interface-address-with-dhcp.txt      |  11 +-
 docs/_include/interface-description.txt            |   5 +-
 docs/_include/interface-dhcp-options.txt           |  16 +--
 docs/_include/interface-dhcpv6-options.txt         |  16 ++-
 .../interface-dhcpv6-prefix-delegation.txt         |  12 +-
 docs/_include/interface-disable-link-detect.txt    |   4 +-
 docs/_include/interface-disable.txt                |   5 +-
 docs/_include/interface-ipv6-addr-autoconf.txt     |   4 +-
 docs/_include/interface-ipv6-addr-eui64.txt        |   4 +-
 docs/_include/interface-mac.txt                    |   4 +-
 docs/_include/interface-mtu.txt                    |   4 +-
 docs/_include/interface-vlan-8021ad.txt            | 143 +++++++++++++++++++++
 docs/_include/interface-vlan-8021q.txt             | 111 ++++++++++++++++
 docs/_include/interface-vlan.txt                   | 109 ----------------
 docs/_include/interface-vrf.txt                    |   4 +-
 docs/_include/need_improvement.txt                 |   5 +-
 docs/common-references.rst                         |   3 +
 docs/interfaces/advanced-index.rst                 |   2 -
 docs/interfaces/bond.rst                           |   2 +-
 docs/interfaces/bridge.rst                         |   2 +-
 docs/interfaces/ethernet.rst                       |  12 +-
 docs/interfaces/pseudo-ethernet.rst                |   2 +-
 docs/interfaces/qinq.rst                           |  77 -----------
 docs/interfaces/vlan.rst                           |  69 ----------
 docs/interfaces/wireless.rst                       |  12 +-
 25 files changed, 333 insertions(+), 305 deletions(-)
 create mode 100644 docs/_include/interface-vlan-8021ad.txt
 create mode 100644 docs/_include/interface-vlan-8021q.txt
 delete mode 100644 docs/_include/interface-vlan.txt
 delete mode 100644 docs/interfaces/qinq.rst
 delete mode 100644 docs/interfaces/vlan.rst

(limited to 'docs/_include')

diff --git a/docs/_include/interface-address-with-dhcp.txt b/docs/_include/interface-address-with-dhcp.txt
index 20cd53ac..4ff78c01 100644
--- a/docs/_include/interface-address-with-dhcp.txt
+++ b/docs/_include/interface-address-with-dhcp.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} address <address | dhcp |
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} address <address | dhcp |
    dhcpv6>
 
   Configure interface `<interface>` with one or more interface addresses.
@@ -14,7 +15,7 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} address 192.0.2.1/24
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} address 2001:db8::1/64
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} address 192.0.2.1/24
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} address 2001:db8::1/64
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcp
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6
\ No newline at end of file
diff --git a/docs/_include/interface-description.txt b/docs/_include/interface-description.txt
index 4347b837..064d9559 100644
--- a/docs/_include/interface-description.txt
+++ b/docs/_include/interface-description.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} description <description>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} description <description>
 
   Set a human readable, descriptive alias for this connection. Alias is used by
   e.g. the :opcmd:`show interfaces` command or SNMP based monitoring tools.
@@ -7,4 +8,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} description 'This is an awesome interface running on VyOS'
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} description 'This is an awesome interface running on VyOS'
\ No newline at end of file
diff --git a/docs/_include/interface-dhcp-options.txt b/docs/_include/interface-dhcp-options.txt
index 2bc23efc..1a0ce260 100644
--- a/docs/_include/interface-dhcp-options.txt
+++ b/docs/_include/interface-dhcp-options.txt
@@ -1,5 +1,5 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-   dhcp-options client-id <description>
+  {{ var5 }} {{ var6 }} dhcp-options client-id <description>
 
   :rfc:`2131` states: The client MAY choose to explicitly provide the identifier
   through the 'client identifier' option. If the client supplies a 'client
@@ -11,10 +11,10 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp-options client-id 'foo-bar'
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcp-options client-id 'foo-bar'
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  dhcp-options host-name <hostname>
+  {{ var5 }} {{ var6 }} dhcp-options host-name <hostname>
 
   Instead of sending the real system hostname to the DHCP server, overwrite the
   host-name with this given-value.
@@ -23,10 +23,10 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp-options host-name 'VyOS'
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcp-options host-name 'VyOS'
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  dhcp-options vendor-class-id <vendor-id>
+  {{ var5 }} {{ var6 }} dhcp-options vendor-class-id <vendor-id>
 
   The vendor-class-id option can be used to request a specific class of vendor
   options from the server.
@@ -35,10 +35,10 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp-options vendor-class-id 'VyOS'
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcp-options vendor-class-id 'VyOS'
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  dhcp-options no-default-route
+  {{ var5 }} {{ var6 }} dhcp-options no-default-route
 
   Only request an address from the DHCP server but do not request a default
   gateway.
@@ -47,4 +47,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcp-options no-default-route
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcp-options no-default-route
diff --git a/docs/_include/interface-dhcpv6-options.txt b/docs/_include/interface-dhcpv6-options.txt
index 00b5e817..a54a7dce 100644
--- a/docs/_include/interface-dhcpv6-options.txt
+++ b/docs/_include/interface-dhcpv6-options.txt
@@ -1,5 +1,5 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  dhcpv6-options parameters-only
+  {{ var5 }} {{ var6 }} dhcpv6-options parameters-only
 
   This statement specifies dhcp6c to only exchange informational configuration
   parameters with servers. A list of DNS server addresses is an example of such
@@ -8,27 +8,27 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-options parameters-only
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options parameters-only
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  dhcpv6-options rapid-commit
+  {{ var5 }} {{ var6 }} dhcpv6-options rapid-commit
 
   When rapid-commit is specified, dhcp6c will include a rapid-commit option in
   solicit messages and wait for an immediate reply instead of advertisements.
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-options rapid-commit
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options rapid-commit
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  dhcpv6-options temporary
+  {{ var5 }} {{ var6 }} dhcpv6-options temporary
 
   Request only a temporary address and not form an IA_NA (Identity Association
   for Non-temporary Addresses) partnership.
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-options temporary
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options temporary
 
 .. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
   :var0: {{ var0 }}
@@ -36,3 +36,7 @@
   :var2: {{ var2 }}
   :var3: {{ var3 }}
   :var4: {{ var4 }}
+  :var5: {{ var5 }}
+  :var6: {{ var6 }}
+  :var7: {{ var7 }}
+
diff --git a/docs/_include/interface-dhcpv6-prefix-delegation.txt b/docs/_include/interface-dhcpv6-prefix-delegation.txt
index 21721400..99132d17 100644
--- a/docs/_include/interface-dhcpv6-prefix-delegation.txt
+++ b/docs/_include/interface-dhcpv6-prefix-delegation.txt
@@ -4,7 +4,7 @@ VyOS 1.3 (equuleus) supports DHCPv6-PD (:rfc:`3633`). DHCPv6 Prefix Delegation
 is supported by most ISPs who provide native IPv6 for consumers on fixed networks.
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  dhcpv6-option pd <id> length <length>
+  {{ var5 }} {{ var6 }} dhcpv6-option pd <id> length <length>
 
   Some ISPs by default only delegate a /64 prefix. To request for a specific
   prefix size use this option to request for a bigger delegation for this pd
@@ -17,10 +17,10 @@ is supported by most ISPs who provide native IPv6 for consumers on fixed network
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-options pd 0 length 56
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options pd 0 length 56
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  dhcpv6-option pd <id> interface <delegatee> address <address>
+  {{ var5 }} {{ var6 }} dhcpv6-option pd <id> interface <delegatee> address <address>
 
   Specify the interface address used locally on the interfcae where the prefix
   has been delegated to. ID must be a decimal integer.
@@ -35,10 +35,10 @@ is supported by most ISPs who provide native IPv6 for consumers on fixed network
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-option pd 0 interface eth8 address 65534
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-option pd 0 interface eth8 address 65534
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  dhcpv6-option pd <id> interface <delegatee> sla-id <id>
+  {{ var5 }} {{ var6 }} dhcpv6-option pd <id> interface <delegatee> sla-id <id>
 
   Specify the identifier value of the site-level aggregator (SLA) on the
   interface. ID must be a decimal number greater then 0 which fits in the
@@ -51,5 +51,5 @@ is supported by most ISPs who provide native IPv6 for consumers on fixed network
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} dhcpv6-option pd 0 interface eth8 sla-id 1
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-option pd 0 interface eth8 sla-id 1
 
diff --git a/docs/_include/interface-disable-link-detect.txt b/docs/_include/interface-disable-link-detect.txt
index efd45e46..1a766715 100644
--- a/docs/_include/interface-disable-link-detect.txt
+++ b/docs/_include/interface-disable-link-detect.txt
@@ -1,5 +1,5 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  disable-link-detect
+  {{ var5 }} {{ var6 }} disable-link-detect
 
   Use this command to direct an interface to not detect any physical state
   changes on a link, for example, when the cable is unplugged.
@@ -10,4 +10,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} disable-link-detect
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} disable-link-detect
\ No newline at end of file
diff --git a/docs/_include/interface-disable.txt b/docs/_include/interface-disable.txt
index a9511d8e..774c1cdd 100644
--- a/docs/_include/interface-disable.txt
+++ b/docs/_include/interface-disable.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} disable
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} disable
 
   Disable given `<interface>`. It will be placed in administratively down
   (``A/D``) state.
@@ -7,4 +8,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} disable
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} disable
\ No newline at end of file
diff --git a/docs/_include/interface-ipv6-addr-autoconf.txt b/docs/_include/interface-ipv6-addr-autoconf.txt
index e349a730..fea1125e 100644
--- a/docs/_include/interface-ipv6-addr-autoconf.txt
+++ b/docs/_include/interface-ipv6-addr-autoconf.txt
@@ -1,5 +1,5 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  ipv6 address autoconf
+  {{ var5 }} {{ var6 }} ipv6 address autoconf
 
   :abbr:`SLAAC (Stateless Address Autoconfiguration)` :rfc:`4862`. IPv6 hosts
   can configure themselves automatically when connected to an IPv6 network using
@@ -16,4 +16,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} ipv6 address autoconf
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address autoconf
diff --git a/docs/_include/interface-ipv6-addr-eui64.txt b/docs/_include/interface-ipv6-addr-eui64.txt
index 10732bf3..e6a58372 100644
--- a/docs/_include/interface-ipv6-addr-eui64.txt
+++ b/docs/_include/interface-ipv6-addr-eui64.txt
@@ -1,9 +1,9 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  ipv6 address eui64 <prefix>
+  {{ var5 }} {{ var6 }} ipv6 address eui64 <prefix>
 
   :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
   :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} ipv6 address eui64 2001:db8:beef::/64
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address eui64 2001:db8:beef::/64
diff --git a/docs/_include/interface-mac.txt b/docs/_include/interface-mac.txt
index 2daeaccf..03aa6106 100644
--- a/docs/_include/interface-mac.txt
+++ b/docs/_include/interface-mac.txt
@@ -1,5 +1,5 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  mac <xx:xx:xx:xx:xx:xx>
+  {{ var5 }} {{ var6 }} mac <xx:xx:xx:xx:xx:xx>
 
   Configure user defined :abbr:`MAC (Media Access Control)` address on given
   `<interface>`.
@@ -8,4 +8,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} mac '00:01:02:03:04:05'
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} mac '00:01:02:03:04:05'
\ No newline at end of file
diff --git a/docs/_include/interface-mtu.txt b/docs/_include/interface-mtu.txt
index 8509779b..76812507 100644
--- a/docs/_include/interface-mtu.txt
+++ b/docs/_include/interface-mtu.txt
@@ -1,5 +1,5 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  mtu <mtu>
+  {{ var5 }} {{ var6 }} mtu <mtu>
 
   Configure :abbr:`MTU (Maximum Transmission Unit)` on given `<interface>`. It
   is the size (in bytes) of the largest ethernet frame sent on this link.
@@ -8,4 +8,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} mtu 1450
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} mtu 9000
\ No newline at end of file
diff --git a/docs/_include/interface-vlan-8021ad.txt b/docs/_include/interface-vlan-8021ad.txt
new file mode 100644
index 00000000..a1e971be
--- /dev/null
+++ b/docs/_include/interface-vlan-8021ad.txt
@@ -0,0 +1,143 @@
+.. include:: ../_include/need_improvement.txt
+
+IEEE 802.1ad_ was an Ethernet networking standard informally known as QinQ as
+an amendment to IEEE standard 802.1q VLAN interfaces as described above.
+802.1ad was incorporated into the base 802.1q_ standard in 2011. The technique
+is also known as provider bridging, Stacked VLANs, or simply QinQ or Q-in-Q.
+"Q-in-Q" can for supported devices apply to C-tag stacking on C-tag (Ethernet
+Type = 0x8100).
+
+The original 802.1q_ specification allows a single Virtual Local Area Network
+(VLAN) header to be inserted into an Ethernet frame. QinQ allows multiple
+VLAN tags to be inserted into a single frame, an essential capability for
+implementing Metro Ethernet network topologies. Just as QinQ extends 802.1Q,
+QinQ itself is extended by other Metro Ethernet protocols.
+
+In a multiple VLAN header context, out of convenience the term "VLAN tag" or
+just "tag" for short is often used in place of "802.1q_ VLAN header". QinQ
+allows multiple VLAN tags in an Ethernet frame; together these tags constitute
+a tag stack. When used in the context of an Ethernet frame, a QinQ frame is a
+frame that has 2 VLAN 802.1q_ headers (double-tagged).
+
+In VyOS the terms ``vif-s`` and ``vif-c`` stand for the ethertype tags that
+are used.
+
+The inner tag is the tag which is closest to the payload portion of the frame.
+It is officially called C-TAG (customer tag, with ethertype 0x8100). The outer
+tag is the one closer/closest to the Ethernet header, its name is S-TAG
+(service tag with Ethernet Type = 0x88a8).
+
+
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-disable.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-disable-link-detect.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-mac.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-mtu.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-vrf.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+**DHCP(v6)**
+
+.. cmdinclude:: ../_include/interface-dhcp-options.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-dhcpv6-options.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. include:: ../common-references.rst
diff --git a/docs/_include/interface-vlan-8021q.txt b/docs/_include/interface-vlan-8021q.txt
new file mode 100644
index 00000000..2c7e58f7
--- /dev/null
+++ b/docs/_include/interface-vlan-8021q.txt
@@ -0,0 +1,111 @@
+IEEE 802.1q_, often referred to as Dot1q, is the networking standard that supports
+virtual LANs (VLANs) on an IEEE 802.3 Ethernet network. The standard defines a
+system of VLAN tagging for Ethernet frames and the accompanying procedures to be
+used by bridges and switches in handling such frames. The standard also contains
+provisions for a quality-of-service prioritization scheme commonly known as IEEE
+802.1p and defines the Generic Attribute Registration Protocol.
+
+Portions of the network which are VLAN-aware (i.e., IEEE 802.1q_ conformant) can
+include VLAN tags. When a frame enters the VLAN-aware portion of the network, a
+tag is added to represent the VLAN membership. Each frame must be distinguishable
+as being within exactly one VLAN. A frame in the VLAN-aware portion of the network
+that does not contain a VLAN tag is assumed to be flowing on the native VLAN.
+
+The standard was developed by IEEE 802.1, a working group of the IEEE 802
+standards committee, and continues to be actively revised. One of the notable
+revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path Bridging)
+and much of the IEEE 802.1d standard.
+
+802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The
+term used for this is ``vif``.
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> vif <vlan-id>
+
+  Create a new VLAN interface on interface `<interface>` using the VLAN number
+  provided via `<vlan-id>`.
+
+  You can create multiple VLAN interfaces on a physical interface. The VLAN ID
+  range is from 0 to 4094.
+
+  .. note:: Only 802.1Q-tagged packets are accepted on Ethernet vifs.
+
+.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-description.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-disable.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-disable-link-detect.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-mac.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-mtu.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-vrf.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+**DHCP(v6)**
+
+.. cmdinclude:: ../_include/interface-dhcp-options.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-dhcpv6-options.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. include:: ../common-references.rst
\ No newline at end of file
diff --git a/docs/_include/interface-vlan.txt b/docs/_include/interface-vlan.txt
deleted file mode 100644
index f1948e84..00000000
--- a/docs/_include/interface-vlan.txt
+++ /dev/null
@@ -1,109 +0,0 @@
-IEEE 802.1q, often referred to as Dot1q, is the networking standard that supports
-virtual LANs (VLANs) on an IEEE 802.3 Ethernet network. The standard defines a
-system of VLAN tagging for Ethernet frames and the accompanying procedures to be
-used by bridges and switches in handling such frames. The standard also contains
-provisions for a quality-of-service prioritization scheme commonly known as IEEE
-802.1p and defines the Generic Attribute Registration Protocol.
-
-Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant) can
-include VLAN tags. When a frame enters the VLAN-aware portion of the network, a
-tag is added to represent the VLAN membership. Each frame must be distinguishable
-as being within exactly one VLAN. A frame in the VLAN-aware portion of the network
-that does not contain a VLAN tag is assumed to be flowing on the native VLAN.
-
-The standard was developed by IEEE 802.1, a working group of the IEEE 802
-standards committee, and continues to be actively revised. One of the notable
-revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path Bridging)
-and much of the IEEE 802.1d standard.
-
-802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The
-term used for this is ``vif``.
-
-.. cfgcmd:: set interfaces {{ var0 }} <interface> vif <vlan-id>
-
-  Create a new VLAN interface on interface `<interface>` using the VLAN number
-  provided via `<vlan-id>`.
-
-  You can create multiple VLAN interfaces on a physical interface. The VLAN ID
-  range is from 0 to 4094.
-
-  .. note:: Only 802.1Q-tagged packets are accepted on Ethernet vifs.
-
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-description.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-disable.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-disable-link-detect.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-mac.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-mtu.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-vrf.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-**DHCP(v6)**
-
-.. cmdinclude:: ../_include/interface-dhcp-options.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-dhcpv6-options.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
\ No newline at end of file
diff --git a/docs/_include/interface-vrf.txt b/docs/_include/interface-vrf.txt
index 450c82aa..1fa94f9f 100644
--- a/docs/_include/interface-vrf.txt
+++ b/docs/_include/interface-vrf.txt
@@ -1,5 +1,5 @@
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  vrf <vrf>
+  {{ var5 }} {{ var6 }} vrf <vrf>
 
   Place interface in given VRF instance.
 
@@ -10,4 +10,4 @@
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} vrf red
\ No newline at end of file
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} vrf red
\ No newline at end of file
diff --git a/docs/_include/need_improvement.txt b/docs/_include/need_improvement.txt
index f7556465..1ce50685 100644
--- a/docs/_include/need_improvement.txt
+++ b/docs/_include/need_improvement.txt
@@ -8,8 +8,9 @@
    <p class="admonition-title">Call for Contributions</p>
 
 
-This page needs improvements, examples and explanations.
-Please take a look at the Contributing Guide for :ref:`documentation`.
+This section needs improvements, examples and explanations.
+
+Please take a look at the Contributing Guide for our :ref:`documentation`.
 
 .. raw:: html
 
diff --git a/docs/common-references.rst b/docs/common-references.rst
index d7e376eb..79881972 100644
--- a/docs/common-references.rst
+++ b/docs/common-references.rst
@@ -1,3 +1,6 @@
 .. _`accel-ppp`: https://accel-ppp.org/
 .. _`Secure Socket Tunneling Protocol`: https://en.wikipedia.org/wiki/Secure_Socket_Tunneling_Protocol
 .. _Phabricator: https://phabricator.vyos.net/
+
+.. _802.1ad: https://en.wikipedia.org/wiki/IEEE_802.1ad
+.. _802.1q: https://en.wikipedia.org/wiki/IEEE_802.1Q
diff --git a/docs/interfaces/advanced-index.rst b/docs/interfaces/advanced-index.rst
index 6e35dac2..7b9bde1e 100644
--- a/docs/interfaces/advanced-index.rst
+++ b/docs/interfaces/advanced-index.rst
@@ -17,9 +17,7 @@ Network Interfaces
    macsec
    pppoe
    pseudo-ethernet
-   qinq
    tunnel
-   vlan
    vxlan
    wireless
    wirelessmodem
diff --git a/docs/interfaces/bond.rst b/docs/interfaces/bond.rst
index eea35e2c..7faddd6f 100644
--- a/docs/interfaces/bond.rst
+++ b/docs/interfaces/bond.rst
@@ -259,7 +259,7 @@ Bond options
 VLAN
 ====
 
-.. cmdinclude:: ../_include/interface-vlan.txt
+.. cmdinclude:: ../_include/interface-vlan-8021q.txt
    :var0: bond
    :var1: bond0
 
diff --git a/docs/interfaces/bridge.rst b/docs/interfaces/bridge.rst
index 045ae2a8..dc94a761 100644
--- a/docs/interfaces/bridge.rst
+++ b/docs/interfaces/bridge.rst
@@ -116,7 +116,7 @@ links providing fault tolerance if an active link fails.
 VLAN
 ====
 
-.. cmdinclude:: ../_include/interface-vlan.txt
+.. cmdinclude:: ../_include/interface-vlan-8021q.txt
    :var0: bridge
    :var1: br0
 
diff --git a/docs/interfaces/ethernet.rst b/docs/interfaces/ethernet.rst
index 343a7d59..8b1ad6bd 100644
--- a/docs/interfaces/ethernet.rst
+++ b/docs/interfaces/ethernet.rst
@@ -52,7 +52,17 @@ Ethernet options
 VLAN
 ====
 
-.. cmdinclude:: ../_include/interface-vlan.txt
+Regular VLANs (802.1q)
+----------------------
+
+.. cmdinclude:: ../_include/interface-vlan-8021q.txt
+   :var0: ethernet
+   :var1: eth0
+
+QinQ (802.1ad)
+--------------
+
+.. cmdinclude:: ../_include/interface-vlan-8021ad.txt
    :var0: ethernet
    :var1: eth0
 
diff --git a/docs/interfaces/pseudo-ethernet.rst b/docs/interfaces/pseudo-ethernet.rst
index d4eb8eff..c2baca39 100644
--- a/docs/interfaces/pseudo-ethernet.rst
+++ b/docs/interfaces/pseudo-ethernet.rst
@@ -60,6 +60,6 @@ Pseudo Ethernet/MACVLAN options
 VLAN
 ====
 
-.. cmdinclude:: ../_include/interface-vlan.txt
+.. cmdinclude:: ../_include/interface-vlan-8021q.txt
    :var0: pseudo-ethernet
    :var1: peth0
diff --git a/docs/interfaces/qinq.rst b/docs/interfaces/qinq.rst
deleted file mode 100644
index 01d9c64a..00000000
--- a/docs/interfaces/qinq.rst
+++ /dev/null
@@ -1,77 +0,0 @@
-.. include:: ../_include/need_improvement.txt
-
-.. _qinq-interface:
-
-QinQ (802.1ad)
---------------
-
-IEEE 802.1ad was an Ethernet networking standard informally known as QinQ as
-an amendment to IEEE standard :ref:`vlan-interface`. 802.1ad was incorporated
-into the base 802.1q standard in 2011. The technique is also known as provider
-bridging, Stacked VLANs, or simply QinQ or Q-in-Q. "Q-in-Q" can for supported
-devices apply to C-tag stacking on C-tag (Ethernet Type = 0x8100).
-
-The original 802.1q specification allows a single Virtual Local Area Network
-(VLAN) header to be inserted into an Ethernet frame. QinQ allows multiple
-VLAN tags to be inserted into a single frame, an essential capability for
-implementing Metro Ethernet network topologies. Just as QinQ extends 802.1Q,
-QinQ itself is extended by other Metro Ethernet protocols.
-
-In a multiple VLAN header context, out of convenience the term "VLAN tag" or
-just "tag" for short is often used in place of "802.1Q VLAN header". QinQ
-allows multiple VLAN tags in an Ethernet frame; together these tags constitute
-a tag stack. When used in the context of an Ethernet frame, a QinQ frame is a
-frame that has 2 VLAN 802.1Q headers (double-tagged).
-
-In VyOS the terms **vif-s** and **vif-c** stand for the ethertype tags that
-are used:
-
-The inner tag is the tag which is closest to the payload portion of the frame.
-It is officially called C-TAG (customer tag, with ethertype 0x8100). The outer
-tag is the one closer/closest to the Ethernet header, its name is S-TAG
-(service tag with ethertype 0x88a8).
-
-Configuration commands:
-
-.. code-block:: none
-
-  interfaces
-      ethernet <eth[0-999]>
-          address <ipv4>
-          address <ipv6>
-          description <txt>
-          disable
-          ip
-              <usual IP options>
-          ipv6
-              <usual IPv6 options>
-          vif-s <[0-4096]>
-              address <ipv4>
-              address <ipv6>
-              description <txt>
-              disable
-              ip
-                  <usual IP options>
-              ipv6
-                  <usual IPv6 options>
-              vif-c <[0-4096]>
-                  address <ipv4>
-                  address <ipv6>
-                  description <txt>
-                  disable
-                  ip
-                      <usual IP options>
-                  ipv6
-                      <usual IPv6 options>
-
-
-Example:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 vif-s 333
-  set interfaces ethernet eth0 vif-s 333 address 192.0.2.10/32
-  set interfaces ethernet eth0 vif-s 333 vif-c 777
-  set interfaces ethernet eth0 vif-s 333 vif-c 777 address 10.10.10.10/24
-
-.. _802.1ad: https://en.wikipedia.org/wiki/IEEE_802.1ad
\ No newline at end of file
diff --git a/docs/interfaces/vlan.rst b/docs/interfaces/vlan.rst
deleted file mode 100644
index 55656d5d..00000000
--- a/docs/interfaces/vlan.rst
+++ /dev/null
@@ -1,69 +0,0 @@
-.. _vlan-interface:
-
-VLAN (802.1q)
--------------
-
-IEEE 802.1q, often referred to as Dot1q, is the networking standard that
-supports virtual LANs (VLANs) on an IEEE 802.3 Ethernet network. The
-standard defines a system of VLAN tagging for Ethernet frames and the
-accompanying procedures to be used by bridges and switches in handling
-such frames. The standard also contains provisions for a quality-of-service
-prioritization scheme commonly known as IEEE 802.1p and defines the Generic
-Attribute Registration Protocol.
-
-Portions of the network which are VLAN-aware (i.e., IEEE 802.1q conformant)
-can include VLAN tags. When a frame enters the VLAN-aware portion of the
-network, a tag is added to represent the VLAN membership. Each frame must
-be distinguishable as being within exactly one VLAN. A frame in the
-VLAN-aware portion of the network that does not contain a VLAN tag is
-assumed to be flowing on the native VLAN.
-
-The standard was developed by IEEE 802.1, a working group of the IEEE 802
-standards committee, and continues to be actively revised. One of the
-notable revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest
-Path Bridging) and much of the IEEE 802.1d standard.
-
-802.1a VLAN interfaces are represented as virtual sub-interfaces in VyOS. The
-term used for this is ``vif``. Configuration of a tagged sub-interface is
-accomplished using the configuration command:
-``set interfaces ethernet <name> vif <vlan-id>``
-
-To assign a vif 100 using the VLAN 100 tag to physical interface eth1 use:
-
-.. code-block:: none
-
-  set interfaces ethernet eth1 vif 100 description 'VLAN 100'
-  set interfaces ethernet eth1 vif 100 address '192.168.100.1/24'
-  set interfaces ethernet eth1 vif 100 address '2001:db8:100::1/64'
-
-Resulting in:
-
-.. code-block:: none
-
-  ethernet eth1 {
-      address 192.168.100.1/24
-      address 2001:db8:100::1/64
-      description INSIDE
-      duplex auto
-      hw-id 00:53:29:44:3b:19
-      smp_affinity auto
-      speed auto
-      vif 100 {
-          address 192.168.100.1/24
-          description "VLAN 100"
-      }
-  }
-
-VLAN interfaces are shown as `<name>.<vlan-id>`, e.g. `eth1.100`:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             172.16.51.129/24                  u/u  OUTSIDE
-  eth1             192.168.0.1/24                    u/u  INSIDE
-  eth1.100         192.168.100.1/24                  u/u  VLAN 100
-  lo               127.0.0.1/8                       u/u
-                   ::1/128
diff --git a/docs/interfaces/wireless.rst b/docs/interfaces/wireless.rst
index b51eb274..2de3b126 100644
--- a/docs/interfaces/wireless.rst
+++ b/docs/interfaces/wireless.rst
@@ -375,7 +375,17 @@ Resulting in
 VLAN
 ====
 
-.. cmdinclude:: ../_include/interface-vlan.txt
+Regular VLANs (802.1q)
+----------------------
+
+.. cmdinclude:: ../_include/interface-vlan-8021q.txt
+   :var0: wireless
+   :var1: wlan0
+
+QinQ (802.1ad)
+--------------
+
+.. cmdinclude:: ../_include/interface-vlan-8021ad.txt
    :var0: wireless
    :var1: wlan0
 
-- 
cgit v1.2.3


From d4863cc15079682634ecca21dd87442ae3cb5666 Mon Sep 17 00:00:00 2001
From: rebortg <github@ghlr.de>
Date: Thu, 26 Nov 2020 22:32:45 +0100
Subject: add vyos-1x submodule

---
 .gitmodules           | 4 ++++
 docs/_include/vyos-1x | 1 +
 2 files changed, 5 insertions(+)
 create mode 100644 .gitmodules
 create mode 160000 docs/_include/vyos-1x

(limited to 'docs/_include')

diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 00000000..d3d92138
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,4 @@
+[submodule "docs/_include/vyos-1x"]
+	path = docs/_include/vyos-1x
+	url = https://github.com/vyos/vyos-1x
+	branch = current
diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
new file mode 160000
index 00000000..64d6e689
--- /dev/null
+++ b/docs/_include/vyos-1x
@@ -0,0 +1 @@
+Subproject commit 64d6e689a8274845a49e6931eda6cda04615de42
-- 
cgit v1.2.3


From 865e4632a2f1dd52f443c072fda5c629dc38ac72 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Fri, 27 Nov 2020 19:10:54 +0100
Subject: include: ipv6: combine autoconf and eui64 into a single file

---
 docs/_include/interface-common.txt             |  6 +-----
 docs/_include/interface-ipv6-addr-autoconf.txt | 19 ----------------
 docs/_include/interface-ipv6-addr-eui64.txt    |  9 --------
 docs/_include/interface-ipv6-address.txt       | 30 ++++++++++++++++++++++++++
 docs/_include/interface-vlan-8021ad.txt        | 12 +----------
 docs/_include/interface-vlan-8021q.txt         |  9 +-------
 6 files changed, 33 insertions(+), 52 deletions(-)
 delete mode 100644 docs/_include/interface-ipv6-addr-autoconf.txt
 delete mode 100644 docs/_include/interface-ipv6-addr-eui64.txt
 create mode 100644 docs/_include/interface-ipv6-address.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-common.txt b/docs/_include/interface-common.txt
index de29356f..f9bc640a 100644
--- a/docs/_include/interface-common.txt
+++ b/docs/_include/interface-common.txt
@@ -22,11 +22,7 @@
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-  :var0: {{ var0 }}
-  :var1: {{ var1 }}
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: ../_include/interface-ipv6-address.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
diff --git a/docs/_include/interface-ipv6-addr-autoconf.txt b/docs/_include/interface-ipv6-addr-autoconf.txt
deleted file mode 100644
index fea1125e..00000000
--- a/docs/_include/interface-ipv6-addr-autoconf.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  {{ var5 }} {{ var6 }} ipv6 address autoconf
-
-  :abbr:`SLAAC (Stateless Address Autoconfiguration)` :rfc:`4862`. IPv6 hosts
-  can configure themselves automatically when connected to an IPv6 network using
-  the Neighbor Discovery Protocol via :abbr:`ICMPv6 (Internet Control Message
-  Protocol version 6)` router discovery messages. When first connected to a
-  network, a host sends a link-local router solicitation multicast request for
-  its configuration parameters; routers respond to such a request with a router
-  advertisement packet that contains Internet Layer configuration parameters.
-
-  .. note:: This method automatically disables IPv6 traffic forwarding on the
-    interface in question.
-
-  Example:
-
-  .. code-block:: none
-
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address autoconf
diff --git a/docs/_include/interface-ipv6-addr-eui64.txt b/docs/_include/interface-ipv6-addr-eui64.txt
deleted file mode 100644
index e6a58372..00000000
--- a/docs/_include/interface-ipv6-addr-eui64.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  {{ var5 }} {{ var6 }} ipv6 address eui64 <prefix>
-
-  :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
-  :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
-
-  .. code-block:: none
-
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address eui64 2001:db8:beef::/64
diff --git a/docs/_include/interface-ipv6-address.txt b/docs/_include/interface-ipv6-address.txt
new file mode 100644
index 00000000..bde3f50d
--- /dev/null
+++ b/docs/_include/interface-ipv6-address.txt
@@ -0,0 +1,30 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ipv6 address autoconf
+
+  :abbr:`SLAAC (Stateless Address Autoconfiguration)` :rfc:`4862`. IPv6 hosts
+  can configure themselves automatically when connected to an IPv6 network using
+  the Neighbor Discovery Protocol via :abbr:`ICMPv6 (Internet Control Message
+  Protocol version 6)` router discovery messages. When first connected to a
+  network, a host sends a link-local router solicitation multicast request for
+  its configuration parameters; routers respond to such a request with a router
+  advertisement packet that contains Internet Layer configuration parameters.
+
+  .. note:: This method automatically disables IPv6 traffic forwarding on the
+    interface in question.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address autoconf
+
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ipv6 address eui64 <prefix>
+
+  :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
+  :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address eui64 2001:db8:beef::/64
diff --git a/docs/_include/interface-vlan-8021ad.txt b/docs/_include/interface-vlan-8021ad.txt
index a1e971be..6ccfbe82 100644
--- a/docs/_include/interface-vlan-8021ad.txt
+++ b/docs/_include/interface-vlan-8021ad.txt
@@ -88,17 +88,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif-s
-   :var3: <vlan-id>
-   :var4: 1000
-   :var5: vif-c
-   :var6: <vlan-id>
-   :var7: 20
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: ../_include/interface-ipv6-address.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
diff --git a/docs/_include/interface-vlan-8021q.txt b/docs/_include/interface-vlan-8021q.txt
index 2c7e58f7..69e8227f 100644
--- a/docs/_include/interface-vlan-8021q.txt
+++ b/docs/_include/interface-vlan-8021q.txt
@@ -71,14 +71,7 @@ term used for this is ``vif``.
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
-   :var0: {{ var0 }}
-   :var1: {{ var1 }}
-   :var2: vif
-   :var3: <vlan-id>
-   :var4: 10
-
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: ../_include/interface-ipv6-address.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
-- 
cgit v1.2.3


From b2a38e4cf36971408924e93b9fc89ef12ef89408 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Fri, 27 Nov 2020 19:14:49 +0100
Subject: interface: ipv6: document no-default-link-local option

---
 docs/_include/interface-ipv6-address.txt | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-ipv6-address.txt b/docs/_include/interface-ipv6-address.txt
index bde3f50d..d57cecde 100644
--- a/docs/_include/interface-ipv6-address.txt
+++ b/docs/_include/interface-ipv6-address.txt
@@ -28,3 +28,8 @@
   .. code-block:: none
 
     set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address eui64 2001:db8:beef::/64
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ipv6 address no-default-link-local
+
+  Do not assign a link-local IPv6 address to this interface
-- 
cgit v1.2.3


From 0d1faa3231ea4f72935b330eba51dc898b1c4e60 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Fri, 27 Nov 2020 19:55:19 +0100
Subject: interface: add documentation about interface 'ip' configuration node

---
 docs/_include/interface-common.txt       |   7 +-
 docs/_include/interface-ip.txt           | 157 +++++++++++++++++++++++++++++++
 docs/_include/interface-ipv6-address.txt |  35 -------
 docs/_include/interface-ipv6.txt         |  55 +++++++++++
 docs/_include/interface-vlan-8021ad.txt  |  12 ++-
 docs/_include/interface-vlan-8021q.txt   |   9 +-
 6 files changed, 236 insertions(+), 39 deletions(-)
 create mode 100644 docs/_include/interface-ip.txt
 delete mode 100644 docs/_include/interface-ipv6-address.txt
 create mode 100644 docs/_include/interface-ipv6.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-common.txt b/docs/_include/interface-common.txt
index f9bc640a..cbe32cfb 100644
--- a/docs/_include/interface-common.txt
+++ b/docs/_include/interface-common.txt
@@ -22,11 +22,14 @@
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-ipv6-address.txt
+.. cmdinclude:: ../_include/interface-ip.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-vrf.txt
+.. cmdinclude:: ../_include/interface-ipv6.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
+.. cmdinclude:: ../_include/interface-vrf.txt
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
diff --git a/docs/_include/interface-ip.txt b/docs/_include/interface-ip.txt
new file mode 100644
index 00000000..89937806
--- /dev/null
+++ b/docs/_include/interface-ip.txt
@@ -0,0 +1,157 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ip arp-cache-timeout
+
+  Once a neighbor has been found, the entry is considered to be valid for at
+  least for this specifc time. An entry's validity will be extended if it
+  receives positive feedback from higher level protocols.
+
+  This defaults to 30 seconds.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip arp-cache-timeout 180
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ip disable-arp-filter
+
+  If set the kernel can respond to arp requests with addresses from other
+  interfaces. This may seem wrong but it usually makes sense, because it
+  increases the chance of successful communication. IP addresses are owned by
+  the complete host on Linux, not by particular interfaces. Only for more
+  complex setups like load-balancing, does this behaviour cause problems.
+
+  If not set (default) allows you to have multiple network interfaces on the
+  same subnet, and have the ARPs for each interface be answered based on whether
+  or not the kernel would route a packet from the ARP'd IP out that interface
+  (therefore you must use source based routing for this to work).
+
+  In other words it allows control of which cards (usually 1) will respond to an
+  arp request.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip disable-arp-filter
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ip disable-forwarding
+
+  Configure interface-specific Host/Router behaviour. If set, the interface will
+  switch to host mode and IPv6 forwarding will be disabled on this interface.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip disable-forwarding
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ip enable-arp-accept
+
+  Define behavior for gratuitous ARP frames who's IP is not already present in
+  the ARP table. If configured create new entries in the ARP table.
+
+  Both replies and requests type gratuitous arp will trigger the ARP table to be
+  updated, if this setting is on.
+
+  If the ARP table already contains the IP address of the gratuitous arp frame,
+  the arp table will be updated regardless if this setting is on or off.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-arp-accept
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ip enable-arp-announce
+
+  Define different restriction levels for announcing the local source IP address
+  from IP packets in ARP requests sent on interface.
+
+  Use any local address, configured on any interface if this is not set.
+
+  If configured, try to avoid local addresses that are not in the target's
+  subnet for this interface. This mode is useful when target hosts reachable via
+  this interface require the source IP address in ARP requests to be part of
+  their logical network configured on the receiving interface. When we generate
+  the request we will check all our subnets that include the target IP and will
+  preserve the source address if it is from such subnet. If there is no such
+  subnet we select source address according to the rules for level 2.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-arp-announce
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ip enable-arp-ignore
+
+  Define different modes for sending replies in response to received ARP
+  requests that resolve local target IP addresses:
+
+  If configured, reply only if the target IP address is local address configured
+  on the incoming interface.
+
+  If this option is unset (default), reply for any local target IP address,
+  configured on any interface.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-arp-ignore
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ip enable-proxy-arp
+
+  Use this command to enable proxy Address Resolution Protocol (ARP) on this
+  interface. Proxy ARP allows an Ethernet interface to respond with its own
+  :abbr:`MAC (Media Access Control)` address to ARP requests for destination IP
+  addresses on subnets attached to other interfaces on the system. Subsequent
+  packets sent to those destination IP addresses are forwarded appropriately by
+  the system.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ip enable-proxy-arp
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ip proxy-arp-pvlan
+
+  Private VLAN proxy arp. Basically allow proxy arp replies back to the same
+  interface (from which the ARP request/solicitation was received).
+
+  This is done to support (ethernet) switch features, like :rfc:`3069`, where
+  the individual ports are NOT allowed to communicate with each other, but they
+  are allowed to talk to the upstream router. As described in :rfc:`3069`, it is
+  possible to allow these hosts to communicate through the upstream router by
+  proxy_arp'ing.
+
+  .. note:: Don't need to be used together with proxy_arp.
+
+  This technology is known by different names:
+
+  - In :rfc:`3069` it is called VLAN Aggregation
+
+  - Cisco and Allied Telesyn call it Private VLAN
+
+  - Hewlett-Packard call it Source-Port filtering or port-isolation
+
+  - Ericsson call it MAC-Forced Forwarding (RFC Draft)
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ip source-validation <strict | loose | disable>
+
+  Enable policy for source validation by reversed path, as specified in
+  :rfc:`3704`. Current recommended practice in :rfc:`3704` is to enable strict
+  mode to prevent IP spoofing from DDos attacks. If using asymmetric routing
+  or other complicated routing, then loose mode is recommended.
+
+  - strict: Each incoming packet is tested against the FIB and if the interface
+    is not the best reverse path the packet check will fail. By default failed
+    packets are discarded.
+
+  - loose: Each incoming packet's source address is also tested against the FIB
+    and if the source address is not reachable via any interface the packet
+    check will fail.
+
+  - disable: No source validation
diff --git a/docs/_include/interface-ipv6-address.txt b/docs/_include/interface-ipv6-address.txt
deleted file mode 100644
index d57cecde..00000000
--- a/docs/_include/interface-ipv6-address.txt
+++ /dev/null
@@ -1,35 +0,0 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  {{ var5 }} {{ var6 }} ipv6 address autoconf
-
-  :abbr:`SLAAC (Stateless Address Autoconfiguration)` :rfc:`4862`. IPv6 hosts
-  can configure themselves automatically when connected to an IPv6 network using
-  the Neighbor Discovery Protocol via :abbr:`ICMPv6 (Internet Control Message
-  Protocol version 6)` router discovery messages. When first connected to a
-  network, a host sends a link-local router solicitation multicast request for
-  its configuration parameters; routers respond to such a request with a router
-  advertisement packet that contains Internet Layer configuration parameters.
-
-  .. note:: This method automatically disables IPv6 traffic forwarding on the
-    interface in question.
-
-  Example:
-
-  .. code-block:: none
-
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address autoconf
-
-
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  {{ var5 }} {{ var6 }} ipv6 address eui64 <prefix>
-
-  :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
-  :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
-
-  .. code-block:: none
-
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address eui64 2001:db8:beef::/64
-
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  {{ var5 }} {{ var6 }} ipv6 address no-default-link-local
-
-  Do not assign a link-local IPv6 address to this interface
diff --git a/docs/_include/interface-ipv6.txt b/docs/_include/interface-ipv6.txt
new file mode 100644
index 00000000..e03817cf
--- /dev/null
+++ b/docs/_include/interface-ipv6.txt
@@ -0,0 +1,55 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ipv6 address autoconf
+
+  :abbr:`SLAAC (Stateless Address Autoconfiguration)` :rfc:`4862`. IPv6 hosts
+  can configure themselves automatically when connected to an IPv6 network using
+  the Neighbor Discovery Protocol via :abbr:`ICMPv6 (Internet Control Message
+  Protocol version 6)` router discovery messages. When first connected to a
+  network, a host sends a link-local router solicitation multicast request for
+  its configuration parameters; routers respond to such a request with a router
+  advertisement packet that contains Internet Layer configuration parameters.
+
+  .. note:: This method automatically disables IPv6 traffic forwarding on the
+    interface in question.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address autoconf
+
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ipv6 address eui64 <prefix>
+
+  :abbr:`EUI-64 (64-Bit Extended Unique Identifier)` as specified in
+  :rfc:`4291` allows a host to assign iteslf a unique 64-Bit IPv6 address.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address eui64 2001:db8:beef::/64
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ipv6 address no-default-link-local
+
+  Do not assign a link-local IPv6 address to this interface.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 address no-default-link-local
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} ipv6 disable-forwarding
+
+  Configure interface-specific Host/Router behaviour. If set, the interface will
+  switch to host mode and IPv6 forwarding will be disabled on this interface.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} ipv6 disable-forwarding
diff --git a/docs/_include/interface-vlan-8021ad.txt b/docs/_include/interface-vlan-8021ad.txt
index 6ccfbe82..a6ee87d9 100644
--- a/docs/_include/interface-vlan-8021ad.txt
+++ b/docs/_include/interface-vlan-8021ad.txt
@@ -88,7 +88,17 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-ipv6-address.txt
+.. cmdinclude:: ../_include/interface-ip.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
+.. cmdinclude:: ../_include/interface-ipv6.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
diff --git a/docs/_include/interface-vlan-8021q.txt b/docs/_include/interface-vlan-8021q.txt
index 69e8227f..c906feb9 100644
--- a/docs/_include/interface-vlan-8021q.txt
+++ b/docs/_include/interface-vlan-8021q.txt
@@ -71,7 +71,14 @@ term used for this is ``vif``.
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-ipv6-address.txt
+.. cmdinclude:: ../_include/interface-ip.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
+.. cmdinclude:: ../_include/interface-ipv6.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
-- 
cgit v1.2.3


From 6fdbdf1f4a92f1085d6c1734594d3270bfd6fd12 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Fri, 27 Nov 2020 20:05:22 +0100
Subject: include: interface: fix ipv6 dhcp pd

---
 docs/_include/interface-common-with-dhcp.txt |  4 ++++
 docs/_include/interface-dhcpv6-options.txt   | 11 -----------
 docs/_include/interface-vlan-8021ad.txt      | 10 ++++++++++
 docs/_include/interface-vlan-8021q.txt       |  7 +++++++
 4 files changed, 21 insertions(+), 11 deletions(-)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-common-with-dhcp.txt b/docs/_include/interface-common-with-dhcp.txt
index 3e1394a3..38a60346 100644
--- a/docs/_include/interface-common-with-dhcp.txt
+++ b/docs/_include/interface-common-with-dhcp.txt
@@ -15,3 +15,7 @@
 .. cmdinclude:: ../_include/interface-dhcpv6-options.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
+
+.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+  :var0: {{ var0 }}
+  :var1: {{ var1 }}
diff --git a/docs/_include/interface-dhcpv6-options.txt b/docs/_include/interface-dhcpv6-options.txt
index a54a7dce..e7eaffb1 100644
--- a/docs/_include/interface-dhcpv6-options.txt
+++ b/docs/_include/interface-dhcpv6-options.txt
@@ -29,14 +29,3 @@
   .. code-block:: none
 
     set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options temporary
-
-.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
-  :var0: {{ var0 }}
-  :var1: {{ var1 }}
-  :var2: {{ var2 }}
-  :var3: {{ var3 }}
-  :var4: {{ var4 }}
-  :var5: {{ var5 }}
-  :var6: {{ var6 }}
-  :var7: {{ var7 }}
-
diff --git a/docs/_include/interface-vlan-8021ad.txt b/docs/_include/interface-vlan-8021ad.txt
index a6ee87d9..e293fb48 100644
--- a/docs/_include/interface-vlan-8021ad.txt
+++ b/docs/_include/interface-vlan-8021ad.txt
@@ -140,4 +140,14 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
+.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif-s
+   :var3: <vlan-id>
+   :var4: 1000
+   :var5: vif-c
+   :var6: <vlan-id>
+   :var7: 20
+
 .. include:: ../common-references.rst
diff --git a/docs/_include/interface-vlan-8021q.txt b/docs/_include/interface-vlan-8021q.txt
index c906feb9..39f10073 100644
--- a/docs/_include/interface-vlan-8021q.txt
+++ b/docs/_include/interface-vlan-8021q.txt
@@ -108,4 +108,11 @@ term used for this is ``vif``.
    :var3: <vlan-id>
    :var4: 10
 
+.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+   :var0: {{ var0 }}
+   :var1: {{ var1 }}
+   :var2: vif
+   :var3: <vlan-id>
+   :var4: 10
+
 .. include:: ../common-references.rst
\ No newline at end of file
-- 
cgit v1.2.3


From adf00431bcc81e270687882e672d59dd2c65515a Mon Sep 17 00:00:00 2001
From: rebortg <github@ghlr.de>
Date: Sun, 29 Nov 2020 19:05:51 +0100
Subject: Templates: move draw.io template to _inlcude folder

---
 docs/.gitignore                            | 1 -
 docs/_include/draw.io/pbr_example_1.drawio | 1 +
 docs/_include/draw.io/vpn_s2s_ikev2.drawio | 1 +
 3 files changed, 2 insertions(+), 1 deletion(-)
 delete mode 100644 docs/.gitignore
 create mode 100644 docs/_include/draw.io/pbr_example_1.drawio
 create mode 100644 docs/_include/draw.io/vpn_s2s_ikev2.drawio

(limited to 'docs/_include')

diff --git a/docs/.gitignore b/docs/.gitignore
deleted file mode 100644
index 69fa449d..00000000
--- a/docs/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-_build/
diff --git a/docs/_include/draw.io/pbr_example_1.drawio b/docs/_include/draw.io/pbr_example_1.drawio
new file mode 100644
index 00000000..0d496572
--- /dev/null
+++ b/docs/_include/draw.io/pbr_example_1.drawio
@@ -0,0 +1 @@
+<mxfile modified="2019-06-20T09:46:15.910Z" host="www.draw.io" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" etag="pgW5M9QC_GIVY4GNWbyF" version="10.7.9" type="device"><diagram name="Page-1" id="c37626ed-c26b-45fb-9056-f9ebc6bb27b6">7VrbcqM4EP0aP4ZCgLk8xkk8u1UzW97K7FyepmRQsGoEYoUc2/P1K4G4CLBNJo7j2rLzAGpJrVafPq2WnYl9l2w/MJitPtEIkYllRtuJfT+xLMtzTPGQkl0pCQKnFMQMR6UINIJH/AspoZoXr3GEcm0gp5RwnOnCkKYpCrkmg4zRjT7siRJ91QzGqCd4DCHpS7/iiK+UFJhm0/EHwvFKLe1PVccShj9jRtepWm9i2U/Fp+xOYKVLjc9XMKKblsh+mNh3jFJeviXbO0Skbyu3lfPme3pruxlK+ZgJn4MU/ArY39bX3eKfT37yffHh8w2wSzXPkKxRtQ+XCIWzCD9Lq/lOecr9dy1NnXG05TeQ4Did2LdiBEFPXDxET+H+lN/kBciyD9jZtpkp3mL1LFbIM5h2ZcuuQGoctGPUUn8+LkClSbimVKYvIMS9RYVsyDghLryiS9/HUa/zCwgswzSAMcI5YxxhaZZYK54Q8QZE3zNiHAu2fYRLRBY0xxxT4Y/7JeWcJmKActB9KMIYMSEgcuSsJtcdJZQVait6NUpv1VxOM+klzujPmsRWLWlpME3fnEsEnjAhQ5prkspBEcxXKFIN0ZPJ7SXbWCZCA9PcM7DISrkRErqOaj9I49B2L0lBTX2RUhFNEGc7MURNuAkCv5yj0qkTlM1NKzf5SrZqpSVgqbQLVT6Ma91NThAvKi28JEU4r04RrLDzgnOEdZwG58kRJ/bUKZKEZYzwzjVJnDNJeO6lJQnLHUgSHcBRJAov1cxRnIjdPjSiGUqjW1nPSZgJzHMcCmErSNAW82+t9+/S58ZUte63CoKisVMNGa0tBGf2fO66fWSjKfIjZygWXHdmzee9uLFrIOWmDsMofEDXLEQHvBcMw92Csyo622hWMoYI5PhZN2MIYbXCguIiK1TR5HeiyfV94VZNS7kDNbFdY/Z0TXVdoK+LQxYj3tMlsIe71rBMDsgPmd1Zyp0GaqnR1gnz9CnipbSjYUKNxyvIEZyNHOb/jxzWu5LD87wqgOs48w3fbj6/SxXPORtVukv1qPI2cQ+s43HfPTFDnIfUEIe6OOdz9dRDXTtwO7Fq2q4feEOx2hzevQLgaPUxXEkUhUf75G9qgpAmkqA1y+YwwUT6/gtiEUyhEqsvQ4B1qruDr0eq5Vcwt9li+85AZVCVCyevDGxwPAhkEZft9YD65gcuq+Hmiz3jAZ0AU98Z8AzwBxIJqDLJ6WumnmO+fLz9C9RX8iUbLvH3lfMbZbUs6FPKEkiGS3rg+obA2xD7msuCcE8R38Fos8IcPWawyNUbwVWdlSPZoLMPjOOHM1CLT+Vfj+gpTVE1WZkO9hJ4FOUOxPTBM+nMsTR0Rx+VaQU4WZFrf8A0+pEhhrMVYpDkRtYpMS4j754cM6XGcbUEMXCj8vw+oN5b4TniOnXF8xCeUx3P6TvjaY8ohd78FARmtb9LOgb7l6PiGDTPcwz612Pw9yl4/Gp25liqflS85s0Xg3aZ5yAYcXu4AnoRB6FoNj9ml18hNP8xYD/8Bw==</diagram></mxfile>
\ No newline at end of file
diff --git a/docs/_include/draw.io/vpn_s2s_ikev2.drawio b/docs/_include/draw.io/vpn_s2s_ikev2.drawio
new file mode 100644
index 00000000..b240c191
--- /dev/null
+++ b/docs/_include/draw.io/vpn_s2s_ikev2.drawio
@@ -0,0 +1 @@
+<mxfile modified="2019-07-18T20:12:29.116Z" host="www.draw.io" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36" etag="se-JT0q6YZwCfwyGJaAA" version="10.9.8" type="device"><diagram name="Page-1" id="c37626ed-c26b-45fb-9056-f9ebc6bb27b6">7Zrdk6I4EMD/Gh+lSMLn4zgz7j7cVk3V1H3svWxFiJhaIB7EUfevv4QEIYCje6eOW4XzIOmQTtL5ddP0OEGP2e5TgderLywm6QTa8W6CniYQIoCA+JKSvZJA2/WVJClorGSgEbzSH0QLbS3d0JiUxo2csZTTtSmMWJ6TiBsyXBRsa962ZKk56xonpCd4jXDal/5JY77SUmDbTcdnQpOVnjpwdccCR9+Tgm1yPd8EomX1Ud0ZrnXp+8sVjtm2JULPE/RYMMbVVbZ7JKk0bm02NW5+pPew7oLk/JwBv/tf4d9PP749rV+/8DAihK2iqRwg1bzhdEPqfVSr5fvaQtUeidQCJmi2XVFOXtc4kr1bAYWQrXiW6m6tjhSc7I4uFBy2L7giLCO82Itb9ICp43pqjGZqilytZNuckOM4SrZqHQ6qccSaiuSgvbGMuNDG+RlDgTs0FLADdHeWOsNQwhXW8jLbJTKqWBEtI2YJ83FSlPrbtFaMy1VlWVs0ljRNH1nKikobspEXhL6Ql7xg30mrR/tj3VP7tzDpTBqeiijwG16Q9IWVlFOWi74F45xlrRseUprIDs7kATZHLBdycGnZiFhGo3qFLOdznNFUnssfpIhxjrVYR0AAL8aA65gMwNDtMYCCAQZAEF7LW0YGbsmAg+4PATQicEsEfMe3XBOCAKCPhsA5DQGJRTqmmyVJMrHh50Y0I3n8ILM80ZuznJg4kB3lf0lbi62r1ldteXn9tGs39q0zabExQ/O55/Vpil0SxM4QTZ43g/N5jyakJ3ohBRXGk+SqyXNhSLXI6rCrdrVMK6ybzUqr1r7d6uuL51SeQtVS5pQ2fB8cYXK2KSJy+rnNcZEQfsqx+yC2IKsz5DZjtawgKeb0zVzuEHd6hhdGxUYazgMPWQFqPp30B3qmRrVrraSdHPf0hu/p9UPf8lof15xF2aw3iwAX71u3reUN5bubOxLHjy+7O8LxT4zwbfDuCHGh1t14/eGU/3sgcMdA0AoEQXDPgQD+EoHA8aDhsHbHZcWbutVx07ODAfKBBfruXqt2PTAQKy4dDKADf9K1nbqmclPXBkOZnpeK454txEXCKzqVQPqc4fXePxtWd0zLKid6EDeAYL1rOmstwIcWCCzRbYmNzqFTqxUNpdmcTYhbK+iEG5FrcTOImA6ug0w7GmgR1qlgJDyrSlC7OWJG47iKWUMlADN1vETq13sGuHY/+weO2/fFujR1+RrAUOJ3FSYs6I4YqAd7FwOvrvu0a0H+LSkYeupfhwIZ+UYI4DSEdvc1EDWiDwPBG8PBrUlw7LsLB/4YDm4MAewWBg9l/w+DILh5tgjHbLH9bhPeXbYYHkXi/xHwxmkTCBZF98DLNc6PK9/qnUv1OSsynA4gZlvyT25f+tWBI6W5h5dJXYewE/8uPLPibJYiwOSsGrQz6VU9lq78O4q5HKyXDgaQVkXyS9AK7O7LdwgGshlYv/0blQZ0JV5rR/hlgUUjsNcCtle1Ce2PpvUK7+LQGcK3qHYzPmWrUlwv8Rp8CxsokF7tMQuv8Do+DEJKliMH+vnldP9FNZSBXwYD0Wx+TqbKu82P9tDzvw==</diagram></mxfile>
\ No newline at end of file
-- 
cgit v1.2.3


From e33e1268f944be445b5a771df0e97e913487512f Mon Sep 17 00:00:00 2001
From: rebortg <github@ghlr.de>
Date: Mon, 30 Nov 2020 19:46:59 +0100
Subject: change include to absolute path

---
 docs/_ext/vyos.py                                 |  9 ++++++--
 docs/_include/interface-common-with-dhcp.txt      |  8 +++----
 docs/_include/interface-common-without-dhcp.txt   |  4 ++--
 docs/_include/interface-common.txt                | 18 ++++++++--------
 docs/_include/interface-dhcpv6-options.txt        |  2 +-
 docs/_include/interface-vlan-8021ad.txt           | 26 +++++++++++------------
 docs/_include/interface-vlan-8021q.txt            | 24 ++++++++++-----------
 docs/configuration/firewall/index.rst             |  1 +
 docs/configuration/interfaces/bonding.rst         |  4 ++--
 docs/configuration/interfaces/bridge.rst          |  4 ++--
 docs/configuration/interfaces/dummy.rst           |  8 +++----
 docs/configuration/interfaces/ethernet.rst        |  6 +++---
 docs/configuration/interfaces/geneve.rst          |  2 +-
 docs/configuration/interfaces/l2tpv3.rst          |  4 ++--
 docs/configuration/interfaces/loopback.rst        |  4 ++--
 docs/configuration/interfaces/macsec.rst          |  2 +-
 docs/configuration/interfaces/openvpn.rst         |  2 +-
 docs/configuration/interfaces/pppoe.rst           |  8 +++----
 docs/configuration/interfaces/pseudo-ethernet.rst |  4 ++--
 docs/configuration/interfaces/tunnel.rst          |  2 +-
 docs/configuration/interfaces/vxlan.rst           |  2 +-
 docs/configuration/interfaces/wireless.rst        |  6 +++---
 docs/configuration/interfaces/wirelessmodem.rst   |  6 +++---
 docs/configuration/nat/nptv6.rst                  |  2 +-
 docs/configuration/policy/index.rst               |  4 ++--
 docs/contributing/debugging.rst                   |  2 +-
 docs/contributing/development.rst                 |  2 +-
 docs/contributing/documentation.rst               |  2 +-
 docs/contributing/issues-features.rst             |  2 +-
 docs/interfaces/advanced-index.rst                | 23 --------------------
 docs/interfaces/basic-index.rst                   | 12 -----------
 docs/routing/bfd.rst                              |  2 +-
 docs/routing/ospf.rst                             |  2 +-
 docs/routing/rip.rst                              |  2 +-
 docs/services/conntrack.rst                       |  2 +-
 docs/services/ipoe-server.rst                     |  4 ++--
 docs/services/pppoe-server.rst                    |  2 +-
 docs/system/lcd.rst                               |  2 +-
 docs/vpn/sstp.rst                                 |  2 +-
 39 files changed, 97 insertions(+), 126 deletions(-)
 delete mode 100644 docs/interfaces/advanced-index.rst
 delete mode 100644 docs/interfaces/basic-index.rst

(limited to 'docs/_include')

diff --git a/docs/_ext/vyos.py b/docs/_ext/vyos.py
index 89cc8ab7..4a974b46 100644
--- a/docs/_ext/vyos.py
+++ b/docs/_ext/vyos.py
@@ -3,7 +3,7 @@ import json
 import os
 from docutils import io, nodes, utils, statemachine
 from docutils.parsers.rst.roles import set_classes
-from docutils.parsers.rst import Directive, directives
+from docutils.parsers.rst import Directive, directives, states
 
 from sphinx.util.docutils import SphinxDirective
 
@@ -173,7 +173,7 @@ class inlinecmd(nodes.inline):
         #self.literal_whitespace -= 1
 
 
-class CfgInclude(Directive):
+class CfgInclude(SphinxDirective):
     required_arguments = 1
     optional_arguments = 0
     final_argument_whitespace = True
@@ -189,10 +189,15 @@ class CfgInclude(Directive):
         'var8': str,
         'var9': str
     }
+    standard_include_path = os.path.join(os.path.dirname(states.__file__),
+                                         'include')
 
     def run(self):
         ### Copy from include directive docutils 
         """Include a file as part of the content of this reST file."""
+        rel_filename, filename = self.env.relfn2path(self.arguments[0])
+        self.arguments[0] = filename
+        self.env.note_included(filename)
         if not self.state.document.settings.file_insertion_enabled:
             raise self.warning('"%s" directive disabled.' % self.name)
         source = self.state_machine.input_lines.source(
diff --git a/docs/_include/interface-common-with-dhcp.txt b/docs/_include/interface-common-with-dhcp.txt
index 3e1394a3..1cacdd53 100644
--- a/docs/_include/interface-common-with-dhcp.txt
+++ b/docs/_include/interface-common-with-dhcp.txt
@@ -1,17 +1,17 @@
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+.. cmdinclude:: /_include/interface-address-with-dhcp.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-common.txt
+.. cmdinclude:: /_include/interface-common.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
 **DHCP(v6)**
 
-.. cmdinclude:: ../_include/interface-dhcp-options.txt
+.. cmdinclude:: /_include/interface-dhcp-options.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-dhcpv6-options.txt
+.. cmdinclude:: /_include/interface-dhcpv6-options.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
diff --git a/docs/_include/interface-common-without-dhcp.txt b/docs/_include/interface-common-without-dhcp.txt
index d861f003..73d39dd0 100644
--- a/docs/_include/interface-common-without-dhcp.txt
+++ b/docs/_include/interface-common-without-dhcp.txt
@@ -1,7 +1,7 @@
-.. cmdinclude:: ../_include/interface-address.txt
+.. cmdinclude:: /_include/interface-address.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-common.txt
+.. cmdinclude:: /_include/interface-common.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
diff --git a/docs/_include/interface-common.txt b/docs/_include/interface-common.txt
index de29356f..68c9c448 100644
--- a/docs/_include/interface-common.txt
+++ b/docs/_include/interface-common.txt
@@ -1,36 +1,36 @@
-.. cmdinclude:: ../_include/interface-description.txt
+.. cmdinclude:: /_include/interface-description.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-disable.txt
+.. cmdinclude:: /_include/interface-disable.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-disable-flow-control.txt
+.. cmdinclude:: /_include/interface-disable-flow-control.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-disable-link-detect.txt
+.. cmdinclude:: /_include/interface-disable-link-detect.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-mac.txt
+.. cmdinclude:: /_include/interface-mac.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-mtu.txt
+.. cmdinclude:: /_include/interface-mtu.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+.. cmdinclude:: /_include/interface-ipv6-addr-autoconf.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: /_include/interface-ipv6-addr-eui64.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-vrf.txt
+.. cmdinclude:: /_include/interface-vrf.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
diff --git a/docs/_include/interface-dhcpv6-options.txt b/docs/_include/interface-dhcpv6-options.txt
index a54a7dce..a47d9f32 100644
--- a/docs/_include/interface-dhcpv6-options.txt
+++ b/docs/_include/interface-dhcpv6-options.txt
@@ -30,7 +30,7 @@
 
     set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options temporary
 
-.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+.. cmdinclude:: /_include/interface-dhcpv6-prefix-delegation.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
   :var2: {{ var2 }}
diff --git a/docs/_include/interface-vlan-8021ad.txt b/docs/_include/interface-vlan-8021ad.txt
index a1e971be..12925ad4 100644
--- a/docs/_include/interface-vlan-8021ad.txt
+++ b/docs/_include/interface-vlan-8021ad.txt
@@ -1,4 +1,4 @@
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 IEEE 802.1ad_ was an Ethernet networking standard informally known as QinQ as
 an amendment to IEEE standard 802.1q VLAN interfaces as described above.
@@ -28,7 +28,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
 (service tag with Ethernet Type = 0x88a8).
 
 
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+.. cmdinclude:: /_include/interface-address-with-dhcp.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -38,7 +38,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-description.txt
+.. cmdinclude:: /_include/interface-description.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -48,7 +48,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-disable.txt
+.. cmdinclude:: /_include/interface-disable.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -58,7 +58,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-disable-link-detect.txt
+.. cmdinclude:: /_include/interface-disable-link-detect.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -68,7 +68,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-mac.txt
+.. cmdinclude:: /_include/interface-mac.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -78,7 +78,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-mtu.txt
+.. cmdinclude:: /_include/interface-mtu.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -88,7 +88,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+.. cmdinclude:: /_include/interface-ipv6-addr-autoconf.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -98,7 +98,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: /_include/interface-ipv6-addr-eui64.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -108,7 +108,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-vrf.txt
+.. cmdinclude:: /_include/interface-vrf.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -120,7 +120,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
 
 **DHCP(v6)**
 
-.. cmdinclude:: ../_include/interface-dhcp-options.txt
+.. cmdinclude:: /_include/interface-dhcp-options.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -130,7 +130,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-dhcpv6-options.txt
+.. cmdinclude:: /_include/interface-dhcpv6-options.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -140,4 +140,4 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
diff --git a/docs/_include/interface-vlan-8021q.txt b/docs/_include/interface-vlan-8021q.txt
index 2c7e58f7..37f652f3 100644
--- a/docs/_include/interface-vlan-8021q.txt
+++ b/docs/_include/interface-vlan-8021q.txt
@@ -29,63 +29,63 @@ term used for this is ``vif``.
 
   .. note:: Only 802.1Q-tagged packets are accepted on Ethernet vifs.
 
-.. cmdinclude:: ../_include/interface-address-with-dhcp.txt
+.. cmdinclude:: /_include/interface-address-with-dhcp.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-description.txt
+.. cmdinclude:: /_include/interface-description.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-disable.txt
+.. cmdinclude:: /_include/interface-disable.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-disable-link-detect.txt
+.. cmdinclude:: /_include/interface-disable-link-detect.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-mac.txt
+.. cmdinclude:: /_include/interface-mac.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-mtu.txt
+.. cmdinclude:: /_include/interface-mtu.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-ipv6-addr-autoconf.txt
+.. cmdinclude:: /_include/interface-ipv6-addr-autoconf.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-ipv6-addr-eui64.txt
+.. cmdinclude:: /_include/interface-ipv6-addr-eui64.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-vrf.txt
+.. cmdinclude:: /_include/interface-vrf.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
@@ -94,18 +94,18 @@ term used for this is ``vif``.
 
 **DHCP(v6)**
 
-.. cmdinclude:: ../_include/interface-dhcp-options.txt
+.. cmdinclude:: /_include/interface-dhcp-options.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-dhcpv6-options.txt
+.. cmdinclude:: /_include/interface-dhcpv6-options.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. include:: ../common-references.rst
\ No newline at end of file
+.. include:: /common-references.rst
\ No newline at end of file
diff --git a/docs/configuration/firewall/index.rst b/docs/configuration/firewall/index.rst
index 870e9a08..d9a3ebe3 100644
--- a/docs/configuration/firewall/index.rst
+++ b/docs/configuration/firewall/index.rst
@@ -3,6 +3,7 @@
 Firewall
 ========
 
+
 Overview
 --------
 
diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst
index 7faddd6f..8ec8f34d 100644
--- a/docs/configuration/interfaces/bonding.rst
+++ b/docs/configuration/interfaces/bonding.rst
@@ -17,7 +17,7 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
+.. cmdinclude:: /_include/interface-common-with-dhcp.txt
    :var0: bond
    :var1: bond0
 
@@ -259,7 +259,7 @@ Bond options
 VLAN
 ====
 
-.. cmdinclude:: ../_include/interface-vlan-8021q.txt
+.. cmdinclude:: /_include/interface-vlan-8021q.txt
    :var0: bond
    :var1: bond0
 
diff --git a/docs/configuration/interfaces/bridge.rst b/docs/configuration/interfaces/bridge.rst
index dc94a761..766d2aa5 100644
--- a/docs/configuration/interfaces/bridge.rst
+++ b/docs/configuration/interfaces/bridge.rst
@@ -21,7 +21,7 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
+.. cmdinclude:: /_include/interface-common-with-dhcp.txt
    :var0: bridge
    :var1: br0
 
@@ -116,7 +116,7 @@ links providing fault tolerance if an active link fails.
 VLAN
 ====
 
-.. cmdinclude:: ../_include/interface-vlan-8021q.txt
+.. cmdinclude:: /_include/interface-vlan-8021q.txt
    :var0: bridge
    :var1: br0
 
diff --git a/docs/configuration/interfaces/dummy.rst b/docs/configuration/interfaces/dummy.rst
index c36d0024..c9845230 100644
--- a/docs/configuration/interfaces/dummy.rst
+++ b/docs/configuration/interfaces/dummy.rst
@@ -25,19 +25,19 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-address.txt
+.. cmdinclude:: /_include/interface-address.txt
    :var0: dummy
    :var1: dum0
 
-.. cmdinclude:: ../_include/interface-description.txt
+.. cmdinclude:: /_include/interface-description.txt
    :var0: dummy
    :var1: dum0
 
-.. cmdinclude:: ../_include/interface-disable.txt
+.. cmdinclude:: /_include/interface-disable.txt
    :var0: dummy
    :var1: dum0
 
-.. cmdinclude:: ../_include/interface-vrf.txt
+.. cmdinclude:: /_include/interface-vrf.txt
    :var0: dummy
    :var1: dum0
 
diff --git a/docs/configuration/interfaces/ethernet.rst b/docs/configuration/interfaces/ethernet.rst
index f2ab3f67..9311c947 100644
--- a/docs/configuration/interfaces/ethernet.rst
+++ b/docs/configuration/interfaces/ethernet.rst
@@ -14,7 +14,7 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
+.. cmdinclude:: /_include/interface-common-with-dhcp.txt
    :var0: ethernet
    :var1: eth0
 
@@ -72,14 +72,14 @@ VLAN
 Regular VLANs (802.1q)
 ----------------------
 
-.. cmdinclude:: ../_include/interface-vlan-8021q.txt
+.. cmdinclude:: /_include/interface-vlan-8021q.txt
    :var0: ethernet
    :var1: eth0
 
 QinQ (802.1ad)
 --------------
 
-.. cmdinclude:: ../_include/interface-vlan-8021ad.txt
+.. cmdinclude:: /_include/interface-vlan-8021ad.txt
    :var0: ethernet
    :var1: eth0
 
diff --git a/docs/configuration/interfaces/geneve.rst b/docs/configuration/interfaces/geneve.rst
index 47068687..9e00d621 100644
--- a/docs/configuration/interfaces/geneve.rst
+++ b/docs/configuration/interfaces/geneve.rst
@@ -39,7 +39,7 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-common-without-dhcp.txt
+.. cmdinclude:: /_include/interface-common-without-dhcp.txt
    :var0: geneve
    :var1: gnv0
 
diff --git a/docs/configuration/interfaces/l2tpv3.rst b/docs/configuration/interfaces/l2tpv3.rst
index 4c9cbf9b..a4b7be36 100644
--- a/docs/configuration/interfaces/l2tpv3.rst
+++ b/docs/configuration/interfaces/l2tpv3.rst
@@ -1,4 +1,4 @@
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 .. _l2tpv3-interface:
 
@@ -31,7 +31,7 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-common-without-dhcp.txt
+.. cmdinclude:: /_include/interface-common-without-dhcp.txt
    :var0: l2tpv3
    :var1: l2tpeth0
 
diff --git a/docs/configuration/interfaces/loopback.rst b/docs/configuration/interfaces/loopback.rst
index a6d659b5..f7386c62 100644
--- a/docs/configuration/interfaces/loopback.rst
+++ b/docs/configuration/interfaces/loopback.rst
@@ -26,11 +26,11 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-address.txt
+.. cmdinclude:: /_include/interface-address.txt
    :var0: loopback
    :var1: lo
 
-.. cmdinclude:: ../_include/interface-description.txt
+.. cmdinclude:: /_include/interface-description.txt
    :var0: loopback
    :var1: lo
 
diff --git a/docs/configuration/interfaces/macsec.rst b/docs/configuration/interfaces/macsec.rst
index ebc8f151..2bf643aa 100644
--- a/docs/configuration/interfaces/macsec.rst
+++ b/docs/configuration/interfaces/macsec.rst
@@ -20,7 +20,7 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
+.. cmdinclude:: /_include/interface-common-with-dhcp.txt
    :var0: macsec
    :var1: macsec0
 
diff --git a/docs/configuration/interfaces/openvpn.rst b/docs/configuration/interfaces/openvpn.rst
index c6934335..7646959c 100644
--- a/docs/configuration/interfaces/openvpn.rst
+++ b/docs/configuration/interfaces/openvpn.rst
@@ -581,4 +581,4 @@ The following commands let you reset OpenVPN.
 
 
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
diff --git a/docs/configuration/interfaces/pppoe.rst b/docs/configuration/interfaces/pppoe.rst
index 313edd84..decfd348 100644
--- a/docs/configuration/interfaces/pppoe.rst
+++ b/docs/configuration/interfaces/pppoe.rst
@@ -59,15 +59,15 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-description.txt
+.. cmdinclude:: /_include/interface-description.txt
    :var0: pppoe
    :var1: pppoe0
 
-.. cmdinclude:: ../_include/interface-disable.txt
+.. cmdinclude:: /_include/interface-disable.txt
    :var0: pppoe
    :var1: pppoe0
 
-.. cmdinclude:: ../_include/interface-vrf.txt
+.. cmdinclude:: /_include/interface-vrf.txt
    :var0: pppoe
    :var1: pppoe0
 
@@ -177,7 +177,7 @@ IPv6
    Use this command to enable acquisition of IPv6 address using stateless
    autoconfig (SLAAC).
 
-.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+.. cmdinclude:: /_include/interface-dhcpv6-prefix-delegation.txt
   :var0: pppoe
   :var1: pppoe0
 
diff --git a/docs/configuration/interfaces/pseudo-ethernet.rst b/docs/configuration/interfaces/pseudo-ethernet.rst
index c2baca39..0471d2e1 100644
--- a/docs/configuration/interfaces/pseudo-ethernet.rst
+++ b/docs/configuration/interfaces/pseudo-ethernet.rst
@@ -45,7 +45,7 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
+.. cmdinclude:: /_include/interface-common-with-dhcp.txt
    :var0: pseudo-ethernet
    :var1: peth0
 
@@ -60,6 +60,6 @@ Pseudo Ethernet/MACVLAN options
 VLAN
 ====
 
-.. cmdinclude:: ../_include/interface-vlan-8021q.txt
+.. cmdinclude:: /_include/interface-vlan-8021q.txt
    :var0: pseudo-ethernet
    :var1: peth0
diff --git a/docs/configuration/interfaces/tunnel.rst b/docs/configuration/interfaces/tunnel.rst
index 4b9da26b..7b1502f8 100644
--- a/docs/configuration/interfaces/tunnel.rst
+++ b/docs/configuration/interfaces/tunnel.rst
@@ -16,7 +16,7 @@ a closer look at the protocols and options currently supported by VyOS.
 Common interface configuration
 ------------------------------
 
-.. cmdinclude:: ../_include/interface-common-without-dhcp.txt
+.. cmdinclude:: /_include/interface-common-without-dhcp.txt
    :var0: tunnel
    :var1: tun0
 
diff --git a/docs/configuration/interfaces/vxlan.rst b/docs/configuration/interfaces/vxlan.rst
index 40dc5400..95f8de35 100644
--- a/docs/configuration/interfaces/vxlan.rst
+++ b/docs/configuration/interfaces/vxlan.rst
@@ -39,7 +39,7 @@ Configuration
 Common interface configuration
 ------------------------------
 
-.. cmdinclude:: ../_include/interface-common-without-dhcp.txt
+.. cmdinclude:: /_include/interface-common-without-dhcp.txt
   :var0: vxlan
   :var1: vxlan0
 
diff --git a/docs/configuration/interfaces/wireless.rst b/docs/configuration/interfaces/wireless.rst
index 2de3b126..82f66cf4 100644
--- a/docs/configuration/interfaces/wireless.rst
+++ b/docs/configuration/interfaces/wireless.rst
@@ -30,7 +30,7 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-common-with-dhcp.txt
+.. cmdinclude:: /_include/interface-common-with-dhcp.txt
    :var0: wireless
    :var1: wlan0
 
@@ -378,14 +378,14 @@ VLAN
 Regular VLANs (802.1q)
 ----------------------
 
-.. cmdinclude:: ../_include/interface-vlan-8021q.txt
+.. cmdinclude:: /_include/interface-vlan-8021q.txt
    :var0: wireless
    :var1: wlan0
 
 QinQ (802.1ad)
 --------------
 
-.. cmdinclude:: ../_include/interface-vlan-8021ad.txt
+.. cmdinclude:: /_include/interface-vlan-8021ad.txt
    :var0: wireless
    :var1: wlan0
 
diff --git a/docs/configuration/interfaces/wirelessmodem.rst b/docs/configuration/interfaces/wirelessmodem.rst
index f9dfa228..a65a47f4 100644
--- a/docs/configuration/interfaces/wirelessmodem.rst
+++ b/docs/configuration/interfaces/wirelessmodem.rst
@@ -15,15 +15,15 @@ Configuration
 Common interface configuration
 ==============================
 
-.. cmdinclude:: ../_include/interface-description.txt
+.. cmdinclude:: /_include/interface-description.txt
    :var0: wirelessmodem
    :var1: wlm0
 
-.. cmdinclude:: ../_include/interface-disable.txt
+.. cmdinclude:: /_include/interface-disable.txt
    :var0: wirelessmodem
    :var1: wlm0
 
-.. cmdinclude:: ../_include/interface-vrf.txt
+.. cmdinclude:: /_include/interface-vrf.txt
    :var0: wirelessmodem
    :var1: wlm0
 
diff --git a/docs/configuration/nat/nptv6.rst b/docs/configuration/nat/nptv6.rst
index f4e08325..c09c8336 100644
--- a/docs/configuration/nat/nptv6.rst
+++ b/docs/configuration/nat/nptv6.rst
@@ -1,4 +1,4 @@
-.. include:: _include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 .. _nptv6:
 
diff --git a/docs/configuration/policy/index.rst b/docs/configuration/policy/index.rst
index 4be494e5..557911d9 100644
--- a/docs/configuration/policy/index.rst
+++ b/docs/configuration/policy/index.rst
@@ -1,4 +1,4 @@
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 ######
 Policy
@@ -65,7 +65,7 @@ neighbor.
 You now see the longer AS path.
 
 
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 .. _routing-pbr:
 
diff --git a/docs/contributing/debugging.rst b/docs/contributing/debugging.rst
index ac2e0510..fcd62c89 100644
--- a/docs/contributing/debugging.rst
+++ b/docs/contributing/debugging.rst
@@ -143,4 +143,4 @@ order of the scripts.
 .. _vyatta-cfg: https://github.com/vyos/vyatta-cfg
 .. _bootchart.conf: https://github.com/vyos/vyos-build/blob/current/data/live-build-config/includes.chroot/etc/systemd/bootchart.conf
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
diff --git a/docs/contributing/development.rst b/docs/contributing/development.rst
index 86371845..0a7fecb5 100644
--- a/docs/contributing/development.rst
+++ b/docs/contributing/development.rst
@@ -711,4 +711,4 @@ http://dev.packages.vyos.net/repositories/.
 .. _`VLAN (VIF)`: https://github.com/vyos/vyos-1x/tree/current/interface-definitions/include/vif.xml.i
 .. _`MAC address`: https://github.com/vyos/vyos-1x/tree/current/interface-definitions/include/interface-mac.xml.i
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
diff --git a/docs/contributing/documentation.rst b/docs/contributing/documentation.rst
index 9dd0c495..0276a7d2 100644
--- a/docs/contributing/documentation.rst
+++ b/docs/contributing/documentation.rst
@@ -325,4 +325,4 @@ predefined structure.
 .. _reStructuredTextDirectives: https://docutils.sourceforge.io/docs/ref/rst/directives.html
 .. _README.md: https://github.com/vyos/vyos-documentation/blob/master/README.md
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
diff --git a/docs/contributing/issues-features.rst b/docs/contributing/issues-features.rst
index 60e49974..473d49d9 100644
--- a/docs/contributing/issues-features.rst
+++ b/docs/contributing/issues-features.rst
@@ -77,4 +77,4 @@ the left side under the specific project.
 .. _Slack: https://slack.vyos.io
 .. _Forum: https://forum.vyos.io
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
diff --git a/docs/interfaces/advanced-index.rst b/docs/interfaces/advanced-index.rst
deleted file mode 100644
index 7b9bde1e..00000000
--- a/docs/interfaces/advanced-index.rst
+++ /dev/null
@@ -1,23 +0,0 @@
-.. _advanced_network-interfaces:
-
-##################
-Network Interfaces
-##################
-
-.. toctree::
-   :maxdepth: 1
-
-   bond
-   bridge
-   dummy
-   ethernet
-   geneve
-   loopback
-   l2tpv3
-   macsec
-   pppoe
-   pseudo-ethernet
-   tunnel
-   vxlan
-   wireless
-   wirelessmodem
diff --git a/docs/interfaces/basic-index.rst b/docs/interfaces/basic-index.rst
deleted file mode 100644
index 425792a2..00000000
--- a/docs/interfaces/basic-index.rst
+++ /dev/null
@@ -1,12 +0,0 @@
-.. _basic_network-interfaces:
-
-########################
-Basic Network Interfaces
-########################
-
-.. toctree::
-   :maxdepth: 1
-
-   ethernet
-   loopback
-   pppoe
diff --git a/docs/routing/bfd.rst b/docs/routing/bfd.rst
index 1d494332..b8fdf489 100644
--- a/docs/routing/bfd.rst
+++ b/docs/routing/bfd.rst
@@ -1,4 +1,4 @@
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 .. _routing-bfd:
 
diff --git a/docs/routing/ospf.rst b/docs/routing/ospf.rst
index fe05178b..19787b11 100644
--- a/docs/routing/ospf.rst
+++ b/docs/routing/ospf.rst
@@ -1,4 +1,4 @@
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 .. _routing-ospf:
 
diff --git a/docs/routing/rip.rst b/docs/routing/rip.rst
index 68868e37..0d73ad34 100644
--- a/docs/routing/rip.rst
+++ b/docs/routing/rip.rst
@@ -1,4 +1,4 @@
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 .. _rip:
 
diff --git a/docs/services/conntrack.rst b/docs/services/conntrack.rst
index c361d293..55cd088e 100644
--- a/docs/services/conntrack.rst
+++ b/docs/services/conntrack.rst
@@ -1,4 +1,4 @@
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 Conntrack
 ---------
diff --git a/docs/services/ipoe-server.rst b/docs/services/ipoe-server.rst
index 3aedf966..279f0c6d 100644
--- a/docs/services/ipoe-server.rst
+++ b/docs/services/ipoe-server.rst
@@ -1,4 +1,4 @@
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 .. _ipoe_server:
 
@@ -146,4 +146,4 @@ The rate-limit is set in kbit/sec.
   -------+------------+-------------------+-------------+-----+--------+------------+--------+----------+------------------
   ipoe0  | eth2       | 08:00:27:2f:d8:06 | 192.168.0.2 |     |        | 500/500    | active | 00:00:05 | dccc870fd31349fb
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
diff --git a/docs/services/pppoe-server.rst b/docs/services/pppoe-server.rst
index e710ba6a..4deb6c7e 100644
--- a/docs/services/pppoe-server.rst
+++ b/docs/services/pppoe-server.rst
@@ -394,4 +394,4 @@ a /56 subnet for the clients internal use.
   --------+----------+-------------+--------------------------+---------------------+-------------------+------------+--------+----------+----------+----------
    ppp0   | test     | 192.168.0.1 | 2001:db8:8002:0:200::/64 | 2001:db8:8003::1/56 | 00:53:00:12:42:eb |            | active | 00:00:49 | 875 B    | 2.1 KiB
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
diff --git a/docs/system/lcd.rst b/docs/system/lcd.rst
index 441becf5..2509946e 100644
--- a/docs/system/lcd.rst
+++ b/docs/system/lcd.rst
@@ -41,5 +41,5 @@ Configuration
    .. note:: We can't support all displays from the beginning. If your display
       type is missing, please create a feature request via Phabricator_.
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
 
diff --git a/docs/vpn/sstp.rst b/docs/vpn/sstp.rst
index e5567cb6..f5e4ad05 100644
--- a/docs/vpn/sstp.rst
+++ b/docs/vpn/sstp.rst
@@ -344,4 +344,4 @@ A connection attempt will be shown as:
 
 .. _sstpc: https://github.com/reliablehosting/sstp-client
 
-.. include:: ../common-references.rst
+.. include:: /common-references.rst
-- 
cgit v1.2.3


From ce090a4ced7fccce3fdc70142e22fa0009fae12b Mon Sep 17 00:00:00 2001
From: rebortg <github@ghlr.de>
Date: Sun, 6 Dec 2020 21:41:10 +0100
Subject: arrange examples

---
 docs/_include/common-references.txt                |   6 +
 docs/_include/interface-vlan-8021ad.txt            |   2 +-
 docs/_include/interface-vlan-8021q.txt             |   2 +-
 docs/appendix/examples/azure-vpn-bgp.rst           | 130 ----
 docs/appendix/examples/azure-vpn-dual-bgp.rst      | 155 -----
 docs/appendix/examples/bgp-ipv6-unnumbered.rst     | 172 -----
 .../examples/dhcp-relay-through-gre-bridge.rst     |  77 ---
 docs/appendix/examples/ha.rst                      | 580 ----------------
 docs/appendix/examples/index.rst                   |  19 -
 docs/appendix/examples/ospf-unnumbered.rst         | 118 ----
 docs/appendix/examples/tunnelbroker-ipv6.rst       | 169 -----
 docs/appendix/examples/wan-load-balancing.rst      | 170 -----
 docs/appendix/examples/zone-policy.rst             | 415 ------------
 docs/cli.rst                                       | 733 +++++++++++++++++++++
 docs/command-list-configuration.rst                |   7 -
 docs/command-list-operation.rst                    |   7 -
 docs/common-references.rst                         |   6 -
 docs/configexamples/azure-vpn-bgp.rst              | 130 ++++
 docs/configexamples/azure-vpn-dual-bgp.rst         | 155 +++++
 docs/configexamples/bgp-ipv6-unnumbered.rst        | 172 +++++
 .../dhcp-relay-through-gre-bridge.rst              |  77 +++
 docs/configexamples/ha.rst                         | 580 ++++++++++++++++
 docs/configexamples/index.rst                      |  19 +
 docs/configexamples/ospf-unnumbered.rst            | 118 ++++
 docs/configexamples/tunnelbroker-ipv6.rst          | 169 +++++
 docs/configexamples/wan-load-balancing.rst         | 170 +++++
 docs/configexamples/zone-policy.rst                | 415 ++++++++++++
 docs/configuration-overview.rst                    | 730 --------------------
 docs/configuration/interfaces/openvpn.rst          |   2 +-
 docs/configuration/nat/index.rst                   |   2 +-
 docs/configuration/policy/index.rst                |   2 +-
 docs/configuration/service/ipoe-server.rst         |   2 +-
 docs/configuration/service/pppoe-server.rst        |   2 +-
 docs/configuration/system/lcd.rst                  |   2 +-
 docs/configuration/vpn/dmvpn.rst                   | 335 ++++++++++
 docs/configuration/vpn/index.rst                   |  15 +
 docs/configuration/vpn/ipsec.rst                   | 192 ++++++
 docs/configuration/vpn/l2tp.rst                    | 235 +++++++
 docs/configuration/vpn/openconnect.rst             |  95 +++
 docs/configuration/vpn/pptp.rst                    |  47 ++
 docs/configuration/vpn/site2site_ipsec.rst         | 298 +++++++++
 docs/configuration/vpn/sstp.rst                    | 347 ++++++++++
 docs/configuration/vrf/index.rst                   | 307 +++++++++
 docs/configuration/zonepolicy/index.rst            |   8 +
 docs/contributing/debugging.rst                    |   2 +-
 docs/contributing/development.rst                  |   2 +-
 docs/contributing/documentation.rst                |   2 +-
 docs/contributing/issues-features.rst              |   2 +-
 docs/coverage.rst                                  |   2 -
 docs/index.rst                                     |   3 +-
 docs/installation/upate.rst                        |  79 ---
 docs/installation/update.rst                       |  79 +++
 docs/operation/index.rst                           |   3 +-
 docs/vpn/dmvpn.rst                                 | 335 ----------
 docs/vpn/index.rst                                 |  18 -
 docs/vpn/ipsec.rst                                 | 192 ------
 docs/vpn/l2tp.rst                                  | 235 -------
 docs/vpn/openconnect.rst                           |  95 ---
 docs/vpn/pptp.rst                                  |  47 --
 docs/vpn/site2site_ipsec.rst                       | 298 ---------
 docs/vpn/sstp.rst                                  | 347 ----------
 docs/vrf.rst                                       | 307 ---------
 62 files changed, 4718 insertions(+), 4724 deletions(-)
 create mode 100644 docs/_include/common-references.txt
 delete mode 100644 docs/appendix/examples/azure-vpn-bgp.rst
 delete mode 100644 docs/appendix/examples/azure-vpn-dual-bgp.rst
 delete mode 100644 docs/appendix/examples/bgp-ipv6-unnumbered.rst
 delete mode 100644 docs/appendix/examples/dhcp-relay-through-gre-bridge.rst
 delete mode 100644 docs/appendix/examples/ha.rst
 delete mode 100644 docs/appendix/examples/index.rst
 delete mode 100644 docs/appendix/examples/ospf-unnumbered.rst
 delete mode 100644 docs/appendix/examples/tunnelbroker-ipv6.rst
 delete mode 100644 docs/appendix/examples/wan-load-balancing.rst
 delete mode 100644 docs/appendix/examples/zone-policy.rst
 delete mode 100644 docs/command-list-configuration.rst
 delete mode 100644 docs/command-list-operation.rst
 delete mode 100644 docs/common-references.rst
 create mode 100644 docs/configexamples/azure-vpn-bgp.rst
 create mode 100644 docs/configexamples/azure-vpn-dual-bgp.rst
 create mode 100644 docs/configexamples/bgp-ipv6-unnumbered.rst
 create mode 100644 docs/configexamples/dhcp-relay-through-gre-bridge.rst
 create mode 100644 docs/configexamples/ha.rst
 create mode 100644 docs/configexamples/index.rst
 create mode 100644 docs/configexamples/ospf-unnumbered.rst
 create mode 100644 docs/configexamples/tunnelbroker-ipv6.rst
 create mode 100644 docs/configexamples/wan-load-balancing.rst
 create mode 100644 docs/configexamples/zone-policy.rst
 delete mode 100644 docs/configuration-overview.rst
 create mode 100644 docs/configuration/vpn/dmvpn.rst
 create mode 100644 docs/configuration/vpn/index.rst
 create mode 100644 docs/configuration/vpn/ipsec.rst
 create mode 100644 docs/configuration/vpn/l2tp.rst
 create mode 100644 docs/configuration/vpn/openconnect.rst
 create mode 100644 docs/configuration/vpn/pptp.rst
 create mode 100644 docs/configuration/vpn/site2site_ipsec.rst
 create mode 100644 docs/configuration/vpn/sstp.rst
 create mode 100644 docs/configuration/vrf/index.rst
 create mode 100644 docs/configuration/zonepolicy/index.rst
 delete mode 100644 docs/installation/upate.rst
 create mode 100644 docs/installation/update.rst
 delete mode 100644 docs/vpn/dmvpn.rst
 delete mode 100644 docs/vpn/index.rst
 delete mode 100644 docs/vpn/ipsec.rst
 delete mode 100644 docs/vpn/l2tp.rst
 delete mode 100644 docs/vpn/openconnect.rst
 delete mode 100644 docs/vpn/pptp.rst
 delete mode 100644 docs/vpn/site2site_ipsec.rst
 delete mode 100644 docs/vpn/sstp.rst
 delete mode 100644 docs/vrf.rst

(limited to 'docs/_include')

diff --git a/docs/_include/common-references.txt b/docs/_include/common-references.txt
new file mode 100644
index 00000000..79881972
--- /dev/null
+++ b/docs/_include/common-references.txt
@@ -0,0 +1,6 @@
+.. _`accel-ppp`: https://accel-ppp.org/
+.. _`Secure Socket Tunneling Protocol`: https://en.wikipedia.org/wiki/Secure_Socket_Tunneling_Protocol
+.. _Phabricator: https://phabricator.vyos.net/
+
+.. _802.1ad: https://en.wikipedia.org/wiki/IEEE_802.1ad
+.. _802.1q: https://en.wikipedia.org/wiki/IEEE_802.1Q
diff --git a/docs/_include/interface-vlan-8021ad.txt b/docs/_include/interface-vlan-8021ad.txt
index 12925ad4..74bc2080 100644
--- a/docs/_include/interface-vlan-8021ad.txt
+++ b/docs/_include/interface-vlan-8021ad.txt
@@ -140,4 +140,4 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. include:: /common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/_include/interface-vlan-8021q.txt b/docs/_include/interface-vlan-8021q.txt
index 37f652f3..db22a1ce 100644
--- a/docs/_include/interface-vlan-8021q.txt
+++ b/docs/_include/interface-vlan-8021q.txt
@@ -108,4 +108,4 @@ term used for this is ``vif``.
    :var3: <vlan-id>
    :var4: 10
 
-.. include:: /common-references.rst
\ No newline at end of file
+.. include:: /_include/common-references.txt
\ No newline at end of file
diff --git a/docs/appendix/examples/azure-vpn-bgp.rst b/docs/appendix/examples/azure-vpn-bgp.rst
deleted file mode 100644
index 176e0ae0..00000000
--- a/docs/appendix/examples/azure-vpn-bgp.rst
+++ /dev/null
@@ -1,130 +0,0 @@
-.. _examples-azure-vpn-bgp:
-
-Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
-------------------------------------------------------------
-
-This guide shows an example of a route-based IKEv2 site-to-site VPN to
-Azure using VTI and BGP for dynamic routing updates.
-
-For redundant / active-active configurations see `Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) <https://docs.vyos.io/en/crux/appendix/examples/azure-vpn-dual-bgp.html>`_
-
-Prerequisites
-^^^^^^^^^^^^^
-
-- A pair of Azure VNet Gateways deployed in active-passive
-  configuration with BGP enabled.
-
-- A local network gateway deployed in Azure representing
-  the Vyos device, matching the below Vyos settings except for
-  address space, which only requires the Vyos private IP, in
-  this example 10.10.0.5/32
-
-- A connection resource deployed in Azure linking the
-  Azure VNet gateway and the local network gateway representing
-  the Vyos device.
-
-Example
-^^^^^^^
-
-+---------------------------------------+---------------------+
-| WAN Interface                         | eth0                |
-+---------------------------------------+---------------------+
-| On-premises address space             | 10.10.0.0/16        |
-+---------------------------------------+---------------------+
-| Azure address space                   |  10.0.0.0/16        |
-+---------------------------------------+---------------------+
-| Vyos public IP                        | 198.51.100.3        |
-+---------------------------------------+---------------------+
-| Vyos private IP                       | 10.10.0.5           |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway public IP          |  203.0.113.2        |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway BGP IP             |  10.0.0.4           |
-+---------------------------------------+---------------------+
-| Pre-shared key                        | ch00s3-4-s3cur3-psk |
-+---------------------------------------+---------------------+
-| Vyos ASN                              | 64499               |
-+---------------------------------------+---------------------+
-| Azure ASN                             | 65540               |
-+---------------------------------------+---------------------+
-
-Vyos configuration
-^^^^^^^^^^^^^^^^^^
-
-- Configure the IKE and ESP settings to match a subset
-  of those supported by Azure:
-
-.. code-block:: none
-
-  set vpn ipsec esp-group AZURE compression 'disable'
-  set vpn ipsec esp-group AZURE lifetime '3600'
-  set vpn ipsec esp-group AZURE mode 'tunnel'
-  set vpn ipsec esp-group AZURE pfs 'dh-group2'
-  set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
-
-  set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
-  set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
-  set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
-  set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
-  set vpn ipsec ike-group AZURE key-exchange 'ikev2'
-  set vpn ipsec ike-group AZURE lifetime '28800'
-  set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
-  set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
-
-- Enable IPsec on eth0
-
-.. code-block:: none
-
-  set vpn ipsec ipsec-interfaces interface 'eth0'
-
-- Configure a VTI with a dummy IP address
-
-.. code-block:: none
-
-  set interfaces vti vti1 address '10.10.1.5/32'
-  set interfaces vti vti1 description 'Azure Tunnel'
-
-- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
-
-.. code-block:: none
-
-  set firewall options interface vti1 adjust-mss 1350
-
-- Configure the VPN tunnel
-
-.. code-block:: none
-
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
-  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
-  set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
-  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
-  set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
-  set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
-  set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
-
-- **Important**: Add an interface route to reach Azure's BGP listener
-
-.. code-block:: none
-
-  set protocols static interface-route 10.0.0.4/32 next-hop-interface vti1
-
-- Configure your BGP settings
-
-.. code-block:: none
-
-  set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
-  set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
-  set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
-  set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
-
-- **Important**: Disable connected check \
-
-.. code-block:: none
-
-  set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check
diff --git a/docs/appendix/examples/azure-vpn-dual-bgp.rst b/docs/appendix/examples/azure-vpn-dual-bgp.rst
deleted file mode 100644
index 13d4b5a2..00000000
--- a/docs/appendix/examples/azure-vpn-dual-bgp.rst
+++ /dev/null
@@ -1,155 +0,0 @@
-.. _examples-azure-vpn-dual-bgp:
-
-Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
-----------------------------------------------------------------------
-
-This guide shows an example of a redundant (active-active) route-based IKEv2
-site-to-site VPN to Azure using VTI
-and BGP for dynamic routing updates.
-
-Prerequisites
-^^^^^^^^^^^^^
-
-- A pair of Azure VNet Gateways deployed in active-active
-  configuration with BGP enabled.
-
-- A local network gateway deployed in Azure representing
-  the Vyos device, matching the below Vyos settings except for
-  address space, which only requires the Vyos private IP, in
-  this example 10.10.0.5/32
-
-- A connection resource deployed in Azure linking the
-  Azure VNet gateway and the local network gateway representing
-  the Vyos device.
-
-Example
-^^^^^^^
-
-+---------------------------------------+---------------------+
-| WAN Interface                         | eth0                |
-+---------------------------------------+---------------------+
-| On-premises address space             | 10.10.0.0/16        |
-+---------------------------------------+---------------------+
-| Azure address space                   |  10.0.0.0/16        |
-+---------------------------------------+---------------------+
-| Vyos public IP                        | 198.51.100.3        |
-+---------------------------------------+---------------------+
-| Vyos private IP                       | 10.10.0.5           |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway 1 public IP        |  203.0.113.2        |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway 2 public IP        |  203.0.113.3        |
-+---------------------------------------+---------------------+
-| Azure VNet Gateway BGP IP             |  10.0.0.4,10.0.0.5  |
-+---------------------------------------+---------------------+
-| Pre-shared key                        | ch00s3-4-s3cur3-psk |
-+---------------------------------------+---------------------+
-| Vyos ASN                              | 64499               |
-+---------------------------------------+---------------------+
-| Azure ASN                             | 65540               |
-+---------------------------------------+---------------------+
-
-Vyos configuration
-^^^^^^^^^^^^^^^^^^
-
-- Configure the IKE and ESP settings to match a subset
-  of those supported by Azure:
-
-.. code-block:: none
-
-  set vpn ipsec esp-group AZURE compression 'disable'
-  set vpn ipsec esp-group AZURE lifetime '3600'
-  set vpn ipsec esp-group AZURE mode 'tunnel'
-  set vpn ipsec esp-group AZURE pfs 'dh-group2'
-  set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
-
-  set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
-  set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
-  set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
-  set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
-  set vpn ipsec ike-group AZURE key-exchange 'ikev2'
-  set vpn ipsec ike-group AZURE lifetime '28800'
-  set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
-  set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
-
-- Enable IPsec on eth0
-
-.. code-block:: none
-
-  set vpn ipsec ipsec-interfaces interface 'eth0'
-
-- Configure two VTIs with a dummy IP address each
-
-.. code-block:: none
-
-  set interfaces vti vti1 address '10.10.1.5/32'
-  set interfaces vti vti1 description 'Azure Primary Tunnel'
-
-  set interfaces vti vti2 address '10.10.1.6/32'
-  set interfaces vti vti2 description 'Azure Secondary Tunnel'
-
-- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
-
-.. code-block:: none
-
-  set firewall options interface vti1 adjust-mss 1350
-  set firewall options interface vti2 adjust-mss 1350
-
-- Configure the VPN tunnels
-
-.. code-block:: none
-
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
-  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
-  set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
-  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
-  set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
-  set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
-  set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
-
-  set vpn ipsec site-to-site peer 203.0.113.3 authentication id '198.51.100.3'
-  set vpn ipsec site-to-site peer 203.0.113.3 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 203.0.113.3 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
-  set vpn ipsec site-to-site peer 203.0.113.3 authentication remote-id '203.0.113.3'
-  set vpn ipsec site-to-site peer 203.0.113.3 connection-type 'respond'
-  set vpn ipsec site-to-site peer 203.0.113.3 description 'AZURE SECONDARY TUNNEL'
-  set vpn ipsec site-to-site peer 203.0.113.3 ike-group 'AZURE'
-  set vpn ipsec site-to-site peer 203.0.113.3 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 203.0.113.3 local-address '10.10.0.5'
-  set vpn ipsec site-to-site peer 203.0.113.3 vti bind 'vti2'
-  set vpn ipsec site-to-site peer 203.0.113.3 vti esp-group 'AZURE'
-
-- **Important**: Add an interface route to reach both Azure's BGP listeners
-
-.. code-block:: none
-
-  set protocols static interface-route 10.0.0.4/32 next-hop-interface vti1
-  set protocols static interface-route 10.0.0.5/32 next-hop-interface vti2
-
-- Configure your BGP settings
-
-.. code-block:: none
-
-  set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
-  set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
-  set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
-  set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
-
-  set protocols bgp 64499 neighbor 10.0.0.5 remote-as '65540'
-  set protocols bgp 64499 neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound'
-  set protocols bgp 64499 neighbor 10.0.0.5 timers holdtime '30'
-  set protocols bgp 64499 neighbor 10.0.0.5 timers keepalive '10'
-
-- **Important**: Disable connected check, otherwise the routes learned
-  from Azure will not be imported into the routing table.
-
-.. code-block:: none
-
-  set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check
-  set protocols bgp 64499 neighbor 10.0.0.5 disable-connected-check
diff --git a/docs/appendix/examples/bgp-ipv6-unnumbered.rst b/docs/appendix/examples/bgp-ipv6-unnumbered.rst
deleted file mode 100644
index ccc1f69a..00000000
--- a/docs/appendix/examples/bgp-ipv6-unnumbered.rst
+++ /dev/null
@@ -1,172 +0,0 @@
-.. _examples-bgp-ipv6-unnumbered:
-
-#########################################
-BGP IPv6 unnumbered with extended nexthop
-#########################################
-
-General information can be found in the :ref:`bgp` chapter.
-
-Configuration
-=============
-
-- Router A:
-
-.. code-block:: none
-
-  set protocols bgp 64496 address-family ipv4-unicast redistribute connected
-  set protocols bgp 64496 address-family ipv6-unicast redistribute connected
-  set protocols bgp 64496 neighbor eth1 interface v6only
-  set protocols bgp 64496 neighbor eth1 interface v6only peer-group 'fabric'
-  set protocols bgp 64496 neighbor eth2 interface v6only
-  set protocols bgp 64496 neighbor eth2 interface v6only peer-group 'fabric'
-  set protocols bgp 64496 parameters bestpath as-path multipath-relax
-  set protocols bgp 64496 parameters bestpath compare-routerid
-  set protocols bgp 64496 parameters default no-ipv4-unicast
-  set protocols bgp 64496 parameters router-id '192.168.0.1'
-  set protocols bgp 64496 peer-group fabric address-family ipv4-unicast
-  set protocols bgp 64496 peer-group fabric address-family ipv6-unicast
-  set protocols bgp 64496 peer-group fabric capability extended-nexthop
-  set protocols bgp 64496 peer-group fabric remote-as 'external'
-
-- Router B:
-
-.. code-block:: none
-
-  set protocols bgp 64499 address-family ipv4-unicast redistribute connected
-  set protocols bgp 64499 address-family ipv6-unicast redistribute connected
-  set protocols bgp 64499 neighbor eth1 interface v6only
-  set protocols bgp 64499 neighbor eth1 interface v6only peer-group 'fabric'
-  set protocols bgp 64499 neighbor eth2 interface v6only
-  set protocols bgp 64499 neighbor eth2 interface v6only peer-group 'fabric'
-  set protocols bgp 64499 parameters bestpath as-path multipath-relax
-  set protocols bgp 64499 parameters bestpath compare-routerid
-  set protocols bgp 64499 parameters default no-ipv4-unicast
-  set protocols bgp 64499 parameters router-id '192.168.0.2'
-  set protocols bgp 64499 peer-group fabric address-family ipv4-unicast
-  set protocols bgp 64499 peer-group fabric address-family ipv6-unicast
-  set protocols bgp 64499 peer-group fabric capability extended-nexthop
-  set protocols bgp 64499 peer-group fabric remote-as 'external'
-
-Results
-=======
-
-- Router A:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             198.51.100.34/24                  u/u
-  eth1             -                                 u/u
-  eth2             -                                 u/u
-  lo               127.0.0.1/8                       u/u
-                   192.168.0.1/32
-                   ::1/128
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip route
-  Codes: K - kernel route, C - connected, S - static, R - RIP,
-         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
-         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
-         F - PBR, f - OpenFabric,
-         > - selected route, * - FIB route
-
-  S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53
-  C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53
-  C>* 192.168.0.1/32 is directly connected, lo, 03:21:56
-  B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07
-    *                       via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07
-
-.. code-block:: none
-
-  vyos@vyos:~$ ping 192.168.0.2
-  PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
-  64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms
-  64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms
-  64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms
-  64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms
-  64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms
-
-  --- 192.168.0.2 ping statistics ---
-  5 packets transmitted, 5 received, 0% packet loss, time 4086ms
-  rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip bgp summary
-
-  IPv4 Unicast Summary:
-  BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0
-  BGP table version 4
-  RIB entries 5, using 800 bytes of memory
-  Peers 2, using 41 KiB of memory
-  Peer groups 1, using 64 bytes of memory
-
-  Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
-  eth1            4      64499      13      13        0    0    0 00:05:33            2
-  eth2            4      64499      13      14        0    0    0 00:05:29            2
-
-  Total number of neighbors 2
-
-- Router B:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             198.51.100.33/24                  u/u
-  eth1             -                                 u/u
-  eth2             -                                 u/u
-  lo               127.0.0.1/8                       u/u
-                   192.168.0.2/32
-                   ::1/128
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip route
-  Codes: K - kernel route, C - connected, S - static, R - RIP,
-         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
-         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
-         F - PBR, f - OpenFabric,
-         > - selected route, * - FIB route
-
-  S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08
-  C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09
-  B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18
-    *                       via fe80::a00:27ff:fe93:e142, eth2, 00:06:18
-  C>* 192.168.0.2/32 is directly connected, lo, 00:44:11
-
-.. code-block:: none
-
-  vyos@vyos:~$ ping 192.168.0.1
-  PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
-  64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms
-  64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms
-  64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms
-  64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms
-
-  --- 192.168.0.1 ping statistics ---
-  4 packets transmitted, 4 received, 0% packet loss, time 3051ms
-  rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip bgp summary
-  IPv4 Unicast Summary:
-  BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0
-  BGP table version 4
-  RIB entries 5, using 800 bytes of memory
-  Peers 2, using 41 KiB of memory
-  Peer groups 1, using 64 bytes of memory
-
-  Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
-  eth1            4      64496      14      14        0    0    0 00:06:40            2
-  eth2            4      64496      14      14        0    0    0 00:06:37            2
-
-  Total number of neighbors 2
-
diff --git a/docs/appendix/examples/dhcp-relay-through-gre-bridge.rst b/docs/appendix/examples/dhcp-relay-through-gre-bridge.rst
deleted file mode 100644
index f94eb67f..00000000
--- a/docs/appendix/examples/dhcp-relay-through-gre-bridge.rst
+++ /dev/null
@@ -1,77 +0,0 @@
-.. _examples-dhcp-relay-through-gre-bridge:
-
-
-DHCP Relay through GRE-Bridge
------------------------------
-
-Diagram
-^^^^^^^
-
-.. image:: /_static/images/dhcp-relay-through-gre-bridge.png
-   :width: 80%
-   :align: center
-   :alt: Network Topology Diagram
-
-Configuration
-^^^^^^^^^^^^^
-
-DHCP Server
-"""""""""""
-
-.. code-block:: none
-
-   set interfaces ethernet eth0 address '10.0.2.1/24'
-   set interfaces loopback lo address '3.3.3.3/24'
-   set interfaces tunnel tun100 address '172.16.0.2/30'
-   set interfaces tunnel tun100 encapsulation 'gre-bridge'
-   set interfaces tunnel tun100 local-ip '10.0.2.1'
-   set interfaces tunnel tun100 remote-ip '192.168.0.1'
-   set protocols ospf area 0 network '3.3.3.0/24'
-   set protocols ospf area 0 network '10.0.2.0/24'
-   set protocols ospf parameters router-id '3.3.3.3'
-   set protocols static interface-route 10.0.1.2/32 next-hop-interface tun100
-   set service dhcp-server shared-network-name asdf authoritative
-   set service dhcp-server shared-network-name asdf subnet 3.3.3.0/24 range 0 start '3.3.3.30'
-   set service dhcp-server shared-network-name asdf subnet 3.3.3.0/24 range 0 stop '3.3.3.40'
-   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 default-router '10.0.1.2'
-   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 range 0 start '10.0.1.200'
-   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 range 0 stop '10.0.1.210'
-   set service dhcp-server shared-network-name asdf subnet 10.2.1.0/24 range 0 start '10.2.1.222'
-   set service dhcp-server shared-network-name asdf subnet 10.2.1.0/24 range 0 stop '10.2.1.233'
-   set service dhcp-server shared-network-name asdf subnet 172.16.0.0/30 range 0 start '172.16.0.1'
-   set service dhcp-server shared-network-name asdf subnet 172.16.0.0/30 range 0 stop '172.16.0.2'
-   
-
-In-Between Router
-"""""""""""""""""
-
-.. code-block:: none
-
-   set interfaces ethernet eth0 address '192.168.0.2/24'
-   set interfaces ethernet eth1 address '10.0.2.2/24'
-   set protocols ospf area 0 network '192.168.0.0/24'
-   set protocols ospf area 0 network '10.0.2.0/24'
-   set protocols ospf parameters router-id '192.168.0.2'
-   
-
-DHCP Relay
-""""""""""
-
-.. code-block:: none
-
-   set interfaces ethernet eth0 address '10.0.1.2/24'
-   set interfaces ethernet eth1 address '192.168.0.1/24'
-   set interfaces loopback lo address '1.1.1.1'
-   set interfaces tunnel tun100 address '172.16.0.1/30'
-   set interfaces tunnel tun100 encapsulation 'gre-bridge'
-   set interfaces tunnel tun100 local-ip '192.168.0.1'
-   set interfaces tunnel tun100 remote-ip '10.0.2.1'
-   set protocols ospf area 0 network '10.0.1.0/24'
-   set protocols ospf area 0 network '192.168.0.0/24'
-   set protocols ospf area 0 network '1.1.1.0/24'
-   set protocols ospf parameters router-id '1.1.1.1'
-   set protocols static interface-route 3.3.3.3/32 next-hop-interface tun100
-   set service dhcp-relay interface 'eth0'
-   set service dhcp-relay interface 'tun100'
-   set service dhcp-relay server '3.3.3.3'
-   
diff --git a/docs/appendix/examples/ha.rst b/docs/appendix/examples/ha.rst
deleted file mode 100644
index 702cb2b2..00000000
--- a/docs/appendix/examples/ha.rst
+++ /dev/null
@@ -1,580 +0,0 @@
-#############################
-High Availability Walkthrough
-#############################
-
-This document walks you through a complete HA setup of two VyOS machines. This
-design is based on a VM as the primary router, and a physical machine as a
-backup, using VRRP, BGP, OSPF and conntrack sharing.
-
-The aim of this document is to walk you through setting everything up so you
-and up at a point where you can reboot any machine and not lose more than a few
-seconds worth of connectivity.
-
-Design
-======
-
-This is based on a real life, in production design. One of the complex issues
-is ensuring you have redundant data INTO your network. We do this with a pair
-of Cisco Nexus switches, and using Virtual PortChannels that are spanned across
-them. This as an added bonus, also allows for complete switch failure without
-an outage. How you achieve this yourself is left as an exercise to the reader
-but our setup is documented here.
-
-Walkthrough suggestion
-----------------------
-
-The ``commit`` command is implied after every section. If you make an error,
-``commit`` will warn you and you can fix it before getting too far into things.
-Please ensure you commit early and commit often.
-
-If you are following through this document, it is strongly suggested you
-complete the entire document, ONLY doing the virtual router1 steps, and then
-come back and walk through it AGAIN on the backup hardware router.
-
-This ensures you don't go to fast, or miss a step. However, it will make your
-life easier to configure the fixed IP address and default route now on the
-hardware router.
-
-Example Network
----------------
-
-In this document, we have been allocated 203.0.113.0/24 by our upstream
-provider, which we are publishing on VLAN100.
-
-They want us to establish a BGP session to their routers on 192.0.2.11 and
-192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and
-we are AS65551.
-
-Our routers are going to have a floating IP address of 203.0.113.1, and use
-.2 and .3 as their fixed IPs.
-
-We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201.
-
-When traffic is originated from the 10.200.201.0/24 network, it will be
-masqueraded to 203.0.113.1
-
-For connection between sites, we are running a WireGuard link to two REMOTE
-routers, and using OSPF over those links to distribute routes. That remote
-site is expected to send traffic from anything in 10.201.0.0/16
-
-VLANs
------
-
-These are the vlans we wll be using:
-
-* 50: Upstream, using the 192.0.2.0/24 network allocated by them.
-* 100: 'Public' network, using our 203.0.113.0/24 network.
-* 201: 'Internal' network, using 10.200.201.0/24
-
-Hardware
---------
-
-* switch1 (Nexus 10gb Switch)
-* switch2 (Nexus 10gb Switch)
-* compute1 (VMware ESXi 6.5)
-* compute2 (VMware ESXi 6.5)
-* compute3 (VMware ESXi 6.5)
-* router2 (Random 1RU machine with 4 NICs)
-
-Note that router1 is a VM that runs on one of the compute nodes.
-
-Network Cabling
----------------
-
-* From Datacenter - This connects into port 1 on both switches, and is tagged
-  as VLAN 50
-* Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch
-* Hardware Router - Port 8 of each switch
-* compute1 - Port 9 of each switch
-* compute2 - Port 10 of each switch
-* compute3 - Port 11 of each switch
-
-This is ignoring the extra Out-of-band management networking, which should be
-on totally different switches, and a different feed into the rack, and is out
-of scope of this.
-
-.. note:: Our implementation uses VMware's Distributed Port Groups, which allows
-  VMware to use LACP. This is a part of the ENTERPRISE licence, and is not
-  available on a Free licence. If you are implementing this and do not have
-  access to DPGs, you should not use VMware, and use some other virtualization
-  platform instead.
-
-
-Basic Setup (via console)
-=========================
-
-Create your router1 VM so it is able to withstand a VM Host failing, or a
-network link failing. Using VMware, this is achieved by enabling vSphere DRS,
-vSphere Availability, and creating a Distributed Port Group that uses LACP.
-
-Many other Hypervisors do this, and I'm hoping that this document will be
-expanded to document how to do this for others.
-
-Create an 'All VLANs' network group, that passes all trunked traffic through
-to the VM. Attach this network group to router1 as eth0.
-
-.. note:: VMware: You must DISABLE SECURITY on this Port group. Make sure that
-   ``Promiscuous Mode``\ , ``MAC address changes`` and ``Forged transmits`` are
-   enabled. All of these will be done as part of failover.
-
-Bonding on Hardware Router
---------------------------
-
-Create a LACP bond on the hardware router. We are assuming that eth0 and eth1
-are connected to port 8 on both switches, and that those ports are configured
-as a Port-Channel.
-
-.. code-block:: none
-
-   set interfaces bonding bond0 description 'Switch Port-Channel'
-   set interfaces bonding bond0 hash-policy 'layer2'
-   set interfaces bonding bond0 member interface 'eth0'
-   set interfaces bonding bond0 member interface 'eth1'
-   set interfaces bonding bond0 mode '802.3ad'
-
-
-Assign external IP addresses
-----------------------------
-
-VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this
-is talking directly to upstream. Create our IP address on vlan50.
-
-For the hardware router, replace ``eth0`` with ``bond0``. As (almost) every
-command is identical, this will not be specified unless different things need
-to be performed on different hosts.
-
-.. code-block:: none
-
-   set interfaces ethernet eth0 vif 50 address '192.0.2.21/24'
-
-In this case, the hardware router has a different IP, so it would be
-
-.. code-block:: none
-
-   set interfaces ethernet bond0 vif 50 address '192.0.2.22/24'
-
-Add (temporary) default route
------------------------------
-
-It is assumed that the routers provided by upstream are capable of acting as a
-default router, add that as a static route.
-
-.. code-block:: none
-
-   set protocols static route 0.0.0.0/0 next-hop 192.0.2.11
-   commit
-   save
-
-
-Enable SSH
-----------
-
-Enable SSH so you can now SSH into the routers, rather than using the console.
-
-.. code-block:: none
-
-   set service ssh
-   commit
-   save
-
-At this point you should be able to SSH into both of them, and will no longer
-need access to the console (unless you break something!)
-
-
-VRRP Configuration
-==================
-
-We are setting up VRRP so that it does NOT fail back when a machine returns into
-service, and it prioritizes router1 over router2.
-
-Internal Network
-----------------
-
-This has a floating IP address of 10.200.201.1/24, using virtual router ID 201.
-The difference between them is the interface name, hello-source-address, and
-peer-address.
-
-**router1**
-
-.. code-block:: none
-
-   set interfaces ethernet eth0 vif 201 address 10.200.201.2/24
-   set high-availability vrrp group int hello-source-address '10.200.201.2'
-   set high-availability vrrp group int interface 'eth0.201'
-   set high-availability vrrp group int peer-address '10.200.201.3'
-   set high-availability vrrp group int no-preempt
-   set high-availability vrrp group int priority '200'
-   set high-availability vrrp group int virtual-address '10.200.201.1/24'
-   set high-availability vrrp group int vrid '201'
-
-
-**router2**
-
-.. code-block:: none
-
-   set interfaces ethernet bond0 vif 201 address 10.200.201.3/24
-   set high-availability vrrp group int hello-source-address '10.200.201.3'
-   set high-availability vrrp group int interface 'bond0.201'
-   set high-availability vrrp group int peer-address '10.200.201.2'
-   set high-availability vrrp group int no-preempt
-   set high-availability vrrp group int priority '100'
-   set high-availability vrrp group int virtual-address '10.200.201.1/24'
-   set high-availability vrrp group int vrid '201'
-
-
-Public Network
---------------
-
-This has a floating IP address of 203.0.113.1/24, using virtual router ID 113.
-The virtual router ID is just a random number between 1 and 254, and can be set
-to whatever you want. Best practices suggest you try to keep them unique
-enterprise-wide.
-
-**router1**
-
-.. code-block:: none
-
-   set interfaces ethernet eth0 vif 100 address 203.0.113.2/24
-   set high-availability vrrp group public hello-source-address '203.0.113.2'
-   set high-availability vrrp group public interface 'eth0.100'
-   set high-availability vrrp group public peer-address '203.0.113.3'
-   set high-availability vrrp group public no-preempt
-   set high-availability vrrp group public priority '200'
-   set high-availability vrrp group public virtual-address '203.0.113.1/24'
-   set high-availability vrrp group public vrid '113'
-
-**router2**
-
-.. code-block:: none
-
-   set interfaces ethernet bond0 vif 100 address 203.0.113.3/24
-   set high-availability vrrp group public hello-source-address '203.0.113.3'
-   set high-availability vrrp group public interface 'bond0.100'
-   set high-availability vrrp group public peer-address '203.0.113.2'
-   set high-availability vrrp group public no-preempt
-   set high-availability vrrp group public priority '100'
-   set high-availability vrrp group public virtual-address '203.0.113.1/24'
-   set high-availability vrrp group public vrid '113'
-
-
-Create VRRP sync-group
-----------------------
-
-The sync group is used to replicate connection tracking. It needs to be assigned
-to a random VRRP group, and we are creating a sync group called ``sync`` using
-the vrrp group ``int``.
-
-.. code-block:: none
-
-   set high-availability vrrp sync-group sync member 'int'
-
-Testing
--------
-
-At this point, you should be able to see both IP addresses when you run
-``show interfaces``\ , and ``show vrrp`` should show both interfaces in MASTER
-state (and SLAVE state on router2).
-
-.. code-block:: none
-
-   vyos@router1:~$ show vrrp
-   Name      Interface      VRID  State    Last Transition
-   --------  -----------  ------  -------  -----------------
-   int       eth0.201        201  MASTER   100s
-   public    eth0.100        113  MASTER   200s
-   vyos@router1:~$
-
-
-You should be able to ping to and from all the IPs you have allocated.
-
-NAT and conntrack-sync
-======================
-
-Masquerade Traffic originating from 10.200.201.0/24 that is heading out the
-public interface.
-
-.. note:: We explicitly exclude the primary upstream network so that BGP or
-   OSPF traffic doesn't accidentally get NAT'ed.
-
-.. code-block:: none
-
-   set nat source rule 10 destination address '!192.0.2.0/24'
-   set nat source rule 10 outbound-interface 'eth0.50'
-   set nat source rule 10 source address '10.200.201.0/24'
-   set nat source rule 10 translation address '203.0.113.1'
-
-
-Configure conntrack-sync and disable helpers
---------------------------------------------
-
-Most conntrack modules cause more problems than they're worth, especially in a
-complex network. Turn them off by default, and if you need to turn them on
-later, you can do so.
-
-.. code-block:: none
-
-   set system conntrack modules ftp disable
-   set system conntrack modules gre disable
-   set system conntrack modules nfs disable
-   set system conntrack modules pptp disable
-   set system conntrack modules sip disable
-   set system conntrack modules tftp disable
-
-Now enable replication between nodes. Replace eth0.201 with bond0.201 on the
-hardware router.
-
-.. code-block:: none
-
-   set service conntrack-sync accept-protocol 'tcp,udp,icmp'
-   set service conntrack-sync event-listen-queue-size '8'
-   set service conntrack-sync failover-mechanism vrrp sync-group 'sync'
-   set service conntrack-sync interface eth0.201
-   set service conntrack-sync mcast-group '224.0.0.50'
-   set service conntrack-sync sync-queue-size '8'
-
-Testing
--------
-
-The simplest way to test is to look at the connection tracking stats on the
-standby hardware router with the command ``show conntrack-sync statistics``.
-The numbers should be very close to the numbers on the primary router.
-
-When you have both routers up, you should be able to establish a connection
-from a NAT'ed machine out to the internet, reboot the active machine, and that
-connection should be preserved, and will not drop out.
-
-OSPF Over WireGuard
-===================
-
-Wireguard doesn't have the concept of an up or down link, due to its design.
-This complicates AND simplifies using it for network transport, as for reliable
-state detection you need to use SOMETHING to detect when the link is down.
-
-If you use a routing protocol itself, you solve two problems at once. This is
-only a basic example, and is provided as a starting point.
-
-Configure Wireguard
--------------------
-
-There is plenty of instructions and documentation on setting up Wireguard. The
-only important thing you need to remember is to only use one WireGuard
-interface per OSPF connection.
-
-We use small /30's from 10.254.60/24 for the point-to-point links.
-
-**router1**
-
-Replace the 203.0.113.3 with whatever the other router's IP address is.
-
-.. code-block:: none
-
-   set interfaces wireguard wg01 address '10.254.60.1/30'
-   set interfaces wireguard wg01 description 'router1-to-offsite1'
-   set interfaces wireguard wg01 ip ospf authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e'
-   set interfaces wireguard wg01 ip ospf cost '11'
-   set interfaces wireguard wg01 ip ospf dead-interval '5'
-   set interfaces wireguard wg01 ip ospf hello-interval '1'
-   set interfaces wireguard wg01 ip ospf network 'point-to-point'
-   set interfaces wireguard wg01 ip ospf priority '1'
-   set interfaces wireguard wg01 ip ospf retransmit-interval '5'
-   set interfaces wireguard wg01 ip ospf transmit-delay '1'
-   set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0'
-   set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001'
-   set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15'
-   set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o='
-   set interfaces wireguard wg01 port '50001'
-
-
-**offsite1**
-
-This is connecting back to the STATIC IP of router1, not the floating.
-
-.. code-block:: none
-
-   set interfaces wireguard wg01 address '10.254.60.2/30'
-   set interfaces wireguard wg01 description 'offsite1-to-router1'
-   set interfaces wireguard wg01 ip ospf authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e'
-   set interfaces wireguard wg01 ip ospf cost '11'
-   set interfaces wireguard wg01 ip ospf dead-interval '5'
-   set interfaces wireguard wg01 ip ospf hello-interval '1'
-   set interfaces wireguard wg01 ip ospf network 'point-to-point'
-   set interfaces wireguard wg01 ip ospf priority '1'
-   set interfaces wireguard wg01 ip ospf retransmit-interval '5'
-   set interfaces wireguard wg01 ip ospf transmit-delay '1'
-   set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0'
-   set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001'
-   set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15'
-   set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q='
-   set interfaces wireguard wg01 port '50001'
-
-Test WireGuard
---------------
-
-Make sure you can ping 10.254.60.1 and .2 from both routers.
-
-Create Export Filter
---------------------
-
-We only want to export the networks we know we should be exporting. Always
-whitelist your route filters, both importing and exporting. A good rule of
-thumb is **'If you are not the default router for a network, don't advertise
-it'**. This means we explicitly do not want to advertise the 192.0.2.0/24
-network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE
-the default route for). This filter is applied to ``redistribute connected``.
-If we WERE to advertise it, the remote machines would see 192.0.2.21 available
-via their default route, establish the connection, and then OSPF would say
-'192.0.2.0/24 is available via this tunnel', at which point the tunnel would
-break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via
-default again. This is called 'flapping'.
-
-.. code-block:: none
-
-   set policy access-list 150 description 'Outbound OSPF Redistribution'
-   set policy access-list 150 rule 10 action 'permit'
-   set policy access-list 150 rule 10 destination any
-   set policy access-list 150 rule 10 source inverse-mask '0.0.0.255'
-   set policy access-list 150 rule 10 source network '10.200.201.0'
-   set policy access-list 150 rule 20 action 'permit'
-   set policy access-list 150 rule 20 destination any
-   set policy access-list 150 rule 20 source inverse-mask '0.0.0.255'
-   set policy access-list 150 rule 20 source network '203.0.113.0'
-   set policy access-list 150 rule 100 action 'deny'
-   set policy access-list 150 rule 100 destination any
-   set policy access-list 150 rule 100 source any
-
-
-Create Import Filter
---------------------
-
-We only want to import networks we know about. Our OSPF peer should only be
-advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE
-MATCH. You deny in access-list 100 to accept the route.
-
-.. code-block:: none
-
-   set policy access-list 100 description 'Inbound OSPF Routes from Peers'
-   set policy access-list 100 rule 10 action 'deny'
-   set policy access-list 100 rule 10 destination any
-   set policy access-list 100 rule 10 source inverse-mask '0.0.255.255'
-   set policy access-list 100 rule 10 source network '10.201.0.0'
-   set policy access-list 100 rule 100 action 'permit'
-   set policy access-list 100 rule 100 destination any
-   set policy access-list 100 rule 100 source any
-   set policy route-map PUBOSPF rule 100 action 'deny'
-   set policy route-map PUBOSPF rule 100 match ip address access-list '100'
-   set policy route-map PUBOSPF rule 500 action 'permit'
-
-
-Enable OSPF
------------
-
-Every router **must** have a unique router-id.
-The 'reference-bandwidth' is used because when OSPF was originally designed,
-the idea of a link faster than 1gbit was unheard of, and it does not scale
-correctly.
-
-.. code-block:: none
-
-   set protocols ospf area 0.0.0.0 authentication 'md5'
-   set protocols ospf area 0.0.0.0 network '10.254.60.0/24'
-   set protocols ospf auto-cost reference-bandwidth '10000'
-   set protocols ospf log-adjacency-changes
-   set protocols ospf parameters abr-type 'cisco'
-   set protocols ospf parameters router-id '10.254.60.2'
-   set protocols ospf route-map PUBOSPF
-
-
-Test OSPF
----------
-
-When you have enabled OSPF on both routers, you should be able to see each
-other with the command ``show ip ospf neighbour``. The state must be 'Full'
-or '2-Way', if it is not then there is a network connectivity issue between the
-hosts. This is often caused by NAT or MTU issues. You should not see any new
-routes (unless this is the second pass) in the output of ``show ip route``
-
-Advertise connected routes
-==========================
-
-As a reminder, only advertise routes that you are the default router for. This
-is why we are NOT announcing the 192.0.2.0/24 network, because if that was
-announced into OSPF, the other routers would try to connect to that network
-over a tunnel that connects to that network!
-
-.. code-block:: none
-
-   set protocols ospf access-list 150 export 'connected'
-   set protocols ospf redistribute connected
-
-
-You should now be able to see the advertised network on the other host.
-
-Duplicate configuration
------------------------
-
-At this pont you now need to create the X link between all four routers. Use a
-different /30 for each link.
-
-Priorities
-----------
-
-Set the cost on the secondary links to be 200. This means that they will not
-be used unless the primary links are down.
-
-.. code-block:: none
-
-   set interfaces wireguard wg01 ip ospf cost '10'
-   set interfaces wireguard wg02 ip ospf cost '200'
-
-
-This will be visible in 'show ip route'.
-
-BGP
-===
-
-BGP is an extremely complex network protocol. An example is provided here.
-
-.. note:: Router id's must be unique.
-
-**router1**
-
-
-The ``redistribute ospf`` command is there purely as an example of how this can
-be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as
-it is not 203.0.113.0/24.
-
-.. code-block:: none
-
-   set policy prefix-list BGPOUT description 'BGP Export List'
-   set policy prefix-list BGPOUT rule 10 action 'deny'
-   set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks'
-   set policy prefix-list BGPOUT rule 10 ge '25'
-   set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0'
-   set policy prefix-list BGPOUT rule 100 action 'permit'
-   set policy prefix-list BGPOUT rule 100 description 'Our network'
-   set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24'
-   set policy prefix-list BGPOUT rule 10000 action 'deny'
-   set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0'
-   set policy route-map BGPOUT description 'BGP Export Filter'
-   set policy route-map BGPOUT rule 10 action 'permit'
-   set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT'
-   set policy route-map BGPOUT rule 10000 action 'deny'
-   set policy route-map BGPPREPENDOUT description 'BGP Export Filter'
-   set policy route-map BGPPREPENDOUT rule 10 action 'permit'
-   set policy route-map BGPPREPENDOUT rule 10 set as-path-prepend '65551 65551 65551'
-   set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT'
-   set policy route-map BGPPREPENDOUT rule 10000 action 'deny'
-   set protocols bgp 65551 address-family ipv4-unicast network 192.0.2.0/24
-   set protocols bgp 65551 address-family ipv4-unicast redistribute connected metric '50'
-   set protocols bgp 65551 address-family ipv4-unicast redistribute ospf metric '50'
-   set protocols bgp 65551 neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT'
-   set protocols bgp 65551 neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound
-   set protocols bgp 65551 neighbor 192.0.2.11 remote-as '65550'
-   set protocols bgp 65551 neighbor 192.0.2.11 update-source '192.0.2.21'
-   set protocols bgp 65551 parameters router-id '192.0.2.21'
-
-
-**router2**
-
-This is identical, but you use the BGPPREPENDOUT route-map to advertise the
-route with a longer path.
diff --git a/docs/appendix/examples/index.rst b/docs/appendix/examples/index.rst
deleted file mode 100644
index b2f7bfde..00000000
--- a/docs/appendix/examples/index.rst
+++ /dev/null
@@ -1,19 +0,0 @@
-.. _examples:
-
-Configuration Blueprints
-========================
-
-This chapter contains various configuration examples:
-
-.. toctree::
-   :maxdepth: 2
-
-   dhcp-relay-through-gre-bridge
-   zone-policy
-   bgp-ipv6-unnumbered
-   ospf-unnumbered
-   azure-vpn-bgp
-   azure-vpn-dual-bgp
-   tunnelbroker-ipv6
-   ha
-   wan-load-balancing
diff --git a/docs/appendix/examples/ospf-unnumbered.rst b/docs/appendix/examples/ospf-unnumbered.rst
deleted file mode 100644
index 39f8f69a..00000000
--- a/docs/appendix/examples/ospf-unnumbered.rst
+++ /dev/null
@@ -1,118 +0,0 @@
-.. _examples-ospf-unnumbered:
-
-#########################
-OSPF unnumbered with ECMP
-#########################
-
-General infomration can be found in the :ref:`routing-ospf` chapter.
-
-Configuration
-=============
-
-- Router A:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address '10.0.0.1/24'
-  set interfaces ethernet eth1 address '192.168.0.1/32'
-  set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-  set interfaces ethernet eth1 ip ospf network 'point-to-point'
-  set interfaces ethernet eth2 address '192.168.0.1/32'
-  set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-  set interfaces ethernet eth2 ip ospf network 'point-to-point'
-  set interfaces loopback lo address '192.168.0.1/32'
-  set protocols ospf area 0.0.0.0 authentication 'md5'
-  set protocols ospf area 0.0.0.0 network '192.168.0.1/32'
-  set protocols ospf parameters router-id '192.168.0.1'
-  set protocols ospf redistribute connected
-
-- Router B:
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address '10.0.0.2/24'
-  set interfaces ethernet eth1 address '192.168.0.2/32'
-  set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-  set interfaces ethernet eth1 ip ospf network 'point-to-point'
-  set interfaces ethernet eth2 address '192.168.0.2/32'
-  set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-  set interfaces ethernet eth2 ip ospf network 'point-to-point'
-  set interfaces loopback lo address '192.168.0.2/32'
-  set protocols ospf area 0.0.0.0 authentication 'md5'
-  set protocols ospf area 0.0.0.0 network '192.168.0.2/32'
-  set protocols ospf parameters router-id '192.168.0.2'
-  set protocols ospf redistribute connected
-
-
-Results
-=======
-
-- Router A:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             10.0.0.1/24                       u/u
-  eth1             192.168.0.1/32                    u/u
-  eth2             192.168.0.1/32                    u/u
-  lo               127.0.0.1/8                       u/u
-                   192.168.0.1/32
-                   ::1/128
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip route
-  Codes: K - kernel route, C - connected, S - static, R - RIP,
-         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
-         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
-         F - PBR, f - OpenFabric,
-         > - selected route, * - FIB route, q - queued route, r - rejected route
-
-  S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
-  O   10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21
-                              via 192.168.0.2, eth2 onlink, 00:13:21
-  C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
-  O   192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53
-  C * 192.168.0.1/32 is directly connected, eth2, 00:56:31
-  C * 192.168.0.1/32 is directly connected, eth1, 00:56:31
-  C>* 192.168.0.1/32 is directly connected, lo, 00:57:36
-  O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03
-    *                        via 192.168.0.2, eth2 onlink, 00:29:03
-
-- Router B:
-
-.. code-block:: none
-
-  vyos@vyos:~$ show interfaces
-  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-  Interface        IP Address                        S/L  Description
-  ---------        ----------                        ---  -----------
-  eth0             10.0.0.2/24                       u/u
-  eth1             192.168.0.2/32                    u/u
-  eth2             192.168.0.2/32                    u/u
-  lo               127.0.0.1/8                       u/u
-                   192.168.0.2/32
-                   ::1/128
-
-.. code-block:: none
-
-  vyos@vyos:~$ show ip route
-  Codes: K - kernel route, C - connected, S - static, R - RIP,
-         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
-         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
-         F - PBR, f - OpenFabric,
-         > - selected route, * - FIB route, q - queued route, r - rejected route
-
-  S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
-  O   10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21
-                              via 192.168.0.1, eth2 onlink, 00:13:21
-  C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
-  O   192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53
-  C * 192.168.0.2/32 is directly connected, eth2, 00:56:31
-  C * 192.168.0.2/32 is directly connected, eth1, 00:56:31
-  C>* 192.168.0.2/32 is directly connected, lo, 00:57:36
-  O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03
-    *                        via 192.168.0.1, eth2 onlink, 00:29:03
diff --git a/docs/appendix/examples/tunnelbroker-ipv6.rst b/docs/appendix/examples/tunnelbroker-ipv6.rst
deleted file mode 100644
index 868b225f..00000000
--- a/docs/appendix/examples/tunnelbroker-ipv6.rst
+++ /dev/null
@@ -1,169 +0,0 @@
-.. _examples-tunnelbroker-ipv6:
-
-#######################
-Tunnelbroker.net (IPv6)
-#######################
-
-This guides walks through the setup of https://www.tunnelbroker.net/ for an
-IPv6 Tunnel.
-
-Prerequisites
-=============
-
-- A public, routable IPv4 address. This does not necessarily need to be static,
-  but you will need to update the tunnel endpoint when/if your IP address
-  changes, which can be done with a script and a scheduled task.
-- Account at https://www.tunnelbroker.net/
-- Requested a "Regular Tunnel". You want to choose a location that is closest
-  to your physical location for the best response time.
-
-Setup initial tunnel
-====================
-
-Set up initial IPv6 tunnel. Replace the field below from the fields on the
-tunnel information page.
-
-.. code-block:: none
-
-  conf
-  set interfaces tunnel tun0 address Client_IPv6_from_Tunnelbroker    # This will be your VyOS install's public IPv6 address
-  set interfaces tunnel tun0 description 'HE.NET IPv6 Tunnel'
-  set interfaces tunnel tun0 encapsulation 'sit'
-  set interfaces tunnel tun0 local-ip Client_IPv4_from_Tunnelbroker   # This is your public IP
-  set interfaces tunnel tun0 mtu '1472'
-  set interfaces tunnel tun0 multicast 'disable'
-  set interfaces tunnel tun0 remote-ip Server_IPv4_from_Tunnelbroker  # This is the IP of the Tunnelbroker server
-  set protocols static interface-route6 ::/0 next-hop-interface tun0  # Tell all traffic to go over this tunnel
-  commit
-
-If your WAN connection is over PPPoE, you may need to set the MTU on the above
-tunnel lower than 1472.
-
-At this point you should be able to ping an IPv6 address, try pinging Google:
-
-.. code-block:: none
-
-   ping6 -c2 2001:4860:4860::8888
-
-   64 bytes from 2001:4860:4860::8888: icmp_seq=1 ttl=57 time=21.7 ms
-   64 bytes from 2001:4860:4860::8888: icmp_seq=2 ttl=57 time=21.1 ms
-
-   --- 2001:4860:4860::8888 ping statistics ---
-   2 packets transmitted, 2 received, 0% packet loss, time 1001ms
-   rtt min/avg/max/mdev = 21.193/21.459/21.726/0.304 ms
-
-Assuming the pings are successful, you need to add some DNS servers.
-Some options:
-
-.. code-block:: none
-
-   set system name-server 2001:4860:4860::8888  # Google
-   set system name-server 2001:4860:4860::8844  # Google
-   set system name-server 2606:4700:4700::1111  # Cloudflare
-   set system name-server 2606:4700:4700::1001  # Cloudflare
-   commit
-
-You should now be able to ping something by IPv6 DNS name:
-
-.. code-block:: none
-
-   # ping6 -c2 one.one.one.one
-   PING one.one.one.one(one.one.one.one) 56 data bytes
-   64 bytes from one.one.one.one: icmp_seq=1 ttl=58 time=16.8 ms
-   64 bytes from one.one.one.one: icmp_seq=2 ttl=58 time=17.4 ms
-
-   --- one.one.one.one ping statistics ---
-   2 packets transmitted, 2 received, 0% packet loss, time 1001ms
-   rtt min/avg/max/mdev = 16.880/17.153/17.426/0.273 ms
-
-Assuming everything works, you can proceed to client configuration
-
-LAN Configuration
-=================
-
-At this point your VyOS install should have full IPv6, but now your LAN devices
-need access.
-
-With Tunnelbroker.net, you have two options:
-
-- Routed /64. This is the default assignment. In IPv6-land, it's good for a
-  single "LAN", and is somewhat equivalent to a /24.
-  Example: `2001:470:xxxx:xxxx::/64`
-- Routed /48. This is something you can request by clicking the "Assign /48"
-  link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k
-  LANs. Example: `2001:470:xxxx::/48`
-
-Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So
-if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore
-the assigned /64, and request the /48 and use that.
-
-Single LAN Setup
-================
-
-Single LAN setup where eth1 is your LAN interface. Use the /64 (all the xxxx
-should be replaced with the information from your `Routed /64` tunnel):
-
-.. code-block:: none
-
-  set interfaces ethernet eth1 address '2001:470:xxxx:xxxx::1/64'
-  set service router-advert interface eth1 name-server '2001:4860:4860::8888'
-  set service router-advert interface eth1 name-server '2001:4860:4860::8844'
-  set service router-advert interface eth1 prefix 2001:470:xxxx:xxxx::/64 
-
-Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, 'valid-lifetime' and 'preferred-lifetime' are set to default values of 30 days and 4 hours respectively.
-
-This accomplishes a few things:
-
-- Sets your LAN interface's IP address
-- Enables router advertisements. This is an IPv6 alternative for DHCP (though
-  DHCPv6 can still be used). With RAs, Your devices will automatically find the
-  information they need for routing and DNS.
-
-Multiple LAN/DMZ Setup
-======================
-
-In this, you use the `Routed /48` information. This allows you to assign a
-different /64 to every interface, LAN, or even device. Or you could break your
-network into smaller chunks like /56 or /60.
-
-The format of these addresses:
-
-- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker.
-- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN
-- `2001:470:xxxx:2::/64`: Another subnet
-- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet.
-
-In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff
-(1-65535).
-
-So, when your LAN is eth1, your DMZ is eth2, your cameras live on eth3, etc:
-
-.. code-block:: none
-
-  set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64'
-  set service router-advert interface eth1 name-server '2001:4860:4860::8888'
-  set service router-advert interface eth1 name-server '2001:4860:4860::8844'
-  set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64
-  
-  set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64'
-  set service router-advert interface eth2 name-server '2001:4860:4860::8888'
-  set service router-advert interface eth2 name-server '2001:4860:4860::8844'
-  set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 
-
-  set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64'
-  set service router-advert interface eth3 name-server '2001:4860:4860::8888'
-  set service router-advert interface eth3 name-server '2001:4860:4860::8844'
-  set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64
-
-Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, 'valid-lifetime' and 'preferred-lifetime' are set to default values of 30 days and 4 hours respectively.
-
-Firewall
-========
-
-Finally, don't forget the :ref:`firewall`. The usage is identical, except for
-instead of `set firewall name NAME`, you would use `set firewall ipv6-name
-NAME`.
-
-Similarly, to attach the firewall, you would use `set interfaces ethernet eth0
-firewall in ipv6-name` or `set zone-policy zone LOCAL from WAN firewall
-ipv6-name`.
diff --git a/docs/appendix/examples/wan-load-balancing.rst b/docs/appendix/examples/wan-load-balancing.rst
deleted file mode 100644
index 7093defe..00000000
--- a/docs/appendix/examples/wan-load-balancing.rst
+++ /dev/null
@@ -1,170 +0,0 @@
-.. _wan-load-balancing:
-
-WAN Load Balancer examples
-==========================
-
-
-Example 1: Distributing load evenly
------------------------------------
-
-The setup used in this example is shown in the following diagram:
-
-.. image:: /_static/images/Wan_load_balancing1.png
-   :width: 80%
-   :align: center
-   :alt: Network Topology Diagram
-
-
-Overview
-^^^^^^^^
- * All traffic coming in trough eth2 is balanced between eth0 and eth1
-   on the router.
- * Pings will be sent to four targets for health testing (33.44.55.66,
-   44.55.66.77, 55.66.77.88 and 66.77.88.99).
- * All outgoing packets are assigned the source address of the assigned
-   interface (SNAT).
- * eth0 is set to be removed from the load balancer's interface pool
-   after 5 ping failures, eth1 will be removed after 4 ping failures.
-
-Create static routes to ping targets
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-Create static routes through the two ISPs towards the ping targets and
-commit the changes:
-
-.. code-block:: none
-
-   set protocols static route 33.44.55.66/32 next-hop 11.22.33.1
-   set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 
-   set protocols static route 55.66.77.88/32 next-hop 22.33.44.1
-   set protocols static route 66.77.88.99/32 next-hop 22.33.44.1
-
-Configure the load balancer
-^^^^^^^^^^^^^^^^^^^^^^^^^^^
-Configure the WAN load balancer with the parameters described above:
-
-.. code-block:: none
-
-   set load-balancing wan interface-health eth0 failure-count 5
-   set load-balancing wan interface-health eth0 nexthop 11.22.33.1
-   set load-balancing wan interface-health eth0 test 10 type ping
-   set load-balancing wan interface-health eth0 test 10 target 33.44.55.66
-   set load-balancing wan interface-health eth0 test 20 type ping
-   set load-balancing wan interface-health eth0 test 20 target 44.55.66.77
-   set load-balancing wan interface-health eth1 failure-count 4
-   set load-balancing wan interface-health eth1 nexthop 22.33.44.1
-   set load-balancing wan interface-health eth1 test 10 type ping
-   set load-balancing wan interface-health eth1 test 10 target 55.66.77.88
-   set load-balancing wan interface-health eth1 test 20 type ping
-   set load-balancing wan interface-health eth1 test 20 target 66.77.88.99
-   set load-balancing wan rule 10 inbound-interface eth2
-   set load-balancing wan rule 10 interface eth0
-   set load-balancing wan rule 10 interface eth1
-
-Example 2: Failover based on interface weights
-----------------------------------------------
-
-This examples uses the failover mode.
-
-Overview
-^^^^^^^^
-In this example eth0 is the primary interface and eth1 is the secondary
-interface to provide simple failover functionality. If eth0 fails, eth1
-takes over.
-
-Create interface weight based configuration
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-The configuration steps are the same as in the previous example, except
-rule 10 so we keep the configuration, remove rule 10 and add a new rule
-for the failover mode:
-
-.. code-block:: none
-
-   delete load-balancing wan rule 10
-   set load-balancing wan rule 10 failover
-   set load-balancing wan rule 10 inbound-interface eth2
-   set load-balancing wan rule 10 interface eth0 weight 10
-   set load-balancing wan rule 10 interface eth1 weight 1
-
-Example 3: Failover based on rule order
----------------------------------------
-
-The previous example used the failover command to send traffic thorugh
-eth1 if eth0 fails. In this example failover functionality is provided
-by rule order.
-
-Overview
-^^^^^^^^
-Two rules will be created, the first rule directs traffic coming in
-from eth2 to eth0 and the second rule directs the traffic to eth1. If
-eth0 fails the first rule is bypassed and the second rule matches,
-directing traffic to eth1.
-
-Create rule order based configuration
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-We keep the configurtation from the previous example, delete rule 10
-and create the two new rules as described:
-
-.. code-block:: none
-
-   delete load-balancing wan rule 10
-   set load-balancing wan rule 10 inbound-interface eth2
-   set load-balancing wan rule 10 interface eth0
-   set load-balancing wan rule 20 inbound-interface eth2
-   set load-balancing wan rule 20 interface eth1
-
-Example 4: Failover based on rule order - priority traffic
-----------------------------------------------------------
-
-A rule order for prioritising traffic is useful in scenarios where the
-secondary link has a lower speed and should only carry high priority
-traffic. It is assumed for this example that eth1 is connected to a
-slower connection than eth0 and should prioritise VoIP traffic.
-
-Overview
-^^^^^^^^
-A rule order for prioritising traffic is useful in scenarios where the
-secondary link has a lower speed and should only carry high priority
-traffic. It is assumed for this example that eth1 is connected to a
-slower connection than eth0 and should prioritise VoIP traffic. 
-
-Create rule order based configuration with low speed secondary link
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-We keep the configuration from the previous example, delete rule 20 and
-create a new rule as described: 
-
-.. code-block:: none
-
-   delete load-balancing wan rule 20
-   set load-balancing wan rule 20 inbound-interface eth2
-   set load-balancing wan rule 20 interface eth1
-   set load-balancing wan rule 20 destination port sip
-   set load-balancing wan rule 20 protocol tcp
-   set protocols static route 0.0.0.0/0 next-hop 11.22.33.1
-
-Example 5: Exclude traffic from load balancing
-----------------------------------------------
-
-In this example two LAN interfaces exist in different subnets instead
-of one like in the previous examples:
-
-.. image:: /_static/images/Wan_load_balancing_exclude1.png                      
-   :width: 80%                                                          
-   :align: center                                                       
-   :alt: Network Topology Diagram 
-
-Adding a rule for the second interface
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Based on the previous example, another rule for traffic from the second
-interface eth3 can be added to the load balancer. However, traffic meant
-to flow between the LAN subnets will be sent to eth0 and eth1 as well.
-To prevent this, another rule is required. This rule excludes traffic
-between the local subnets from the load balancer. It also excludes
-locally-sources packets (required for web caching with load balancing).
-eth+ is used as an alias that refers to all ethernet interfaces:
-
-.. code-block:: none
-
-   set load-balancing wan rule 5 exclude
-   set load-balancing wan rule 5 inbound-interface eth+
-   set load-balancing wan rule 5 destination address 10.0.0.0/8
diff --git a/docs/appendix/examples/zone-policy.rst b/docs/appendix/examples/zone-policy.rst
deleted file mode 100644
index bfe77c2e..00000000
--- a/docs/appendix/examples/zone-policy.rst
+++ /dev/null
@@ -1,415 +0,0 @@
-.. _examples-zone-policy:
-
-Zone-Policy example
--------------------
-
-Native IPv4 and IPv6
-^^^^^^^^^^^^^^^^^^^^
-
-We have three networks.
-
-.. code-block:: none
-
-  WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64
-  LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64
-  DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64
-
-
-**This specific example is for a router on a stick, but is very easily
-adapted for however many NICs you have**:
-
-
-* Internet - 192.168.200.100 - TCP/80
-* Internet - 192.168.200.100 - TCP/443
-* Internet - 192.168.200.100 - TCP/25
-* Internet - 192.168.200.100 - TCP/53
-* VyOS actis as DHCP, DNS forwarder, NAT, router and firewall.
-* 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web
-  and mail (SMTP/IMAP) server.
-* 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It
-  can SSH to VyOS.
-* LAN and DMZ hosts have basic outbound access: Web, FTP, SSH.
-* LAN can access DMZ resources.
-* DMZ cannot access LAN resources.
-* Inbound WAN connect to DMZ host.
-
-.. image:: /_static/images/zone-policy-diagram.png
-   :width: 80%
-   :align: center
-   :alt: Network Topology Diagram
-
-The VyOS interface is assigned the .1/:1 address of their respective
-networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30.
-
-It will look something like this:
-
-.. code-block:: none
-
-  interfaces {
-      ethernet eth0 {
-          duplex auto
-          hw-id 00:53:ed:6e:2a:92
-          smp_affinity auto
-          speed auto
-          vif 10 {
-              address 172.16.10.1/24
-              address 2001:db8:0:9999::1/64
-          }
-          vif 20 {
-              address 192.168.100.1/24
-              address 2001:db8:0:AAAA::1/64
-          }
-          vif 30 {
-              address 192.168.200.1/24
-              address 2001:db8:0:BBBB::1/64
-          }
-      }
-      loopback lo {
-      }
-  }
-
-
-Zones Basics
-^^^^^^^^^^^^
-
-Each interface is assigned to a zone. The interface can be physical or
-virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly
-the same.
-
-Traffic flows from zone A to zone B. That flow is what I refer to as a
-zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations.
-
-Ruleset are created per zone-pair-direction.
-
-I name rule sets to indicate which zone-pair-direction they represent.
-eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN.
-
-In VyOS, you have to have unique Ruleset names. In the event of overlap,
-I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This
-allows for each auto-completion and uniqueness.
-
-In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is
-the firewall itself.
-
-If your computer is on the LAN and you need to SSH into your VyOS box,
-you would need a rule to allow it in the LAN-Local ruleset. If you want
-to access a webpage from your VyOS box, you need a rule to allow it in
-the Local-LAN ruleset.
-
-In rules, it is good to keep them named consistently. As the number of
-rules you have grows, the more consistency you have, the easier your
-life will be.
-
-.. code-block:: none
-
-  Rule 1 - State Established, Related
-  Rule 2 - State Invalid
-  Rule 100 - ICMP
-  Rule 200 - Web
-  Rule 300 - FTP
-  Rule 400 - NTP
-  Rule 500 - SMTP
-  Rule 600 - DNS
-  Rule 700 - DHCP
-  Rule 800 - SSH
-  Rule 900 - IMAPS
-
-The first two rules are to deal with the idiosyncrasies of VyOS and
-iptables.
-
-Zones and Rulesets both have a default action statement. When using
-Zone-Policies, the default action is set by the zone-policy statement
-and is represented by rule 10000.
-
-It is good practice to log both accepted and denied traffic. It can save
-you significant headaches when trying to troubleshoot a connectivity
-issue.
-
-To add logging to the default rule, do:
-
-.. code-block:: none
-
-  set firewall name <ruleSet> enable-default-log
-
-
-By default, iptables does not allow traffic for established session to
-return, so you must explicitly allow this. I do this by adding two rules
-to every ruleset. 1 allows established and related state packets through
-and rule 2 drops and logs invalid state packets. We place the
-established/related rule at the top because the vast majority of traffic
-on a network is established and the invalid rule to prevent invalid
-state packets from mistakenly being matched against other rules. Having
-the most matched rule listed first reduces CPU load in high volume
-environments. Note: I have filed a bug to have this added as a default
-action as well.
-
-''It is important to note, that you do not want to add logging to the
-established state rule as you will be logging both the inbound and
-outbound packets for each session instead of just the initiation of the
-session. Your logs will be massive in a very short period of time.''
-
-In VyOS you must have the interfaces created before you can apply it to
-the zone and the rulesets must be created prior to applying it to a
-zone-policy.
-
-I create/configure the interfaces first. Build out the rulesets for each
-zone-pair-direction which includes at least the three state rules. Then
-I setup the zone-policies.
-
-Zones do not allow for a default action of accept; either drop or
-reject. It is important to remember this because if you apply an
-interface to a zone and commit, any active connections will be dropped.
-Specifically, if you are SSH’d into VyOS and add local or the interface
-you are connecting through to a zone and do not have rulesets in place
-to allow SSH and established sessions, you will not be able to connect.
-
-The following are the rules that were created for this example (may not
-be complete), both in IPv4 and IPv6. If there is no IP specified, then
-the source/destination address is not explicit.
-
-.. code-block:: none
-
-  WAN – DMZ:192.168.200.200 – tcp/80
-  WAN – DMZ:192.168.200.200 – tcp/443
-  WAN – DMZ:192.168.200.200 – tcp/25
-  WAN – DMZ:192.168.200.200 – tcp/53
-  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/80
-  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/443
-  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/25
-  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/53
-
-  DMZ - Local - tcp/53
-  DMZ - Local - tcp/123
-  DMZ - Local - tcp/67,68
-
-  LAN - Local - tcp/53
-  LAN - Local - tcp/123
-  LAN - Local - tcp/67,68
-  LAN:192.168.100.10 - Local - tcp/22
-  LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22
-
-  LAN - WAN - tcp/80
-  LAN - WAN - tcp/443
-  LAN - WAN - tcp/22
-  LAN - WAN - tcp/20,21
-
-  DMZ - WAN - tcp/80
-  DMZ - WAN - tcp/443
-  DMZ - WAN - tcp/22
-  DMZ - WAN - tcp/20,21
-  DMZ - WAN - tcp/53
-  DMZ - WAN - udp/53
-
-  Local - WAN - tcp/80
-  Local - WAN - tcp/443
-  Local - WAN - tcp/20,21
-
-  Local - DMZ - tcp/25
-  Local - DMZ - tcp/67,68
-  Local - DMZ - tcp/53
-  Local - DMZ - udp/53
-
-  Local - LAN - tcp/67,68
-
-  LAN - DMZ - tcp/80
-  LAN - DMZ - tcp/443
-  LAN - DMZ - tcp/993
-  LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22
-  LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22
-
-Since we have 4 zones, we need to setup the following rulesets.
-
-.. code-block:: none
-
-  Lan-wan
-  Lan-local
-  Lan-dmz
-  Wan-lan
-  Wan-local
-  Wan-dmz
-  Local-lan
-  Local-wan
-  Local-dmz
-  Dmz-lan
-  Dmz-wan
-  Dmz-local
-
-Even if the two zones will never communicate, it is a good idea to
-create the zone-pair-direction rulesets and set enable-default-log. This
-will allow you to log attempts to access the networks. Without it, you
-will never see the connection attempts.
-
-This is an example of the three base rules.
-
-.. code-block:: none
-
-  name wan-lan {
-    default-action drop
-    enable-default-log
-    rule 1 {
-      action accept
-      state {
-        established enable
-        related enable
-      }
-    }
-    rule 2 {
-      action drop
-      log enable
-      state {
-        invalid enable
-      }
-    }
-  }
-
-
-Here is an example of an IPv6 DMZ-WAN ruleset.
-
-.. code-block:: none
-
-  ipv6-name dmz-wan-6 {
-    default-action drop
-    enable-default-log
-    rule 1 {
-      action accept
-      state {
-        established enable
-        related enable
-      }
-    }
-    rule 2 {
-      action drop
-      log enable
-      state {
-        invalid enable
-    }
-    rule 100 {
-      action accept
-      log enable
-      protocol ipv6-icmp
-    }
-    rule 200 {
-      action accept
-      destination {
-        port 80,443
-      }
-      log enable
-      protocol tcp
-    }
-    rule 300 {
-      action accept
-      destination {
-        port 20,21
-      }
-      log enable
-      protocol tcp
-    }
-    rule 500 {
-      action accept
-      destination {
-        port 25
-      }
-      log enable
-      protocol tcp
-      source {
-        address 2001:db8:0:BBBB::200
-      }
-    }
-    rule 600 {
-      action accept
-      destination {
-        port 53
-      }
-      log enable
-      protocol tcp_udp
-      source {
-        address 2001:db8:0:BBBB::200
-      }
-    }
-    rule 800 {
-      action accept
-      destination {
-      port 22
-      }
-      log enable
-      protocol tcp
-    }
-  }
-
-Once you have all of your rulesets built, then you need to create your
-zone-policy.
-
-Start by setting the interface and default action for each zone.
-
-.. code-block:: none
-
-  set zone-policy zone dmz default-action drop
-  set zone-policy zone dmz interface eth0.30
-
-In this case, we are setting the v6 ruleset that represents traffic
-sourced from the LAN, destined for the DMZ. Because the zone-policy
-firewall syntax is a little awkward, I keep it straight by thinking of
-it backwards.
-
-.. code-block:: none
-
-  set zone-policy zone dmz from lan firewall ipv6-name lan-dmz-6
-
-DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out
-a bunch at one time.
-
-In the end, you will end up with something like this config. I took out
-everything but the Firewall, Interfaces, and zone-policy sections. It is
-long enough as is.
-
-
-IPv6 Tunnel
-^^^^^^^^^^^
-
-If you are using a IPv6 tunnel from HE.net or someone else, the basis is
-the same except you have two WAN interface. One for v4 and one for v6.
-
-You would have 5 zones instead of just 4 and you would configure your v6
-ruleset between your tunnel interface and your LAN/DMZ zones instead of
-to the WAN.
-
-LAN, WAN, DMZ, local and TUN (tunnel)
-
-v6 pairs would be:
-
-.. code-block:: none
-
-  lan-tun
-  lan-local
-  lan-dmz
-  tun-lan
-  tun-local
-  tun-dmz
-  local-lan
-  local-tun
-  local-dmz
-  dmz-lan
-  dmz-tun
-  dmz-local
-
-Notice, none go to WAN since WAN wouldn't have a v6 address on it.
-
-You would have to add a couple of rules on your wan-local ruleset to
-allow protocol 41 in.
-
-Something like:
-
-.. code-block:: none
-
-  rule 400 {
-    action accept
-    destination {
-      address 172.16.10.1
-    }
-    log enable
-    protocol 41
-    source {
-      address ip.of.tunnel.broker
-    }
-  }
-
diff --git a/docs/cli.rst b/docs/cli.rst
index b138b18b..34ab3df6 100644
--- a/docs/cli.rst
+++ b/docs/cli.rst
@@ -97,3 +97,736 @@ To enter configuration mode use the ``configure`` command:
 
 See the configuration section of this document for more information on
 configuration mode.
+
+
+.. _configuration-overview:
+
+######################
+Configuration Overview
+######################
+
+VyOS makes use of a unified configuration file for the entire system's
+configuration: ``/config/config.boot``. This allows easy template
+creation, backup, and replication of system configuration. A system can
+thus also be easily cloned by simply copying the required configuration
+files.
+
+Terminology
+===========
+live
+A VyOS system has three major types of configurations:
+
+* **Active** or **running configuration** is the system configuration
+  that is loaded  and currently active (used by VyOS). Any change in
+  the configuration will have to be committed to belong to the
+  active/running configuration.
+
+* **Working configuration** is the one that is currently being modified
+  in configuration mode. Changes made to the working configuration do
+  not go into effect until the changes are committed with the
+  :cfgcmd:`commit` command. At which time the working configuration will
+  become the active or running configuration.
+
+* **Saved configuration** is the one saved to a file using the
+  :cfgcmd:`save` command. It allows you to keep safe a configuration for
+  future uses. There can be multiple configuration files. The default or
+  "boot" configuration is saved and loaded from the file
+  ``/config/config.boot``.
+
+Seeing and navigating the configuration
+=======================================
+
+.. opcmd:: show configuration
+
+   View the current active configuration, also known as the running
+   configuration, from the operational mode.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show configuration
+     interfaces {
+         ethernet eth0 {
+             address dhcp
+             hw-id 00:53:00:00:aa:01
+         }
+         loopback lo {
+         }
+     }
+     service {
+         ssh {
+             port 22
+         }
+     }
+     system {
+         config-management {
+             commit-revisions 20
+         }
+         console {
+             device ttyS0 {
+                 speed 9600
+             }
+         }
+         login {
+             user vyos {
+                 authentication {
+                     encrypted-password ****************
+                 }
+                 level admin
+             }
+         }
+         ntp {
+             server 0.pool.ntp.org {
+             }
+             server 1.pool.ntp.org {
+             }
+             server 2.pool.ntp.org {
+             }
+         }
+         syslog {
+             global {
+                 facility all {
+                     level notice
+                 }
+                 facility protocols {
+                     level debug
+                 }
+             }
+         }
+     }
+
+By default, the configuration is displayed in a hierarchy like the above
+example, this is only one of the possible ways to display the
+configuration. When the configuration is generated and the device is
+configured, changes are added through a collection of :cfgcmd:`set` and
+:cfgcmd:`delete` commands.
+
+.. opcmd:: show configuration commands
+
+   Get a collection of all the set commands required which led to the
+   running configuration.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show configuration commands
+     set interfaces ethernet eth0 address 'dhcp'
+     set interfaces ethernet eth0 hw-id '00:53:dd:44:3b:0f'
+     set interfaces loopback 'lo'
+     set service ssh port '22'
+     set system config-management commit-revisions '20'
+     set system console device ttyS0 speed '9600'
+     set system login user vyos authentication encrypted-password '$6$Vt68...QzF0'
+     set system login user vyos level 'admin'
+     set system ntp server '0.pool.ntp.org'
+     set system ntp server '1.pool.ntp.org'
+     set system ntp server '2.pool.ntp.org'
+     set system syslog global facility all level 'notice'
+     set system syslog global facility protocols level 'debug'
+
+Both these ``show`` commands should be executed when in operational
+mode, they do not work directly in configuration mode. There is a
+special way on how to :ref:`run_opmode_from_config_mode`.
+
+.. hint:: Use the ``show configuration commands | strip-private``
+   command when you want to hide private data. You may want to do so if
+   you want to share your configuration on the `forum`_.
+
+.. _`forum`: https://forum.vyos.io
+
+
+The config mode
+---------------
+
+When entering the configuration mode you are navigating inside a tree
+structure, to enter configuration mode enter the command
+:opcmd:`configure` when in operational mode.
+
+.. code-block:: none
+
+  vyos@vyos$ configure
+  [edit]
+  vyos@vyos#
+
+
+.. note:: When going into configuration mode, prompt changes from
+   ``$`` to ``#``.
+
+
+All commands executed here are relative to the configuration level you
+have entered. You can do everything from the top level, but commands
+will be quite lengthy when manually typing them.
+
+The current hierarchy level can be changed by the :cfgcmd:`edit`
+command.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# edit interfaces ethernet eth0
+
+  [edit interfaces ethernet eth0]
+  vyos@vyos#
+
+You are now in a sublevel relative to ``interfaces ethernet eth0``, all
+commands executed from this point on are relative to this sublevel. Use
+eithe the :cfgcmd:`top` or :cfgcmd:`exit` command to go back to the top
+of the hierarchy. You can also use the :cfgcmd:`up` command to move only
+one level up at a time.
+
+.. cfgcmd:: show
+
+The :cfgcmd:`show` command within configuration mode will show the
+working configuration indicating line changes with ``+`` for additions,
+``>`` for replacements and ``-`` for deletions.
+
+**Example:**
+
+.. code-block:: none
+
+ vyos@vyos:~$ configure
+ [edit]
+ vyos@vyos# show interfaces
+  ethernet eth0 {
+      description MY_OLD_DESCRIPTION
+      disable
+      hw-id 00:53:dd:44:3b:03
+  }
+  loopback lo {
+  }
+ [edit]
+ vyos@vyos# set interfaces ethernet eth0 address dhcp
+ [edit]
+ vyos@vyos# set interfaces ethernet eth0 description MY_NEW_DESCRIPTION
+ [edit]
+ vyos@vyos# delete interfaces ethernet eth0 disable
+ [edit]
+ vyos@vyos# show interfaces
+  ethernet eth0 {
+ +    address dhcp
+ >    description MY_NEW_DESCRIPTION
+ -    disable
+      hw-id 00:53:dd:44:3b:03
+  }
+  loopback lo {
+  }
+
+It is also possible to display all `set` commands within configuration
+mode using :cfgcmd:`show | commands`
+
+.. code-block:: none
+
+  vyos@vyos# show interfaces ethernet eth0 | commands
+  set address dhcp
+  set hw-id 00:53:ad:44:3b:03
+
+These commands are also relative to the level you are inside and only 
+relevant configuration blocks will be displayed when entering a
+sub-level.
+
+.. code-block:: none
+
+  [edit interfaces ethernet eth0]
+  vyos@vyos# show
+   address dhcp
+   hw-id 00:53:ad:44:3b:03
+
+Exiting from the configuration mode is done via the :cfgcmd:`exit`
+command from the top level, executing :cfgcmd:`exit` from within a
+sub-level takes you back to the top level.
+
+.. code-block:: none
+
+  [edit interfaces ethernet eth0]
+  vyos@vyos# exit
+  [edit]
+  vyos@vyos# exit
+  Warning: configuration changes have not been saved.
+
+
+Editing the configuration
+=========================
+
+The configuration can be edited by the use of :cfgcmd:`set` and
+:cfgcmd:`delete` commands from within configuration mode.
+
+.. cfgcmd:: set
+
+   Use this command to set the value of a parameter or to create a new
+   element.
+
+Configuration commands are flattened from the tree into 'one-liner'
+commands shown in :opcmd:`show configuration commands` from operation
+mode. Commands are relative to the level where they are executed and all
+redundant information from the current level is removed from the command
+entered.
+
+.. code-block:: none
+
+  [edit]
+  vyos@vyos# set interface ethernet eth0 address 192.0.2.100/24
+
+
+.. code-block:: none
+
+  [edit interfaces ethernet eth0]
+  vyos@vyos# set address 203.0.113.6/24
+
+
+These two commands above are essentially the same, just executed from
+different levels in the hierarchy.
+
+.. cfgcmd:: delete
+
+   To delete a configuration entry use the :cfgcmd:`delete` command,
+   this also deletes all sub-levels under the current level you've
+   specified in the :cfgcmd:`delete` command. Deleting an entry will
+   also result in the element reverting back to its default value if one
+   exists.
+
+   .. code-block:: none
+
+     [edit interfaces ethernet eth0]
+     vyos@vyos# delete address 192.0.2.100/24
+
+.. cfgcmd:: commit
+
+  Any change you do on the configuration, will not take effect until
+  committed using the :cfgcmd:`commit` command in configuration mode.
+
+  .. code-block:: none
+
+    vyos@vyos# commit
+    [edit]
+    vyos@vyos# exit
+    Warning: configuration changes have not been saved.
+    vyos@vyos:~$
+
+.. _save:
+
+.. cfgcmd:: save
+
+   Use this command to preserve configuration changes upon reboot. By
+   default it is stored at */config/config.boot*. In the case you want
+   to store the configuration file somewhere else, you can add a local
+   path, an SCP address, an FTP address or a TFTP address. 
+
+   .. code-block:: none
+
+     vyos@vyos# save
+     Saving configuration to '/config/config.boot'...
+     Done
+
+   .. code-block:: none
+
+     vyos@vyos# save [tab]
+     Possible completions:
+       <Enter>       Save to system config file
+       <file>        Save to file on local machine
+       scp://<user>:<passwd>@<host>:/<file> Save to file on remote machine
+       ftp://<user>:<passwd>@<host>/<file> Save to file on remote machine
+       tftp://<host>/<file>      Save to file on remote machine
+     vyos@vyos# save tftp://192.168.0.100/vyos-test.config.boot
+     Saving configuration to 'tftp://192.168.0.100/vyos-test.config.boot'...
+     ######################################################################## 100.0%
+     Done
+
+.. cfgcmd:: exit [discard]
+
+   Configuration mode can not be exited while uncommitted changes exist.
+   To exit configuration mode without applying changes, the
+   :cfgcmd:`exit discard` command must be used.
+
+   All changes in the working config will thus be lost.
+
+   .. code-block:: none
+
+     vyos@vyos# exit
+     Cannot exit: configuration modified.
+     Use 'exit discard' to discard the changes and exit.
+     [edit]
+     vyos@vyos# exit discard
+
+
+.. cfgcmd:: commit-confirm <minutes>
+
+   Use this command to temporarily commit your changes and set the
+   number of minutes available for validation. ``confirm`` must
+   be entered within those minutes, otherwise the system will reboot
+   into the previous configuration. The default value is 10 minutes.
+
+
+   What if you are doing something dangerous? Suppose you want to setup
+   a firewall, and you are not sure there are no mistakes that will lock
+   you out of your system. You can use confirmed commit. If you issue
+   the ``commit-confirm`` command, your changes will be commited, and if
+   you don't issue issue the ``confirm`` command in 10 minutes, your
+   system will reboot into previous config revision.
+
+   .. code-block:: none
+   
+      vyos@router# set interfaces ethernet eth0 firewall local name FromWorld
+      vyos@router# commit-confirm 
+      commit confirm will be automatically reboot in 10 minutes unless confirmed
+      Proceed? [confirm]y
+      [edit]
+      vyos@router# confirm 
+      [edit]
+
+
+   .. note:: A reboot because you did not enter ``confirm`` will not
+      take you necessarily to the *saved configuration*, but to the
+      point before the unfortunate commit.
+
+
+.. cfgcmd:: copy
+
+   Copy a configuration element.
+
+   You can copy and remove configuration subtrees. Suppose you set up a
+   firewall ruleset ``FromWorld`` with one rule that allows traffic from
+   specific subnet. Now you want to setup a similar rule, but for
+   different subnet. Change your edit level to
+   ``firewall name FromWorld`` and use ``copy rule 10 to rule 20``, then
+   modify rule 20.
+
+
+   .. code-block:: none
+   
+      vyos@router# show firewall name FromWorld 
+       default-action drop
+       rule 10 {
+           action accept
+           source {
+               address 203.0.113.0/24
+           }
+       }
+      [edit]
+      vyos@router# edit firewall name FromWorld 
+      [edit firewall name FromWorld]
+      vyos@router# copy rule 10 to rule 20
+      [edit firewall name FromWorld]
+      vyos@router# set rule 20 source address 198.51.100.0/24
+      [edit firewall name FromWorld]
+      vyos@router# commit
+      [edit firewall name FromWorld]
+
+
+.. cfgcmd:: rename
+
+   Rename a configuration element.
+
+   You can also rename config subtrees:
+
+   .. code-block:: none
+   
+      vyos@router# rename rule 10 to rule 5
+      [edit firewall name FromWorld]
+      vyos@router# commit
+      [edit firewall name FromWorld]
+
+   Note that ``show`` command respects your edit level and from this
+   level you can view the modified firewall ruleset with just ``show``
+   with no parameters.
+
+   .. code-block:: none
+   
+      vyos@router# show 
+       default-action drop
+       rule 5 {
+           action accept
+           source {
+               address 203.0.113.0/24
+           }
+       }
+       rule 20 {
+           action accept
+           source {
+               address 198.51.100.0/24
+           }
+       }
+
+
+.. cfgcmd:: comment <config node> "comment text"
+
+   Add comment as an annotation to a configuration node.
+
+   The ``comment`` command allows you to insert a comment above the
+   ``<config node>`` configuration section. When shown, comments are
+   enclosed with ``/*`` and ``*/`` as open/close delimiters. Comments
+   need to be commited, just like other config changes.
+
+   To remove an existing comment from your current configuration,
+   specify an empty string enclosed in double quote marks (``""``) as
+   the comment text.
+
+   Example:
+
+   .. code-block:: none
+
+     vyos@vyos# comment firewall all-ping "Yes I know this VyOS is cool"
+     vyos@vyos# commit
+     vyos@vyos# show
+      firewall {
+          /* Yes I know this VyOS is cool */
+          all-ping enable
+          broadcast-ping disable
+          ...
+      }
+
+   .. note:: An important thing to note is that since the comment is
+      added on top of the section, it will not appear if the ``show
+      <section>`` command is used. With the above example, the `show
+      firewall` command would return starting after the ``firewall
+      {`` line, hiding the comment.
+
+
+
+
+   
+
+.. _run_opmode_from_config_mode:
+
+Access opmode from config mode
+==============================
+
+When inside configuration mode you are not directly able to execute
+operational commands.
+
+.. cfgcmd:: run
+
+  Access to these commands are possible through the use of the
+  ``run [command]`` command. From this command you will have access to
+  everything accessible from operational mode.
+
+  Command completion and syntax help with ``?`` and ``[tab]`` will also
+  work.
+
+  .. code-block:: none
+
+    [edit]
+    vyos@vyos# run show interfaces
+    Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+    Interface        IP Address                        S/L  Description
+    ---------        ----------                        ---  -----------
+    eth0             0.0.0.0/0                         u/u
+
+Managing configurations
+=======================
+
+VyOS comes with an integrated versioning system for the system
+configuration. It automatically maintains a backup of every previous
+configuration which has been committed to the system. The configurations
+are versioned locally for rollback but they can also be stored on a
+remote host for archiving/backup reasons.
+
+Local Archive
+-------------
+
+Revisions are stored on disk. You can view, compare and rollback them to
+any previous revisions if something goes wrong.
+
+.. opcmd:: show system commit
+
+   View all existing revisions on the local system.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show system commit
+     0   2015-03-30 08:53:03 by vyos via cli
+     1   2015-03-30 08:52:20 by vyos via cli
+     2   2015-03-26 21:26:01 by root via boot-config-loader
+     3   2015-03-26 20:43:18 by root via boot-config-loader
+     4   2015-03-25 11:06:14 by root via boot-config-loader
+     5   2015-03-25 01:04:28 by root via boot-config-loader
+     6   2015-03-25 00:16:47 by vyos via cli
+     7   2015-03-24 23:43:45 by root via boot-config-loader
+
+
+.. cfgcmd:: set system config-management commit-revisions <N>
+
+   You can specify the number of revisions stored on disk. N can be in
+   the range of 0 - 65535. When the number of revisions exceeds the
+   configured value, the oldest revision is removed. The default setting
+   for this value is to store 100 revisions locally.
+
+
+Compare configurations
+----------------------
+
+VyOS lets you compare different configurations.
+
+.. cfgcmd:: compare <saved | N> <M>
+
+   Use this command to spot what the differences are between different
+   configurations.
+
+   .. code-block:: none
+
+     vyos@vyos# compare [tab]
+     Possible completions:
+       <Enter>	Compare working & active configurations
+       saved		Compare working & saved configurations
+       <N>		Compare working with revision N
+       <N> <M>	Compare revision N with M
+       Revisions:
+         0	   2013-12-17 20:01:37 root by boot-config-loader
+         1	   2013-12-13 15:59:31 root by boot-config-loader
+         2	   2013-12-12 21:56:22 vyos by cli
+         3	   2013-12-12 21:55:11 vyos by cli
+         4	   2013-12-12 21:27:54 vyos by cli
+         5	   2013-12-12 21:23:29 vyos by cli
+         6	   2013-12-12 21:13:59 root by boot-config-loader
+         7	   2013-12-12 16:25:19 vyos by cli
+         8	   2013-12-12 15:44:36 vyos by cli
+         9	   2013-12-12 15:42:07 root by boot-config-loader
+         10   2013-12-12 15:42:06 root by init
+
+   The command :cfgcmd:`compare` allows you to compare different type of
+   configurations. It also lets you compare different revisions through
+   the :cfgcmd:`compare N M` command, where N and M are revision
+   numbers. The output will describe how the configuration N is when
+   compared to M indicating with a plus sign (``+``) the additional
+   parts N has when compared to M, and indicating with a minus sign
+   (``-``) the lacking parts N misses when compared to M.
+
+   .. code-block:: none
+
+     vyos@vyos# compare 0 6
+     [edit interfaces]
+     +dummy dum1 {
+     +    address 10.189.0.1/31
+     +}
+     [edit interfaces ethernet eth0]
+     +vif 99 {
+     +    address 10.199.0.1/31
+     +}
+     -vif 900 {
+     -    address 192.0.2.4/24
+     -}
+
+
+.. opcmd:: show system commit diff <number>
+
+   Show commit revision difference.
+
+
+The command above also lets you see the difference between two commits.
+By default the difference with the running config is shown.
+
+.. code-block:: none
+
+   vyos@router# run show system commit diff 4
+   [edit system]
+   +ipv6 {
+   +    disable-forwarding
+   +}
+
+This means four commits ago we did ``set system ipv6 disable-forwarding``.
+
+
+Rollback Changes
+----------------
+
+You can rollback configuration changes using the rollback command. This
+will apply the selected revision and trigger a system reboot.
+
+.. cfgcmd:: rollback <N>
+
+   Rollback to revision N (currently requires reboot)
+
+   .. code-block:: none
+
+     vyos@vyos# compare 1
+     [edit system]
+     >host-name vyos-1
+     [edit]
+
+     vyos@vyos# rollback 1
+     Proceed with reboot? [confirm][y]
+     Broadcast message from root@vyos-1 (pts/0) (Tue Dec 17 21:07:45 2013):
+     The system is going down for reboot NOW!
+
+Remote Archive
+--------------
+
+VyOS can upload the configuration to a remote location after each call
+to :cfgcmd:`commit`. You will have to set the commit-archive location.
+TFTP, FTP, SCP and SFTP servers are supported. Every time a
+:cfgcmd:`commit` is successfull the ``config.boot`` file will be copied
+to the defined destination(s). The filename used on the remote host will
+be ``config.boot-hostname.YYYYMMDD_HHMMSS``. 
+
+.. cfgcmd:: set system config-management commit-archive location <URI>
+
+   Specify remote location of commit archive as any of the below
+   :abbr:`URI (Uniform Resource Identifier)`
+
+   * ``scp://<user>:<passwd>@<host>:/<dir>``
+   * ``sftp://<user>:<passwd>@<host>/<dir>``
+   * ``ftp://<user>:<passwd>@<host>/<dir>``
+   * ``tftp://<host>/<dir>``
+
+.. note:: The number of revisions don't affect the commit-archive.
+
+.. note:: You may find VyOS not allowing the secure connection because
+   it cannot verify the legitimacy of the remote server. You can use
+   the workaround below to quickly add the remote host's SSH
+   fingerprint to your ``~/.ssh/known_hosts`` file:
+
+   .. code-block:: none
+
+     vyos@vyos# ssh-keyscan <host> >> ~/.ssh/known_hosts
+
+Saving and loading manually
+---------------------------
+
+You can use the ``save`` and ``load`` commands if you want to manually
+manage specific configuration files.
+
+When using the save_ command, you can add a specific location where
+to store your configuration file. And, when needed it, you will be able
+to load it with the ``load`` command:
+
+.. cfgcmd:: load <URI>
+
+   Use this command to load a configuration which will replace the
+   running configuration. Define the location of the configuration file
+   to be loaded. You can use a path to a local file, an SCP address, an
+   SFTP address, an FTP address, an HTTP address, an HTTPS address or a
+   TFTP address.
+
+  .. code-block:: none
+
+     vyos@vyos# load 
+     Possible completions:
+       <Enter>				        Load from system config file
+       <file>			        	Load from file on local machine
+       scp://<user>:<passwd>@<host>:/<file>	Load from file on remote machine
+       sftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
+       ftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
+       http://<host>/<file>			Load from file on remote machine
+       https://<host>/<file>			Load from file on remote machine
+       tftp://<host>/<file>			Load from file on remote machine
+     
+
+
+Restore Default
+---------------
+
+In the case you want to completely delete your configuration and restore
+the default one, you can enter the following command in configuration
+mode:
+
+.. code-block:: none
+
+  load /opt/vyatta/etc/config.boot.default
+
+You will be asked if you want to continue. If you accept, you will have
+to use :cfgcmd:`commit` if you want to make the changes active.
+
+Then you may want to :cfgcmd:`save` in order to delete the saved
+configuration too.
+
+.. note:: If you are remotely connected, you will lose your connection.
+   You may want to copy first the config, edit it to ensure
+   connectivity, and load the edited config.
+
diff --git a/docs/command-list-configuration.rst b/docs/command-list-configuration.rst
deleted file mode 100644
index 7b981518..00000000
--- a/docs/command-list-configuration.rst
+++ /dev/null
@@ -1,7 +0,0 @@
-.. _configuration_level_commands:
-
-********************************
-Configuration Level Command List
-********************************
-
-.. cfgcmdlist::
diff --git a/docs/command-list-operation.rst b/docs/command-list-operation.rst
deleted file mode 100644
index bbb0298c..00000000
--- a/docs/command-list-operation.rst
+++ /dev/null
@@ -1,7 +0,0 @@
-.. _operational_level_commands:
-
-******************************
-Operational Level Command List
-******************************
-
-.. opcmdlist::
diff --git a/docs/common-references.rst b/docs/common-references.rst
deleted file mode 100644
index 79881972..00000000
--- a/docs/common-references.rst
+++ /dev/null
@@ -1,6 +0,0 @@
-.. _`accel-ppp`: https://accel-ppp.org/
-.. _`Secure Socket Tunneling Protocol`: https://en.wikipedia.org/wiki/Secure_Socket_Tunneling_Protocol
-.. _Phabricator: https://phabricator.vyos.net/
-
-.. _802.1ad: https://en.wikipedia.org/wiki/IEEE_802.1ad
-.. _802.1q: https://en.wikipedia.org/wiki/IEEE_802.1Q
diff --git a/docs/configexamples/azure-vpn-bgp.rst b/docs/configexamples/azure-vpn-bgp.rst
new file mode 100644
index 00000000..176e0ae0
--- /dev/null
+++ b/docs/configexamples/azure-vpn-bgp.rst
@@ -0,0 +1,130 @@
+.. _examples-azure-vpn-bgp:
+
+Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
+------------------------------------------------------------
+
+This guide shows an example of a route-based IKEv2 site-to-site VPN to
+Azure using VTI and BGP for dynamic routing updates.
+
+For redundant / active-active configurations see `Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) <https://docs.vyos.io/en/crux/appendix/examples/azure-vpn-dual-bgp.html>`_
+
+Prerequisites
+^^^^^^^^^^^^^
+
+- A pair of Azure VNet Gateways deployed in active-passive
+  configuration with BGP enabled.
+
+- A local network gateway deployed in Azure representing
+  the Vyos device, matching the below Vyos settings except for
+  address space, which only requires the Vyos private IP, in
+  this example 10.10.0.5/32
+
+- A connection resource deployed in Azure linking the
+  Azure VNet gateway and the local network gateway representing
+  the Vyos device.
+
+Example
+^^^^^^^
+
++---------------------------------------+---------------------+
+| WAN Interface                         | eth0                |
++---------------------------------------+---------------------+
+| On-premises address space             | 10.10.0.0/16        |
++---------------------------------------+---------------------+
+| Azure address space                   |  10.0.0.0/16        |
++---------------------------------------+---------------------+
+| Vyos public IP                        | 198.51.100.3        |
++---------------------------------------+---------------------+
+| Vyos private IP                       | 10.10.0.5           |
++---------------------------------------+---------------------+
+| Azure VNet Gateway public IP          |  203.0.113.2        |
++---------------------------------------+---------------------+
+| Azure VNet Gateway BGP IP             |  10.0.0.4           |
++---------------------------------------+---------------------+
+| Pre-shared key                        | ch00s3-4-s3cur3-psk |
++---------------------------------------+---------------------+
+| Vyos ASN                              | 64499               |
++---------------------------------------+---------------------+
+| Azure ASN                             | 65540               |
++---------------------------------------+---------------------+
+
+Vyos configuration
+^^^^^^^^^^^^^^^^^^
+
+- Configure the IKE and ESP settings to match a subset
+  of those supported by Azure:
+
+.. code-block:: none
+
+  set vpn ipsec esp-group AZURE compression 'disable'
+  set vpn ipsec esp-group AZURE lifetime '3600'
+  set vpn ipsec esp-group AZURE mode 'tunnel'
+  set vpn ipsec esp-group AZURE pfs 'dh-group2'
+  set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
+
+  set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
+  set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
+  set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
+  set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
+  set vpn ipsec ike-group AZURE key-exchange 'ikev2'
+  set vpn ipsec ike-group AZURE lifetime '28800'
+  set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
+  set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
+
+- Enable IPsec on eth0
+
+.. code-block:: none
+
+  set vpn ipsec ipsec-interfaces interface 'eth0'
+
+- Configure a VTI with a dummy IP address
+
+.. code-block:: none
+
+  set interfaces vti vti1 address '10.10.1.5/32'
+  set interfaces vti vti1 description 'Azure Tunnel'
+
+- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
+
+.. code-block:: none
+
+  set firewall options interface vti1 adjust-mss 1350
+
+- Configure the VPN tunnel
+
+.. code-block:: none
+
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
+  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
+  set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
+  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
+  set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
+  set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
+  set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
+
+- **Important**: Add an interface route to reach Azure's BGP listener
+
+.. code-block:: none
+
+  set protocols static interface-route 10.0.0.4/32 next-hop-interface vti1
+
+- Configure your BGP settings
+
+.. code-block:: none
+
+  set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
+  set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
+  set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
+  set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
+
+- **Important**: Disable connected check \
+
+.. code-block:: none
+
+  set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check
diff --git a/docs/configexamples/azure-vpn-dual-bgp.rst b/docs/configexamples/azure-vpn-dual-bgp.rst
new file mode 100644
index 00000000..13d4b5a2
--- /dev/null
+++ b/docs/configexamples/azure-vpn-dual-bgp.rst
@@ -0,0 +1,155 @@
+.. _examples-azure-vpn-dual-bgp:
+
+Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
+----------------------------------------------------------------------
+
+This guide shows an example of a redundant (active-active) route-based IKEv2
+site-to-site VPN to Azure using VTI
+and BGP for dynamic routing updates.
+
+Prerequisites
+^^^^^^^^^^^^^
+
+- A pair of Azure VNet Gateways deployed in active-active
+  configuration with BGP enabled.
+
+- A local network gateway deployed in Azure representing
+  the Vyos device, matching the below Vyos settings except for
+  address space, which only requires the Vyos private IP, in
+  this example 10.10.0.5/32
+
+- A connection resource deployed in Azure linking the
+  Azure VNet gateway and the local network gateway representing
+  the Vyos device.
+
+Example
+^^^^^^^
+
++---------------------------------------+---------------------+
+| WAN Interface                         | eth0                |
++---------------------------------------+---------------------+
+| On-premises address space             | 10.10.0.0/16        |
++---------------------------------------+---------------------+
+| Azure address space                   |  10.0.0.0/16        |
++---------------------------------------+---------------------+
+| Vyos public IP                        | 198.51.100.3        |
++---------------------------------------+---------------------+
+| Vyos private IP                       | 10.10.0.5           |
++---------------------------------------+---------------------+
+| Azure VNet Gateway 1 public IP        |  203.0.113.2        |
++---------------------------------------+---------------------+
+| Azure VNet Gateway 2 public IP        |  203.0.113.3        |
++---------------------------------------+---------------------+
+| Azure VNet Gateway BGP IP             |  10.0.0.4,10.0.0.5  |
++---------------------------------------+---------------------+
+| Pre-shared key                        | ch00s3-4-s3cur3-psk |
++---------------------------------------+---------------------+
+| Vyos ASN                              | 64499               |
++---------------------------------------+---------------------+
+| Azure ASN                             | 65540               |
++---------------------------------------+---------------------+
+
+Vyos configuration
+^^^^^^^^^^^^^^^^^^
+
+- Configure the IKE and ESP settings to match a subset
+  of those supported by Azure:
+
+.. code-block:: none
+
+  set vpn ipsec esp-group AZURE compression 'disable'
+  set vpn ipsec esp-group AZURE lifetime '3600'
+  set vpn ipsec esp-group AZURE mode 'tunnel'
+  set vpn ipsec esp-group AZURE pfs 'dh-group2'
+  set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
+
+  set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
+  set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
+  set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
+  set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
+  set vpn ipsec ike-group AZURE key-exchange 'ikev2'
+  set vpn ipsec ike-group AZURE lifetime '28800'
+  set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
+  set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
+
+- Enable IPsec on eth0
+
+.. code-block:: none
+
+  set vpn ipsec ipsec-interfaces interface 'eth0'
+
+- Configure two VTIs with a dummy IP address each
+
+.. code-block:: none
+
+  set interfaces vti vti1 address '10.10.1.5/32'
+  set interfaces vti vti1 description 'Azure Primary Tunnel'
+
+  set interfaces vti vti2 address '10.10.1.6/32'
+  set interfaces vti vti2 description 'Azure Secondary Tunnel'
+
+- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
+
+.. code-block:: none
+
+  set firewall options interface vti1 adjust-mss 1350
+  set firewall options interface vti2 adjust-mss 1350
+
+- Configure the VPN tunnels
+
+.. code-block:: none
+
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
+  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
+  set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
+  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
+  set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
+  set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
+  set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
+
+  set vpn ipsec site-to-site peer 203.0.113.3 authentication id '198.51.100.3'
+  set vpn ipsec site-to-site peer 203.0.113.3 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 203.0.113.3 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
+  set vpn ipsec site-to-site peer 203.0.113.3 authentication remote-id '203.0.113.3'
+  set vpn ipsec site-to-site peer 203.0.113.3 connection-type 'respond'
+  set vpn ipsec site-to-site peer 203.0.113.3 description 'AZURE SECONDARY TUNNEL'
+  set vpn ipsec site-to-site peer 203.0.113.3 ike-group 'AZURE'
+  set vpn ipsec site-to-site peer 203.0.113.3 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 203.0.113.3 local-address '10.10.0.5'
+  set vpn ipsec site-to-site peer 203.0.113.3 vti bind 'vti2'
+  set vpn ipsec site-to-site peer 203.0.113.3 vti esp-group 'AZURE'
+
+- **Important**: Add an interface route to reach both Azure's BGP listeners
+
+.. code-block:: none
+
+  set protocols static interface-route 10.0.0.4/32 next-hop-interface vti1
+  set protocols static interface-route 10.0.0.5/32 next-hop-interface vti2
+
+- Configure your BGP settings
+
+.. code-block:: none
+
+  set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
+  set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
+  set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
+  set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
+
+  set protocols bgp 64499 neighbor 10.0.0.5 remote-as '65540'
+  set protocols bgp 64499 neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound'
+  set protocols bgp 64499 neighbor 10.0.0.5 timers holdtime '30'
+  set protocols bgp 64499 neighbor 10.0.0.5 timers keepalive '10'
+
+- **Important**: Disable connected check, otherwise the routes learned
+  from Azure will not be imported into the routing table.
+
+.. code-block:: none
+
+  set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check
+  set protocols bgp 64499 neighbor 10.0.0.5 disable-connected-check
diff --git a/docs/configexamples/bgp-ipv6-unnumbered.rst b/docs/configexamples/bgp-ipv6-unnumbered.rst
new file mode 100644
index 00000000..ccc1f69a
--- /dev/null
+++ b/docs/configexamples/bgp-ipv6-unnumbered.rst
@@ -0,0 +1,172 @@
+.. _examples-bgp-ipv6-unnumbered:
+
+#########################################
+BGP IPv6 unnumbered with extended nexthop
+#########################################
+
+General information can be found in the :ref:`bgp` chapter.
+
+Configuration
+=============
+
+- Router A:
+
+.. code-block:: none
+
+  set protocols bgp 64496 address-family ipv4-unicast redistribute connected
+  set protocols bgp 64496 address-family ipv6-unicast redistribute connected
+  set protocols bgp 64496 neighbor eth1 interface v6only
+  set protocols bgp 64496 neighbor eth1 interface v6only peer-group 'fabric'
+  set protocols bgp 64496 neighbor eth2 interface v6only
+  set protocols bgp 64496 neighbor eth2 interface v6only peer-group 'fabric'
+  set protocols bgp 64496 parameters bestpath as-path multipath-relax
+  set protocols bgp 64496 parameters bestpath compare-routerid
+  set protocols bgp 64496 parameters default no-ipv4-unicast
+  set protocols bgp 64496 parameters router-id '192.168.0.1'
+  set protocols bgp 64496 peer-group fabric address-family ipv4-unicast
+  set protocols bgp 64496 peer-group fabric address-family ipv6-unicast
+  set protocols bgp 64496 peer-group fabric capability extended-nexthop
+  set protocols bgp 64496 peer-group fabric remote-as 'external'
+
+- Router B:
+
+.. code-block:: none
+
+  set protocols bgp 64499 address-family ipv4-unicast redistribute connected
+  set protocols bgp 64499 address-family ipv6-unicast redistribute connected
+  set protocols bgp 64499 neighbor eth1 interface v6only
+  set protocols bgp 64499 neighbor eth1 interface v6only peer-group 'fabric'
+  set protocols bgp 64499 neighbor eth2 interface v6only
+  set protocols bgp 64499 neighbor eth2 interface v6only peer-group 'fabric'
+  set protocols bgp 64499 parameters bestpath as-path multipath-relax
+  set protocols bgp 64499 parameters bestpath compare-routerid
+  set protocols bgp 64499 parameters default no-ipv4-unicast
+  set protocols bgp 64499 parameters router-id '192.168.0.2'
+  set protocols bgp 64499 peer-group fabric address-family ipv4-unicast
+  set protocols bgp 64499 peer-group fabric address-family ipv6-unicast
+  set protocols bgp 64499 peer-group fabric capability extended-nexthop
+  set protocols bgp 64499 peer-group fabric remote-as 'external'
+
+Results
+=======
+
+- Router A:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             198.51.100.34/24                  u/u
+  eth1             -                                 u/u
+  eth2             -                                 u/u
+  lo               127.0.0.1/8                       u/u
+                   192.168.0.1/32
+                   ::1/128
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip route
+  Codes: K - kernel route, C - connected, S - static, R - RIP,
+         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+         F - PBR, f - OpenFabric,
+         > - selected route, * - FIB route
+
+  S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53
+  C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53
+  C>* 192.168.0.1/32 is directly connected, lo, 03:21:56
+  B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07
+    *                       via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07
+
+.. code-block:: none
+
+  vyos@vyos:~$ ping 192.168.0.2
+  PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
+  64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms
+  64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms
+  64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms
+  64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms
+  64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms
+
+  --- 192.168.0.2 ping statistics ---
+  5 packets transmitted, 5 received, 0% packet loss, time 4086ms
+  rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip bgp summary
+
+  IPv4 Unicast Summary:
+  BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0
+  BGP table version 4
+  RIB entries 5, using 800 bytes of memory
+  Peers 2, using 41 KiB of memory
+  Peer groups 1, using 64 bytes of memory
+
+  Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
+  eth1            4      64499      13      13        0    0    0 00:05:33            2
+  eth2            4      64499      13      14        0    0    0 00:05:29            2
+
+  Total number of neighbors 2
+
+- Router B:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             198.51.100.33/24                  u/u
+  eth1             -                                 u/u
+  eth2             -                                 u/u
+  lo               127.0.0.1/8                       u/u
+                   192.168.0.2/32
+                   ::1/128
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip route
+  Codes: K - kernel route, C - connected, S - static, R - RIP,
+         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+         F - PBR, f - OpenFabric,
+         > - selected route, * - FIB route
+
+  S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08
+  C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09
+  B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18
+    *                       via fe80::a00:27ff:fe93:e142, eth2, 00:06:18
+  C>* 192.168.0.2/32 is directly connected, lo, 00:44:11
+
+.. code-block:: none
+
+  vyos@vyos:~$ ping 192.168.0.1
+  PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
+  64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms
+  64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms
+  64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms
+  64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms
+
+  --- 192.168.0.1 ping statistics ---
+  4 packets transmitted, 4 received, 0% packet loss, time 3051ms
+  rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip bgp summary
+  IPv4 Unicast Summary:
+  BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0
+  BGP table version 4
+  RIB entries 5, using 800 bytes of memory
+  Peers 2, using 41 KiB of memory
+  Peer groups 1, using 64 bytes of memory
+
+  Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
+  eth1            4      64496      14      14        0    0    0 00:06:40            2
+  eth2            4      64496      14      14        0    0    0 00:06:37            2
+
+  Total number of neighbors 2
+
diff --git a/docs/configexamples/dhcp-relay-through-gre-bridge.rst b/docs/configexamples/dhcp-relay-through-gre-bridge.rst
new file mode 100644
index 00000000..f94eb67f
--- /dev/null
+++ b/docs/configexamples/dhcp-relay-through-gre-bridge.rst
@@ -0,0 +1,77 @@
+.. _examples-dhcp-relay-through-gre-bridge:
+
+
+DHCP Relay through GRE-Bridge
+-----------------------------
+
+Diagram
+^^^^^^^
+
+.. image:: /_static/images/dhcp-relay-through-gre-bridge.png
+   :width: 80%
+   :align: center
+   :alt: Network Topology Diagram
+
+Configuration
+^^^^^^^^^^^^^
+
+DHCP Server
+"""""""""""
+
+.. code-block:: none
+
+   set interfaces ethernet eth0 address '10.0.2.1/24'
+   set interfaces loopback lo address '3.3.3.3/24'
+   set interfaces tunnel tun100 address '172.16.0.2/30'
+   set interfaces tunnel tun100 encapsulation 'gre-bridge'
+   set interfaces tunnel tun100 local-ip '10.0.2.1'
+   set interfaces tunnel tun100 remote-ip '192.168.0.1'
+   set protocols ospf area 0 network '3.3.3.0/24'
+   set protocols ospf area 0 network '10.0.2.0/24'
+   set protocols ospf parameters router-id '3.3.3.3'
+   set protocols static interface-route 10.0.1.2/32 next-hop-interface tun100
+   set service dhcp-server shared-network-name asdf authoritative
+   set service dhcp-server shared-network-name asdf subnet 3.3.3.0/24 range 0 start '3.3.3.30'
+   set service dhcp-server shared-network-name asdf subnet 3.3.3.0/24 range 0 stop '3.3.3.40'
+   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 default-router '10.0.1.2'
+   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 range 0 start '10.0.1.200'
+   set service dhcp-server shared-network-name asdf subnet 10.0.1.0/24 range 0 stop '10.0.1.210'
+   set service dhcp-server shared-network-name asdf subnet 10.2.1.0/24 range 0 start '10.2.1.222'
+   set service dhcp-server shared-network-name asdf subnet 10.2.1.0/24 range 0 stop '10.2.1.233'
+   set service dhcp-server shared-network-name asdf subnet 172.16.0.0/30 range 0 start '172.16.0.1'
+   set service dhcp-server shared-network-name asdf subnet 172.16.0.0/30 range 0 stop '172.16.0.2'
+   
+
+In-Between Router
+"""""""""""""""""
+
+.. code-block:: none
+
+   set interfaces ethernet eth0 address '192.168.0.2/24'
+   set interfaces ethernet eth1 address '10.0.2.2/24'
+   set protocols ospf area 0 network '192.168.0.0/24'
+   set protocols ospf area 0 network '10.0.2.0/24'
+   set protocols ospf parameters router-id '192.168.0.2'
+   
+
+DHCP Relay
+""""""""""
+
+.. code-block:: none
+
+   set interfaces ethernet eth0 address '10.0.1.2/24'
+   set interfaces ethernet eth1 address '192.168.0.1/24'
+   set interfaces loopback lo address '1.1.1.1'
+   set interfaces tunnel tun100 address '172.16.0.1/30'
+   set interfaces tunnel tun100 encapsulation 'gre-bridge'
+   set interfaces tunnel tun100 local-ip '192.168.0.1'
+   set interfaces tunnel tun100 remote-ip '10.0.2.1'
+   set protocols ospf area 0 network '10.0.1.0/24'
+   set protocols ospf area 0 network '192.168.0.0/24'
+   set protocols ospf area 0 network '1.1.1.0/24'
+   set protocols ospf parameters router-id '1.1.1.1'
+   set protocols static interface-route 3.3.3.3/32 next-hop-interface tun100
+   set service dhcp-relay interface 'eth0'
+   set service dhcp-relay interface 'tun100'
+   set service dhcp-relay server '3.3.3.3'
+   
diff --git a/docs/configexamples/ha.rst b/docs/configexamples/ha.rst
new file mode 100644
index 00000000..702cb2b2
--- /dev/null
+++ b/docs/configexamples/ha.rst
@@ -0,0 +1,580 @@
+#############################
+High Availability Walkthrough
+#############################
+
+This document walks you through a complete HA setup of two VyOS machines. This
+design is based on a VM as the primary router, and a physical machine as a
+backup, using VRRP, BGP, OSPF and conntrack sharing.
+
+The aim of this document is to walk you through setting everything up so you
+and up at a point where you can reboot any machine and not lose more than a few
+seconds worth of connectivity.
+
+Design
+======
+
+This is based on a real life, in production design. One of the complex issues
+is ensuring you have redundant data INTO your network. We do this with a pair
+of Cisco Nexus switches, and using Virtual PortChannels that are spanned across
+them. This as an added bonus, also allows for complete switch failure without
+an outage. How you achieve this yourself is left as an exercise to the reader
+but our setup is documented here.
+
+Walkthrough suggestion
+----------------------
+
+The ``commit`` command is implied after every section. If you make an error,
+``commit`` will warn you and you can fix it before getting too far into things.
+Please ensure you commit early and commit often.
+
+If you are following through this document, it is strongly suggested you
+complete the entire document, ONLY doing the virtual router1 steps, and then
+come back and walk through it AGAIN on the backup hardware router.
+
+This ensures you don't go to fast, or miss a step. However, it will make your
+life easier to configure the fixed IP address and default route now on the
+hardware router.
+
+Example Network
+---------------
+
+In this document, we have been allocated 203.0.113.0/24 by our upstream
+provider, which we are publishing on VLAN100.
+
+They want us to establish a BGP session to their routers on 192.0.2.11 and
+192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and
+we are AS65551.
+
+Our routers are going to have a floating IP address of 203.0.113.1, and use
+.2 and .3 as their fixed IPs.
+
+We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201.
+
+When traffic is originated from the 10.200.201.0/24 network, it will be
+masqueraded to 203.0.113.1
+
+For connection between sites, we are running a WireGuard link to two REMOTE
+routers, and using OSPF over those links to distribute routes. That remote
+site is expected to send traffic from anything in 10.201.0.0/16
+
+VLANs
+-----
+
+These are the vlans we wll be using:
+
+* 50: Upstream, using the 192.0.2.0/24 network allocated by them.
+* 100: 'Public' network, using our 203.0.113.0/24 network.
+* 201: 'Internal' network, using 10.200.201.0/24
+
+Hardware
+--------
+
+* switch1 (Nexus 10gb Switch)
+* switch2 (Nexus 10gb Switch)
+* compute1 (VMware ESXi 6.5)
+* compute2 (VMware ESXi 6.5)
+* compute3 (VMware ESXi 6.5)
+* router2 (Random 1RU machine with 4 NICs)
+
+Note that router1 is a VM that runs on one of the compute nodes.
+
+Network Cabling
+---------------
+
+* From Datacenter - This connects into port 1 on both switches, and is tagged
+  as VLAN 50
+* Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch
+* Hardware Router - Port 8 of each switch
+* compute1 - Port 9 of each switch
+* compute2 - Port 10 of each switch
+* compute3 - Port 11 of each switch
+
+This is ignoring the extra Out-of-band management networking, which should be
+on totally different switches, and a different feed into the rack, and is out
+of scope of this.
+
+.. note:: Our implementation uses VMware's Distributed Port Groups, which allows
+  VMware to use LACP. This is a part of the ENTERPRISE licence, and is not
+  available on a Free licence. If you are implementing this and do not have
+  access to DPGs, you should not use VMware, and use some other virtualization
+  platform instead.
+
+
+Basic Setup (via console)
+=========================
+
+Create your router1 VM so it is able to withstand a VM Host failing, or a
+network link failing. Using VMware, this is achieved by enabling vSphere DRS,
+vSphere Availability, and creating a Distributed Port Group that uses LACP.
+
+Many other Hypervisors do this, and I'm hoping that this document will be
+expanded to document how to do this for others.
+
+Create an 'All VLANs' network group, that passes all trunked traffic through
+to the VM. Attach this network group to router1 as eth0.
+
+.. note:: VMware: You must DISABLE SECURITY on this Port group. Make sure that
+   ``Promiscuous Mode``\ , ``MAC address changes`` and ``Forged transmits`` are
+   enabled. All of these will be done as part of failover.
+
+Bonding on Hardware Router
+--------------------------
+
+Create a LACP bond on the hardware router. We are assuming that eth0 and eth1
+are connected to port 8 on both switches, and that those ports are configured
+as a Port-Channel.
+
+.. code-block:: none
+
+   set interfaces bonding bond0 description 'Switch Port-Channel'
+   set interfaces bonding bond0 hash-policy 'layer2'
+   set interfaces bonding bond0 member interface 'eth0'
+   set interfaces bonding bond0 member interface 'eth1'
+   set interfaces bonding bond0 mode '802.3ad'
+
+
+Assign external IP addresses
+----------------------------
+
+VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this
+is talking directly to upstream. Create our IP address on vlan50.
+
+For the hardware router, replace ``eth0`` with ``bond0``. As (almost) every
+command is identical, this will not be specified unless different things need
+to be performed on different hosts.
+
+.. code-block:: none
+
+   set interfaces ethernet eth0 vif 50 address '192.0.2.21/24'
+
+In this case, the hardware router has a different IP, so it would be
+
+.. code-block:: none
+
+   set interfaces ethernet bond0 vif 50 address '192.0.2.22/24'
+
+Add (temporary) default route
+-----------------------------
+
+It is assumed that the routers provided by upstream are capable of acting as a
+default router, add that as a static route.
+
+.. code-block:: none
+
+   set protocols static route 0.0.0.0/0 next-hop 192.0.2.11
+   commit
+   save
+
+
+Enable SSH
+----------
+
+Enable SSH so you can now SSH into the routers, rather than using the console.
+
+.. code-block:: none
+
+   set service ssh
+   commit
+   save
+
+At this point you should be able to SSH into both of them, and will no longer
+need access to the console (unless you break something!)
+
+
+VRRP Configuration
+==================
+
+We are setting up VRRP so that it does NOT fail back when a machine returns into
+service, and it prioritizes router1 over router2.
+
+Internal Network
+----------------
+
+This has a floating IP address of 10.200.201.1/24, using virtual router ID 201.
+The difference between them is the interface name, hello-source-address, and
+peer-address.
+
+**router1**
+
+.. code-block:: none
+
+   set interfaces ethernet eth0 vif 201 address 10.200.201.2/24
+   set high-availability vrrp group int hello-source-address '10.200.201.2'
+   set high-availability vrrp group int interface 'eth0.201'
+   set high-availability vrrp group int peer-address '10.200.201.3'
+   set high-availability vrrp group int no-preempt
+   set high-availability vrrp group int priority '200'
+   set high-availability vrrp group int virtual-address '10.200.201.1/24'
+   set high-availability vrrp group int vrid '201'
+
+
+**router2**
+
+.. code-block:: none
+
+   set interfaces ethernet bond0 vif 201 address 10.200.201.3/24
+   set high-availability vrrp group int hello-source-address '10.200.201.3'
+   set high-availability vrrp group int interface 'bond0.201'
+   set high-availability vrrp group int peer-address '10.200.201.2'
+   set high-availability vrrp group int no-preempt
+   set high-availability vrrp group int priority '100'
+   set high-availability vrrp group int virtual-address '10.200.201.1/24'
+   set high-availability vrrp group int vrid '201'
+
+
+Public Network
+--------------
+
+This has a floating IP address of 203.0.113.1/24, using virtual router ID 113.
+The virtual router ID is just a random number between 1 and 254, and can be set
+to whatever you want. Best practices suggest you try to keep them unique
+enterprise-wide.
+
+**router1**
+
+.. code-block:: none
+
+   set interfaces ethernet eth0 vif 100 address 203.0.113.2/24
+   set high-availability vrrp group public hello-source-address '203.0.113.2'
+   set high-availability vrrp group public interface 'eth0.100'
+   set high-availability vrrp group public peer-address '203.0.113.3'
+   set high-availability vrrp group public no-preempt
+   set high-availability vrrp group public priority '200'
+   set high-availability vrrp group public virtual-address '203.0.113.1/24'
+   set high-availability vrrp group public vrid '113'
+
+**router2**
+
+.. code-block:: none
+
+   set interfaces ethernet bond0 vif 100 address 203.0.113.3/24
+   set high-availability vrrp group public hello-source-address '203.0.113.3'
+   set high-availability vrrp group public interface 'bond0.100'
+   set high-availability vrrp group public peer-address '203.0.113.2'
+   set high-availability vrrp group public no-preempt
+   set high-availability vrrp group public priority '100'
+   set high-availability vrrp group public virtual-address '203.0.113.1/24'
+   set high-availability vrrp group public vrid '113'
+
+
+Create VRRP sync-group
+----------------------
+
+The sync group is used to replicate connection tracking. It needs to be assigned
+to a random VRRP group, and we are creating a sync group called ``sync`` using
+the vrrp group ``int``.
+
+.. code-block:: none
+
+   set high-availability vrrp sync-group sync member 'int'
+
+Testing
+-------
+
+At this point, you should be able to see both IP addresses when you run
+``show interfaces``\ , and ``show vrrp`` should show both interfaces in MASTER
+state (and SLAVE state on router2).
+
+.. code-block:: none
+
+   vyos@router1:~$ show vrrp
+   Name      Interface      VRID  State    Last Transition
+   --------  -----------  ------  -------  -----------------
+   int       eth0.201        201  MASTER   100s
+   public    eth0.100        113  MASTER   200s
+   vyos@router1:~$
+
+
+You should be able to ping to and from all the IPs you have allocated.
+
+NAT and conntrack-sync
+======================
+
+Masquerade Traffic originating from 10.200.201.0/24 that is heading out the
+public interface.
+
+.. note:: We explicitly exclude the primary upstream network so that BGP or
+   OSPF traffic doesn't accidentally get NAT'ed.
+
+.. code-block:: none
+
+   set nat source rule 10 destination address '!192.0.2.0/24'
+   set nat source rule 10 outbound-interface 'eth0.50'
+   set nat source rule 10 source address '10.200.201.0/24'
+   set nat source rule 10 translation address '203.0.113.1'
+
+
+Configure conntrack-sync and disable helpers
+--------------------------------------------
+
+Most conntrack modules cause more problems than they're worth, especially in a
+complex network. Turn them off by default, and if you need to turn them on
+later, you can do so.
+
+.. code-block:: none
+
+   set system conntrack modules ftp disable
+   set system conntrack modules gre disable
+   set system conntrack modules nfs disable
+   set system conntrack modules pptp disable
+   set system conntrack modules sip disable
+   set system conntrack modules tftp disable
+
+Now enable replication between nodes. Replace eth0.201 with bond0.201 on the
+hardware router.
+
+.. code-block:: none
+
+   set service conntrack-sync accept-protocol 'tcp,udp,icmp'
+   set service conntrack-sync event-listen-queue-size '8'
+   set service conntrack-sync failover-mechanism vrrp sync-group 'sync'
+   set service conntrack-sync interface eth0.201
+   set service conntrack-sync mcast-group '224.0.0.50'
+   set service conntrack-sync sync-queue-size '8'
+
+Testing
+-------
+
+The simplest way to test is to look at the connection tracking stats on the
+standby hardware router with the command ``show conntrack-sync statistics``.
+The numbers should be very close to the numbers on the primary router.
+
+When you have both routers up, you should be able to establish a connection
+from a NAT'ed machine out to the internet, reboot the active machine, and that
+connection should be preserved, and will not drop out.
+
+OSPF Over WireGuard
+===================
+
+Wireguard doesn't have the concept of an up or down link, due to its design.
+This complicates AND simplifies using it for network transport, as for reliable
+state detection you need to use SOMETHING to detect when the link is down.
+
+If you use a routing protocol itself, you solve two problems at once. This is
+only a basic example, and is provided as a starting point.
+
+Configure Wireguard
+-------------------
+
+There is plenty of instructions and documentation on setting up Wireguard. The
+only important thing you need to remember is to only use one WireGuard
+interface per OSPF connection.
+
+We use small /30's from 10.254.60/24 for the point-to-point links.
+
+**router1**
+
+Replace the 203.0.113.3 with whatever the other router's IP address is.
+
+.. code-block:: none
+
+   set interfaces wireguard wg01 address '10.254.60.1/30'
+   set interfaces wireguard wg01 description 'router1-to-offsite1'
+   set interfaces wireguard wg01 ip ospf authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e'
+   set interfaces wireguard wg01 ip ospf cost '11'
+   set interfaces wireguard wg01 ip ospf dead-interval '5'
+   set interfaces wireguard wg01 ip ospf hello-interval '1'
+   set interfaces wireguard wg01 ip ospf network 'point-to-point'
+   set interfaces wireguard wg01 ip ospf priority '1'
+   set interfaces wireguard wg01 ip ospf retransmit-interval '5'
+   set interfaces wireguard wg01 ip ospf transmit-delay '1'
+   set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0'
+   set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001'
+   set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15'
+   set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o='
+   set interfaces wireguard wg01 port '50001'
+
+
+**offsite1**
+
+This is connecting back to the STATIC IP of router1, not the floating.
+
+.. code-block:: none
+
+   set interfaces wireguard wg01 address '10.254.60.2/30'
+   set interfaces wireguard wg01 description 'offsite1-to-router1'
+   set interfaces wireguard wg01 ip ospf authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e'
+   set interfaces wireguard wg01 ip ospf cost '11'
+   set interfaces wireguard wg01 ip ospf dead-interval '5'
+   set interfaces wireguard wg01 ip ospf hello-interval '1'
+   set interfaces wireguard wg01 ip ospf network 'point-to-point'
+   set interfaces wireguard wg01 ip ospf priority '1'
+   set interfaces wireguard wg01 ip ospf retransmit-interval '5'
+   set interfaces wireguard wg01 ip ospf transmit-delay '1'
+   set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0'
+   set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001'
+   set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15'
+   set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q='
+   set interfaces wireguard wg01 port '50001'
+
+Test WireGuard
+--------------
+
+Make sure you can ping 10.254.60.1 and .2 from both routers.
+
+Create Export Filter
+--------------------
+
+We only want to export the networks we know we should be exporting. Always
+whitelist your route filters, both importing and exporting. A good rule of
+thumb is **'If you are not the default router for a network, don't advertise
+it'**. This means we explicitly do not want to advertise the 192.0.2.0/24
+network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE
+the default route for). This filter is applied to ``redistribute connected``.
+If we WERE to advertise it, the remote machines would see 192.0.2.21 available
+via their default route, establish the connection, and then OSPF would say
+'192.0.2.0/24 is available via this tunnel', at which point the tunnel would
+break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via
+default again. This is called 'flapping'.
+
+.. code-block:: none
+
+   set policy access-list 150 description 'Outbound OSPF Redistribution'
+   set policy access-list 150 rule 10 action 'permit'
+   set policy access-list 150 rule 10 destination any
+   set policy access-list 150 rule 10 source inverse-mask '0.0.0.255'
+   set policy access-list 150 rule 10 source network '10.200.201.0'
+   set policy access-list 150 rule 20 action 'permit'
+   set policy access-list 150 rule 20 destination any
+   set policy access-list 150 rule 20 source inverse-mask '0.0.0.255'
+   set policy access-list 150 rule 20 source network '203.0.113.0'
+   set policy access-list 150 rule 100 action 'deny'
+   set policy access-list 150 rule 100 destination any
+   set policy access-list 150 rule 100 source any
+
+
+Create Import Filter
+--------------------
+
+We only want to import networks we know about. Our OSPF peer should only be
+advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE
+MATCH. You deny in access-list 100 to accept the route.
+
+.. code-block:: none
+
+   set policy access-list 100 description 'Inbound OSPF Routes from Peers'
+   set policy access-list 100 rule 10 action 'deny'
+   set policy access-list 100 rule 10 destination any
+   set policy access-list 100 rule 10 source inverse-mask '0.0.255.255'
+   set policy access-list 100 rule 10 source network '10.201.0.0'
+   set policy access-list 100 rule 100 action 'permit'
+   set policy access-list 100 rule 100 destination any
+   set policy access-list 100 rule 100 source any
+   set policy route-map PUBOSPF rule 100 action 'deny'
+   set policy route-map PUBOSPF rule 100 match ip address access-list '100'
+   set policy route-map PUBOSPF rule 500 action 'permit'
+
+
+Enable OSPF
+-----------
+
+Every router **must** have a unique router-id.
+The 'reference-bandwidth' is used because when OSPF was originally designed,
+the idea of a link faster than 1gbit was unheard of, and it does not scale
+correctly.
+
+.. code-block:: none
+
+   set protocols ospf area 0.0.0.0 authentication 'md5'
+   set protocols ospf area 0.0.0.0 network '10.254.60.0/24'
+   set protocols ospf auto-cost reference-bandwidth '10000'
+   set protocols ospf log-adjacency-changes
+   set protocols ospf parameters abr-type 'cisco'
+   set protocols ospf parameters router-id '10.254.60.2'
+   set protocols ospf route-map PUBOSPF
+
+
+Test OSPF
+---------
+
+When you have enabled OSPF on both routers, you should be able to see each
+other with the command ``show ip ospf neighbour``. The state must be 'Full'
+or '2-Way', if it is not then there is a network connectivity issue between the
+hosts. This is often caused by NAT or MTU issues. You should not see any new
+routes (unless this is the second pass) in the output of ``show ip route``
+
+Advertise connected routes
+==========================
+
+As a reminder, only advertise routes that you are the default router for. This
+is why we are NOT announcing the 192.0.2.0/24 network, because if that was
+announced into OSPF, the other routers would try to connect to that network
+over a tunnel that connects to that network!
+
+.. code-block:: none
+
+   set protocols ospf access-list 150 export 'connected'
+   set protocols ospf redistribute connected
+
+
+You should now be able to see the advertised network on the other host.
+
+Duplicate configuration
+-----------------------
+
+At this pont you now need to create the X link between all four routers. Use a
+different /30 for each link.
+
+Priorities
+----------
+
+Set the cost on the secondary links to be 200. This means that they will not
+be used unless the primary links are down.
+
+.. code-block:: none
+
+   set interfaces wireguard wg01 ip ospf cost '10'
+   set interfaces wireguard wg02 ip ospf cost '200'
+
+
+This will be visible in 'show ip route'.
+
+BGP
+===
+
+BGP is an extremely complex network protocol. An example is provided here.
+
+.. note:: Router id's must be unique.
+
+**router1**
+
+
+The ``redistribute ospf`` command is there purely as an example of how this can
+be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as
+it is not 203.0.113.0/24.
+
+.. code-block:: none
+
+   set policy prefix-list BGPOUT description 'BGP Export List'
+   set policy prefix-list BGPOUT rule 10 action 'deny'
+   set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks'
+   set policy prefix-list BGPOUT rule 10 ge '25'
+   set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0'
+   set policy prefix-list BGPOUT rule 100 action 'permit'
+   set policy prefix-list BGPOUT rule 100 description 'Our network'
+   set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24'
+   set policy prefix-list BGPOUT rule 10000 action 'deny'
+   set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0'
+   set policy route-map BGPOUT description 'BGP Export Filter'
+   set policy route-map BGPOUT rule 10 action 'permit'
+   set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT'
+   set policy route-map BGPOUT rule 10000 action 'deny'
+   set policy route-map BGPPREPENDOUT description 'BGP Export Filter'
+   set policy route-map BGPPREPENDOUT rule 10 action 'permit'
+   set policy route-map BGPPREPENDOUT rule 10 set as-path-prepend '65551 65551 65551'
+   set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT'
+   set policy route-map BGPPREPENDOUT rule 10000 action 'deny'
+   set protocols bgp 65551 address-family ipv4-unicast network 192.0.2.0/24
+   set protocols bgp 65551 address-family ipv4-unicast redistribute connected metric '50'
+   set protocols bgp 65551 address-family ipv4-unicast redistribute ospf metric '50'
+   set protocols bgp 65551 neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT'
+   set protocols bgp 65551 neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound
+   set protocols bgp 65551 neighbor 192.0.2.11 remote-as '65550'
+   set protocols bgp 65551 neighbor 192.0.2.11 update-source '192.0.2.21'
+   set protocols bgp 65551 parameters router-id '192.0.2.21'
+
+
+**router2**
+
+This is identical, but you use the BGPPREPENDOUT route-map to advertise the
+route with a longer path.
diff --git a/docs/configexamples/index.rst b/docs/configexamples/index.rst
new file mode 100644
index 00000000..b2f7bfde
--- /dev/null
+++ b/docs/configexamples/index.rst
@@ -0,0 +1,19 @@
+.. _examples:
+
+Configuration Blueprints
+========================
+
+This chapter contains various configuration examples:
+
+.. toctree::
+   :maxdepth: 2
+
+   dhcp-relay-through-gre-bridge
+   zone-policy
+   bgp-ipv6-unnumbered
+   ospf-unnumbered
+   azure-vpn-bgp
+   azure-vpn-dual-bgp
+   tunnelbroker-ipv6
+   ha
+   wan-load-balancing
diff --git a/docs/configexamples/ospf-unnumbered.rst b/docs/configexamples/ospf-unnumbered.rst
new file mode 100644
index 00000000..39f8f69a
--- /dev/null
+++ b/docs/configexamples/ospf-unnumbered.rst
@@ -0,0 +1,118 @@
+.. _examples-ospf-unnumbered:
+
+#########################
+OSPF unnumbered with ECMP
+#########################
+
+General infomration can be found in the :ref:`routing-ospf` chapter.
+
+Configuration
+=============
+
+- Router A:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address '10.0.0.1/24'
+  set interfaces ethernet eth1 address '192.168.0.1/32'
+  set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+  set interfaces ethernet eth1 ip ospf network 'point-to-point'
+  set interfaces ethernet eth2 address '192.168.0.1/32'
+  set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+  set interfaces ethernet eth2 ip ospf network 'point-to-point'
+  set interfaces loopback lo address '192.168.0.1/32'
+  set protocols ospf area 0.0.0.0 authentication 'md5'
+  set protocols ospf area 0.0.0.0 network '192.168.0.1/32'
+  set protocols ospf parameters router-id '192.168.0.1'
+  set protocols ospf redistribute connected
+
+- Router B:
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address '10.0.0.2/24'
+  set interfaces ethernet eth1 address '192.168.0.2/32'
+  set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+  set interfaces ethernet eth1 ip ospf network 'point-to-point'
+  set interfaces ethernet eth2 address '192.168.0.2/32'
+  set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+  set interfaces ethernet eth2 ip ospf network 'point-to-point'
+  set interfaces loopback lo address '192.168.0.2/32'
+  set protocols ospf area 0.0.0.0 authentication 'md5'
+  set protocols ospf area 0.0.0.0 network '192.168.0.2/32'
+  set protocols ospf parameters router-id '192.168.0.2'
+  set protocols ospf redistribute connected
+
+
+Results
+=======
+
+- Router A:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             10.0.0.1/24                       u/u
+  eth1             192.168.0.1/32                    u/u
+  eth2             192.168.0.1/32                    u/u
+  lo               127.0.0.1/8                       u/u
+                   192.168.0.1/32
+                   ::1/128
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip route
+  Codes: K - kernel route, C - connected, S - static, R - RIP,
+         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+         F - PBR, f - OpenFabric,
+         > - selected route, * - FIB route, q - queued route, r - rejected route
+
+  S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
+  O   10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21
+                              via 192.168.0.2, eth2 onlink, 00:13:21
+  C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
+  O   192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53
+  C * 192.168.0.1/32 is directly connected, eth2, 00:56:31
+  C * 192.168.0.1/32 is directly connected, eth1, 00:56:31
+  C>* 192.168.0.1/32 is directly connected, lo, 00:57:36
+  O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03
+    *                        via 192.168.0.2, eth2 onlink, 00:29:03
+
+- Router B:
+
+.. code-block:: none
+
+  vyos@vyos:~$ show interfaces
+  Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+  Interface        IP Address                        S/L  Description
+  ---------        ----------                        ---  -----------
+  eth0             10.0.0.2/24                       u/u
+  eth1             192.168.0.2/32                    u/u
+  eth2             192.168.0.2/32                    u/u
+  lo               127.0.0.1/8                       u/u
+                   192.168.0.2/32
+                   ::1/128
+
+.. code-block:: none
+
+  vyos@vyos:~$ show ip route
+  Codes: K - kernel route, C - connected, S - static, R - RIP,
+         O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+         T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+         F - PBR, f - OpenFabric,
+         > - selected route, * - FIB route, q - queued route, r - rejected route
+
+  S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
+  O   10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21
+                              via 192.168.0.1, eth2 onlink, 00:13:21
+  C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
+  O   192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53
+  C * 192.168.0.2/32 is directly connected, eth2, 00:56:31
+  C * 192.168.0.2/32 is directly connected, eth1, 00:56:31
+  C>* 192.168.0.2/32 is directly connected, lo, 00:57:36
+  O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03
+    *                        via 192.168.0.1, eth2 onlink, 00:29:03
diff --git a/docs/configexamples/tunnelbroker-ipv6.rst b/docs/configexamples/tunnelbroker-ipv6.rst
new file mode 100644
index 00000000..868b225f
--- /dev/null
+++ b/docs/configexamples/tunnelbroker-ipv6.rst
@@ -0,0 +1,169 @@
+.. _examples-tunnelbroker-ipv6:
+
+#######################
+Tunnelbroker.net (IPv6)
+#######################
+
+This guides walks through the setup of https://www.tunnelbroker.net/ for an
+IPv6 Tunnel.
+
+Prerequisites
+=============
+
+- A public, routable IPv4 address. This does not necessarily need to be static,
+  but you will need to update the tunnel endpoint when/if your IP address
+  changes, which can be done with a script and a scheduled task.
+- Account at https://www.tunnelbroker.net/
+- Requested a "Regular Tunnel". You want to choose a location that is closest
+  to your physical location for the best response time.
+
+Setup initial tunnel
+====================
+
+Set up initial IPv6 tunnel. Replace the field below from the fields on the
+tunnel information page.
+
+.. code-block:: none
+
+  conf
+  set interfaces tunnel tun0 address Client_IPv6_from_Tunnelbroker    # This will be your VyOS install's public IPv6 address
+  set interfaces tunnel tun0 description 'HE.NET IPv6 Tunnel'
+  set interfaces tunnel tun0 encapsulation 'sit'
+  set interfaces tunnel tun0 local-ip Client_IPv4_from_Tunnelbroker   # This is your public IP
+  set interfaces tunnel tun0 mtu '1472'
+  set interfaces tunnel tun0 multicast 'disable'
+  set interfaces tunnel tun0 remote-ip Server_IPv4_from_Tunnelbroker  # This is the IP of the Tunnelbroker server
+  set protocols static interface-route6 ::/0 next-hop-interface tun0  # Tell all traffic to go over this tunnel
+  commit
+
+If your WAN connection is over PPPoE, you may need to set the MTU on the above
+tunnel lower than 1472.
+
+At this point you should be able to ping an IPv6 address, try pinging Google:
+
+.. code-block:: none
+
+   ping6 -c2 2001:4860:4860::8888
+
+   64 bytes from 2001:4860:4860::8888: icmp_seq=1 ttl=57 time=21.7 ms
+   64 bytes from 2001:4860:4860::8888: icmp_seq=2 ttl=57 time=21.1 ms
+
+   --- 2001:4860:4860::8888 ping statistics ---
+   2 packets transmitted, 2 received, 0% packet loss, time 1001ms
+   rtt min/avg/max/mdev = 21.193/21.459/21.726/0.304 ms
+
+Assuming the pings are successful, you need to add some DNS servers.
+Some options:
+
+.. code-block:: none
+
+   set system name-server 2001:4860:4860::8888  # Google
+   set system name-server 2001:4860:4860::8844  # Google
+   set system name-server 2606:4700:4700::1111  # Cloudflare
+   set system name-server 2606:4700:4700::1001  # Cloudflare
+   commit
+
+You should now be able to ping something by IPv6 DNS name:
+
+.. code-block:: none
+
+   # ping6 -c2 one.one.one.one
+   PING one.one.one.one(one.one.one.one) 56 data bytes
+   64 bytes from one.one.one.one: icmp_seq=1 ttl=58 time=16.8 ms
+   64 bytes from one.one.one.one: icmp_seq=2 ttl=58 time=17.4 ms
+
+   --- one.one.one.one ping statistics ---
+   2 packets transmitted, 2 received, 0% packet loss, time 1001ms
+   rtt min/avg/max/mdev = 16.880/17.153/17.426/0.273 ms
+
+Assuming everything works, you can proceed to client configuration
+
+LAN Configuration
+=================
+
+At this point your VyOS install should have full IPv6, but now your LAN devices
+need access.
+
+With Tunnelbroker.net, you have two options:
+
+- Routed /64. This is the default assignment. In IPv6-land, it's good for a
+  single "LAN", and is somewhat equivalent to a /24.
+  Example: `2001:470:xxxx:xxxx::/64`
+- Routed /48. This is something you can request by clicking the "Assign /48"
+  link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k
+  LANs. Example: `2001:470:xxxx::/48`
+
+Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So
+if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore
+the assigned /64, and request the /48 and use that.
+
+Single LAN Setup
+================
+
+Single LAN setup where eth1 is your LAN interface. Use the /64 (all the xxxx
+should be replaced with the information from your `Routed /64` tunnel):
+
+.. code-block:: none
+
+  set interfaces ethernet eth1 address '2001:470:xxxx:xxxx::1/64'
+  set service router-advert interface eth1 name-server '2001:4860:4860::8888'
+  set service router-advert interface eth1 name-server '2001:4860:4860::8844'
+  set service router-advert interface eth1 prefix 2001:470:xxxx:xxxx::/64 
+
+Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, 'valid-lifetime' and 'preferred-lifetime' are set to default values of 30 days and 4 hours respectively.
+
+This accomplishes a few things:
+
+- Sets your LAN interface's IP address
+- Enables router advertisements. This is an IPv6 alternative for DHCP (though
+  DHCPv6 can still be used). With RAs, Your devices will automatically find the
+  information they need for routing and DNS.
+
+Multiple LAN/DMZ Setup
+======================
+
+In this, you use the `Routed /48` information. This allows you to assign a
+different /64 to every interface, LAN, or even device. Or you could break your
+network into smaller chunks like /56 or /60.
+
+The format of these addresses:
+
+- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker.
+- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN
+- `2001:470:xxxx:2::/64`: Another subnet
+- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet.
+
+In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff
+(1-65535).
+
+So, when your LAN is eth1, your DMZ is eth2, your cameras live on eth3, etc:
+
+.. code-block:: none
+
+  set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64'
+  set service router-advert interface eth1 name-server '2001:4860:4860::8888'
+  set service router-advert interface eth1 name-server '2001:4860:4860::8844'
+  set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64
+  
+  set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64'
+  set service router-advert interface eth2 name-server '2001:4860:4860::8888'
+  set service router-advert interface eth2 name-server '2001:4860:4860::8844'
+  set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 
+
+  set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64'
+  set service router-advert interface eth3 name-server '2001:4860:4860::8888'
+  set service router-advert interface eth3 name-server '2001:4860:4860::8844'
+  set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64
+
+Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, 'valid-lifetime' and 'preferred-lifetime' are set to default values of 30 days and 4 hours respectively.
+
+Firewall
+========
+
+Finally, don't forget the :ref:`firewall`. The usage is identical, except for
+instead of `set firewall name NAME`, you would use `set firewall ipv6-name
+NAME`.
+
+Similarly, to attach the firewall, you would use `set interfaces ethernet eth0
+firewall in ipv6-name` or `set zone-policy zone LOCAL from WAN firewall
+ipv6-name`.
diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst
new file mode 100644
index 00000000..7093defe
--- /dev/null
+++ b/docs/configexamples/wan-load-balancing.rst
@@ -0,0 +1,170 @@
+.. _wan-load-balancing:
+
+WAN Load Balancer examples
+==========================
+
+
+Example 1: Distributing load evenly
+-----------------------------------
+
+The setup used in this example is shown in the following diagram:
+
+.. image:: /_static/images/Wan_load_balancing1.png
+   :width: 80%
+   :align: center
+   :alt: Network Topology Diagram
+
+
+Overview
+^^^^^^^^
+ * All traffic coming in trough eth2 is balanced between eth0 and eth1
+   on the router.
+ * Pings will be sent to four targets for health testing (33.44.55.66,
+   44.55.66.77, 55.66.77.88 and 66.77.88.99).
+ * All outgoing packets are assigned the source address of the assigned
+   interface (SNAT).
+ * eth0 is set to be removed from the load balancer's interface pool
+   after 5 ping failures, eth1 will be removed after 4 ping failures.
+
+Create static routes to ping targets
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+Create static routes through the two ISPs towards the ping targets and
+commit the changes:
+
+.. code-block:: none
+
+   set protocols static route 33.44.55.66/32 next-hop 11.22.33.1
+   set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 
+   set protocols static route 55.66.77.88/32 next-hop 22.33.44.1
+   set protocols static route 66.77.88.99/32 next-hop 22.33.44.1
+
+Configure the load balancer
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+Configure the WAN load balancer with the parameters described above:
+
+.. code-block:: none
+
+   set load-balancing wan interface-health eth0 failure-count 5
+   set load-balancing wan interface-health eth0 nexthop 11.22.33.1
+   set load-balancing wan interface-health eth0 test 10 type ping
+   set load-balancing wan interface-health eth0 test 10 target 33.44.55.66
+   set load-balancing wan interface-health eth0 test 20 type ping
+   set load-balancing wan interface-health eth0 test 20 target 44.55.66.77
+   set load-balancing wan interface-health eth1 failure-count 4
+   set load-balancing wan interface-health eth1 nexthop 22.33.44.1
+   set load-balancing wan interface-health eth1 test 10 type ping
+   set load-balancing wan interface-health eth1 test 10 target 55.66.77.88
+   set load-balancing wan interface-health eth1 test 20 type ping
+   set load-balancing wan interface-health eth1 test 20 target 66.77.88.99
+   set load-balancing wan rule 10 inbound-interface eth2
+   set load-balancing wan rule 10 interface eth0
+   set load-balancing wan rule 10 interface eth1
+
+Example 2: Failover based on interface weights
+----------------------------------------------
+
+This examples uses the failover mode.
+
+Overview
+^^^^^^^^
+In this example eth0 is the primary interface and eth1 is the secondary
+interface to provide simple failover functionality. If eth0 fails, eth1
+takes over.
+
+Create interface weight based configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+The configuration steps are the same as in the previous example, except
+rule 10 so we keep the configuration, remove rule 10 and add a new rule
+for the failover mode:
+
+.. code-block:: none
+
+   delete load-balancing wan rule 10
+   set load-balancing wan rule 10 failover
+   set load-balancing wan rule 10 inbound-interface eth2
+   set load-balancing wan rule 10 interface eth0 weight 10
+   set load-balancing wan rule 10 interface eth1 weight 1
+
+Example 3: Failover based on rule order
+---------------------------------------
+
+The previous example used the failover command to send traffic thorugh
+eth1 if eth0 fails. In this example failover functionality is provided
+by rule order.
+
+Overview
+^^^^^^^^
+Two rules will be created, the first rule directs traffic coming in
+from eth2 to eth0 and the second rule directs the traffic to eth1. If
+eth0 fails the first rule is bypassed and the second rule matches,
+directing traffic to eth1.
+
+Create rule order based configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+We keep the configurtation from the previous example, delete rule 10
+and create the two new rules as described:
+
+.. code-block:: none
+
+   delete load-balancing wan rule 10
+   set load-balancing wan rule 10 inbound-interface eth2
+   set load-balancing wan rule 10 interface eth0
+   set load-balancing wan rule 20 inbound-interface eth2
+   set load-balancing wan rule 20 interface eth1
+
+Example 4: Failover based on rule order - priority traffic
+----------------------------------------------------------
+
+A rule order for prioritising traffic is useful in scenarios where the
+secondary link has a lower speed and should only carry high priority
+traffic. It is assumed for this example that eth1 is connected to a
+slower connection than eth0 and should prioritise VoIP traffic.
+
+Overview
+^^^^^^^^
+A rule order for prioritising traffic is useful in scenarios where the
+secondary link has a lower speed and should only carry high priority
+traffic. It is assumed for this example that eth1 is connected to a
+slower connection than eth0 and should prioritise VoIP traffic. 
+
+Create rule order based configuration with low speed secondary link
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+We keep the configuration from the previous example, delete rule 20 and
+create a new rule as described: 
+
+.. code-block:: none
+
+   delete load-balancing wan rule 20
+   set load-balancing wan rule 20 inbound-interface eth2
+   set load-balancing wan rule 20 interface eth1
+   set load-balancing wan rule 20 destination port sip
+   set load-balancing wan rule 20 protocol tcp
+   set protocols static route 0.0.0.0/0 next-hop 11.22.33.1
+
+Example 5: Exclude traffic from load balancing
+----------------------------------------------
+
+In this example two LAN interfaces exist in different subnets instead
+of one like in the previous examples:
+
+.. image:: /_static/images/Wan_load_balancing_exclude1.png                      
+   :width: 80%                                                          
+   :align: center                                                       
+   :alt: Network Topology Diagram 
+
+Adding a rule for the second interface
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Based on the previous example, another rule for traffic from the second
+interface eth3 can be added to the load balancer. However, traffic meant
+to flow between the LAN subnets will be sent to eth0 and eth1 as well.
+To prevent this, another rule is required. This rule excludes traffic
+between the local subnets from the load balancer. It also excludes
+locally-sources packets (required for web caching with load balancing).
+eth+ is used as an alias that refers to all ethernet interfaces:
+
+.. code-block:: none
+
+   set load-balancing wan rule 5 exclude
+   set load-balancing wan rule 5 inbound-interface eth+
+   set load-balancing wan rule 5 destination address 10.0.0.0/8
diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst
new file mode 100644
index 00000000..bfe77c2e
--- /dev/null
+++ b/docs/configexamples/zone-policy.rst
@@ -0,0 +1,415 @@
+.. _examples-zone-policy:
+
+Zone-Policy example
+-------------------
+
+Native IPv4 and IPv6
+^^^^^^^^^^^^^^^^^^^^
+
+We have three networks.
+
+.. code-block:: none
+
+  WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64
+  LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64
+  DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64
+
+
+**This specific example is for a router on a stick, but is very easily
+adapted for however many NICs you have**:
+
+
+* Internet - 192.168.200.100 - TCP/80
+* Internet - 192.168.200.100 - TCP/443
+* Internet - 192.168.200.100 - TCP/25
+* Internet - 192.168.200.100 - TCP/53
+* VyOS actis as DHCP, DNS forwarder, NAT, router and firewall.
+* 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web
+  and mail (SMTP/IMAP) server.
+* 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It
+  can SSH to VyOS.
+* LAN and DMZ hosts have basic outbound access: Web, FTP, SSH.
+* LAN can access DMZ resources.
+* DMZ cannot access LAN resources.
+* Inbound WAN connect to DMZ host.
+
+.. image:: /_static/images/zone-policy-diagram.png
+   :width: 80%
+   :align: center
+   :alt: Network Topology Diagram
+
+The VyOS interface is assigned the .1/:1 address of their respective
+networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30.
+
+It will look something like this:
+
+.. code-block:: none
+
+  interfaces {
+      ethernet eth0 {
+          duplex auto
+          hw-id 00:53:ed:6e:2a:92
+          smp_affinity auto
+          speed auto
+          vif 10 {
+              address 172.16.10.1/24
+              address 2001:db8:0:9999::1/64
+          }
+          vif 20 {
+              address 192.168.100.1/24
+              address 2001:db8:0:AAAA::1/64
+          }
+          vif 30 {
+              address 192.168.200.1/24
+              address 2001:db8:0:BBBB::1/64
+          }
+      }
+      loopback lo {
+      }
+  }
+
+
+Zones Basics
+^^^^^^^^^^^^
+
+Each interface is assigned to a zone. The interface can be physical or
+virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly
+the same.
+
+Traffic flows from zone A to zone B. That flow is what I refer to as a
+zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations.
+
+Ruleset are created per zone-pair-direction.
+
+I name rule sets to indicate which zone-pair-direction they represent.
+eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN.
+
+In VyOS, you have to have unique Ruleset names. In the event of overlap,
+I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This
+allows for each auto-completion and uniqueness.
+
+In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is
+the firewall itself.
+
+If your computer is on the LAN and you need to SSH into your VyOS box,
+you would need a rule to allow it in the LAN-Local ruleset. If you want
+to access a webpage from your VyOS box, you need a rule to allow it in
+the Local-LAN ruleset.
+
+In rules, it is good to keep them named consistently. As the number of
+rules you have grows, the more consistency you have, the easier your
+life will be.
+
+.. code-block:: none
+
+  Rule 1 - State Established, Related
+  Rule 2 - State Invalid
+  Rule 100 - ICMP
+  Rule 200 - Web
+  Rule 300 - FTP
+  Rule 400 - NTP
+  Rule 500 - SMTP
+  Rule 600 - DNS
+  Rule 700 - DHCP
+  Rule 800 - SSH
+  Rule 900 - IMAPS
+
+The first two rules are to deal with the idiosyncrasies of VyOS and
+iptables.
+
+Zones and Rulesets both have a default action statement. When using
+Zone-Policies, the default action is set by the zone-policy statement
+and is represented by rule 10000.
+
+It is good practice to log both accepted and denied traffic. It can save
+you significant headaches when trying to troubleshoot a connectivity
+issue.
+
+To add logging to the default rule, do:
+
+.. code-block:: none
+
+  set firewall name <ruleSet> enable-default-log
+
+
+By default, iptables does not allow traffic for established session to
+return, so you must explicitly allow this. I do this by adding two rules
+to every ruleset. 1 allows established and related state packets through
+and rule 2 drops and logs invalid state packets. We place the
+established/related rule at the top because the vast majority of traffic
+on a network is established and the invalid rule to prevent invalid
+state packets from mistakenly being matched against other rules. Having
+the most matched rule listed first reduces CPU load in high volume
+environments. Note: I have filed a bug to have this added as a default
+action as well.
+
+''It is important to note, that you do not want to add logging to the
+established state rule as you will be logging both the inbound and
+outbound packets for each session instead of just the initiation of the
+session. Your logs will be massive in a very short period of time.''
+
+In VyOS you must have the interfaces created before you can apply it to
+the zone and the rulesets must be created prior to applying it to a
+zone-policy.
+
+I create/configure the interfaces first. Build out the rulesets for each
+zone-pair-direction which includes at least the three state rules. Then
+I setup the zone-policies.
+
+Zones do not allow for a default action of accept; either drop or
+reject. It is important to remember this because if you apply an
+interface to a zone and commit, any active connections will be dropped.
+Specifically, if you are SSH’d into VyOS and add local or the interface
+you are connecting through to a zone and do not have rulesets in place
+to allow SSH and established sessions, you will not be able to connect.
+
+The following are the rules that were created for this example (may not
+be complete), both in IPv4 and IPv6. If there is no IP specified, then
+the source/destination address is not explicit.
+
+.. code-block:: none
+
+  WAN – DMZ:192.168.200.200 – tcp/80
+  WAN – DMZ:192.168.200.200 – tcp/443
+  WAN – DMZ:192.168.200.200 – tcp/25
+  WAN – DMZ:192.168.200.200 – tcp/53
+  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/80
+  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/443
+  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/25
+  WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/53
+
+  DMZ - Local - tcp/53
+  DMZ - Local - tcp/123
+  DMZ - Local - tcp/67,68
+
+  LAN - Local - tcp/53
+  LAN - Local - tcp/123
+  LAN - Local - tcp/67,68
+  LAN:192.168.100.10 - Local - tcp/22
+  LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22
+
+  LAN - WAN - tcp/80
+  LAN - WAN - tcp/443
+  LAN - WAN - tcp/22
+  LAN - WAN - tcp/20,21
+
+  DMZ - WAN - tcp/80
+  DMZ - WAN - tcp/443
+  DMZ - WAN - tcp/22
+  DMZ - WAN - tcp/20,21
+  DMZ - WAN - tcp/53
+  DMZ - WAN - udp/53
+
+  Local - WAN - tcp/80
+  Local - WAN - tcp/443
+  Local - WAN - tcp/20,21
+
+  Local - DMZ - tcp/25
+  Local - DMZ - tcp/67,68
+  Local - DMZ - tcp/53
+  Local - DMZ - udp/53
+
+  Local - LAN - tcp/67,68
+
+  LAN - DMZ - tcp/80
+  LAN - DMZ - tcp/443
+  LAN - DMZ - tcp/993
+  LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22
+  LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22
+
+Since we have 4 zones, we need to setup the following rulesets.
+
+.. code-block:: none
+
+  Lan-wan
+  Lan-local
+  Lan-dmz
+  Wan-lan
+  Wan-local
+  Wan-dmz
+  Local-lan
+  Local-wan
+  Local-dmz
+  Dmz-lan
+  Dmz-wan
+  Dmz-local
+
+Even if the two zones will never communicate, it is a good idea to
+create the zone-pair-direction rulesets and set enable-default-log. This
+will allow you to log attempts to access the networks. Without it, you
+will never see the connection attempts.
+
+This is an example of the three base rules.
+
+.. code-block:: none
+
+  name wan-lan {
+    default-action drop
+    enable-default-log
+    rule 1 {
+      action accept
+      state {
+        established enable
+        related enable
+      }
+    }
+    rule 2 {
+      action drop
+      log enable
+      state {
+        invalid enable
+      }
+    }
+  }
+
+
+Here is an example of an IPv6 DMZ-WAN ruleset.
+
+.. code-block:: none
+
+  ipv6-name dmz-wan-6 {
+    default-action drop
+    enable-default-log
+    rule 1 {
+      action accept
+      state {
+        established enable
+        related enable
+      }
+    }
+    rule 2 {
+      action drop
+      log enable
+      state {
+        invalid enable
+    }
+    rule 100 {
+      action accept
+      log enable
+      protocol ipv6-icmp
+    }
+    rule 200 {
+      action accept
+      destination {
+        port 80,443
+      }
+      log enable
+      protocol tcp
+    }
+    rule 300 {
+      action accept
+      destination {
+        port 20,21
+      }
+      log enable
+      protocol tcp
+    }
+    rule 500 {
+      action accept
+      destination {
+        port 25
+      }
+      log enable
+      protocol tcp
+      source {
+        address 2001:db8:0:BBBB::200
+      }
+    }
+    rule 600 {
+      action accept
+      destination {
+        port 53
+      }
+      log enable
+      protocol tcp_udp
+      source {
+        address 2001:db8:0:BBBB::200
+      }
+    }
+    rule 800 {
+      action accept
+      destination {
+      port 22
+      }
+      log enable
+      protocol tcp
+    }
+  }
+
+Once you have all of your rulesets built, then you need to create your
+zone-policy.
+
+Start by setting the interface and default action for each zone.
+
+.. code-block:: none
+
+  set zone-policy zone dmz default-action drop
+  set zone-policy zone dmz interface eth0.30
+
+In this case, we are setting the v6 ruleset that represents traffic
+sourced from the LAN, destined for the DMZ. Because the zone-policy
+firewall syntax is a little awkward, I keep it straight by thinking of
+it backwards.
+
+.. code-block:: none
+
+  set zone-policy zone dmz from lan firewall ipv6-name lan-dmz-6
+
+DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out
+a bunch at one time.
+
+In the end, you will end up with something like this config. I took out
+everything but the Firewall, Interfaces, and zone-policy sections. It is
+long enough as is.
+
+
+IPv6 Tunnel
+^^^^^^^^^^^
+
+If you are using a IPv6 tunnel from HE.net or someone else, the basis is
+the same except you have two WAN interface. One for v4 and one for v6.
+
+You would have 5 zones instead of just 4 and you would configure your v6
+ruleset between your tunnel interface and your LAN/DMZ zones instead of
+to the WAN.
+
+LAN, WAN, DMZ, local and TUN (tunnel)
+
+v6 pairs would be:
+
+.. code-block:: none
+
+  lan-tun
+  lan-local
+  lan-dmz
+  tun-lan
+  tun-local
+  tun-dmz
+  local-lan
+  local-tun
+  local-dmz
+  dmz-lan
+  dmz-tun
+  dmz-local
+
+Notice, none go to WAN since WAN wouldn't have a v6 address on it.
+
+You would have to add a couple of rules on your wan-local ruleset to
+allow protocol 41 in.
+
+Something like:
+
+.. code-block:: none
+
+  rule 400 {
+    action accept
+    destination {
+      address 172.16.10.1
+    }
+    log enable
+    protocol 41
+    source {
+      address ip.of.tunnel.broker
+    }
+  }
+
diff --git a/docs/configuration-overview.rst b/docs/configuration-overview.rst
deleted file mode 100644
index 5658cdbb..00000000
--- a/docs/configuration-overview.rst
+++ /dev/null
@@ -1,730 +0,0 @@
-.. _configuration-overview:
-
-######################
-Configuration Overview
-######################
-
-VyOS makes use of a unified configuration file for the entire system's
-configuration: ``/config/config.boot``. This allows easy template
-creation, backup, and replication of system configuration. A system can
-thus also be easily cloned by simply copying the required configuration
-files.
-
-Terminology
-===========
-live
-A VyOS system has three major types of configurations:
-
-* **Active** or **running configuration** is the system configuration
-  that is loaded  and currently active (used by VyOS). Any change in
-  the configuration will have to be committed to belong to the
-  active/running configuration.
-
-* **Working configuration** is the one that is currently being modified
-  in configuration mode. Changes made to the working configuration do
-  not go into effect until the changes are committed with the
-  :cfgcmd:`commit` command. At which time the working configuration will
-  become the active or running configuration.
-
-* **Saved configuration** is the one saved to a file using the
-  :cfgcmd:`save` command. It allows you to keep safe a configuration for
-  future uses. There can be multiple configuration files. The default or
-  "boot" configuration is saved and loaded from the file
-  ``/config/config.boot``.
-
-Seeing and navigating the configuration
-=======================================
-
-.. opcmd:: show configuration
-
-   View the current active configuration, also known as the running
-   configuration, from the operational mode.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show configuration
-     interfaces {
-         ethernet eth0 {
-             address dhcp
-             hw-id 00:53:00:00:aa:01
-         }
-         loopback lo {
-         }
-     }
-     service {
-         ssh {
-             port 22
-         }
-     }
-     system {
-         config-management {
-             commit-revisions 20
-         }
-         console {
-             device ttyS0 {
-                 speed 9600
-             }
-         }
-         login {
-             user vyos {
-                 authentication {
-                     encrypted-password ****************
-                 }
-                 level admin
-             }
-         }
-         ntp {
-             server 0.pool.ntp.org {
-             }
-             server 1.pool.ntp.org {
-             }
-             server 2.pool.ntp.org {
-             }
-         }
-         syslog {
-             global {
-                 facility all {
-                     level notice
-                 }
-                 facility protocols {
-                     level debug
-                 }
-             }
-         }
-     }
-
-By default, the configuration is displayed in a hierarchy like the above
-example, this is only one of the possible ways to display the
-configuration. When the configuration is generated and the device is
-configured, changes are added through a collection of :cfgcmd:`set` and
-:cfgcmd:`delete` commands.
-
-.. opcmd:: show configuration commands
-
-   Get a collection of all the set commands required which led to the
-   running configuration.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show configuration commands
-     set interfaces ethernet eth0 address 'dhcp'
-     set interfaces ethernet eth0 hw-id '00:53:dd:44:3b:0f'
-     set interfaces loopback 'lo'
-     set service ssh port '22'
-     set system config-management commit-revisions '20'
-     set system console device ttyS0 speed '9600'
-     set system login user vyos authentication encrypted-password '$6$Vt68...QzF0'
-     set system login user vyos level 'admin'
-     set system ntp server '0.pool.ntp.org'
-     set system ntp server '1.pool.ntp.org'
-     set system ntp server '2.pool.ntp.org'
-     set system syslog global facility all level 'notice'
-     set system syslog global facility protocols level 'debug'
-
-Both these ``show`` commands should be executed when in operational
-mode, they do not work directly in configuration mode. There is a
-special way on how to :ref:`run_opmode_from_config_mode`.
-
-.. hint:: Use the ``show configuration commands | strip-private``
-   command when you want to hide private data. You may want to do so if
-   you want to share your configuration on the `forum`_.
-
-.. _`forum`: https://forum.vyos.io
-
-
-The config mode
----------------
-
-When entering the configuration mode you are navigating inside a tree
-structure, to enter configuration mode enter the command
-:opcmd:`configure` when in operational mode.
-
-.. code-block:: none
-
-  vyos@vyos$ configure
-  [edit]
-  vyos@vyos#
-
-
-.. note:: When going into configuration mode, prompt changes from
-   ``$`` to ``#``.
-
-
-All commands executed here are relative to the configuration level you
-have entered. You can do everything from the top level, but commands
-will be quite lengthy when manually typing them.
-
-The current hierarchy level can be changed by the :cfgcmd:`edit`
-command.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# edit interfaces ethernet eth0
-
-  [edit interfaces ethernet eth0]
-  vyos@vyos#
-
-You are now in a sublevel relative to ``interfaces ethernet eth0``, all
-commands executed from this point on are relative to this sublevel. Use
-eithe the :cfgcmd:`top` or :cfgcmd:`exit` command to go back to the top
-of the hierarchy. You can also use the :cfgcmd:`up` command to move only
-one level up at a time.
-
-.. cfgcmd:: show
-
-The :cfgcmd:`show` command within configuration mode will show the
-working configuration indicating line changes with ``+`` for additions,
-``>`` for replacements and ``-`` for deletions.
-
-**Example:**
-
-.. code-block:: none
-
- vyos@vyos:~$ configure
- [edit]
- vyos@vyos# show interfaces
-  ethernet eth0 {
-      description MY_OLD_DESCRIPTION
-      disable
-      hw-id 00:53:dd:44:3b:03
-  }
-  loopback lo {
-  }
- [edit]
- vyos@vyos# set interfaces ethernet eth0 address dhcp
- [edit]
- vyos@vyos# set interfaces ethernet eth0 description MY_NEW_DESCRIPTION
- [edit]
- vyos@vyos# delete interfaces ethernet eth0 disable
- [edit]
- vyos@vyos# show interfaces
-  ethernet eth0 {
- +    address dhcp
- >    description MY_NEW_DESCRIPTION
- -    disable
-      hw-id 00:53:dd:44:3b:03
-  }
-  loopback lo {
-  }
-
-It is also possible to display all `set` commands within configuration
-mode using :cfgcmd:`show | commands`
-
-.. code-block:: none
-
-  vyos@vyos# show interfaces ethernet eth0 | commands
-  set address dhcp
-  set hw-id 00:53:ad:44:3b:03
-
-These commands are also relative to the level you are inside and only 
-relevant configuration blocks will be displayed when entering a
-sub-level.
-
-.. code-block:: none
-
-  [edit interfaces ethernet eth0]
-  vyos@vyos# show
-   address dhcp
-   hw-id 00:53:ad:44:3b:03
-
-Exiting from the configuration mode is done via the :cfgcmd:`exit`
-command from the top level, executing :cfgcmd:`exit` from within a
-sub-level takes you back to the top level.
-
-.. code-block:: none
-
-  [edit interfaces ethernet eth0]
-  vyos@vyos# exit
-  [edit]
-  vyos@vyos# exit
-  Warning: configuration changes have not been saved.
-
-
-Editing the configuration
-=========================
-
-The configuration can be edited by the use of :cfgcmd:`set` and
-:cfgcmd:`delete` commands from within configuration mode.
-
-.. cfgcmd:: set
-
-   Use this command to set the value of a parameter or to create a new
-   element.
-
-Configuration commands are flattened from the tree into 'one-liner'
-commands shown in :opcmd:`show configuration commands` from operation
-mode. Commands are relative to the level where they are executed and all
-redundant information from the current level is removed from the command
-entered.
-
-.. code-block:: none
-
-  [edit]
-  vyos@vyos# set interface ethernet eth0 address 192.0.2.100/24
-
-
-.. code-block:: none
-
-  [edit interfaces ethernet eth0]
-  vyos@vyos# set address 203.0.113.6/24
-
-
-These two commands above are essentially the same, just executed from
-different levels in the hierarchy.
-
-.. cfgcmd:: delete
-
-   To delete a configuration entry use the :cfgcmd:`delete` command,
-   this also deletes all sub-levels under the current level you've
-   specified in the :cfgcmd:`delete` command. Deleting an entry will
-   also result in the element reverting back to its default value if one
-   exists.
-
-   .. code-block:: none
-
-     [edit interfaces ethernet eth0]
-     vyos@vyos# delete address 192.0.2.100/24
-
-.. cfgcmd:: commit
-
-  Any change you do on the configuration, will not take effect until
-  committed using the :cfgcmd:`commit` command in configuration mode.
-
-  .. code-block:: none
-
-    vyos@vyos# commit
-    [edit]
-    vyos@vyos# exit
-    Warning: configuration changes have not been saved.
-    vyos@vyos:~$
-
-.. _save:
-
-.. cfgcmd:: save
-
-   Use this command to preserve configuration changes upon reboot. By
-   default it is stored at */config/config.boot*. In the case you want
-   to store the configuration file somewhere else, you can add a local
-   path, an SCP address, an FTP address or a TFTP address. 
-
-   .. code-block:: none
-
-     vyos@vyos# save
-     Saving configuration to '/config/config.boot'...
-     Done
-
-   .. code-block:: none
-
-     vyos@vyos# save [tab]
-     Possible completions:
-       <Enter>       Save to system config file
-       <file>        Save to file on local machine
-       scp://<user>:<passwd>@<host>:/<file> Save to file on remote machine
-       ftp://<user>:<passwd>@<host>/<file> Save to file on remote machine
-       tftp://<host>/<file>      Save to file on remote machine
-     vyos@vyos# save tftp://192.168.0.100/vyos-test.config.boot
-     Saving configuration to 'tftp://192.168.0.100/vyos-test.config.boot'...
-     ######################################################################## 100.0%
-     Done
-
-.. cfgcmd:: exit [discard]
-
-   Configuration mode can not be exited while uncommitted changes exist.
-   To exit configuration mode without applying changes, the
-   :cfgcmd:`exit discard` command must be used.
-
-   All changes in the working config will thus be lost.
-
-   .. code-block:: none
-
-     vyos@vyos# exit
-     Cannot exit: configuration modified.
-     Use 'exit discard' to discard the changes and exit.
-     [edit]
-     vyos@vyos# exit discard
-
-
-.. cfgcmd:: commit-confirm <minutes>
-
-   Use this command to temporarily commit your changes and set the
-   number of minutes available for validation. ``confirm`` must
-   be entered within those minutes, otherwise the system will reboot
-   into the previous configuration. The default value is 10 minutes.
-
-
-   What if you are doing something dangerous? Suppose you want to setup
-   a firewall, and you are not sure there are no mistakes that will lock
-   you out of your system. You can use confirmed commit. If you issue
-   the ``commit-confirm`` command, your changes will be commited, and if
-   you don't issue issue the ``confirm`` command in 10 minutes, your
-   system will reboot into previous config revision.
-
-   .. code-block:: none
-   
-      vyos@router# set interfaces ethernet eth0 firewall local name FromWorld
-      vyos@router# commit-confirm 
-      commit confirm will be automatically reboot in 10 minutes unless confirmed
-      Proceed? [confirm]y
-      [edit]
-      vyos@router# confirm 
-      [edit]
-
-
-   .. note:: A reboot because you did not enter ``confirm`` will not
-      take you necessarily to the *saved configuration*, but to the
-      point before the unfortunate commit.
-
-
-.. cfgcmd:: copy
-
-   Copy a configuration element.
-
-   You can copy and remove configuration subtrees. Suppose you set up a
-   firewall ruleset ``FromWorld`` with one rule that allows traffic from
-   specific subnet. Now you want to setup a similar rule, but for
-   different subnet. Change your edit level to
-   ``firewall name FromWorld`` and use ``copy rule 10 to rule 20``, then
-   modify rule 20.
-
-
-   .. code-block:: none
-   
-      vyos@router# show firewall name FromWorld 
-       default-action drop
-       rule 10 {
-           action accept
-           source {
-               address 203.0.113.0/24
-           }
-       }
-      [edit]
-      vyos@router# edit firewall name FromWorld 
-      [edit firewall name FromWorld]
-      vyos@router# copy rule 10 to rule 20
-      [edit firewall name FromWorld]
-      vyos@router# set rule 20 source address 198.51.100.0/24
-      [edit firewall name FromWorld]
-      vyos@router# commit
-      [edit firewall name FromWorld]
-
-
-.. cfgcmd:: rename
-
-   Rename a configuration element.
-
-   You can also rename config subtrees:
-
-   .. code-block:: none
-   
-      vyos@router# rename rule 10 to rule 5
-      [edit firewall name FromWorld]
-      vyos@router# commit
-      [edit firewall name FromWorld]
-
-   Note that ``show`` command respects your edit level and from this
-   level you can view the modified firewall ruleset with just ``show``
-   with no parameters.
-
-   .. code-block:: none
-   
-      vyos@router# show 
-       default-action drop
-       rule 5 {
-           action accept
-           source {
-               address 203.0.113.0/24
-           }
-       }
-       rule 20 {
-           action accept
-           source {
-               address 198.51.100.0/24
-           }
-       }
-
-
-.. cfgcmd:: comment <config node> "comment text"
-
-   Add comment as an annotation to a configuration node.
-
-   The ``comment`` command allows you to insert a comment above the
-   ``<config node>`` configuration section. When shown, comments are
-   enclosed with ``/*`` and ``*/`` as open/close delimiters. Comments
-   need to be commited, just like other config changes.
-
-   To remove an existing comment from your current configuration,
-   specify an empty string enclosed in double quote marks (``""``) as
-   the comment text.
-
-   Example:
-
-   .. code-block:: none
-
-     vyos@vyos# comment firewall all-ping "Yes I know this VyOS is cool"
-     vyos@vyos# commit
-     vyos@vyos# show
-      firewall {
-          /* Yes I know this VyOS is cool */
-          all-ping enable
-          broadcast-ping disable
-          ...
-      }
-
-   .. note:: An important thing to note is that since the comment is
-      added on top of the section, it will not appear if the ``show
-      <section>`` command is used. With the above example, the `show
-      firewall` command would return starting after the ``firewall
-      {`` line, hiding the comment.
-
-
-
-
-   
-
-.. _run_opmode_from_config_mode:
-
-Access opmode from config mode
-==============================
-
-When inside configuration mode you are not directly able to execute
-operational commands.
-
-.. cfgcmd:: run
-
-  Access to these commands are possible through the use of the
-  ``run [command]`` command. From this command you will have access to
-  everything accessible from operational mode.
-
-  Command completion and syntax help with ``?`` and ``[tab]`` will also
-  work.
-
-  .. code-block:: none
-
-    [edit]
-    vyos@vyos# run show interfaces
-    Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-    Interface        IP Address                        S/L  Description
-    ---------        ----------                        ---  -----------
-    eth0             0.0.0.0/0                         u/u
-
-Managing configurations
-=======================
-
-VyOS comes with an integrated versioning system for the system
-configuration. It automatically maintains a backup of every previous
-configuration which has been committed to the system. The configurations
-are versioned locally for rollback but they can also be stored on a
-remote host for archiving/backup reasons.
-
-Local Archive
--------------
-
-Revisions are stored on disk. You can view, compare and rollback them to
-any previous revisions if something goes wrong.
-
-.. opcmd:: show system commit
-
-   View all existing revisions on the local system.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show system commit
-     0   2015-03-30 08:53:03 by vyos via cli
-     1   2015-03-30 08:52:20 by vyos via cli
-     2   2015-03-26 21:26:01 by root via boot-config-loader
-     3   2015-03-26 20:43:18 by root via boot-config-loader
-     4   2015-03-25 11:06:14 by root via boot-config-loader
-     5   2015-03-25 01:04:28 by root via boot-config-loader
-     6   2015-03-25 00:16:47 by vyos via cli
-     7   2015-03-24 23:43:45 by root via boot-config-loader
-
-
-.. cfgcmd:: set system config-management commit-revisions <N>
-
-   You can specify the number of revisions stored on disk. N can be in
-   the range of 0 - 65535. When the number of revisions exceeds the
-   configured value, the oldest revision is removed. The default setting
-   for this value is to store 100 revisions locally.
-
-
-Compare configurations
-----------------------
-
-VyOS lets you compare different configurations.
-
-.. cfgcmd:: compare <saved | N> <M>
-
-   Use this command to spot what the differences are between different
-   configurations.
-
-   .. code-block:: none
-
-     vyos@vyos# compare [tab]
-     Possible completions:
-       <Enter>	Compare working & active configurations
-       saved		Compare working & saved configurations
-       <N>		Compare working with revision N
-       <N> <M>	Compare revision N with M
-       Revisions:
-         0	   2013-12-17 20:01:37 root by boot-config-loader
-         1	   2013-12-13 15:59:31 root by boot-config-loader
-         2	   2013-12-12 21:56:22 vyos by cli
-         3	   2013-12-12 21:55:11 vyos by cli
-         4	   2013-12-12 21:27:54 vyos by cli
-         5	   2013-12-12 21:23:29 vyos by cli
-         6	   2013-12-12 21:13:59 root by boot-config-loader
-         7	   2013-12-12 16:25:19 vyos by cli
-         8	   2013-12-12 15:44:36 vyos by cli
-         9	   2013-12-12 15:42:07 root by boot-config-loader
-         10   2013-12-12 15:42:06 root by init
-
-   The command :cfgcmd:`compare` allows you to compare different type of
-   configurations. It also lets you compare different revisions through
-   the :cfgcmd:`compare N M` command, where N and M are revision
-   numbers. The output will describe how the configuration N is when
-   compared to M indicating with a plus sign (``+``) the additional
-   parts N has when compared to M, and indicating with a minus sign
-   (``-``) the lacking parts N misses when compared to M.
-
-   .. code-block:: none
-
-     vyos@vyos# compare 0 6
-     [edit interfaces]
-     +dummy dum1 {
-     +    address 10.189.0.1/31
-     +}
-     [edit interfaces ethernet eth0]
-     +vif 99 {
-     +    address 10.199.0.1/31
-     +}
-     -vif 900 {
-     -    address 192.0.2.4/24
-     -}
-
-
-.. opcmd:: show system commit diff <number>
-
-   Show commit revision difference.
-
-
-The command above also lets you see the difference between two commits.
-By default the difference with the running config is shown.
-
-.. code-block:: none
-
-   vyos@router# run show system commit diff 4
-   [edit system]
-   +ipv6 {
-   +    disable-forwarding
-   +}
-
-This means four commits ago we did ``set system ipv6 disable-forwarding``.
-
-
-Rollback Changes
-----------------
-
-You can rollback configuration changes using the rollback command. This
-will apply the selected revision and trigger a system reboot.
-
-.. cfgcmd:: rollback <N>
-
-   Rollback to revision N (currently requires reboot)
-
-   .. code-block:: none
-
-     vyos@vyos# compare 1
-     [edit system]
-     >host-name vyos-1
-     [edit]
-
-     vyos@vyos# rollback 1
-     Proceed with reboot? [confirm][y]
-     Broadcast message from root@vyos-1 (pts/0) (Tue Dec 17 21:07:45 2013):
-     The system is going down for reboot NOW!
-
-Remote Archive
---------------
-
-VyOS can upload the configuration to a remote location after each call
-to :cfgcmd:`commit`. You will have to set the commit-archive location.
-TFTP, FTP, SCP and SFTP servers are supported. Every time a
-:cfgcmd:`commit` is successfull the ``config.boot`` file will be copied
-to the defined destination(s). The filename used on the remote host will
-be ``config.boot-hostname.YYYYMMDD_HHMMSS``. 
-
-.. cfgcmd:: set system config-management commit-archive location <URI>
-
-   Specify remote location of commit archive as any of the below
-   :abbr:`URI (Uniform Resource Identifier)`
-
-   * ``scp://<user>:<passwd>@<host>:/<dir>``
-   * ``sftp://<user>:<passwd>@<host>/<dir>``
-   * ``ftp://<user>:<passwd>@<host>/<dir>``
-   * ``tftp://<host>/<dir>``
-
-.. note:: The number of revisions don't affect the commit-archive.
-
-.. note:: You may find VyOS not allowing the secure connection because
-   it cannot verify the legitimacy of the remote server. You can use
-   the workaround below to quickly add the remote host's SSH
-   fingerprint to your ``~/.ssh/known_hosts`` file:
-
-   .. code-block:: none
-
-     vyos@vyos# ssh-keyscan <host> >> ~/.ssh/known_hosts
-
-Saving and loading manually
----------------------------
-
-You can use the ``save`` and ``load`` commands if you want to manually
-manage specific configuration files.
-
-When using the save_ command, you can add a specific location where
-to store your configuration file. And, when needed it, you will be able
-to load it with the ``load`` command:
-
-.. cfgcmd:: load <URI>
-
-   Use this command to load a configuration which will replace the
-   running configuration. Define the location of the configuration file
-   to be loaded. You can use a path to a local file, an SCP address, an
-   SFTP address, an FTP address, an HTTP address, an HTTPS address or a
-   TFTP address.
-
-  .. code-block:: none
-
-     vyos@vyos# load 
-     Possible completions:
-       <Enter>				        Load from system config file
-       <file>			        	Load from file on local machine
-       scp://<user>:<passwd>@<host>:/<file>	Load from file on remote machine
-       sftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
-       ftp://<user>:<passwd>@<host>/<file>	Load from file on remote machine
-       http://<host>/<file>			Load from file on remote machine
-       https://<host>/<file>			Load from file on remote machine
-       tftp://<host>/<file>			Load from file on remote machine
-     
-
-
-Restore Default
----------------
-
-In the case you want to completely delete your configuration and restore
-the default one, you can enter the following command in configuration
-mode:
-
-.. code-block:: none
-
-  load /opt/vyatta/etc/config.boot.default
-
-You will be asked if you want to continue. If you accept, you will have
-to use :cfgcmd:`commit` if you want to make the changes active.
-
-Then you may want to :cfgcmd:`save` in order to delete the saved
-configuration too.
-
-.. note:: If you are remotely connected, you will lose your connection.
-   You may want to copy first the config, edit it to ensure
-   connectivity, and load the edited config.
diff --git a/docs/configuration/interfaces/openvpn.rst b/docs/configuration/interfaces/openvpn.rst
index 7646959c..f503ae84 100644
--- a/docs/configuration/interfaces/openvpn.rst
+++ b/docs/configuration/interfaces/openvpn.rst
@@ -581,4 +581,4 @@ The following commands let you reset OpenVPN.
 
 
 
-.. include:: /common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/configuration/nat/index.rst b/docs/configuration/nat/index.rst
index 85bd41d5..5aeffb63 100644
--- a/docs/configuration/nat/index.rst
+++ b/docs/configuration/nat/index.rst
@@ -606,7 +606,7 @@ The ASP requests that all connections from this company should come from
 172.29.41.89 - an address that is assigned by the ASP and not in use at
 the customer site.
 
-.. figure:: _static/images/nat_before_vpn_topology.png
+.. figure:: /_static/images/nat_before_vpn_topology.png
    :scale: 100 %
    :alt: NAT before VPN Topology
 
diff --git a/docs/configuration/policy/index.rst b/docs/configuration/policy/index.rst
index 557911d9..4b7d48ee 100644
--- a/docs/configuration/policy/index.rst
+++ b/docs/configuration/policy/index.rst
@@ -125,7 +125,7 @@ Routing tables that will be used in this example are:
 * ``main`` Routing table used by VyOS and other interfaces not
   participating in PBR
 
-.. figure:: ../_static/images/pbr_example_1.png
+.. figure:: /_static/images/pbr_example_1.png
    :scale: 80 %
    :alt: PBR multiple uplinks
 
diff --git a/docs/configuration/service/ipoe-server.rst b/docs/configuration/service/ipoe-server.rst
index 279f0c6d..3f794af8 100644
--- a/docs/configuration/service/ipoe-server.rst
+++ b/docs/configuration/service/ipoe-server.rst
@@ -146,4 +146,4 @@ The rate-limit is set in kbit/sec.
   -------+------------+-------------------+-------------+-----+--------+------------+--------+----------+------------------
   ipoe0  | eth2       | 08:00:27:2f:d8:06 | 192.168.0.2 |     |        | 500/500    | active | 00:00:05 | dccc870fd31349fb
 
-.. include:: /common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/configuration/service/pppoe-server.rst b/docs/configuration/service/pppoe-server.rst
index 4deb6c7e..28d1f097 100644
--- a/docs/configuration/service/pppoe-server.rst
+++ b/docs/configuration/service/pppoe-server.rst
@@ -394,4 +394,4 @@ a /56 subnet for the clients internal use.
   --------+----------+-------------+--------------------------+---------------------+-------------------+------------+--------+----------+----------+----------
    ppp0   | test     | 192.168.0.1 | 2001:db8:8002:0:200::/64 | 2001:db8:8003::1/56 | 00:53:00:12:42:eb |            | active | 00:00:49 | 875 B    | 2.1 KiB
 
-.. include:: /common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/configuration/system/lcd.rst b/docs/configuration/system/lcd.rst
index 2509946e..808d45a2 100644
--- a/docs/configuration/system/lcd.rst
+++ b/docs/configuration/system/lcd.rst
@@ -41,5 +41,5 @@ Configuration
    .. note:: We can't support all displays from the beginning. If your display
       type is missing, please create a feature request via Phabricator_.
 
-.. include:: /common-references.rst
+.. include:: /_include/common-references.txt
 
diff --git a/docs/configuration/vpn/dmvpn.rst b/docs/configuration/vpn/dmvpn.rst
new file mode 100644
index 00000000..d6706421
--- /dev/null
+++ b/docs/configuration/vpn/dmvpn.rst
@@ -0,0 +1,335 @@
+.. _vpn-dmvpn:
+
+#####
+DMVPN
+#####
+
+:abbr:`DMVPN (Dynamic Multipoint Virtual Private Network)` is a dynamic
+:abbr:`VPN (Virtual Private Network)` technology originally developed by Cisco.
+While their implementation was somewhat proprietary, the underlying
+technologies are actually standards based. The three technologies are:
+
+* :abbr:`NHRP (Next Hop Resolution Protocol)` :rfc:`2332`
+* :abbr:`mGRE (Multipoint Generic Routing Encapsulation)` :rfc:`1702`
+* :abbr:`IPSec (IP Security)` - too many RFCs to list, but start with :rfc:`4301`
+
+NHRP provides the dynamic tunnel endpoint discovery mechanism (endpoint
+registration, and endpoint discovery/lookup), mGRE provides the tunnel
+encapsulation itself, and the IPSec protocols handle the key exchange, and
+crypto mechanism.
+
+In short, DMVPN provides the capability for creating a dynamic-mesh VPN
+network without having to pre-configure (static) all possible tunnel end-point
+peers.
+
+.. note:: DMVPN only automates the tunnel endpoint discovery and setup. A
+   complete solution also incorporates the use of a routing protocol. BGP is
+   particularly well suited for use with DMVPN.
+
+.. figure:: /_static/images/vpn_dmvpn_topology01.png
+   :scale: 40 %
+   :alt: Baseline DMVPN topology
+
+   Baseline DMVPN topology
+
+*************
+Configuration
+*************
+
+* Please refer to the :ref:`tunnel-interface` documentation for the individual
+  tunnel related options.
+
+* Please refer to the :ref:`ipsec` documentation for the individual IPSec
+  related options.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> cisco-authentication <secret>
+
+  Enables Cisco style authentication on NHRP packets. This embeds the secret
+  plaintext password to the outgoing NHRP packets. Incoming NHRP packets on
+  this interface are discarded unless the secret password is present. Maximum
+  length of the secret is 8 characters.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> dynamic-map <address>
+  nbma-domain-name <fqdn>
+
+  Specifies that the :abbr:`NBMA (Non-broadcast multiple-access network)`
+  addresses of the next hop servers are defined in the domain name
+  nbma-domain-name. For each A record opennhrp creates a dynamic NHS entry.
+
+  Each dynamic NHS will get a peer entry with the configured network address
+  and the discovered NBMA address.
+
+  The first registration request is sent to the protocol broadcast address, and
+  the server's real protocol address is dynamically detected from the first
+  registration reply.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> holding-time <timeout>
+
+  Specifies the holding time for NHRP Registration Requests and Resolution
+  Replies sent from this interface or shortcut-target. The holdtime is specified
+  in seconds and defaults to two hours.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> map cisco
+
+  If the statically mapped peer is running Cisco IOS, specify the cisco keyword.
+  It is used to fix statically the Registration Request ID so that a matching
+  Purge Request can be sent if NBMA address has changed. This is to work around
+  broken IOS which requires Purge Request ID to match the original Registration
+  Request ID.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> map nbma-address <address>
+
+  Creates static peer mapping of protocol-address to :abbr:`NBMA (Non-broadcast
+  multiple-access network)` address.
+
+  If the IP prefix mask is present, it directs opennhrp to use this peer as a
+  next hop server when sending Resolution Requests matching this subnet.
+
+  This is also known as the HUBs IP address or FQDN.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> map register
+
+  The optional parameter register specifies that Registration Request should be
+  sent to this peer on startup.
+
+  This option is required when running a DMVPN spoke.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> multicast <dynamic | nhs>
+
+  Determines how opennhrp daemon should soft switch the multicast traffic.
+  Currently, multicast traffic is captured by opennhrp daemon using a packet
+  socket, and resent back to proper destinations. This means that multicast
+  packet sending is CPU intensive.
+
+  Specfying nhs makes all multicast packets to be repeated to each statically
+  configured next hop.
+
+  Synamic instructs to forward to all peers which we have a direct connection
+  with. Alternatively, you can specify the directive multiple times for each
+  protocol-address the multicast traffic should be sent to.
+
+  .. warning:: It is very easy to misconfigure multicast repeating if you have
+    multiple NHSes.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> non-caching
+
+   Disables caching of peer information from forwarded NHRP Resolution Reply
+   packets. This can be used to reduce memory consumption on big NBMA subnets.
+
+  .. note:: Currently does not do much as caching is not implemented.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> redirect
+
+  Enable sending of Cisco style NHRP Traffic Indication packets. If this is
+  enabled and opennhrp detects a forwarded  packet, it will send a message to
+  the original sender of the packet instructing it to create a direct connection
+  with the destination. This is basically a protocol independent equivalent of
+  ICMP redirect.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut
+
+  Enable creation of shortcut routes.
+
+  A received NHRP Traffic Indication will trigger the resolution and
+  establishment of a shortcut route.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut-destination
+
+  This instructs opennhrp to reply with authorative answers on NHRP Resolution
+  Requests destinied to addresses in this interface (instead of forwarding the
+  packets). This effectively allows the creation of shortcut routes to subnets
+  located on the interface.
+
+  When specified, this should be the only keyword for the interface.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut-target <address>
+
+  Defines an off-NBMA network prefix for which the GRE interface will act as a
+  gateway. This an alternative to defining local interfaces with
+  shortcut-destination flag.
+
+.. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut-target <address>
+  holding-time <timeout>
+
+  Specifies the holding time for NHRP Registration Requests and Resolution
+  Replies sent from this interface or shortcut-target. The holdtime is specified
+  in seconds and defaults to two hours.
+
+*******
+Example
+*******
+
+
+This blueprint uses VyOS as the DMVPN Hub and Cisco (7206VXR) and VyOS as
+multiple spoke sites. The lab was build using :abbr:`EVE-NG (Emulated Virtual
+Environment NG)`.
+
+.. figure:: /_static/images/blueprint-dmvpn.png
+   :alt: DMVPN network
+
+   DMVPN example network
+
+Each node (Hub and Spoke) uses an IP address from the network 172.16.253.128/29.
+
+The below referenced IP address `192.0.2.1` is used as example address
+representing a global unicast address under which the HUB can be contacted by
+each and every individual spoke.
+
+Configuration
+=============
+
+Hub
+---
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address 192.0.2.1/24
+
+  set interfaces tunnel tun100 address '172.16.253.134/29'
+  set interfaces tunnel tun100 encapsulation 'gre'
+  set interfaces tunnel tun100 local-ip '192.0.2.1'
+  set interfaces tunnel tun100 multicast 'enable'
+  set interfaces tunnel tun100 parameters ip key '1'
+
+  set protocols nhrp tunnel tun100 cisco-authentication 'secret'
+  set protocols nhrp tunnel tun100 holding-time '300'
+  set protocols nhrp tunnel tun100 multicast 'dynamic'
+  set protocols nhrp tunnel tun100 redirect
+  set protocols nhrp tunnel tun100 shortcut
+
+  set vpn ipsec esp-group ESP-HUB compression 'disable'
+  set vpn ipsec esp-group ESP-HUB lifetime '1800'
+  set vpn ipsec esp-group ESP-HUB mode 'tunnel'
+  set vpn ipsec esp-group ESP-HUB pfs 'dh-group2'
+  set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+  set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des'
+  set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5'
+  set vpn ipsec ike-group IKE-HUB ikev2-reauth 'no'
+  set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+  set vpn ipsec ike-group IKE-HUB lifetime '3600'
+  set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+  set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+  set vpn ipsec ike-group IKE-HUB proposal 2 dh-group '2'
+  set vpn ipsec ike-group IKE-HUB proposal 2 encryption 'aes128'
+  set vpn ipsec ike-group IKE-HUB proposal 2 hash 'sha1'
+
+  set vpn ipsec ipsec-interfaces interface 'eth0'
+
+  set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+  set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
+  set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
+  set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+  set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+
+.. note:: Setting this up on AWS will require a "Custom Protocol Rule" for
+  protocol number "47" (GRE) Allow Rule in TWO places. Firstly on the VPC
+  Network ACL, and secondly on the security group network ACL attached to the
+  EC2 instance. This has been tested as working for the official AMI image on
+  the AWS Marketplace. (Locate the correct VPC and security group by navigating
+  through the details pane below your EC2 instance in the AWS console).
+
+Spoke
+-----
+
+The individual spoke configurations only differ in the local IP address on the
+``tun10`` interface. See the above diagram for the individual IP addresses.
+
+spoke01-spoke04
+^^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  crypto keyring DMVPN
+    pre-shared-key address 192.0.2.1 key secret
+  !
+  crypto isakmp policy 10
+   encr aes 256
+   authentication pre-share
+   group 2
+  crypto isakmp invalid-spi-recovery
+  crypto isakmp keepalive 30 30 periodic
+  crypto isakmp profile DMVPN
+     keyring DMVPN
+     match identity address 192.0.2.1 255.255.255.255
+  !
+  crypto ipsec transform-set DMVPN-AES256 esp-aes 256 esp-sha-hmac
+   mode transport
+  !
+  crypto ipsec profile DMVPN
+   set security-association idle-time 720
+   set transform-set DMVPN-AES256
+   set isakmp-profile DMVPN
+  !
+  interface Tunnel10
+   ! individual spoke tunnel IP must change
+   ip address 172.16.253.129 255.255.255.248
+   no ip redirects
+   ip nhrp authentication secret
+   ip nhrp map 172.16.253.134 192.0.2.1
+   ip nhrp map multicast 192.0.2.1
+   ip nhrp network-id 1
+   ip nhrp holdtime 600
+   ip nhrp nhs 172.16.253.134
+   ip nhrp registration timeout 75
+   tunnel source FastEthernet0/0
+   tunnel mode gre multipoint
+   tunnel key 1
+  !
+  interface FastEthernet0/0
+   ip address dhcp
+   duplex half
+
+
+spoke05
+^^^^^^^
+
+VyOS can also run in DMVPN spoke mode.
+
+.. code-block:: none
+
+  set interfaces ethernet eth0 address 'dhcp'
+
+  set interfaces tunnel tun100 address '172.16.253.133/29'
+  set interfaces tunnel tun100 local-ip 0.0.0.0
+  set interfaces tunnel tun100 encapsulation 'gre'
+  set interfaces tunnel tun100 multicast 'enable'
+  set interfaces tunnel tun100 parameters ip key '1'
+
+  set protocols nhrp tunnel tun100 cisco-authentication 'secret'
+  set protocols nhrp tunnel tun100 holding-time '300'
+  set protocols nhrp tunnel tun100 map 172.16.253.134/29 nbma-address '192.0.2.1'
+  set protocols nhrp tunnel tun100 map 172.16.253.134/29 register
+  set protocols nhrp tunnel tun100 multicast 'nhs'
+  set protocols nhrp tunnel tun100 redirect
+  set protocols nhrp tunnel tun100 shortcut
+
+  set vpn ipsec esp-group ESP-HUB compression 'disable'
+  set vpn ipsec esp-group ESP-HUB lifetime '1800'
+  set vpn ipsec esp-group ESP-HUB mode 'tunnel'
+  set vpn ipsec esp-group ESP-HUB pfs 'dh-group2'
+  set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+  set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des'
+  set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5'
+  set vpn ipsec ike-group IKE-HUB close-action 'none'
+  set vpn ipsec ike-group IKE-HUB ikev2-reauth 'no'
+  set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+  set vpn ipsec ike-group IKE-HUB lifetime '3600'
+  set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+  set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+  set vpn ipsec ike-group IKE-HUB proposal 2 dh-group '2'
+  set vpn ipsec ike-group IKE-HUB proposal 2 encryption 'aes128'
+  set vpn ipsec ike-group IKE-HUB proposal 2 hash 'sha1'
+
+  set vpn ipsec ipsec-interfaces interface 'eth0'
+
+  set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+  set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
+  set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
+  set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+  set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+
+
diff --git a/docs/configuration/vpn/index.rst b/docs/configuration/vpn/index.rst
new file mode 100644
index 00000000..397093c2
--- /dev/null
+++ b/docs/configuration/vpn/index.rst
@@ -0,0 +1,15 @@
+###
+VPN
+###
+
+
+.. toctree::
+   :maxdepth: 1
+   :includehidden:
+
+   ipsec
+   l2tp
+   openconnect
+   pptp
+   rsa-keys
+   sstp
\ No newline at end of file
diff --git a/docs/configuration/vpn/ipsec.rst b/docs/configuration/vpn/ipsec.rst
new file mode 100644
index 00000000..647f3753
--- /dev/null
+++ b/docs/configuration/vpn/ipsec.rst
@@ -0,0 +1,192 @@
+.. _ipsec:
+
+#####
+IPsec
+#####
+
+:abbr:`GRE (Generic Routing Encapsulation)`, GRE/IPsec (or IPIP/IPsec,
+SIT/IPsec, or any other stateless tunnel protocol over IPsec) is the usual way
+to protect the traffic inside a tunnel.
+
+An advantage of this scheme is that you get a real interface with its own
+address, which makes it easier to setup static routes or use dynamic routing
+protocols without having to modify IPsec policies. The other advantage is that
+it greatly simplifies router to router communication, which can be tricky with
+plain IPsec because the external outgoing address of the router usually doesn't
+match the IPsec policy of typical site-to-site setup and you need to add special
+configuration for it, or adjust the source address for outgoing traffic of your
+applications. GRE/IPsec has no such problem and is completely transparent for
+the applications.
+
+GRE/IPIP/SIT and IPsec are widely accepted standards, which make this scheme
+easy to implement between VyOS and virtually any other router.
+
+For simplicity we'll assume that the protocol is GRE, it's not hard to guess
+what needs to be changed to make it work with a different protocol. We assume
+that IPsec will use pre-shared secret authentication and will use AES128/SHA1
+for the cipher and hash. Adjust this as necessary.
+
+.. NOTE:: VMware users should ensure that a VMXNET3 adapter is used. E1000
+  adapters have known issues with GRE processing.
+
+*************************
+IPsec policy matching GRE
+*************************
+
+The first and arguably cleaner option is to make your IPsec policy match GRE
+packets between external addresses of your routers. This is the best option if
+both routers have static external addresses.
+
+Suppose the LEFT router has external address 192.0.2.10 on its eth0 interface,
+and the RIGHT router is 203.0.113.45
+
+On the LEFT:
+
+.. code-block:: none
+
+  # GRE tunnel
+  set interfaces tunnel tun0 encapsulation gre
+  set interfaces tunnel tun0 local-ip 192.0.2.10
+  set interfaces tunnel tun0 remote-ip 203.0.113.45
+  set interfaces tunnel tun0 address 10.10.10.1/30
+
+  ## IPsec
+  set vpn ipsec ipsec-interfaces interface eth0
+
+  # IKE group
+  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '2'
+  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes128'
+  set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha1'
+
+  # ESP group
+  set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes128'
+  set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha1'
+
+  # IPsec tunnel
+  set vpn ipsec site-to-site peer 203.0.113.45 authentication mode pre-shared-secret
+  set vpn ipsec site-to-site peer 203.0.113.45 authentication pre-shared-secret MYSECRETKEY
+
+  set vpn ipsec site-to-site peer 203.0.113.45 ike-group MyIKEGroup
+  set vpn ipsec site-to-site peer 203.0.113.45 default-esp-group MyESPGroup
+
+  set vpn ipsec site-to-site peer 203.0.113.45 local-address 192.0.2.10
+
+  # This will match all GRE traffic to the peer
+  set vpn ipsec site-to-site peer 203.0.113.45 tunnel 1 protocol gre
+
+On the RIGHT, setup by analogy and swap local and remote addresses.
+
+
+Source tunnel from loopbacks
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The scheme above doesn't work when one of the routers has a dynamic external
+address though. The classic workaround for this is to setup an address on a
+loopback interface and use it as a source address for the GRE tunnel, then setup
+an IPsec policy to match those loopback addresses.
+
+We assume that the LEFT router has static 192.0.2.10 address on eth0, and the
+RIGHT router has a dynamic address on eth0.
+
+**Setting up the GRE tunnel**
+
+On the LEFT:
+
+.. code-block:: none
+
+  set interfaces loopback lo address 192.168.99.1/32
+
+  set interfaces tunnel tun0 encapsulation gre
+  set interfaces tunnel tun0 address 10.10.10.1/30
+  set interfaces tunnel tun0 local-ip 192.168.99.1
+  set interfaces tunnel tun0 remote-ip 192.168.99.2
+
+On the RIGHT:
+
+.. code-block:: none
+
+  set interfaces loopback lo address 192.168.99.2/32
+
+  set interfaces tunnel tun0 encapsulation gre
+  set interfaces tunnel tun0 address 10.10.10.2/30
+  set interfaces tunnel tun0 local-ip 192.168.99.2
+  set interfaces tunnel tun0 remote-ip 192.168.99.1
+
+**Setting up IPSec**
+
+However, now you need to make IPsec work with dynamic address on one side. The
+tricky part is that pre-shared secret authentication doesn't work with dynamic
+address, so we'll have to use RSA keys.
+
+First, on both routers run the operational command "generate vpn rsa-key bits
+2048". You may choose different length than 2048 of course.
+
+.. code-block:: none
+
+  vyos@left# run generate vpn rsa-key bits 2048
+  Generating rsa-key to /config/ipsec.d/rsa-keys/localhost.key
+
+  Your new local RSA key has been generated
+  The public portion of the key is:
+
+  0sAQO2335[long string here]
+
+Then on the opposite router, add the RSA key to your config.
+
+.. code-block:: none
+
+  set vpn rsa-keys rsa-key-name LEFT rsa-key KEYGOESHERE
+
+Now you are ready to setup IPsec. You'll need to use an ID instead of address
+for the peer on the dynamic side.
+
+On the LEFT (static address):
+
+.. code-block:: none
+
+  set vpn rsa-keys rsa-key-name RIGHT rsa-key <PUBLIC KEY FROM THE RIGHT>
+
+  set vpn ipsec ipsec-interfaces interface eth0
+
+  set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128
+  set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1
+
+  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2
+  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
+  set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1
+
+  set vpn ipsec site-to-site peer @RIGHT authentication mode rsa
+  set vpn ipsec site-to-site peer @RIGHT authentication rsa-key-name RIGHT
+  set vpn ipsec site-to-site peer @RIGHT default-esp-group MyESPGroup
+  set vpn ipsec site-to-site peer @RIGHT ike-group MyIKEGroup
+  set vpn ipsec site-to-site peer @RIGHT local-address 192.0.2.10
+  set vpn ipsec site-to-site peer @RIGHT connection-type respond
+  set vpn ipsec site-to-site peer @RIGHT tunnel 1 local prefix 192.168.99.1/32  # Additional loopback address on the local
+  set vpn ipsec site-to-site peer @RIGHT tunnel 1 remote prefix 192.168.99.2/32 # Additional loopback address on the remote
+
+
+On the RIGHT (dynamic address):
+
+.. code-block:: none
+
+  set vpn rsa-keys rsa-key-name LEFT rsa-key <PUBLIC KEY FROM THE LEFT>
+
+  set vpn ipsec ipsec-interfaces interface eth0
+
+  set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128
+  set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1
+
+  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2
+  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
+  set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1
+
+  set vpn ipsec site-to-site peer 192.0.2.10 authentication id @RIGHT
+  set vpn ipsec site-to-site peer 192.0.2.10 authentication mode rsa
+  set vpn ipsec site-to-site peer 192.0.2.10 authentication rsa-key-name LEFT
+  set vpn ipsec site-to-site peer 192.0.2.10 remote-id @LEFT
+  set vpn ipsec site-to-site peer 192.0.2.10 connection-type initiate
+  set vpn ipsec site-to-site peer 192.0.2.10 default-esp-group MyESPGroup
+  set vpn ipsec site-to-site peer 192.0.2.10 ike-group MyIKEGroup
+  set vpn ipsec site-to-site peer 192.0.2.10 local-address any
+  set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 local prefix 192.168.99.2/32  # Additional loopback address on the local
+  set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 remote prefix 192.168.99.1/32 # Additional loopback address on the remote
diff --git a/docs/configuration/vpn/l2tp.rst b/docs/configuration/vpn/l2tp.rst
new file mode 100644
index 00000000..0d8dde08
--- /dev/null
+++ b/docs/configuration/vpn/l2tp.rst
@@ -0,0 +1,235 @@
+.. _l2tp:
+
+L2TP
+----
+
+VyOS utilizes accel-ppp_ to provide L2TP server functionality. It can be used
+with local authentication or a connected RADIUS server.
+
+L2TP over IPsec
+===============
+
+Example for configuring a simple L2TP over IPsec VPN for remote access (works
+with native Windows and Mac VPN clients):
+
+.. code-block:: none
+
+  set vpn ipsec ipsec-interfaces interface eth0
+  set vpn ipsec nat-traversal enable
+  set vpn ipsec nat-networks allowed-network 0.0.0.0/0
+
+  set vpn l2tp remote-access outside-address 192.0.2.2
+  set vpn l2tp remote-access client-ip-pool start 192.168.255.2
+  set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
+  set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
+  set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret <secret>
+  set vpn l2tp remote-access authentication mode local
+  set vpn l2tp remote-access authentication local-users username test password 'test'
+
+In the example above an external IP of 192.0.2.2 is assumed.
+
+If a local firewall policy is in place on your external interface you will need
+to allow the ports below:
+
+* UDP port 500 (IKE)
+* IP protocol number 50 (ESP)
+* UDP port 1701 for IPsec
+
+As well as the below to allow NAT-traversal (when NAT is detected by the
+VPN client, ESP is encapsulated in UDP for NAT-traversal):
+
+* UDP port 4500 (NAT-T)
+
+Example:
+
+.. code-block:: none
+
+  set firewall name OUTSIDE-LOCAL rule 40 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 40 protocol 'esp'
+  set firewall name OUTSIDE-LOCAL rule 41 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 41 destination port '500'
+  set firewall name OUTSIDE-LOCAL rule 41 protocol 'udp'
+  set firewall name OUTSIDE-LOCAL rule 42 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 42 destination port '4500'
+  set firewall name OUTSIDE-LOCAL rule 42 protocol 'udp'
+  set firewall name OUTSIDE-LOCAL rule 43 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 43 destination port '1701'
+  set firewall name OUTSIDE-LOCAL rule 43 ipsec 'match-ipsec'
+  set firewall name OUTSIDE-LOCAL rule 43 protocol 'udp'
+
+To allow VPN-clients access via your external address, a NAT rule is required:
+
+
+.. code-block:: none
+
+  set nat source rule 110 outbound-interface 'eth0'
+  set nat source rule 110 source address '192.168.255.0/24'
+  set nat source rule 110 translation address masquerade
+
+
+VPN-clients will request configuration parameters, optionally you can DNS
+parameter to the client.
+
+.. code-block:: none
+
+  set vpn l2tp remote-access dns-servers server-1 '8.8.8.8'
+  set vpn l2tp remote-access dns-servers server-2 '8.8.4.4'
+
+.. note:: Those are the `Google public DNS`_ servers, but you can choose
+   any public available servers, like Quad9_ (9.9.9.9), Cloudflare_ (1.1.1.1)
+   or OpenNIC_.
+
+Established sessions can be viewed using the **show vpn remote-access**
+operational command, or **show l2tp-server sessions**
+
+.. code-block:: none
+
+  vyos@vyos:~$ show vpn remote-access
+   ifname | username | calling-sid  |      ip       | rate-limit | type | comp | state  |  uptime
+  --------+----------+--------------+---------------+------------+------+------+--------+----------
+   ppp0   | vyos     | 192.168.0.36 | 192.168.255.1 |            | l2tp |      | active | 00:06:13
+
+
+LNS (L2TP Network Server)
+=========================
+
+LNS are often used to connect to a LAC (L2TP Access Concentrator).
+
+Below is an example to configure a LNS:
+
+.. code-block:: none
+
+  set vpn l2tp remote-access outside-address 192.0.2.2
+  set vpn l2tp remote-access client-ip-pool start 192.168.255.2
+  set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
+  set vpn l2tp remote-access lns shared-secret 'secret'
+  set vpn l2tp remote-access ccp-disable
+  set vpn l2tp remote-access authentication mode local
+  set vpn l2tp remote-access authentication local-users username test password 'test'
+
+The example above uses 192.0.2.2 as external IP address. A LAC normally
+requires an authentication password, which is set in the example configuration
+to ``lns shared-secret 'secret'``. This setup requires the Compression Control
+Protocol (CCP) being disabled, the command ``set vpn l2tp remote-access ccp-disable``
+accomplishes that.
+
+
+Bandwidth Shaping
+=================
+
+Bandwidth rate limits can be set for local users or via RADIUS based attributes.
+
+Bandwidth Shaping for local users
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The rate-limit is set in kbit/sec.
+
+.. code-block:: none
+
+  set vpn l2tp remote-access outside-address 192.0.2.2
+  set vpn l2tp remote-access client-ip-pool start 192.168.255.2
+  set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
+  set vpn l2tp remote-access authentication mode local
+  set vpn l2tp remote-access authentication local-users username test password test
+  set vpn l2tp remote-access authentication local-users username test rate-limit download 20480
+  set vpn l2tp remote-access authentication local-users username test rate-limit upload 10240
+
+  vyos@vyos:~$ show vpn remote-access
+  ifname | username | calling-sid  |      ip       | rate-limit  | type | comp | state  |  uptime
+  -------+----------+--------------+---------------+-------------+------+------+--------+-----------
+  ppp0   | test     | 192.168.0.36 | 192.168.255.2 | 20480/10240 | l2tp |      | active | 00:06:30
+
+RADIUS authentication
+======================
+
+To enable RADIUS based authentication, the authentication mode needs to be
+changed within the configuration. Previous settings like the local users, still
+exists within the configuration, however they are not used if the mode has been
+changed from local to radius. Once changed back to local, it will use all local
+accounts again.
+
+.. code-block:: none
+
+  set vpn l2tp remote-access authentication mode <local|radius>
+
+Since the RADIUS server would be a single point of failure, multiple RADIUS
+servers can be setup and will be used subsequentially.
+
+.. code-block:: none
+
+  set vpn l2tp remote-access authentication radius server 10.0.0.1 key 'foo'
+  set vpn l2tp remote-access authentication radius server 10.0.0.2 key 'foo'
+
+.. note:: Some RADIUS_ severs use an access control list which allows or denies
+   queries, make sure to add your VyOS router to the allowed client list.
+
+RADIUS source address
+^^^^^^^^^^^^^^^^^^^^^
+
+If you are using OSPF as IGP always the closets interface connected to the RADIUS
+server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests to a
+single source IP e.g. the loopback interface.
+
+.. code-block:: none
+
+  set vpn l2tp remote-access authentication radius source-address 10.0.0.3
+
+Above command will use `10.0.0.3` as source IPv4 address for all RADIUS queries
+on this NAS.
+
+.. note:: The ``source-address`` must be configured on one of VyOS interface.
+   Best proctice would be a loopback or dummy interface.
+
+RADIUS bandwidth shaping attribute
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To enable bandwidth shaping via RADIUS, the option rate-limit needs to be enabled.
+
+.. code-block:: none
+
+  set vpn l2tp remote-access authentication radius rate-limit enable
+
+The default RADIUS attribute for rate limiting is ``Filter-Id``, but you may also
+redefine it.
+
+.. code-block:: none
+
+  set vpn l2tp remote-access authentication radius rate-limit attribute Download-Speed
+
+.. note:: If you set a custom RADIUS attribute you must define it on both
+   dictionaries at RADIUS server and client, which is the vyos router in our
+   example.
+
+The RADIUS dictionaries in VyOS are located at ``/usr/share/accel-ppp/radius/``
+
+RADIUS advanced features
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+Received RADIUS attributes have a higher priority than parameters defined within
+the CLI configuration, refer to the explanation below.
+
+Allocation clients ip addresses by RADIUS
+*****************************************
+
+If the RADIUS server sends the attribute ``Framed-IP-Address`` then this IP
+address will be allocated to the client and the option ip-pool within the CLI
+config is being ignored.
+
+Renaming clients interfaces by RADIUS
+*************************************
+
+If the RADIUS server uses the attribute ``NAS-Port-Id``, ppp tunnels will be
+renamed.
+
+.. note:: The value of the attribute ``NAS-Port-Id`` must be less than 16
+   characters, otherwise the interface won't be renamed.
+
+
+.. _`Google Public DNS`: https://developers.google.com/speed/public-dns
+.. _Quad9: https://quad9.net
+.. _CloudFlare: https://blog.cloudflare.com/announcing-1111
+.. _OpenNIC: https://www.opennic.org/
+.. _RADIUS: https://en.wikipedia.org/wiki/RADIUS
+.. _FreeRADIUS: https://freeradius.org
+.. _`Network Policy Server`: https://en.wikipedia.org/wiki/Network_Policy_Server
+.. _accel-ppp: https://accel-ppp.org/
diff --git a/docs/configuration/vpn/openconnect.rst b/docs/configuration/vpn/openconnect.rst
new file mode 100644
index 00000000..a409ed9d
--- /dev/null
+++ b/docs/configuration/vpn/openconnect.rst
@@ -0,0 +1,95 @@
+.. _vpn-openconnect:
+
+###########
+OpenConnect
+###########
+
+OpenConnect-compatible server feature is available from this release.
+Openconnect VPN supports SSL connection and offers full network access. SSL VPN
+network extension connects the end-user system to the corporate network with
+access controls based only on network layer information, such as destination IP
+address and port number. So, it provides safe communication for all types of
+device traffic across public networks and private networks, also encrypts the
+traffic with SSL protocol.
+
+The remote user will use the openconnect client to connect to the router and
+will receive an IP address from a VPN pool, allowing full access to the network.
+
+.. note:: All certificates should be stored on VyOS under /config/auth. If
+   certificates are not stored in the /config directory they will not be
+   migrated during a software update.
+
+*************
+Configuration
+*************
+
+SSL Certificates
+================
+
+We need to generate the certificate which authenticates users who attempt to
+access the network resource through the SSL VPN tunnels. The following command
+will create a self signed certificates and will be stored in the file path
+`/config/auth`.
+
+.. code-block:: none
+
+  openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -keyout /config/auth/server.key -out /config/auth/server.crt
+  openssl req -new -x509 -key /config/auth/server.key -out /config/auth/ca.crt
+
+We can also create the certificates using Cerbort which is an easy-to-use client
+that fetches a certificate from Let's Encrypt an open certificate authority
+launched by the EFF, Mozilla, and others and deploys it to a web server.
+
+.. code-block:: none
+
+  sudo certbot certonly --standalone --preferred-challenges http -d <domain name>
+
+Server Configuration
+====================
+
+.. code-block:: none
+
+  set vpn openconnect authentication local-users username <user> password <pass>
+  set vpn openconnect authentication mode <local|radius>
+  set vpn opneconnect network-settings client-ip-settings subnet <subnet>
+  set vpn openconnect network-settings name-server <address>
+  set vpn openconnect network-settings name-server <address>
+  set vpn openconnect ssl ca-cert-file <file>
+  set vpn openconnect ssl cert-file <file>
+  set vpn openconnect ssl key-file <file>
+
+
+*******
+Example
+*******
+
+Use local user name "user4" with password "SecretPassword"
+Client IP addresses will be provided from pool 100.64.0.0/24
+The Gateway IP Address must be in one of the router´s interfaces.
+
+.. code-block:: none
+
+  set vpn openconnect authentication local-users username user4 password 'SecretPassword'
+  set vpn openconnect authentication mode 'local'
+  set vpn openconnect network-settings client-ip-settings subnet '100.64.0.0/24'
+  set vpn openconnect network-settings name-server '1.1.1.1'
+  set vpn openconnect network-settings name-server '8.8.8.8'
+  set vpn openconnect ssl ca-cert-file '/config/auth/fullchain.pem'
+  set vpn openconnect ssl cert-file '/config/auth/cert.pem'
+  set vpn openconnect ssl key-file '/config/auth/privkey.pem'
+
+
+************
+Verification
+************
+
+.. code-block:: none
+
+
+  vyos@RTR1:~$ show openconnect-server sessions
+
+  interface    username    ip            remote IP      RX        TX        state      uptime
+  -----------  ----------  ------------  -------------  --------  --------  ---------  --------
+  sslvpn0      user4       100.64.0.105  xx.xxx.49.253  127.3 KB  160.0 KB  connected  12m:28s
+
+.. note:: It is compatible with Cisco (R) AnyConnect (R) clients.
diff --git a/docs/configuration/vpn/pptp.rst b/docs/configuration/vpn/pptp.rst
new file mode 100644
index 00000000..72b3feb0
--- /dev/null
+++ b/docs/configuration/vpn/pptp.rst
@@ -0,0 +1,47 @@
+.. _pptp:
+
+PPTP-Server
+-----------
+
+The Point-to-Point Tunneling Protocol (PPTP_) has been implemented in VyOS only for backwards compatibility.
+PPTP has many well known security issues and you should use one of the many other new VPN implementations.
+
+As per default and if not otherwise defined, mschap-v2 is being used for authentication and mppe 128-bit (stateless) for encryption.
+If no gateway-address is set within the configuration, the lowest IP out of the /24 client-ip-pool is being used. For instance, in the example below it would be 192.168.0.1.
+
+server example
+^^^^^^^^^^^^^^
+
+.. code-block:: none
+
+  set vpn pptp remote-access authentication local-users username test password 'test'
+  set vpn pptp remote-access authentication mode 'local'
+  set vpn pptp remote-access client-ip-pool start '192.168.0.10'
+  set vpn pptp remote-access client-ip-pool stop '192.168.0.15'
+  set vpn pptp remote-access gateway-address '10.100.100.1'
+  set vpn pptp remote-access outside-address '10.1.1.120'
+
+
+client example (debian 9)
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Install the client software via apt and execute pptpsetup to generate the configuration.
+
+
+.. code-block:: none
+
+  apt-get install pptp-linux
+  pptpsetup --create TESTTUNNEL --server 10.1.1.120 --username test --password test --encrypt
+  pon TESTTUNNEL
+
+The command pon TESTUNNEL establishes the PPTP tunnel to the remote system.
+
+
+All tunnel sessions can be checked via:
+
+.. code-block:: none
+
+  run sh pptp-server sessions
+   ifname | username | calling-sid |      ip      | type | comp | state  |  uptime
+  --------+----------+-------------+--------------+------+------+--------+----------
+   ppp0   | test     | 10.1.1.99   | 192.168.0.10 | pptp | mppe | active | 00:00:58
diff --git a/docs/configuration/vpn/site2site_ipsec.rst b/docs/configuration/vpn/site2site_ipsec.rst
new file mode 100644
index 00000000..97f27b43
--- /dev/null
+++ b/docs/configuration/vpn/site2site_ipsec.rst
@@ -0,0 +1,298 @@
+.. _size2site_ipsec:
+
+Site-to-Site
+============
+
+Site-to-site mode provides a way to add remote peers, which could be configured to exchange encrypted information between them and VyOS itself or connected/routed networks.
+
+To configure site-to-site connection you need to add peers with the ``set vpn ipsec site-to-site`` command.
+
+You can identify a remote peer with:
+
+* IPv4 or IPv6 address. This mode is easiest for configuration and mostly used when a peer has a public static IP address;
+* Hostname. This mode is similar to IP address, only you define DNS name instead of an IP. Could be used when a peer has a public IP address and DNS name, but an IP address could be changed from time to time;
+* Remote ID of the peer. In this mode, there is no predefined remote address nor DNS name of the peer. This mode is useful when a peer doesn't have a publicly available IP address (NAT between it and VyOS), or IP address could be changed.
+
+Each site-to-site peer has the next options:
+
+* ``authentication`` - configure authentication between VyOS and a remote peer. Suboptions:
+
+ * ``id`` - ID for the local VyOS router. If defined, during the authentication it will be send to remote peer;
+
+ * ``mode`` - mode for authentication between VyOS and remote peer:
+
+  * ``pre-shared-secret`` - use predefined shared secret phrase, must be the same for local and remote side;
+
+  * ``rsa`` - use simple shared RSA key. The key must be defined in the ``set vpn rsa-keys`` section;
+
+  * ``x509`` - use certificates infrastructure for authentication.
+
+ * ``pre-shared-secret`` - predefined shared secret. Used if configured ``mode pre-shared-secret``;
+
+ * ``remote-id`` - define an ID for remote peer, instead of using peer name or address. Useful in case if the remote peer is behind NAT or if ``mode x509`` is used;
+
+ * ``rsa-key-name`` - shared RSA key for authentication. The key must be defined in the ``set vpn rsa-keys`` section;
+
+ * ``use-x509-id`` - use local ID from x509 certificate. Cannot be used when ``id`` is defined;
+
+ * ``x509`` - options for x509 authentication mode:
+
+  * ``ca-cert-file`` - CA certificate file. Using for authenticating remote peer;
+
+  * ``cert-file`` - certificate file, which will be used for authenticating local router on remote peer;
+
+  * ``crl-file`` - file with the Certificate Revocation List. Using to check if a certificate for the remote peer is valid or revoked;
+
+  * ``key`` - a private key, which will be used for authenticating local router on remote peer:
+
+   * ``file`` - path to the key file;
+
+   * ``password`` - passphrase private key, if needed.
+
+* ``connection-type`` - how to handle this connection process. Possible variants:
+
+ * ``initiate`` - do initial connection to remote peer immediately after configuring and after boot. In this mode the connection will not be restarted in case of disconnection, therefore should be used only together with DPD or another session tracking methods;
+
+ * ``respond`` - do not try to initiate a connection to a remote peer. In this mode, the IPSec session will be established only after initiation from a remote peer. Could be useful when there is no direct connectivity to the peer due to firewall or NAT in the middle of the local and remote side.
+
+* ``default-esp-group`` - ESP group to use by default for traffic encryption. Might be overwritten by individual settings for tunnel or VTI interface binding;
+
+* ``description`` - description for this peer;
+
+* ``dhcp-interface`` - use an IP address, received from DHCP for IPSec connection with this peer, instead of ``local-address``;
+
+* ``force-encapsulation`` - force encapsulation of ESP into UDP datagrams. Useful in case if between local and remote side is firewall or NAT, which not allows passing plain ESP packets between them;
+
+* ``ike-group`` - IKE group to use for key exchanges;
+
+* ``ikev2-reauth`` - reauthenticate remote peer during the rekeying process. Can be used only with IKEv2:
+
+ * ``yes`` - create a new IKE_SA from the scratch and try to recreate all IPsec SAs;
+
+ * ``no`` - rekey without uninstalling the IPsec SAs;
+
+ * ``inherit`` - use default behavior for the used IKE group.
+
+* ``local-address`` - local IP address for IPSec connection with this peer. If defined ``any``, then an IP address which configured on interface with default route will be used;
+
+* ``tunnel`` - define criteria for traffic to be matched for encrypting and send it to a peer:
+
+ * ``disable`` - disable this tunnel;
+
+ * ``esp-group`` - define ESP group for encrypt traffic, defined by this tunnel;
+
+ * ``local`` - define a local source for match traffic, which should be encrypted and send to this peer:
+
+  * ``port`` - define port. Have effect only when used together with ``prefix``;
+
+  * ``prefix`` - IP network at local side.
+
+ * ``protocol`` - define the protocol for match traffic, which should be encrypted and send to this peer;
+
+ * ``remote`` - define the remote destination for match traffic, which should be encrypted and send to this peer:
+
+  * ``port`` - define port. Have effect only when used together with ``prefix``;
+
+  * ``prefix`` - IP network at remote side.
+
+* ``vti`` - use a VTI interface for traffic encryption. Any traffic, which will be send to VTI interface will be encrypted and send to this peer. Using VTI makes IPSec configuration much flexible and easier in complex situation, and allows to dynamically add/delete remote networks, reachable via a peer, as in this mode router don't need to create additional SA/policy for each remote network:
+
+ * ``bind`` - select a VTI interface to bind to this peer;
+
+ * ``esp-group`` - define ESP group for encrypt traffic, passed this VTI interface.
+
+Examples:
+------------------
+
+IKEv1
+^^^^^
+
+Example:
+
+* WAN interface on `eth1`
+* left subnet: `192.168.0.0/24` site1, server side (i.e. locality, actually
+  there is no client or server roles)
+* left local_ip: `198.51.100.3` # server side WAN IP
+* right subnet: `10.0.0.0/24` site2,remote office side
+* right local_ip: `203.0.113.2` # remote office side WAN IP
+
+.. code-block:: none
+
+  # server config
+  set vpn ipsec esp-group office-srv-esp compression 'disable'
+  set vpn ipsec esp-group office-srv-esp lifetime '1800'
+  set vpn ipsec esp-group office-srv-esp mode 'tunnel'
+  set vpn ipsec esp-group office-srv-esp pfs 'enable'
+  set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
+  set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
+  set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
+  set vpn ipsec ike-group office-srv-ike lifetime '3600'
+  set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
+  set vpn ipsec ipsec-interfaces interface 'eth1'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'SomePreSharedKey'
+  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'office-srv-ike'
+  set vpn ipsec site-to-site peer 203.0.113.2 local-address '198.51.100.3'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 allow-nat-networks 'disable'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 allow-public-networks 'disable'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 esp-group 'office-srv-esp'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 local prefix '192.168.0.0/24'
+  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 remote prefix '10.0.0.0/21'
+
+  # remote office config
+  set vpn ipsec esp-group office-srv-esp compression 'disable'
+  set vpn ipsec esp-group office-srv-esp lifetime '1800'
+  set vpn ipsec esp-group office-srv-esp mode 'tunnel'
+  set vpn ipsec esp-group office-srv-esp pfs 'enable'
+  set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
+  set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
+  set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
+  set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
+  set vpn ipsec ike-group office-srv-ike lifetime '3600'
+  set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
+  set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
+  set vpn ipsec ipsec-interfaces interface 'eth1'
+  set vpn ipsec site-to-site peer 198.51.100.3 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 198.51.100.3 authentication pre-shared-secret 'SomePreSharedKey'
+  set vpn ipsec site-to-site peer 198.51.100.3 ike-group 'office-srv-ike'
+  set vpn ipsec site-to-site peer 198.51.100.3 local-address '203.0.113.2'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 allow-nat-networks 'disable'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 allow-public-networks 'disable'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 esp-group 'office-srv-esp'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 local prefix '10.0.0.0/21'
+  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 remote prefix '192.168.0.0/24'
+
+Show status of new setup:
+
+.. code-block:: none
+
+  vyos@srv-gw0:~$ show vpn ike sa
+  Peer ID / IP                            Local ID / IP
+  ------------                            -------------
+  203.0.113.2                                 198.51.100.3
+     State  Encrypt  Hash    D-H Grp  NAT-T  A-Time  L-Time
+     -----  -------  ----    -------  -----  ------  ------
+     up     aes256   sha1    5        no     734     3600
+
+  vyos@srv-gw0:~$ show vpn ipsec sa
+  Peer ID / IP                            Local ID / IP
+  ------------                            -------------
+  203.0.113.2                                 198.51.100.3
+     Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
+     ------  -----  -------------  -------  ----    -----  ------  ------  -----
+     0       up     7.5M/230.6K    aes256   sha1    no     567     1800    all
+
+If there is SNAT rules on eth1, need to add exclude rule
+
+.. code-block:: none
+
+  # server side
+  set nat source rule 10 destination address '10.0.0.0/24'
+  set nat source rule 10 'exclude'
+  set nat source rule 10 outbound-interface 'eth1'
+  set nat source rule 10 source address '192.168.0.0/24'
+
+  # remote office side
+  set nat source rule 10 destination address '192.168.0.0/24'
+  set nat source rule 10 'exclude'
+  set nat source rule 10 outbound-interface 'eth1'
+  set nat source rule 10 source address '10.0.0.0/24'
+
+To allow traffic to pass through to clients, you need to add the following
+rules. (if you used the default configuration at the top of this page)
+
+.. code-block:: none
+
+  # server side
+  set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 32 source address '10.0.0.0/24'
+
+  # remote office side
+  set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
+  set firewall name OUTSIDE-LOCAL rule 32 source address '192.168.0.0/24'
+
+IKEv2
+^^^^^
+
+Imagine the following topology
+
+.. figure:: /_static/images/vpn_s2s_ikev2.png
+   :scale: 50 %
+   :alt: IPSec IKEv2 site2site VPN
+
+   IPSec IKEv2 site2site VPN (source ./draw.io/vpn_s2s_ikev2.drawio)
+
+
+.. note:: Don't get confused about the used /31 tunnel subnet. :rfc:`3021`
+   gives you additional information for using /31 subnets on point-to-point
+   links.
+
+**left**
+
+.. code-block:: none
+
+  set interfaces vti vti10 address '10.0.0.2/31'
+
+  set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
+  set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
+  set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
+  set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
+  set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
+  set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'hold'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
+  set vpn ipsec ike-group IKEv2_DEFAULT ikev2-reauth 'no'
+  set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
+  set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
+  set vpn ipsec ike-group IKEv2_DEFAULT mobike 'disable'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
+  set vpn ipsec ipsec-interfaces interface 'eth0.201'
+  set vpn ipsec site-to-site peer 172.18.202.10 authentication id '172.18.201.10'
+  set vpn ipsec site-to-site peer 172.18.202.10 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 172.18.202.10 authentication pre-shared-secret 'secretkey'
+  set vpn ipsec site-to-site peer 172.18.202.10 authentication remote-id '172.18.202.10'
+  set vpn ipsec site-to-site peer 172.18.202.10 connection-type 'initiate'
+  set vpn ipsec site-to-site peer 172.18.202.10 ike-group 'IKEv2_DEFAULT'
+  set vpn ipsec site-to-site peer 172.18.202.10 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 172.18.202.10 local-address '172.18.201.10'
+  set vpn ipsec site-to-site peer 172.18.202.10 vti bind 'vti10'
+  set vpn ipsec site-to-site peer 172.18.202.10 vti esp-group 'ESP_DEFAULT'
+
+**right**
+
+.. code-block:: none
+
+  set interfaces vti vti10 address '10.0.0.3/31'
+
+  set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
+  set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
+  set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
+  set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
+  set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
+  set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'hold'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
+  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
+  set vpn ipsec ike-group IKEv2_DEFAULT ikev2-reauth 'no'
+  set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
+  set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
+  set vpn ipsec ike-group IKEv2_DEFAULT mobike 'disable'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
+  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
+  set vpn ipsec ipsec-interfaces interface 'eth0.202'
+  set vpn ipsec site-to-site peer 172.18.201.10 authentication id '172.18.202.10'
+  set vpn ipsec site-to-site peer 172.18.201.10 authentication mode 'pre-shared-secret'
+  set vpn ipsec site-to-site peer 172.18.201.10 authentication pre-shared-secret 'secretkey'
+  set vpn ipsec site-to-site peer 172.18.201.10 authentication remote-id '172.18.201.10'
+  set vpn ipsec site-to-site peer 172.18.201.10 connection-type 'initiate'
+  set vpn ipsec site-to-site peer 172.18.201.10 ike-group 'IKEv2_DEFAULT'
+  set vpn ipsec site-to-site peer 172.18.201.10 ikev2-reauth 'inherit'
+  set vpn ipsec site-to-site peer 172.18.201.10 local-address '172.18.202.10'
+  set vpn ipsec site-to-site peer 172.18.201.10 vti bind 'vti10'
+  set vpn ipsec site-to-site peer 172.18.201.10 vti esp-group 'ESP_DEFAULT'
diff --git a/docs/configuration/vpn/sstp.rst b/docs/configuration/vpn/sstp.rst
new file mode 100644
index 00000000..dbaa41c0
--- /dev/null
+++ b/docs/configuration/vpn/sstp.rst
@@ -0,0 +1,347 @@
+.. _sstp:
+
+####
+SSTP
+####
+
+:abbr:`SSTP (Secure Socket Tunneling Protocol)` is a form of :abbr:`VPN
+(Virtual Private Network)` tunnel that provides a mechanism to transport PPP
+traffic through an SSL/TLS channel. SSL/TLS provides transport-level security
+with key negotiation, encryption and traffic integrity checking. The use of
+SSL/TLS over TCP port 443 allows SSTP to pass through virtually all firewalls
+and proxy servers except for authenticated web proxies.
+
+SSTP is available for Linux, BSD, and Windows.
+
+VyOS utilizes accel-ppp_ to provide SSTP server functionality. We support both
+local and RADIUS authentication.
+
+As SSTP provides PPP via a SSL/TLS channel the use of either publically signed
+certificates as well as a private PKI is required.
+
+.. note:: All certificates should be stored on VyOS under ``/config/auth``. If
+  certificates are not stored in the ``/config`` directory they will not be
+  migrated during a software update.
+
+Certificates
+============
+
+Self Signed CA
+--------------
+
+To generate the CA, the server private key and certificates the following
+commands can be used.
+
+.. code-block:: none
+
+  vyos@vyos:~$ mkdir -p /config/user-data/sstp
+  vyos@vyos:~$ openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -keyout /config/user-data/sstp/server.key -out /config/user-data/sstp/server.crt
+
+  Generating a 4096 bit RSA private key
+  .........................++
+  ...............................................................++
+  writing new private key to 'server.key'
+  [...]
+  Country Name (2 letter code) [AU]:
+  State or Province Name (full name) [Some-State]:
+  Locality Name (eg, city) []:
+  Organization Name (eg, company) [Internet Widgits Pty Ltd]:
+  Organizational Unit Name (eg, section) []:
+  Common Name (e.g. server FQDN or YOUR name) []:
+  Email Address []:
+
+  vyos@vyos:~$ openssl req -new -x509 -key /config/user-data/sstp/server.key -out /config/user-data/sstp/ca.crt
+  [...]
+  Country Name (2 letter code) [AU]:
+  State or Province Name (full name) [Some-State]:
+  Locality Name (eg, city) []:
+  Organization Name (eg, company) [Internet Widgits Pty Ltd]:
+  Organizational Unit Name (eg, section) []:
+  Common Name (e.g. server FQDN or YOUR name) []:
+  Email Address []:
+
+
+Configuration
+=============
+
+.. cfgcmd:: set vpn sstp authentication local-users username <user> password <pass>
+
+  Create `<user>` for local authentication on this system. The users password
+  will be set to `<pass>`.
+
+.. cfgcmd:: set vpn sstp authentication local-users username <user> disable
+
+  Disable `<user>` account.
+
+.. cfgcmd:: set vpn sstp authentication local-users username <user> static-ip <address>
+
+  Assign static IP address to `<user>` account.
+
+.. cfgcmd:: set vpn sstp authentication local-users username <user> rate-limit download <bandwidth>
+
+  Download bandwidth limit in kbit/s for `<user>`.
+
+.. cfgcmd:: set vpn sstp authentication local-users username <user> rate-limit upload <bandwidth>
+
+  Upload bandwidth limit in kbit/s for `<user>`.
+
+.. cfgcmd:: set vpn sstp authentication protocols <pap | chap | mschap | mschap-v2>
+
+  Require the peer to authenticate itself using one of the following protocols:
+  pap, chap, mschap, mschap-v2.
+
+.. cfgcmd:: set vpn sstp authentication mode <local | radius>
+
+  Set authentication backend. The configured authentication backend is used
+  for all queries.
+
+  * **radius**: All authentication queries are handled by a configured RADIUS
+    server.
+  * **local**: All authentication queries are handled locally.
+
+
+.. cfgcmd:: set vpn sstp gateway-address <gateway>
+
+  Specifies single `<gateway>` IP address to be used as local address of PPP
+  interfaces.
+
+
+.. cfgcmd:: set vpn sstp client-ip-pool subnet <subnet>
+
+  Use `<subnet>` as the IP pool for all connecting clients.
+
+
+.. cfgcmd:: set vpn sstp client-ipv6-pool prefix <address> mask <number-of-bits>
+
+  Use this comand to set the IPv6 address pool from which an SSTP client
+  will get an IPv6 prefix of your defined length (mask) to terminate the
+  SSTP endpoint at their side. The mask length can be set from 48 to 128
+  bit long, the default value is 64.
+
+
+.. cfgcmd:: set vpn sstp client-ipv6-pool delegate <address> delegation-prefix <number-of-bits>
+
+  Use this command to configure DHCPv6 Prefix Delegation (RFC3633) on
+  SSTP. You will have to set your IPv6 pool and the length of the
+  delegation prefix. From the defined IPv6 pool you will be handing out
+  networks of the defined length (delegation-prefix). The length of the
+  delegation prefix can be set from 32 to 64 bit long.
+
+
+.. cfgcmd:: set vpn sstp name-server <address>
+
+  Connected client should use `<address>` as their DNS server. This
+  command accepts both IPv4 and IPv6 addresses. Up to two nameservers
+  can be configured for IPv4, up to three for IPv6.
+
+Maximum number of IPv4 nameservers
+
+SSL Certificates
+----------------
+
+.. cfgcmd:: set vpn sstp ssl ca-cert-file <file>
+
+  Path to `<file>` pointing to the certificate authority certificate.
+
+.. cfgcmd:: set vpn sstp ssl cert-file <file>
+
+  Path to `<file>` pointing to the servers certificate (public portion).
+
+.. cfgcmd:: set vpn sstp ssl key-file <file>
+
+  Path to `<file>` pointing to the servers certificate (private portion).
+
+PPP Settings
+------------
+
+.. cfgcmd:: set vpn sstp ppp-options lcp-echo-failure <number>
+
+  Defines the maximum `<number>` of unanswered echo requests. Upon reaching the
+  value `<number>`, the session will be reset.
+
+.. cfgcmd:: set vpn sstp ppp-options lcp-echo-interval <interval>
+
+  If this option is specified and is greater than 0, then the PPP module will
+  send LCP pings of the echo request every `<interval>` seconds.
+
+.. cfgcmd:: set vpn sstp ppp-options lcp-echo-timeout
+
+  Specifies timeout in seconds to wait for any peer activity. If this option
+  specified it turns on adaptive lcp echo functionality and "lcp-echo-failure"
+  is not used.
+
+.. cfgcmd:: set vpn sstp ppp-options mppe <require | prefer | deny>
+
+  Specifies :abbr:`MPPE (Microsoft Point-to-Point Encryption)` negotioation
+  preference.
+
+  * **require** - ask client for mppe, if it rejects drop connection
+  * **prefer** - ask client for mppe, if it rejects don't fail
+  * **deny** - deny mppe
+
+  Default behavior - don't ask client for mppe, but allow it if client wants.
+  Please note that RADIUS may override this option by MS-MPPE-Encryption-Policy
+  attribute.
+
+
+RADIUS
+------
+
+Server
+^^^^^^
+
+.. cfgcmd:: set vpn sstp authentication radius server <server> port <port>
+
+  Configure RADIUS `<server>` and its required port for authentication requests.
+
+.. cfgcmd:: set vpn sstp authentication radius server <server> key <secret>
+
+  Configure RADIUS `<server>` and its required shared `<secret>` for
+  communicating with the RADIUS server.
+
+.. cfgcmd:: set vpn sstp authentication radius server <server> fail-time <time>
+
+  Mark RADIUS server as offline for this given `<time>` in seconds.
+
+.. cfgcmd:: set vpn sstp authentication radius server <server> disable
+
+  Temporary disable this RADIUS server.
+
+Options
+^^^^^^^
+
+.. cfgcmd:: set vpn sstp authentication radius acct-timeout <timeout>
+
+  Timeout to wait reply for Interim-Update packets. (default 3 seconds)
+
+.. cfgcmd:: set vpn sstp authentication radius dynamic-author server <address>
+
+  Specifies IP address for Dynamic Authorization Extension server (DM/CoA)
+
+.. cfgcmd:: set vpn sstp authentication radius dynamic-author port <port>
+
+  Port for Dynamic Authorization Extension server (DM/CoA)
+
+.. cfgcmd:: set vpn sstp authentication radius dynamic-author key <secret>
+
+  Secret for Dynamic Authorization Extension server (DM/CoA)
+
+.. cfgcmd:: set vpn sstp authentication radius max-try <number>
+
+  Maximum number of tries to send Access-Request/Accounting-Request queries
+
+.. cfgcmd:: set vpn sstp authentication radius timeout <timeout>
+
+  Timeout to wait response from server (seconds)
+
+.. cfgcmd:: set vpn sstp authentication radius nas-identifier <identifier>
+
+  Value to send to RADIUS server in NAS-Identifier attribute and to be matched
+  in DM/CoA requests.
+
+.. cfgcmd:: set vpn sstp authentication radius nas-ip-address <address>
+
+  Value to send to RADIUS server in NAS-IP-Address attribute and to be matched
+  in DM/CoA requests. Also DM/CoA server will bind to that address.
+
+.. cfgcmd:: set vpn sstp authentication radius source-address <address>
+
+  Source IPv4 address used in all RADIUS server queires.
+
+.. cfgcmd:: set vpn sstp authentication radius rate-limit attribute <attribute>
+
+  Specifies which RADIUS server attribute contains the rate limit information.
+  The default attribute is `Filter-Id`.
+
+.. cfgcmd:: set vpn sstp authentication radius rate-limit enable
+
+  Enables bandwidth shaping via RADIUS.
+
+.. cfgcmd:: set vpn sstp authentication radius rate-limit vendor
+
+  Specifies the vendor dictionary, dictionary needs to be in
+  /usr/share/accel-ppp/radius.
+
+
+Example
+=======
+
+* Use local user `foo` with password `bar`
+* Client IP addresses will be provided from pool `192.0.2.0/25`
+
+.. code-block:: none
+
+  set vpn sstp authentication local-users username vyos password vyos
+  set vpn sstp authentication mode local
+  set vpn sstp gateway-address 192.0.2.254
+  set vpn sstp client-ip-pool subnet 192.0.2.0/25
+  set vpn sstp name-server 10.0.0.1
+  set vpn sstp name-server 10.0.0.2
+  set vpn sstp ssl ca-cert-file /config/auth/ca.crt
+  set vpn sstp ssl cert-file /config/auth/server.crt
+  set vpn sstp ssl key-file /config/auth/server.key
+
+Testing SSTP
+============
+
+Once you have setup your SSTP server there comes the time to do some basic
+testing. The Linux client used for testing is called sstpc_. sstpc_ requires a
+PPP configuration/peer file.
+
+The following PPP configuration tests MSCHAP-v2:
+
+.. code-block:: none
+
+  $ cat /etc/ppp/peers/vyos
+  usepeerdns
+  #require-mppe
+  #require-pap
+  require-mschap-v2
+  noauth
+  lock
+  refuse-pap
+  refuse-eap
+  refuse-chap
+  refuse-mschap
+  #refuse-mschap-v2
+  nobsdcomp
+  nodeflate
+  debug
+
+
+You can now "dial" the peer with the follwoing command: ``sstpc --log-level 4
+--log-stderr --user vyos --password vyos vpn.example.com -- call vyos``.
+
+A connection attempt will be shown as:
+
+.. code-block:: none
+
+  $ sstpc --log-level 4 --log-stderr --user vyos --password vyos vpn.example.com -- call vyos
+
+  Mar 22 13:29:12 sstpc[12344]: Resolved vpn.example.com to 192.0.2.1
+  Mar 22 13:29:12 sstpc[12344]: Connected to vpn.example.com
+  Mar 22 13:29:12 sstpc[12344]: Sending Connect-Request Message
+  Mar 22 13:29:12 sstpc[12344]: SEND SSTP CRTL PKT(14)
+  Mar 22 13:29:12 sstpc[12344]:   TYPE(1): CONNECT REQUEST, ATTR(1):
+  Mar 22 13:29:12 sstpc[12344]:     ENCAP PROTO(1): 6
+  Mar 22 13:29:12 sstpc[12344]: RECV SSTP CRTL PKT(48)
+  Mar 22 13:29:12 sstpc[12344]:   TYPE(2): CONNECT ACK, ATTR(1):
+  Mar 22 13:29:12 sstpc[12344]:     CRYPTO BIND REQ(4): 40
+  Mar 22 13:29:12 sstpc[12344]: Started PPP Link Negotiation
+  Mar 22 13:29:15 sstpc[12344]: Sending Connected Message
+  Mar 22 13:29:15 sstpc[12344]: SEND SSTP CRTL PKT(112)
+  Mar 22 13:29:15 sstpc[12344]:   TYPE(4): CONNECTED, ATTR(1):
+  Mar 22 13:29:15 sstpc[12344]:     CRYPTO BIND(3): 104
+  Mar 22 13:29:15 sstpc[12344]: Connection Established
+
+  $ ip addr show ppp0
+  164: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1452 qdisc fq_codel state UNKNOWN group default qlen 3
+       link/ppp  promiscuity 0
+       inet 100.64.2.2 peer 100.64.1.1/32 scope global ppp0
+          valid_lft forever preferred_lft forever
+
+
+
+.. _sstpc: https://github.com/reliablehosting/sstp-client
+
+.. include:: /_include/common-references.txt
diff --git a/docs/configuration/vrf/index.rst b/docs/configuration/vrf/index.rst
new file mode 100644
index 00000000..a47175f2
--- /dev/null
+++ b/docs/configuration/vrf/index.rst
@@ -0,0 +1,307 @@
+.. _vrf:
+
+###
+VRF
+###
+
+:abbr:`VRF (Virtual Routing and Forwarding)` devices combined with ip rules
+provides the ability to create virtual routing and forwarding domains (aka
+VRFs, VRF-lite to be specific) in the Linux network stack. One use case is the
+multi-tenancy problem where each tenant has their own unique routing tables and
+in the very least need different default gateways.
+
+.. warning:: VRFs are an "needs testing" feature. If you think things should be
+   different then they are implemented and handled right now - please feedback
+   via a task created in Phabricator_.
+
+
+Configuration
+=============
+
+A VRF device is created with an associated route table. Network interfaces are
+then enslaved to a VRF device.
+
+.. cfgcmd:: set vrf name <name>
+
+   Create new VRF instance with `<name>`. The name is used when placing individual
+   interfaces into the VRF.
+
+.. cfgcmd:: set vrf name <name> table <id>
+
+   Configure use routing table `<id>` used by VRF `<name>`.
+
+   .. note:: A routing table ID can not be modified once it is assigned. It can
+      only be changed by deleting and re-adding the VRF instance.
+
+
+.. cfgcmd:: set vrf bind-to-all
+
+   By default the scope of the port bindings for unbound sockets is limited to
+   the default VRF. That is, it will not be matched by packets arriving on
+   interfaces enslaved to a VRF and processes may bind to the same port if
+   they bind to a VRF.
+
+   TCP & UDP services running in the default VRF context (ie., not bound to any
+   VRF device) can work across all VRF domains by enabling this option.
+
+Interfaces
+----------
+
+When VRFs are used it is not only mandatory to create a VRF but also the VRF
+itself needs to be assigned to an interface.
+
+.. cfgcmd:: set interfaces <dummy | ethernet | bonding | bridge | pppoe> <interface> vrf <name>
+
+   Assign interface identified by `<interface>` to VRF named `<name>`.
+
+Routing
+-------
+
+Static
+^^^^^^
+
+Static routes are manually configured routes, which, in general, cannot be
+updated dynamically from information VyOS learns about the network topology from
+other routing protocols. However, if a link fails, the router will remove
+routes, including static routes, from the :abbr:`RIPB (Routing Information
+Base)` that used this interface to reach the next hop. In general, static
+routes should only be used for very simple network topologies, or to override
+the behavior of a dynamic routing protocol for a small number of routes. The
+collection of all routes the router has learned from its configuration or from
+its dynamic routing protocols is stored in the RIB. Unicast routes are directly
+used to determine the forwarding table used for unicast packet forwarding.
+
+Static Routes
+"""""""""""""
+
+.. cfgcmd:: set protocols vrf <name> static route <subnet> next-hop <address>
+
+   Configure next-hop `<address>` for an IPv4 static route in the VRF identified
+   by `<name>`. Multiple static routes can be created.
+
+.. cfgcmd:: set protocols vrf <name> static route <subnet> next-hop <address> disable
+
+   Disable IPv4 static route entry in the VRF identified by `<name>`
+
+.. cfgcmd:: set protocols vrf <name> static route <subnet> next-hop <address> distance <distance>
+
+   Defines next-hop distance for this route, routes with smaller administrative
+   distance are elected prior those with a higher distance.
+
+   Range is 1 to 255, default is 1.
+
+.. cfgcmd:: set protocols vrf <name> static route6 <subnet> next-hop <address>
+
+   Configure next-hop `<address>` for an IPv6 static route in the VRF identified
+   by `<name>`. Multiple IPv6 static routes can be created.
+
+.. cfgcmd:: set protocols vrf <name> static route6 <subnet> next-hop <address> disable
+
+   Disable IPv6 static route entry in the VRF identified by `<name>`.
+
+.. cfgcmd:: set protocols vrf <name> static route6 <subnet> next-hop <address> distance <distance>
+
+   Defines next-hop distance for this route, routes with smaller administrative
+   distance are elected prior those with a higher distance.
+
+   Range is 1 to 255, default is 1.
+
+   .. note:: Routes with a distance of 255 are effectively disabled and not
+      installed into the kernel.
+
+
+Leaking
+"""""""
+
+.. cfgcmd:: set protocols vrf <name> static route <subnet> next-hop <address> next-hop-vrf <default | vrf-name>
+
+   Use this command if you have shared services or routes that should be shared
+   between multiple VRF instances. This will add an IPv4 route to VRF `<name>`
+   routing table to reach a `<subnet>` via a next-hop gatewys `<address>` in
+   a different VRF or leak it into the default VRF.
+
+.. cfgcmd:: set protocols vrf <name> static route6 <subnet> next-hop <address> next-hop-vrf <default | vrf-name>
+
+   Use this command if you have shared services or routes that should be shared
+   between multiple VRF instances. This will add an IPv6 route to VRF `<name>`
+   routing table to reach a `<subnet>` via a next-hop gatewys `<address>` in
+   a different VRF or leak it into the default VRF.
+
+
+Interface Routes
+""""""""""""""""
+
+.. cfgcmd:: set protocols vrf <name> static interface-route <subnet> next-hop-interface <interface>
+
+   Allows you to configure the next-hop interface for an interface-based IPv4
+   static route. `<interface>` will be the next-hop interface where trafic is
+   routed for the given `<subnet>`.
+
+.. cfgcmd:: set protocols vrf <name> static interface-route <subnet> next-hop-interface <interface> disable
+
+   Disables interface-based IPv4 static route.
+
+.. cfgcmd:: set protocols vrf <name> static interface-route <subnet> next-hop-interface <interface> distance <distance>
+
+   Defines next-hop distance for this route, routes with smaller administrative
+   distance are elected prior those with a higher distance.
+
+   Range is 1 to 255, default is 1.
+
+.. cfgcmd:: set protocols vrf <name> static interface-route6 <subnet> next-hop-interface <interface>
+
+   Allows you to configure the next-hop interface for an interface-based IPv6
+   static route. `<interface>` will be the next-hop interface where trafic is
+   routed for the given `<subnet>`.
+
+.. cfgcmd:: set protocols vrf <name> static interface-route6 <subnet> next-hop-interface <interface> disable
+
+   Disables interface-based IPv6 static route.
+
+.. cfgcmd:: set protocols vrf <name> static interface-route6 <subnet> next-hop-interface <interface> distance <distance>
+
+   Defines next-hop distance for this route, routes with smaller administrative
+   distance are elected prior those with a higher distance.
+
+   Range is 1 to 255, default is 1.
+
+Blackhole
+"""""""""
+
+.. cfgcmd:: set protocols vrf <name> static route <subnet> blackhole
+
+   Use this command to configure a "black-hole" route on the router. A
+   black-hole route is a route for which the system silently discard packets
+   that are matched. This prevents networks leaking out public interfaces, but
+   it does not prevent them from being used as a more specific route inside your
+   network.
+
+.. cfgcmd:: set protocols vrf <name> static route <subnet> blackhole distance <distance>
+
+   Defines blackhole distance for this route, routes with smaller administrative
+   distance are elected prior those with a higher distance.
+
+.. cfgcmd:: set protocols vrf <name> static route6 <subnet> blackhole
+
+   Use this command to configure a "black-hole" route on the router. A
+   black-hole route is a route for which the system silently discard packets
+   that are matched. This prevents networks leaking out public interfaces, but
+   it does not prevent them from being used as a more specific route inside your
+   network.
+
+.. cfgcmd:: set protocols vrf <name> static route6 <subnet> blackhole distance <distance>
+
+   Defines blackhole distance for this route, routes with smaller administrative
+   distance are elected prior those with a higher distance.
+
+
+Operation
+=========
+
+It is not sufficient to only configure a VRF but VRFs must be maintained, too.
+For VR Fmaintenance the followin operational commands are in place.
+
+.. opcmd:: show vrf
+
+   List VRFs that have been created
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show vrf
+     VRF name          state     mac address        flags                     interfaces
+     --------          -----     -----------        -----                     ----------
+     blue              up        de:c4:83:d8:74:24  noarp,master,up,lower_up  dum200,eth0.302
+     red               up        be:36:ce:02:df:aa  noarp,master,up,lower_up  dum100,eth0.300,bond0.100,peth0
+
+   .. note:: Command should probably be extended to list also the real interfaces
+      assigned to this one VRF to get a better overview.
+
+.. opcmd:: show vrf <name>
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show vrf name blue
+     VRF name          state     mac address        flags                     interfaces
+     --------          -----     -----------        -----                     ----------
+     blue              up        de:c4:83:d8:74:24  noarp,master,up,lower_up  dum200,eth0.302
+
+.. opcmd:: show ip route vrf <name>
+
+   Display IPv4 routing table for VRF identified by `<name>`.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show ip route vrf blue
+     Codes: K - kernel route, C - connected, S - static, R - RIP,
+            O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+            T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+            F - PBR, f - OpenFabric,
+            > - selected route, * - FIB route, q - queued route, r - rejected route
+
+     VRF blue:
+     K   0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 00:00:50
+     S>* 172.16.0.0/16 [1/0] via 192.0.2.1, dum1, 00:00:02
+     C>* 192.0.2.0/24 is directly connected, dum1, 00:00:06
+
+
+.. opcmd:: show ipv6 route vrf <name>
+
+   Display IPv6 routing table for VRF identified by `<name>`.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ show ipv6 route vrf red
+     Codes: K - kernel route, C - connected, S - static, R - RIPng,
+            O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table,
+            v - VNC, V - VNC-Direct, A - Babel, D - SHARP, F - PBR,
+            f - OpenFabric,
+            > - selected route, * - FIB route, q - queued route, r - rejected route
+
+     VRF red:
+     K   ::/0 [255/8192] unreachable (ICMP unreachable), 00:43:20
+     C>* 2001:db8::/64 is directly connected, dum1, 00:02:19
+     C>* fe80::/64 is directly connected, dum1, 00:43:19
+     K>* ff00::/8 [0/256] is directly connected, dum1, 00:43:19
+
+
+.. opcmd:: ping <host> vrf <name>
+
+   The ping command is used to test whether a network host is reachable or not.
+
+   Ping uses ICMP protocol's mandatory ECHO_REQUEST datagram to elicit an
+   ICMP ECHO_RESPONSE from a host or gateway. ECHO_REQUEST datagrams (pings)
+   will have an IP and ICMP header, followed by "struct timeval" and an
+   arbitrary number of pad bytes used to fill out the packet.
+
+   When doing fault isolation with ping, your should first run it on the local
+   host, to verify that the local network interface is up and running. Then,
+   continue with hosts and gateways further down the road towards your
+   destination. Round-trip times and packet loss statistics are computed.
+
+   Duplicate packets are not included in the packet loss calculation, although
+   the round-trip time of these packets is used in calculating the minimum/
+   average/maximum round-trip time numbers.
+
+   Ping command can be interrupted at any given time using `<Ctrl>+c`- A brief
+   statistic is shown afterwards.
+
+   .. code-block:: none
+
+     vyos@vyos:~$ ping 192.0.2.1 vrf red
+     PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data.
+     64 bytes from 192.0.2.1: icmp_seq=1 ttl=64 time=0.070 ms
+     64 bytes from 192.0.2.1: icmp_seq=2 ttl=64 time=0.078 ms
+     ^C
+     --- 192.0.2.1 ping statistics ---
+     2 packets transmitted, 2 received, 0% packet loss, time 4ms
+     rtt min/avg/max/mdev = 0.070/0.074/0.078/0.004 ms
+
+.. opcmd:: traceroute vrf <name> [ipv4 | ipv6] <host>
+
+   Displays the route packets take to a network host utilizing VRF instance
+   identified by `<name>`. When using the IPv4 or IPv6 option, display the route
+   packets take to the for the given hosts IP address family. This option is
+   useful when the host specified is a hostname rather than an IP address.
+
+
+.. include:: /_include/common-references.txt
diff --git a/docs/configuration/zonepolicy/index.rst b/docs/configuration/zonepolicy/index.rst
new file mode 100644
index 00000000..31784dc3
--- /dev/null
+++ b/docs/configuration/zonepolicy/index.rst
@@ -0,0 +1,8 @@
+###########
+Zone Policy
+###########
+
+
+.. toctree::
+   :maxdepth: 1
+   :includehidden:
\ No newline at end of file
diff --git a/docs/contributing/debugging.rst b/docs/contributing/debugging.rst
index fcd62c89..644545bf 100644
--- a/docs/contributing/debugging.rst
+++ b/docs/contributing/debugging.rst
@@ -143,4 +143,4 @@ order of the scripts.
 .. _vyatta-cfg: https://github.com/vyos/vyatta-cfg
 .. _bootchart.conf: https://github.com/vyos/vyos-build/blob/current/data/live-build-config/includes.chroot/etc/systemd/bootchart.conf
 
-.. include:: /common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/contributing/development.rst b/docs/contributing/development.rst
index 0a7fecb5..73b8b22e 100644
--- a/docs/contributing/development.rst
+++ b/docs/contributing/development.rst
@@ -711,4 +711,4 @@ http://dev.packages.vyos.net/repositories/.
 .. _`VLAN (VIF)`: https://github.com/vyos/vyos-1x/tree/current/interface-definitions/include/vif.xml.i
 .. _`MAC address`: https://github.com/vyos/vyos-1x/tree/current/interface-definitions/include/interface-mac.xml.i
 
-.. include:: /common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/contributing/documentation.rst b/docs/contributing/documentation.rst
index 0276a7d2..197f5b03 100644
--- a/docs/contributing/documentation.rst
+++ b/docs/contributing/documentation.rst
@@ -325,4 +325,4 @@ predefined structure.
 .. _reStructuredTextDirectives: https://docutils.sourceforge.io/docs/ref/rst/directives.html
 .. _README.md: https://github.com/vyos/vyos-documentation/blob/master/README.md
 
-.. include:: /common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/contributing/issues-features.rst b/docs/contributing/issues-features.rst
index 473d49d9..9b6602f9 100644
--- a/docs/contributing/issues-features.rst
+++ b/docs/contributing/issues-features.rst
@@ -77,4 +77,4 @@ the left side under the specific project.
 .. _Slack: https://slack.vyos.io
 .. _Forum: https://forum.vyos.io
 
-.. include:: /common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/coverage.rst b/docs/coverage.rst
index f003f9ff..01d51e90 100644
--- a/docs/coverage.rst
+++ b/docs/coverage.rst
@@ -1,5 +1,3 @@
-:orphan:
-
 ########
 Coverage
 ########
diff --git a/docs/index.rst b/docs/index.rst
index 96272fff..ed16b420 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -22,7 +22,7 @@ VyOS User Guide
    :caption: first steps
 
    installation/index
-   quickstart/index
+   quick-start
    cli
    
 .. toctree::
@@ -47,4 +47,5 @@ VyOS User Guide
 
 
    contributing/index
+   coverage
    copyright
diff --git a/docs/installation/upate.rst b/docs/installation/upate.rst
deleted file mode 100644
index a3a887f0..00000000
--- a/docs/installation/upate.rst
+++ /dev/null
@@ -1,79 +0,0 @@
-.. _update_vyos:
-
-Update VyOS
-===========
-
-New system images can be added using the :opcmd:`add system image`
-command. The command will extract the chosen image and will prompt you
-to use the current system configuration and SSH security keys, allowing
-for the new image to boot using the current configuration.
-
-.. note:: Only LTS releases are PGP-signed.
-
-.. opcmd:: add system image <url | path> [vrf name] [username user [password pass]]
-
-   Use this command to install a new system image. You can reach the
-   image from the web (http://, https://) or from your local system,
-   e.g.  /tmp/vyos-1.2.3-amd64.iso.
-
-   The `add system image` command also supports installing new versions
-   of VyOS through an optional given VRF. Also if URL in question requires
-   authentication, you can specify an optional username and password via
-   the commandline which will be passed as "Basic-Auth" to the server.
-
-If there is not enough **free disk space available**, the installation
-will be canceled. To delete images use the :opcmd:`delete system image`
-command.
-
-VyOS configuration is associated to each image, and **each image has a
-unique copy of its configuration**. This is different than a traditional
-network router where the configuration is shared across all images.
-
-.. note:: If you have any personal files, like some scripts you created,
-   and you don't want them to be lost during the upgrade, make sure
-   those files are stored in ``/config`` as this directory is always copied
-   to newer installed images.
-
-You can access files from a previous installation and copy them to your
-current image if they were located in the ``/config`` directory. This
-can be done using the :opcmd:`copy` command. So, for instance, in order
-to copy ``/config/config.boot`` from VyOS 1.2.1 image, you would use the
-following command:
-
-.. code::
-
-   copy file 1.2.1://config/config.boot to /tmp/config.boot.1.2.1
-
-
-Example
-"""""""
-
-.. code-block:: none
-
-     vyos@vyos:~$ add system image https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
-     Trying to fetch ISO file from https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
-       % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
-                                      Dload  Upload   Total   Spent    Left  Speed
-     100  338M  100  338M    0     0  3837k      0  0:01:30  0:01:30 --:--:-- 3929k
-     ISO download succeeded.
-     Checking for digital signature file...
-       % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
-                                      Dload  Upload   Total   Spent    Left  Speed
-       0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
-     curl: (22) The requested URL returned error: 404 Not Found
-
-     Unable to fetch digital signature file.
-     Do you want to continue without signature check? (yes/no) [yes]
-     Checking MD5 checksums of files on the ISO image...OK.
-     Done!
-
-     What would you like to name this image? [vyos-1.3-rolling-201912201452]:
-
-     OK.  This image will be named: vyos-1.3-rolling-201912201452
-
-
-.. hint:: | The most up-do-date Rolling Release for AMD64 can be accessed using the following URL:
-   | https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
-
-After reboot you might want to verify the version you are running with
-the :opcmd:`show version` command.
\ No newline at end of file
diff --git a/docs/installation/update.rst b/docs/installation/update.rst
new file mode 100644
index 00000000..a3a887f0
--- /dev/null
+++ b/docs/installation/update.rst
@@ -0,0 +1,79 @@
+.. _update_vyos:
+
+Update VyOS
+===========
+
+New system images can be added using the :opcmd:`add system image`
+command. The command will extract the chosen image and will prompt you
+to use the current system configuration and SSH security keys, allowing
+for the new image to boot using the current configuration.
+
+.. note:: Only LTS releases are PGP-signed.
+
+.. opcmd:: add system image <url | path> [vrf name] [username user [password pass]]
+
+   Use this command to install a new system image. You can reach the
+   image from the web (http://, https://) or from your local system,
+   e.g.  /tmp/vyos-1.2.3-amd64.iso.
+
+   The `add system image` command also supports installing new versions
+   of VyOS through an optional given VRF. Also if URL in question requires
+   authentication, you can specify an optional username and password via
+   the commandline which will be passed as "Basic-Auth" to the server.
+
+If there is not enough **free disk space available**, the installation
+will be canceled. To delete images use the :opcmd:`delete system image`
+command.
+
+VyOS configuration is associated to each image, and **each image has a
+unique copy of its configuration**. This is different than a traditional
+network router where the configuration is shared across all images.
+
+.. note:: If you have any personal files, like some scripts you created,
+   and you don't want them to be lost during the upgrade, make sure
+   those files are stored in ``/config`` as this directory is always copied
+   to newer installed images.
+
+You can access files from a previous installation and copy them to your
+current image if they were located in the ``/config`` directory. This
+can be done using the :opcmd:`copy` command. So, for instance, in order
+to copy ``/config/config.boot`` from VyOS 1.2.1 image, you would use the
+following command:
+
+.. code::
+
+   copy file 1.2.1://config/config.boot to /tmp/config.boot.1.2.1
+
+
+Example
+"""""""
+
+.. code-block:: none
+
+     vyos@vyos:~$ add system image https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
+     Trying to fetch ISO file from https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
+       % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                      Dload  Upload   Total   Spent    Left  Speed
+     100  338M  100  338M    0     0  3837k      0  0:01:30  0:01:30 --:--:-- 3929k
+     ISO download succeeded.
+     Checking for digital signature file...
+       % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
+                                      Dload  Upload   Total   Spent    Left  Speed
+       0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
+     curl: (22) The requested URL returned error: 404 Not Found
+
+     Unable to fetch digital signature file.
+     Do you want to continue without signature check? (yes/no) [yes]
+     Checking MD5 checksums of files on the ISO image...OK.
+     Done!
+
+     What would you like to name this image? [vyos-1.3-rolling-201912201452]:
+
+     OK.  This image will be named: vyos-1.3-rolling-201912201452
+
+
+.. hint:: | The most up-do-date Rolling Release for AMD64 can be accessed using the following URL:
+   | https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso
+
+After reboot you might want to verify the version you are running with
+the :opcmd:`show version` command.
\ No newline at end of file
diff --git a/docs/operation/index.rst b/docs/operation/index.rst
index b40f769d..647b5b25 100644
--- a/docs/operation/index.rst
+++ b/docs/operation/index.rst
@@ -7,4 +7,5 @@ Operation Mode
    :includehidden:
 
    information
-   ip-command
\ No newline at end of file
+   ip-commands
+   boot-options
\ No newline at end of file
diff --git a/docs/vpn/dmvpn.rst b/docs/vpn/dmvpn.rst
deleted file mode 100644
index 5100b92f..00000000
--- a/docs/vpn/dmvpn.rst
+++ /dev/null
@@ -1,335 +0,0 @@
-.. _vpn-dmvpn:
-
-#####
-DMVPN
-#####
-
-:abbr:`DMVPN (Dynamic Multipoint Virtual Private Network)` is a dynamic
-:abbr:`VPN (Virtual Private Network)` technology originally developed by Cisco.
-While their implementation was somewhat proprietary, the underlying
-technologies are actually standards based. The three technologies are:
-
-* :abbr:`NHRP (Next Hop Resolution Protocol)` :rfc:`2332`
-* :abbr:`mGRE (Multipoint Generic Routing Encapsulation)` :rfc:`1702`
-* :abbr:`IPSec (IP Security)` - too many RFCs to list, but start with :rfc:`4301`
-
-NHRP provides the dynamic tunnel endpoint discovery mechanism (endpoint
-registration, and endpoint discovery/lookup), mGRE provides the tunnel
-encapsulation itself, and the IPSec protocols handle the key exchange, and
-crypto mechanism.
-
-In short, DMVPN provides the capability for creating a dynamic-mesh VPN
-network without having to pre-configure (static) all possible tunnel end-point
-peers.
-
-.. note:: DMVPN only automates the tunnel endpoint discovery and setup. A
-   complete solution also incorporates the use of a routing protocol. BGP is
-   particularly well suited for use with DMVPN.
-
-.. figure:: ../_static/images/vpn_dmvpn_topology01.png
-   :scale: 40 %
-   :alt: Baseline DMVPN topology
-
-   Baseline DMVPN topology
-
-*************
-Configuration
-*************
-
-* Please refer to the :ref:`tunnel-interface` documentation for the individual
-  tunnel related options.
-
-* Please refer to the :ref:`ipsec` documentation for the individual IPSec
-  related options.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> cisco-authentication <secret>
-
-  Enables Cisco style authentication on NHRP packets. This embeds the secret
-  plaintext password to the outgoing NHRP packets. Incoming NHRP packets on
-  this interface are discarded unless the secret password is present. Maximum
-  length of the secret is 8 characters.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> dynamic-map <address>
-  nbma-domain-name <fqdn>
-
-  Specifies that the :abbr:`NBMA (Non-broadcast multiple-access network)`
-  addresses of the next hop servers are defined in the domain name
-  nbma-domain-name. For each A record opennhrp creates a dynamic NHS entry.
-
-  Each dynamic NHS will get a peer entry with the configured network address
-  and the discovered NBMA address.
-
-  The first registration request is sent to the protocol broadcast address, and
-  the server's real protocol address is dynamically detected from the first
-  registration reply.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> holding-time <timeout>
-
-  Specifies the holding time for NHRP Registration Requests and Resolution
-  Replies sent from this interface or shortcut-target. The holdtime is specified
-  in seconds and defaults to two hours.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> map cisco
-
-  If the statically mapped peer is running Cisco IOS, specify the cisco keyword.
-  It is used to fix statically the Registration Request ID so that a matching
-  Purge Request can be sent if NBMA address has changed. This is to work around
-  broken IOS which requires Purge Request ID to match the original Registration
-  Request ID.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> map nbma-address <address>
-
-  Creates static peer mapping of protocol-address to :abbr:`NBMA (Non-broadcast
-  multiple-access network)` address.
-
-  If the IP prefix mask is present, it directs opennhrp to use this peer as a
-  next hop server when sending Resolution Requests matching this subnet.
-
-  This is also known as the HUBs IP address or FQDN.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> map register
-
-  The optional parameter register specifies that Registration Request should be
-  sent to this peer on startup.
-
-  This option is required when running a DMVPN spoke.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> multicast <dynamic | nhs>
-
-  Determines how opennhrp daemon should soft switch the multicast traffic.
-  Currently, multicast traffic is captured by opennhrp daemon using a packet
-  socket, and resent back to proper destinations. This means that multicast
-  packet sending is CPU intensive.
-
-  Specfying nhs makes all multicast packets to be repeated to each statically
-  configured next hop.
-
-  Synamic instructs to forward to all peers which we have a direct connection
-  with. Alternatively, you can specify the directive multiple times for each
-  protocol-address the multicast traffic should be sent to.
-
-  .. warning:: It is very easy to misconfigure multicast repeating if you have
-    multiple NHSes.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> non-caching
-
-   Disables caching of peer information from forwarded NHRP Resolution Reply
-   packets. This can be used to reduce memory consumption on big NBMA subnets.
-
-  .. note:: Currently does not do much as caching is not implemented.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> redirect
-
-  Enable sending of Cisco style NHRP Traffic Indication packets. If this is
-  enabled and opennhrp detects a forwarded  packet, it will send a message to
-  the original sender of the packet instructing it to create a direct connection
-  with the destination. This is basically a protocol independent equivalent of
-  ICMP redirect.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut
-
-  Enable creation of shortcut routes.
-
-  A received NHRP Traffic Indication will trigger the resolution and
-  establishment of a shortcut route.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut-destination
-
-  This instructs opennhrp to reply with authorative answers on NHRP Resolution
-  Requests destinied to addresses in this interface (instead of forwarding the
-  packets). This effectively allows the creation of shortcut routes to subnets
-  located on the interface.
-
-  When specified, this should be the only keyword for the interface.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut-target <address>
-
-  Defines an off-NBMA network prefix for which the GRE interface will act as a
-  gateway. This an alternative to defining local interfaces with
-  shortcut-destination flag.
-
-.. cfgcmd:: set protocols nhrp tunnel <tunnel> shortcut-target <address>
-  holding-time <timeout>
-
-  Specifies the holding time for NHRP Registration Requests and Resolution
-  Replies sent from this interface or shortcut-target. The holdtime is specified
-  in seconds and defaults to two hours.
-
-*******
-Example
-*******
-
-
-This blueprint uses VyOS as the DMVPN Hub and Cisco (7206VXR) and VyOS as
-multiple spoke sites. The lab was build using :abbr:`EVE-NG (Emulated Virtual
-Environment NG)`.
-
-.. figure:: /_static/images/blueprint-dmvpn.png
-   :alt: DMVPN network
-
-   DMVPN example network
-
-Each node (Hub and Spoke) uses an IP address from the network 172.16.253.128/29.
-
-The below referenced IP address `192.0.2.1` is used as example address
-representing a global unicast address under which the HUB can be contacted by
-each and every individual spoke.
-
-Configuration
-=============
-
-Hub
----
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address 192.0.2.1/24
-
-  set interfaces tunnel tun100 address '172.16.253.134/29'
-  set interfaces tunnel tun100 encapsulation 'gre'
-  set interfaces tunnel tun100 local-ip '192.0.2.1'
-  set interfaces tunnel tun100 multicast 'enable'
-  set interfaces tunnel tun100 parameters ip key '1'
-
-  set protocols nhrp tunnel tun100 cisco-authentication 'secret'
-  set protocols nhrp tunnel tun100 holding-time '300'
-  set protocols nhrp tunnel tun100 multicast 'dynamic'
-  set protocols nhrp tunnel tun100 redirect
-  set protocols nhrp tunnel tun100 shortcut
-
-  set vpn ipsec esp-group ESP-HUB compression 'disable'
-  set vpn ipsec esp-group ESP-HUB lifetime '1800'
-  set vpn ipsec esp-group ESP-HUB mode 'tunnel'
-  set vpn ipsec esp-group ESP-HUB pfs 'dh-group2'
-  set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
-  set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des'
-  set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5'
-  set vpn ipsec ike-group IKE-HUB ikev2-reauth 'no'
-  set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
-  set vpn ipsec ike-group IKE-HUB lifetime '3600'
-  set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
-  set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
-  set vpn ipsec ike-group IKE-HUB proposal 2 dh-group '2'
-  set vpn ipsec ike-group IKE-HUB proposal 2 encryption 'aes128'
-  set vpn ipsec ike-group IKE-HUB proposal 2 hash 'sha1'
-
-  set vpn ipsec ipsec-interfaces interface 'eth0'
-
-  set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
-  set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
-  set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
-  set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
-  set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
-
-.. note:: Setting this up on AWS will require a "Custom Protocol Rule" for
-  protocol number "47" (GRE) Allow Rule in TWO places. Firstly on the VPC
-  Network ACL, and secondly on the security group network ACL attached to the
-  EC2 instance. This has been tested as working for the official AMI image on
-  the AWS Marketplace. (Locate the correct VPC and security group by navigating
-  through the details pane below your EC2 instance in the AWS console).
-
-Spoke
------
-
-The individual spoke configurations only differ in the local IP address on the
-``tun10`` interface. See the above diagram for the individual IP addresses.
-
-spoke01-spoke04
-^^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  crypto keyring DMVPN
-    pre-shared-key address 192.0.2.1 key secret
-  !
-  crypto isakmp policy 10
-   encr aes 256
-   authentication pre-share
-   group 2
-  crypto isakmp invalid-spi-recovery
-  crypto isakmp keepalive 30 30 periodic
-  crypto isakmp profile DMVPN
-     keyring DMVPN
-     match identity address 192.0.2.1 255.255.255.255
-  !
-  crypto ipsec transform-set DMVPN-AES256 esp-aes 256 esp-sha-hmac
-   mode transport
-  !
-  crypto ipsec profile DMVPN
-   set security-association idle-time 720
-   set transform-set DMVPN-AES256
-   set isakmp-profile DMVPN
-  !
-  interface Tunnel10
-   ! individual spoke tunnel IP must change
-   ip address 172.16.253.129 255.255.255.248
-   no ip redirects
-   ip nhrp authentication secret
-   ip nhrp map 172.16.253.134 192.0.2.1
-   ip nhrp map multicast 192.0.2.1
-   ip nhrp network-id 1
-   ip nhrp holdtime 600
-   ip nhrp nhs 172.16.253.134
-   ip nhrp registration timeout 75
-   tunnel source FastEthernet0/0
-   tunnel mode gre multipoint
-   tunnel key 1
-  !
-  interface FastEthernet0/0
-   ip address dhcp
-   duplex half
-
-
-spoke05
-^^^^^^^
-
-VyOS can also run in DMVPN spoke mode.
-
-.. code-block:: none
-
-  set interfaces ethernet eth0 address 'dhcp'
-
-  set interfaces tunnel tun100 address '172.16.253.133/29'
-  set interfaces tunnel tun100 local-ip 0.0.0.0
-  set interfaces tunnel tun100 encapsulation 'gre'
-  set interfaces tunnel tun100 multicast 'enable'
-  set interfaces tunnel tun100 parameters ip key '1'
-
-  set protocols nhrp tunnel tun100 cisco-authentication 'secret'
-  set protocols nhrp tunnel tun100 holding-time '300'
-  set protocols nhrp tunnel tun100 map 172.16.253.134/29 nbma-address '192.0.2.1'
-  set protocols nhrp tunnel tun100 map 172.16.253.134/29 register
-  set protocols nhrp tunnel tun100 multicast 'nhs'
-  set protocols nhrp tunnel tun100 redirect
-  set protocols nhrp tunnel tun100 shortcut
-
-  set vpn ipsec esp-group ESP-HUB compression 'disable'
-  set vpn ipsec esp-group ESP-HUB lifetime '1800'
-  set vpn ipsec esp-group ESP-HUB mode 'tunnel'
-  set vpn ipsec esp-group ESP-HUB pfs 'dh-group2'
-  set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
-  set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des'
-  set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5'
-  set vpn ipsec ike-group IKE-HUB close-action 'none'
-  set vpn ipsec ike-group IKE-HUB ikev2-reauth 'no'
-  set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
-  set vpn ipsec ike-group IKE-HUB lifetime '3600'
-  set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
-  set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
-  set vpn ipsec ike-group IKE-HUB proposal 2 dh-group '2'
-  set vpn ipsec ike-group IKE-HUB proposal 2 encryption 'aes128'
-  set vpn ipsec ike-group IKE-HUB proposal 2 hash 'sha1'
-
-  set vpn ipsec ipsec-interfaces interface 'eth0'
-
-  set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
-  set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
-  set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
-  set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
-  set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
-
-
diff --git a/docs/vpn/index.rst b/docs/vpn/index.rst
deleted file mode 100644
index c208b3c0..00000000
--- a/docs/vpn/index.rst
+++ /dev/null
@@ -1,18 +0,0 @@
-.. _vpn:
-
-###
-VPN
-###
-
-.. toctree::
-   :maxdepth: 2
-
-   dmvpn
-   ipsec
-   l2tp
-   openconnect
-   openvpn
-   pptp
-   site2site_ipsec
-   sstp
-   wireguard
diff --git a/docs/vpn/ipsec.rst b/docs/vpn/ipsec.rst
deleted file mode 100644
index 647f3753..00000000
--- a/docs/vpn/ipsec.rst
+++ /dev/null
@@ -1,192 +0,0 @@
-.. _ipsec:
-
-#####
-IPsec
-#####
-
-:abbr:`GRE (Generic Routing Encapsulation)`, GRE/IPsec (or IPIP/IPsec,
-SIT/IPsec, or any other stateless tunnel protocol over IPsec) is the usual way
-to protect the traffic inside a tunnel.
-
-An advantage of this scheme is that you get a real interface with its own
-address, which makes it easier to setup static routes or use dynamic routing
-protocols without having to modify IPsec policies. The other advantage is that
-it greatly simplifies router to router communication, which can be tricky with
-plain IPsec because the external outgoing address of the router usually doesn't
-match the IPsec policy of typical site-to-site setup and you need to add special
-configuration for it, or adjust the source address for outgoing traffic of your
-applications. GRE/IPsec has no such problem and is completely transparent for
-the applications.
-
-GRE/IPIP/SIT and IPsec are widely accepted standards, which make this scheme
-easy to implement between VyOS and virtually any other router.
-
-For simplicity we'll assume that the protocol is GRE, it's not hard to guess
-what needs to be changed to make it work with a different protocol. We assume
-that IPsec will use pre-shared secret authentication and will use AES128/SHA1
-for the cipher and hash. Adjust this as necessary.
-
-.. NOTE:: VMware users should ensure that a VMXNET3 adapter is used. E1000
-  adapters have known issues with GRE processing.
-
-*************************
-IPsec policy matching GRE
-*************************
-
-The first and arguably cleaner option is to make your IPsec policy match GRE
-packets between external addresses of your routers. This is the best option if
-both routers have static external addresses.
-
-Suppose the LEFT router has external address 192.0.2.10 on its eth0 interface,
-and the RIGHT router is 203.0.113.45
-
-On the LEFT:
-
-.. code-block:: none
-
-  # GRE tunnel
-  set interfaces tunnel tun0 encapsulation gre
-  set interfaces tunnel tun0 local-ip 192.0.2.10
-  set interfaces tunnel tun0 remote-ip 203.0.113.45
-  set interfaces tunnel tun0 address 10.10.10.1/30
-
-  ## IPsec
-  set vpn ipsec ipsec-interfaces interface eth0
-
-  # IKE group
-  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '2'
-  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes128'
-  set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha1'
-
-  # ESP group
-  set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes128'
-  set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha1'
-
-  # IPsec tunnel
-  set vpn ipsec site-to-site peer 203.0.113.45 authentication mode pre-shared-secret
-  set vpn ipsec site-to-site peer 203.0.113.45 authentication pre-shared-secret MYSECRETKEY
-
-  set vpn ipsec site-to-site peer 203.0.113.45 ike-group MyIKEGroup
-  set vpn ipsec site-to-site peer 203.0.113.45 default-esp-group MyESPGroup
-
-  set vpn ipsec site-to-site peer 203.0.113.45 local-address 192.0.2.10
-
-  # This will match all GRE traffic to the peer
-  set vpn ipsec site-to-site peer 203.0.113.45 tunnel 1 protocol gre
-
-On the RIGHT, setup by analogy and swap local and remote addresses.
-
-
-Source tunnel from loopbacks
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The scheme above doesn't work when one of the routers has a dynamic external
-address though. The classic workaround for this is to setup an address on a
-loopback interface and use it as a source address for the GRE tunnel, then setup
-an IPsec policy to match those loopback addresses.
-
-We assume that the LEFT router has static 192.0.2.10 address on eth0, and the
-RIGHT router has a dynamic address on eth0.
-
-**Setting up the GRE tunnel**
-
-On the LEFT:
-
-.. code-block:: none
-
-  set interfaces loopback lo address 192.168.99.1/32
-
-  set interfaces tunnel tun0 encapsulation gre
-  set interfaces tunnel tun0 address 10.10.10.1/30
-  set interfaces tunnel tun0 local-ip 192.168.99.1
-  set interfaces tunnel tun0 remote-ip 192.168.99.2
-
-On the RIGHT:
-
-.. code-block:: none
-
-  set interfaces loopback lo address 192.168.99.2/32
-
-  set interfaces tunnel tun0 encapsulation gre
-  set interfaces tunnel tun0 address 10.10.10.2/30
-  set interfaces tunnel tun0 local-ip 192.168.99.2
-  set interfaces tunnel tun0 remote-ip 192.168.99.1
-
-**Setting up IPSec**
-
-However, now you need to make IPsec work with dynamic address on one side. The
-tricky part is that pre-shared secret authentication doesn't work with dynamic
-address, so we'll have to use RSA keys.
-
-First, on both routers run the operational command "generate vpn rsa-key bits
-2048". You may choose different length than 2048 of course.
-
-.. code-block:: none
-
-  vyos@left# run generate vpn rsa-key bits 2048
-  Generating rsa-key to /config/ipsec.d/rsa-keys/localhost.key
-
-  Your new local RSA key has been generated
-  The public portion of the key is:
-
-  0sAQO2335[long string here]
-
-Then on the opposite router, add the RSA key to your config.
-
-.. code-block:: none
-
-  set vpn rsa-keys rsa-key-name LEFT rsa-key KEYGOESHERE
-
-Now you are ready to setup IPsec. You'll need to use an ID instead of address
-for the peer on the dynamic side.
-
-On the LEFT (static address):
-
-.. code-block:: none
-
-  set vpn rsa-keys rsa-key-name RIGHT rsa-key <PUBLIC KEY FROM THE RIGHT>
-
-  set vpn ipsec ipsec-interfaces interface eth0
-
-  set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128
-  set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1
-
-  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2
-  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
-  set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1
-
-  set vpn ipsec site-to-site peer @RIGHT authentication mode rsa
-  set vpn ipsec site-to-site peer @RIGHT authentication rsa-key-name RIGHT
-  set vpn ipsec site-to-site peer @RIGHT default-esp-group MyESPGroup
-  set vpn ipsec site-to-site peer @RIGHT ike-group MyIKEGroup
-  set vpn ipsec site-to-site peer @RIGHT local-address 192.0.2.10
-  set vpn ipsec site-to-site peer @RIGHT connection-type respond
-  set vpn ipsec site-to-site peer @RIGHT tunnel 1 local prefix 192.168.99.1/32  # Additional loopback address on the local
-  set vpn ipsec site-to-site peer @RIGHT tunnel 1 remote prefix 192.168.99.2/32 # Additional loopback address on the remote
-
-
-On the RIGHT (dynamic address):
-
-.. code-block:: none
-
-  set vpn rsa-keys rsa-key-name LEFT rsa-key <PUBLIC KEY FROM THE LEFT>
-
-  set vpn ipsec ipsec-interfaces interface eth0
-
-  set vpn ipsec esp-group MyESPGroup proposal 1 encryption aes128
-  set vpn ipsec esp-group MyESPGroup proposal 1 hash sha1
-
-  set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group 2
-  set vpn ipsec ike-group MyIKEGroup proposal 1 encryption aes128
-  set vpn ipsec ike-group MyIKEGroup proposal 1 hash sha1
-
-  set vpn ipsec site-to-site peer 192.0.2.10 authentication id @RIGHT
-  set vpn ipsec site-to-site peer 192.0.2.10 authentication mode rsa
-  set vpn ipsec site-to-site peer 192.0.2.10 authentication rsa-key-name LEFT
-  set vpn ipsec site-to-site peer 192.0.2.10 remote-id @LEFT
-  set vpn ipsec site-to-site peer 192.0.2.10 connection-type initiate
-  set vpn ipsec site-to-site peer 192.0.2.10 default-esp-group MyESPGroup
-  set vpn ipsec site-to-site peer 192.0.2.10 ike-group MyIKEGroup
-  set vpn ipsec site-to-site peer 192.0.2.10 local-address any
-  set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 local prefix 192.168.99.2/32  # Additional loopback address on the local
-  set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 remote prefix 192.168.99.1/32 # Additional loopback address on the remote
diff --git a/docs/vpn/l2tp.rst b/docs/vpn/l2tp.rst
deleted file mode 100644
index 0d8dde08..00000000
--- a/docs/vpn/l2tp.rst
+++ /dev/null
@@ -1,235 +0,0 @@
-.. _l2tp:
-
-L2TP
-----
-
-VyOS utilizes accel-ppp_ to provide L2TP server functionality. It can be used
-with local authentication or a connected RADIUS server.
-
-L2TP over IPsec
-===============
-
-Example for configuring a simple L2TP over IPsec VPN for remote access (works
-with native Windows and Mac VPN clients):
-
-.. code-block:: none
-
-  set vpn ipsec ipsec-interfaces interface eth0
-  set vpn ipsec nat-traversal enable
-  set vpn ipsec nat-networks allowed-network 0.0.0.0/0
-
-  set vpn l2tp remote-access outside-address 192.0.2.2
-  set vpn l2tp remote-access client-ip-pool start 192.168.255.2
-  set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
-  set vpn l2tp remote-access ipsec-settings authentication mode pre-shared-secret
-  set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret <secret>
-  set vpn l2tp remote-access authentication mode local
-  set vpn l2tp remote-access authentication local-users username test password 'test'
-
-In the example above an external IP of 192.0.2.2 is assumed.
-
-If a local firewall policy is in place on your external interface you will need
-to allow the ports below:
-
-* UDP port 500 (IKE)
-* IP protocol number 50 (ESP)
-* UDP port 1701 for IPsec
-
-As well as the below to allow NAT-traversal (when NAT is detected by the
-VPN client, ESP is encapsulated in UDP for NAT-traversal):
-
-* UDP port 4500 (NAT-T)
-
-Example:
-
-.. code-block:: none
-
-  set firewall name OUTSIDE-LOCAL rule 40 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 40 protocol 'esp'
-  set firewall name OUTSIDE-LOCAL rule 41 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 41 destination port '500'
-  set firewall name OUTSIDE-LOCAL rule 41 protocol 'udp'
-  set firewall name OUTSIDE-LOCAL rule 42 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 42 destination port '4500'
-  set firewall name OUTSIDE-LOCAL rule 42 protocol 'udp'
-  set firewall name OUTSIDE-LOCAL rule 43 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 43 destination port '1701'
-  set firewall name OUTSIDE-LOCAL rule 43 ipsec 'match-ipsec'
-  set firewall name OUTSIDE-LOCAL rule 43 protocol 'udp'
-
-To allow VPN-clients access via your external address, a NAT rule is required:
-
-
-.. code-block:: none
-
-  set nat source rule 110 outbound-interface 'eth0'
-  set nat source rule 110 source address '192.168.255.0/24'
-  set nat source rule 110 translation address masquerade
-
-
-VPN-clients will request configuration parameters, optionally you can DNS
-parameter to the client.
-
-.. code-block:: none
-
-  set vpn l2tp remote-access dns-servers server-1 '8.8.8.8'
-  set vpn l2tp remote-access dns-servers server-2 '8.8.4.4'
-
-.. note:: Those are the `Google public DNS`_ servers, but you can choose
-   any public available servers, like Quad9_ (9.9.9.9), Cloudflare_ (1.1.1.1)
-   or OpenNIC_.
-
-Established sessions can be viewed using the **show vpn remote-access**
-operational command, or **show l2tp-server sessions**
-
-.. code-block:: none
-
-  vyos@vyos:~$ show vpn remote-access
-   ifname | username | calling-sid  |      ip       | rate-limit | type | comp | state  |  uptime
-  --------+----------+--------------+---------------+------------+------+------+--------+----------
-   ppp0   | vyos     | 192.168.0.36 | 192.168.255.1 |            | l2tp |      | active | 00:06:13
-
-
-LNS (L2TP Network Server)
-=========================
-
-LNS are often used to connect to a LAC (L2TP Access Concentrator).
-
-Below is an example to configure a LNS:
-
-.. code-block:: none
-
-  set vpn l2tp remote-access outside-address 192.0.2.2
-  set vpn l2tp remote-access client-ip-pool start 192.168.255.2
-  set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
-  set vpn l2tp remote-access lns shared-secret 'secret'
-  set vpn l2tp remote-access ccp-disable
-  set vpn l2tp remote-access authentication mode local
-  set vpn l2tp remote-access authentication local-users username test password 'test'
-
-The example above uses 192.0.2.2 as external IP address. A LAC normally
-requires an authentication password, which is set in the example configuration
-to ``lns shared-secret 'secret'``. This setup requires the Compression Control
-Protocol (CCP) being disabled, the command ``set vpn l2tp remote-access ccp-disable``
-accomplishes that.
-
-
-Bandwidth Shaping
-=================
-
-Bandwidth rate limits can be set for local users or via RADIUS based attributes.
-
-Bandwidth Shaping for local users
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The rate-limit is set in kbit/sec.
-
-.. code-block:: none
-
-  set vpn l2tp remote-access outside-address 192.0.2.2
-  set vpn l2tp remote-access client-ip-pool start 192.168.255.2
-  set vpn l2tp remote-access client-ip-pool stop 192.168.255.254
-  set vpn l2tp remote-access authentication mode local
-  set vpn l2tp remote-access authentication local-users username test password test
-  set vpn l2tp remote-access authentication local-users username test rate-limit download 20480
-  set vpn l2tp remote-access authentication local-users username test rate-limit upload 10240
-
-  vyos@vyos:~$ show vpn remote-access
-  ifname | username | calling-sid  |      ip       | rate-limit  | type | comp | state  |  uptime
-  -------+----------+--------------+---------------+-------------+------+------+--------+-----------
-  ppp0   | test     | 192.168.0.36 | 192.168.255.2 | 20480/10240 | l2tp |      | active | 00:06:30
-
-RADIUS authentication
-======================
-
-To enable RADIUS based authentication, the authentication mode needs to be
-changed within the configuration. Previous settings like the local users, still
-exists within the configuration, however they are not used if the mode has been
-changed from local to radius. Once changed back to local, it will use all local
-accounts again.
-
-.. code-block:: none
-
-  set vpn l2tp remote-access authentication mode <local|radius>
-
-Since the RADIUS server would be a single point of failure, multiple RADIUS
-servers can be setup and will be used subsequentially.
-
-.. code-block:: none
-
-  set vpn l2tp remote-access authentication radius server 10.0.0.1 key 'foo'
-  set vpn l2tp remote-access authentication radius server 10.0.0.2 key 'foo'
-
-.. note:: Some RADIUS_ severs use an access control list which allows or denies
-   queries, make sure to add your VyOS router to the allowed client list.
-
-RADIUS source address
-^^^^^^^^^^^^^^^^^^^^^
-
-If you are using OSPF as IGP always the closets interface connected to the RADIUS
-server is used. With VyOS 1.2 you can bind all outgoing RADIUS requests to a
-single source IP e.g. the loopback interface.
-
-.. code-block:: none
-
-  set vpn l2tp remote-access authentication radius source-address 10.0.0.3
-
-Above command will use `10.0.0.3` as source IPv4 address for all RADIUS queries
-on this NAS.
-
-.. note:: The ``source-address`` must be configured on one of VyOS interface.
-   Best proctice would be a loopback or dummy interface.
-
-RADIUS bandwidth shaping attribute
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-To enable bandwidth shaping via RADIUS, the option rate-limit needs to be enabled.
-
-.. code-block:: none
-
-  set vpn l2tp remote-access authentication radius rate-limit enable
-
-The default RADIUS attribute for rate limiting is ``Filter-Id``, but you may also
-redefine it.
-
-.. code-block:: none
-
-  set vpn l2tp remote-access authentication radius rate-limit attribute Download-Speed
-
-.. note:: If you set a custom RADIUS attribute you must define it on both
-   dictionaries at RADIUS server and client, which is the vyos router in our
-   example.
-
-The RADIUS dictionaries in VyOS are located at ``/usr/share/accel-ppp/radius/``
-
-RADIUS advanced features
-^^^^^^^^^^^^^^^^^^^^^^^^
-
-Received RADIUS attributes have a higher priority than parameters defined within
-the CLI configuration, refer to the explanation below.
-
-Allocation clients ip addresses by RADIUS
-*****************************************
-
-If the RADIUS server sends the attribute ``Framed-IP-Address`` then this IP
-address will be allocated to the client and the option ip-pool within the CLI
-config is being ignored.
-
-Renaming clients interfaces by RADIUS
-*************************************
-
-If the RADIUS server uses the attribute ``NAS-Port-Id``, ppp tunnels will be
-renamed.
-
-.. note:: The value of the attribute ``NAS-Port-Id`` must be less than 16
-   characters, otherwise the interface won't be renamed.
-
-
-.. _`Google Public DNS`: https://developers.google.com/speed/public-dns
-.. _Quad9: https://quad9.net
-.. _CloudFlare: https://blog.cloudflare.com/announcing-1111
-.. _OpenNIC: https://www.opennic.org/
-.. _RADIUS: https://en.wikipedia.org/wiki/RADIUS
-.. _FreeRADIUS: https://freeradius.org
-.. _`Network Policy Server`: https://en.wikipedia.org/wiki/Network_Policy_Server
-.. _accel-ppp: https://accel-ppp.org/
diff --git a/docs/vpn/openconnect.rst b/docs/vpn/openconnect.rst
deleted file mode 100644
index a409ed9d..00000000
--- a/docs/vpn/openconnect.rst
+++ /dev/null
@@ -1,95 +0,0 @@
-.. _vpn-openconnect:
-
-###########
-OpenConnect
-###########
-
-OpenConnect-compatible server feature is available from this release.
-Openconnect VPN supports SSL connection and offers full network access. SSL VPN
-network extension connects the end-user system to the corporate network with
-access controls based only on network layer information, such as destination IP
-address and port number. So, it provides safe communication for all types of
-device traffic across public networks and private networks, also encrypts the
-traffic with SSL protocol.
-
-The remote user will use the openconnect client to connect to the router and
-will receive an IP address from a VPN pool, allowing full access to the network.
-
-.. note:: All certificates should be stored on VyOS under /config/auth. If
-   certificates are not stored in the /config directory they will not be
-   migrated during a software update.
-
-*************
-Configuration
-*************
-
-SSL Certificates
-================
-
-We need to generate the certificate which authenticates users who attempt to
-access the network resource through the SSL VPN tunnels. The following command
-will create a self signed certificates and will be stored in the file path
-`/config/auth`.
-
-.. code-block:: none
-
-  openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -keyout /config/auth/server.key -out /config/auth/server.crt
-  openssl req -new -x509 -key /config/auth/server.key -out /config/auth/ca.crt
-
-We can also create the certificates using Cerbort which is an easy-to-use client
-that fetches a certificate from Let's Encrypt an open certificate authority
-launched by the EFF, Mozilla, and others and deploys it to a web server.
-
-.. code-block:: none
-
-  sudo certbot certonly --standalone --preferred-challenges http -d <domain name>
-
-Server Configuration
-====================
-
-.. code-block:: none
-
-  set vpn openconnect authentication local-users username <user> password <pass>
-  set vpn openconnect authentication mode <local|radius>
-  set vpn opneconnect network-settings client-ip-settings subnet <subnet>
-  set vpn openconnect network-settings name-server <address>
-  set vpn openconnect network-settings name-server <address>
-  set vpn openconnect ssl ca-cert-file <file>
-  set vpn openconnect ssl cert-file <file>
-  set vpn openconnect ssl key-file <file>
-
-
-*******
-Example
-*******
-
-Use local user name "user4" with password "SecretPassword"
-Client IP addresses will be provided from pool 100.64.0.0/24
-The Gateway IP Address must be in one of the router´s interfaces.
-
-.. code-block:: none
-
-  set vpn openconnect authentication local-users username user4 password 'SecretPassword'
-  set vpn openconnect authentication mode 'local'
-  set vpn openconnect network-settings client-ip-settings subnet '100.64.0.0/24'
-  set vpn openconnect network-settings name-server '1.1.1.1'
-  set vpn openconnect network-settings name-server '8.8.8.8'
-  set vpn openconnect ssl ca-cert-file '/config/auth/fullchain.pem'
-  set vpn openconnect ssl cert-file '/config/auth/cert.pem'
-  set vpn openconnect ssl key-file '/config/auth/privkey.pem'
-
-
-************
-Verification
-************
-
-.. code-block:: none
-
-
-  vyos@RTR1:~$ show openconnect-server sessions
-
-  interface    username    ip            remote IP      RX        TX        state      uptime
-  -----------  ----------  ------------  -------------  --------  --------  ---------  --------
-  sslvpn0      user4       100.64.0.105  xx.xxx.49.253  127.3 KB  160.0 KB  connected  12m:28s
-
-.. note:: It is compatible with Cisco (R) AnyConnect (R) clients.
diff --git a/docs/vpn/pptp.rst b/docs/vpn/pptp.rst
deleted file mode 100644
index 72b3feb0..00000000
--- a/docs/vpn/pptp.rst
+++ /dev/null
@@ -1,47 +0,0 @@
-.. _pptp:
-
-PPTP-Server
------------
-
-The Point-to-Point Tunneling Protocol (PPTP_) has been implemented in VyOS only for backwards compatibility.
-PPTP has many well known security issues and you should use one of the many other new VPN implementations.
-
-As per default and if not otherwise defined, mschap-v2 is being used for authentication and mppe 128-bit (stateless) for encryption.
-If no gateway-address is set within the configuration, the lowest IP out of the /24 client-ip-pool is being used. For instance, in the example below it would be 192.168.0.1.
-
-server example
-^^^^^^^^^^^^^^
-
-.. code-block:: none
-
-  set vpn pptp remote-access authentication local-users username test password 'test'
-  set vpn pptp remote-access authentication mode 'local'
-  set vpn pptp remote-access client-ip-pool start '192.168.0.10'
-  set vpn pptp remote-access client-ip-pool stop '192.168.0.15'
-  set vpn pptp remote-access gateway-address '10.100.100.1'
-  set vpn pptp remote-access outside-address '10.1.1.120'
-
-
-client example (debian 9)
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-Install the client software via apt and execute pptpsetup to generate the configuration.
-
-
-.. code-block:: none
-
-  apt-get install pptp-linux
-  pptpsetup --create TESTTUNNEL --server 10.1.1.120 --username test --password test --encrypt
-  pon TESTTUNNEL
-
-The command pon TESTUNNEL establishes the PPTP tunnel to the remote system.
-
-
-All tunnel sessions can be checked via:
-
-.. code-block:: none
-
-  run sh pptp-server sessions
-   ifname | username | calling-sid |      ip      | type | comp | state  |  uptime
-  --------+----------+-------------+--------------+------+------+--------+----------
-   ppp0   | test     | 10.1.1.99   | 192.168.0.10 | pptp | mppe | active | 00:00:58
diff --git a/docs/vpn/site2site_ipsec.rst b/docs/vpn/site2site_ipsec.rst
deleted file mode 100644
index 08ccc648..00000000
--- a/docs/vpn/site2site_ipsec.rst
+++ /dev/null
@@ -1,298 +0,0 @@
-.. _size2site_ipsec:
-
-Site-to-Site
-============
-
-Site-to-site mode provides a way to add remote peers, which could be configured to exchange encrypted information between them and VyOS itself or connected/routed networks.
-
-To configure site-to-site connection you need to add peers with the ``set vpn ipsec site-to-site`` command.
-
-You can identify a remote peer with:
-
-* IPv4 or IPv6 address. This mode is easiest for configuration and mostly used when a peer has a public static IP address;
-* Hostname. This mode is similar to IP address, only you define DNS name instead of an IP. Could be used when a peer has a public IP address and DNS name, but an IP address could be changed from time to time;
-* Remote ID of the peer. In this mode, there is no predefined remote address nor DNS name of the peer. This mode is useful when a peer doesn't have a publicly available IP address (NAT between it and VyOS), or IP address could be changed.
-
-Each site-to-site peer has the next options:
-
-* ``authentication`` - configure authentication between VyOS and a remote peer. Suboptions:
-
- * ``id`` - ID for the local VyOS router. If defined, during the authentication it will be send to remote peer;
-
- * ``mode`` - mode for authentication between VyOS and remote peer:
-
-  * ``pre-shared-secret`` - use predefined shared secret phrase, must be the same for local and remote side;
-
-  * ``rsa`` - use simple shared RSA key. The key must be defined in the ``set vpn rsa-keys`` section;
-
-  * ``x509`` - use certificates infrastructure for authentication.
-
- * ``pre-shared-secret`` - predefined shared secret. Used if configured ``mode pre-shared-secret``;
-
- * ``remote-id`` - define an ID for remote peer, instead of using peer name or address. Useful in case if the remote peer is behind NAT or if ``mode x509`` is used;
-
- * ``rsa-key-name`` - shared RSA key for authentication. The key must be defined in the ``set vpn rsa-keys`` section;
-
- * ``use-x509-id`` - use local ID from x509 certificate. Cannot be used when ``id`` is defined;
-
- * ``x509`` - options for x509 authentication mode:
-
-  * ``ca-cert-file`` - CA certificate file. Using for authenticating remote peer;
-
-  * ``cert-file`` - certificate file, which will be used for authenticating local router on remote peer;
-
-  * ``crl-file`` - file with the Certificate Revocation List. Using to check if a certificate for the remote peer is valid or revoked;
-
-  * ``key`` - a private key, which will be used for authenticating local router on remote peer:
-
-   * ``file`` - path to the key file;
-
-   * ``password`` - passphrase private key, if needed.
-
-* ``connection-type`` - how to handle this connection process. Possible variants:
-
- * ``initiate`` - do initial connection to remote peer immediately after configuring and after boot. In this mode the connection will not be restarted in case of disconnection, therefore should be used only together with DPD or another session tracking methods;
-
- * ``respond`` - do not try to initiate a connection to a remote peer. In this mode, the IPSec session will be established only after initiation from a remote peer. Could be useful when there is no direct connectivity to the peer due to firewall or NAT in the middle of the local and remote side.
-
-* ``default-esp-group`` - ESP group to use by default for traffic encryption. Might be overwritten by individual settings for tunnel or VTI interface binding;
-
-* ``description`` - description for this peer;
-
-* ``dhcp-interface`` - use an IP address, received from DHCP for IPSec connection with this peer, instead of ``local-address``;
-
-* ``force-encapsulation`` - force encapsulation of ESP into UDP datagrams. Useful in case if between local and remote side is firewall or NAT, which not allows passing plain ESP packets between them;
-
-* ``ike-group`` - IKE group to use for key exchanges;
-
-* ``ikev2-reauth`` - reauthenticate remote peer during the rekeying process. Can be used only with IKEv2:
-
- * ``yes`` - create a new IKE_SA from the scratch and try to recreate all IPsec SAs;
-
- * ``no`` - rekey without uninstalling the IPsec SAs;
-
- * ``inherit`` - use default behavior for the used IKE group.
-
-* ``local-address`` - local IP address for IPSec connection with this peer. If defined ``any``, then an IP address which configured on interface with default route will be used;
-
-* ``tunnel`` - define criteria for traffic to be matched for encrypting and send it to a peer:
-
- * ``disable`` - disable this tunnel;
-
- * ``esp-group`` - define ESP group for encrypt traffic, defined by this tunnel;
-
- * ``local`` - define a local source for match traffic, which should be encrypted and send to this peer:
-
-  * ``port`` - define port. Have effect only when used together with ``prefix``;
-
-  * ``prefix`` - IP network at local side.
-
- * ``protocol`` - define the protocol for match traffic, which should be encrypted and send to this peer;
-
- * ``remote`` - define the remote destination for match traffic, which should be encrypted and send to this peer:
-
-  * ``port`` - define port. Have effect only when used together with ``prefix``;
-
-  * ``prefix`` - IP network at remote side.
-
-* ``vti`` - use a VTI interface for traffic encryption. Any traffic, which will be send to VTI interface will be encrypted and send to this peer. Using VTI makes IPSec configuration much flexible and easier in complex situation, and allows to dynamically add/delete remote networks, reachable via a peer, as in this mode router don't need to create additional SA/policy for each remote network:
-
- * ``bind`` - select a VTI interface to bind to this peer;
-
- * ``esp-group`` - define ESP group for encrypt traffic, passed this VTI interface.
-
-Examples:
-------------------
-
-IKEv1
-^^^^^
-
-Example:
-
-* WAN interface on `eth1`
-* left subnet: `192.168.0.0/24` site1, server side (i.e. locality, actually
-  there is no client or server roles)
-* left local_ip: `198.51.100.3` # server side WAN IP
-* right subnet: `10.0.0.0/24` site2,remote office side
-* right local_ip: `203.0.113.2` # remote office side WAN IP
-
-.. code-block:: none
-
-  # server config
-  set vpn ipsec esp-group office-srv-esp compression 'disable'
-  set vpn ipsec esp-group office-srv-esp lifetime '1800'
-  set vpn ipsec esp-group office-srv-esp mode 'tunnel'
-  set vpn ipsec esp-group office-srv-esp pfs 'enable'
-  set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
-  set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
-  set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
-  set vpn ipsec ike-group office-srv-ike lifetime '3600'
-  set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
-  set vpn ipsec ipsec-interfaces interface 'eth1'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'SomePreSharedKey'
-  set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'office-srv-ike'
-  set vpn ipsec site-to-site peer 203.0.113.2 local-address '198.51.100.3'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 allow-nat-networks 'disable'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 allow-public-networks 'disable'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 esp-group 'office-srv-esp'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 local prefix '192.168.0.0/24'
-  set vpn ipsec site-to-site peer 203.0.113.2 tunnel 0 remote prefix '10.0.0.0/21'
-
-  # remote office config
-  set vpn ipsec esp-group office-srv-esp compression 'disable'
-  set vpn ipsec esp-group office-srv-esp lifetime '1800'
-  set vpn ipsec esp-group office-srv-esp mode 'tunnel'
-  set vpn ipsec esp-group office-srv-esp pfs 'enable'
-  set vpn ipsec esp-group office-srv-esp proposal 1 encryption 'aes256'
-  set vpn ipsec esp-group office-srv-esp proposal 1 hash 'sha1'
-  set vpn ipsec ike-group office-srv-ike ikev2-reauth 'no'
-  set vpn ipsec ike-group office-srv-ike key-exchange 'ikev1'
-  set vpn ipsec ike-group office-srv-ike lifetime '3600'
-  set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
-  set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
-  set vpn ipsec ipsec-interfaces interface 'eth1'
-  set vpn ipsec site-to-site peer 198.51.100.3 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 198.51.100.3 authentication pre-shared-secret 'SomePreSharedKey'
-  set vpn ipsec site-to-site peer 198.51.100.3 ike-group 'office-srv-ike'
-  set vpn ipsec site-to-site peer 198.51.100.3 local-address '203.0.113.2'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 allow-nat-networks 'disable'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 allow-public-networks 'disable'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 esp-group 'office-srv-esp'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 local prefix '10.0.0.0/21'
-  set vpn ipsec site-to-site peer 198.51.100.3 tunnel 0 remote prefix '192.168.0.0/24'
-
-Show status of new setup:
-
-.. code-block:: none
-
-  vyos@srv-gw0:~$ show vpn ike sa
-  Peer ID / IP                            Local ID / IP
-  ------------                            -------------
-  203.0.113.2                                 198.51.100.3
-     State  Encrypt  Hash    D-H Grp  NAT-T  A-Time  L-Time
-     -----  -------  ----    -------  -----  ------  ------
-     up     aes256   sha1    5        no     734     3600
-
-  vyos@srv-gw0:~$ show vpn ipsec sa
-  Peer ID / IP                            Local ID / IP
-  ------------                            -------------
-  203.0.113.2                                 198.51.100.3
-     Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto
-     ------  -----  -------------  -------  ----    -----  ------  ------  -----
-     0       up     7.5M/230.6K    aes256   sha1    no     567     1800    all
-
-If there is SNAT rules on eth1, need to add exclude rule
-
-.. code-block:: none
-
-  # server side
-  set nat source rule 10 destination address '10.0.0.0/24'
-  set nat source rule 10 'exclude'
-  set nat source rule 10 outbound-interface 'eth1'
-  set nat source rule 10 source address '192.168.0.0/24'
-
-  # remote office side
-  set nat source rule 10 destination address '192.168.0.0/24'
-  set nat source rule 10 'exclude'
-  set nat source rule 10 outbound-interface 'eth1'
-  set nat source rule 10 source address '10.0.0.0/24'
-
-To allow traffic to pass through to clients, you need to add the following
-rules. (if you used the default configuration at the top of this page)
-
-.. code-block:: none
-
-  # server side
-  set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 32 source address '10.0.0.0/24'
-
-  # remote office side
-  set firewall name OUTSIDE-LOCAL rule 32 action 'accept'
-  set firewall name OUTSIDE-LOCAL rule 32 source address '192.168.0.0/24'
-
-IKEv2
-^^^^^
-
-Imagine the following topology
-
-.. figure:: ../_static/images/vpn_s2s_ikev2.png
-   :scale: 50 %
-   :alt: IPSec IKEv2 site2site VPN
-
-   IPSec IKEv2 site2site VPN (source ./draw.io/vpn_s2s_ikev2.drawio)
-
-
-.. note:: Don't get confused about the used /31 tunnel subnet. :rfc:`3021`
-   gives you additional information for using /31 subnets on point-to-point
-   links.
-
-**left**
-
-.. code-block:: none
-
-  set interfaces vti vti10 address '10.0.0.2/31'
-
-  set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
-  set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
-  set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
-  set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
-  set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
-  set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'hold'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
-  set vpn ipsec ike-group IKEv2_DEFAULT ikev2-reauth 'no'
-  set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
-  set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
-  set vpn ipsec ike-group IKEv2_DEFAULT mobike 'disable'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
-  set vpn ipsec ipsec-interfaces interface 'eth0.201'
-  set vpn ipsec site-to-site peer 172.18.202.10 authentication id '172.18.201.10'
-  set vpn ipsec site-to-site peer 172.18.202.10 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 172.18.202.10 authentication pre-shared-secret 'secretkey'
-  set vpn ipsec site-to-site peer 172.18.202.10 authentication remote-id '172.18.202.10'
-  set vpn ipsec site-to-site peer 172.18.202.10 connection-type 'initiate'
-  set vpn ipsec site-to-site peer 172.18.202.10 ike-group 'IKEv2_DEFAULT'
-  set vpn ipsec site-to-site peer 172.18.202.10 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 172.18.202.10 local-address '172.18.201.10'
-  set vpn ipsec site-to-site peer 172.18.202.10 vti bind 'vti10'
-  set vpn ipsec site-to-site peer 172.18.202.10 vti esp-group 'ESP_DEFAULT'
-
-**right**
-
-.. code-block:: none
-
-  set interfaces vti vti10 address '10.0.0.3/31'
-
-  set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
-  set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
-  set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
-  set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
-  set vpn ipsec esp-group ESP_DEFAULT proposal 10 encryption 'aes256gcm128'
-  set vpn ipsec esp-group ESP_DEFAULT proposal 10 hash 'sha256'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection action 'hold'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection interval '30'
-  set vpn ipsec ike-group IKEv2_DEFAULT dead-peer-detection timeout '120'
-  set vpn ipsec ike-group IKEv2_DEFAULT ikev2-reauth 'no'
-  set vpn ipsec ike-group IKEv2_DEFAULT key-exchange 'ikev2'
-  set vpn ipsec ike-group IKEv2_DEFAULT lifetime '10800'
-  set vpn ipsec ike-group IKEv2_DEFAULT mobike 'disable'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 dh-group '19'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 encryption 'aes256gcm128'
-  set vpn ipsec ike-group IKEv2_DEFAULT proposal 10 hash 'sha256'
-  set vpn ipsec ipsec-interfaces interface 'eth0.202'
-  set vpn ipsec site-to-site peer 172.18.201.10 authentication id '172.18.202.10'
-  set vpn ipsec site-to-site peer 172.18.201.10 authentication mode 'pre-shared-secret'
-  set vpn ipsec site-to-site peer 172.18.201.10 authentication pre-shared-secret 'secretkey'
-  set vpn ipsec site-to-site peer 172.18.201.10 authentication remote-id '172.18.201.10'
-  set vpn ipsec site-to-site peer 172.18.201.10 connection-type 'initiate'
-  set vpn ipsec site-to-site peer 172.18.201.10 ike-group 'IKEv2_DEFAULT'
-  set vpn ipsec site-to-site peer 172.18.201.10 ikev2-reauth 'inherit'
-  set vpn ipsec site-to-site peer 172.18.201.10 local-address '172.18.202.10'
-  set vpn ipsec site-to-site peer 172.18.201.10 vti bind 'vti10'
-  set vpn ipsec site-to-site peer 172.18.201.10 vti esp-group 'ESP_DEFAULT'
diff --git a/docs/vpn/sstp.rst b/docs/vpn/sstp.rst
deleted file mode 100644
index f5e4ad05..00000000
--- a/docs/vpn/sstp.rst
+++ /dev/null
@@ -1,347 +0,0 @@
-.. _sstp:
-
-####
-SSTP
-####
-
-:abbr:`SSTP (Secure Socket Tunneling Protocol)` is a form of :abbr:`VPN
-(Virtual Private Network)` tunnel that provides a mechanism to transport PPP
-traffic through an SSL/TLS channel. SSL/TLS provides transport-level security
-with key negotiation, encryption and traffic integrity checking. The use of
-SSL/TLS over TCP port 443 allows SSTP to pass through virtually all firewalls
-and proxy servers except for authenticated web proxies.
-
-SSTP is available for Linux, BSD, and Windows.
-
-VyOS utilizes accel-ppp_ to provide SSTP server functionality. We support both
-local and RADIUS authentication.
-
-As SSTP provides PPP via a SSL/TLS channel the use of either publically signed
-certificates as well as a private PKI is required.
-
-.. note:: All certificates should be stored on VyOS under ``/config/auth``. If
-  certificates are not stored in the ``/config`` directory they will not be
-  migrated during a software update.
-
-Certificates
-============
-
-Self Signed CA
---------------
-
-To generate the CA, the server private key and certificates the following
-commands can be used.
-
-.. code-block:: none
-
-  vyos@vyos:~$ mkdir -p /config/user-data/sstp
-  vyos@vyos:~$ openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -keyout /config/user-data/sstp/server.key -out /config/user-data/sstp/server.crt
-
-  Generating a 4096 bit RSA private key
-  .........................++
-  ...............................................................++
-  writing new private key to 'server.key'
-  [...]
-  Country Name (2 letter code) [AU]:
-  State or Province Name (full name) [Some-State]:
-  Locality Name (eg, city) []:
-  Organization Name (eg, company) [Internet Widgits Pty Ltd]:
-  Organizational Unit Name (eg, section) []:
-  Common Name (e.g. server FQDN or YOUR name) []:
-  Email Address []:
-
-  vyos@vyos:~$ openssl req -new -x509 -key /config/user-data/sstp/server.key -out /config/user-data/sstp/ca.crt
-  [...]
-  Country Name (2 letter code) [AU]:
-  State or Province Name (full name) [Some-State]:
-  Locality Name (eg, city) []:
-  Organization Name (eg, company) [Internet Widgits Pty Ltd]:
-  Organizational Unit Name (eg, section) []:
-  Common Name (e.g. server FQDN or YOUR name) []:
-  Email Address []:
-
-
-Configuration
-=============
-
-.. cfgcmd:: set vpn sstp authentication local-users username <user> password <pass>
-
-  Create `<user>` for local authentication on this system. The users password
-  will be set to `<pass>`.
-
-.. cfgcmd:: set vpn sstp authentication local-users username <user> disable
-
-  Disable `<user>` account.
-
-.. cfgcmd:: set vpn sstp authentication local-users username <user> static-ip <address>
-
-  Assign static IP address to `<user>` account.
-
-.. cfgcmd:: set vpn sstp authentication local-users username <user> rate-limit download <bandwidth>
-
-  Download bandwidth limit in kbit/s for `<user>`.
-
-.. cfgcmd:: set vpn sstp authentication local-users username <user> rate-limit upload <bandwidth>
-
-  Upload bandwidth limit in kbit/s for `<user>`.
-
-.. cfgcmd:: set vpn sstp authentication protocols <pap | chap | mschap | mschap-v2>
-
-  Require the peer to authenticate itself using one of the following protocols:
-  pap, chap, mschap, mschap-v2.
-
-.. cfgcmd:: set vpn sstp authentication mode <local | radius>
-
-  Set authentication backend. The configured authentication backend is used
-  for all queries.
-
-  * **radius**: All authentication queries are handled by a configured RADIUS
-    server.
-  * **local**: All authentication queries are handled locally.
-
-
-.. cfgcmd:: set vpn sstp gateway-address <gateway>
-
-  Specifies single `<gateway>` IP address to be used as local address of PPP
-  interfaces.
-
-
-.. cfgcmd:: set vpn sstp client-ip-pool subnet <subnet>
-
-  Use `<subnet>` as the IP pool for all connecting clients.
-
-
-.. cfgcmd:: set vpn sstp client-ipv6-pool prefix <address> mask <number-of-bits>
-
-  Use this comand to set the IPv6 address pool from which an SSTP client
-  will get an IPv6 prefix of your defined length (mask) to terminate the
-  SSTP endpoint at their side. The mask length can be set from 48 to 128
-  bit long, the default value is 64.
-
-
-.. cfgcmd:: set vpn sstp client-ipv6-pool delegate <address> delegation-prefix <number-of-bits>
-
-  Use this command to configure DHCPv6 Prefix Delegation (RFC3633) on
-  SSTP. You will have to set your IPv6 pool and the length of the
-  delegation prefix. From the defined IPv6 pool you will be handing out
-  networks of the defined length (delegation-prefix). The length of the
-  delegation prefix can be set from 32 to 64 bit long.
-
-
-.. cfgcmd:: set vpn sstp name-server <address>
-
-  Connected client should use `<address>` as their DNS server. This
-  command accepts both IPv4 and IPv6 addresses. Up to two nameservers
-  can be configured for IPv4, up to three for IPv6.
-
-Maximum number of IPv4 nameservers
-
-SSL Certificates
-----------------
-
-.. cfgcmd:: set vpn sstp ssl ca-cert-file <file>
-
-  Path to `<file>` pointing to the certificate authority certificate.
-
-.. cfgcmd:: set vpn sstp ssl cert-file <file>
-
-  Path to `<file>` pointing to the servers certificate (public portion).
-
-.. cfgcmd:: set vpn sstp ssl key-file <file>
-
-  Path to `<file>` pointing to the servers certificate (private portion).
-
-PPP Settings
-------------
-
-.. cfgcmd:: set vpn sstp ppp-options lcp-echo-failure <number>
-
-  Defines the maximum `<number>` of unanswered echo requests. Upon reaching the
-  value `<number>`, the session will be reset.
-
-.. cfgcmd:: set vpn sstp ppp-options lcp-echo-interval <interval>
-
-  If this option is specified and is greater than 0, then the PPP module will
-  send LCP pings of the echo request every `<interval>` seconds.
-
-.. cfgcmd:: set vpn sstp ppp-options lcp-echo-timeout
-
-  Specifies timeout in seconds to wait for any peer activity. If this option
-  specified it turns on adaptive lcp echo functionality and "lcp-echo-failure"
-  is not used.
-
-.. cfgcmd:: set vpn sstp ppp-options mppe <require | prefer | deny>
-
-  Specifies :abbr:`MPPE (Microsoft Point-to-Point Encryption)` negotioation
-  preference.
-
-  * **require** - ask client for mppe, if it rejects drop connection
-  * **prefer** - ask client for mppe, if it rejects don't fail
-  * **deny** - deny mppe
-
-  Default behavior - don't ask client for mppe, but allow it if client wants.
-  Please note that RADIUS may override this option by MS-MPPE-Encryption-Policy
-  attribute.
-
-
-RADIUS
-------
-
-Server
-^^^^^^
-
-.. cfgcmd:: set vpn sstp authentication radius server <server> port <port>
-
-  Configure RADIUS `<server>` and its required port for authentication requests.
-
-.. cfgcmd:: set vpn sstp authentication radius server <server> key <secret>
-
-  Configure RADIUS `<server>` and its required shared `<secret>` for
-  communicating with the RADIUS server.
-
-.. cfgcmd:: set vpn sstp authentication radius server <server> fail-time <time>
-
-  Mark RADIUS server as offline for this given `<time>` in seconds.
-
-.. cfgcmd:: set vpn sstp authentication radius server <server> disable
-
-  Temporary disable this RADIUS server.
-
-Options
-^^^^^^^
-
-.. cfgcmd:: set vpn sstp authentication radius acct-timeout <timeout>
-
-  Timeout to wait reply for Interim-Update packets. (default 3 seconds)
-
-.. cfgcmd:: set vpn sstp authentication radius dynamic-author server <address>
-
-  Specifies IP address for Dynamic Authorization Extension server (DM/CoA)
-
-.. cfgcmd:: set vpn sstp authentication radius dynamic-author port <port>
-
-  Port for Dynamic Authorization Extension server (DM/CoA)
-
-.. cfgcmd:: set vpn sstp authentication radius dynamic-author key <secret>
-
-  Secret for Dynamic Authorization Extension server (DM/CoA)
-
-.. cfgcmd:: set vpn sstp authentication radius max-try <number>
-
-  Maximum number of tries to send Access-Request/Accounting-Request queries
-
-.. cfgcmd:: set vpn sstp authentication radius timeout <timeout>
-
-  Timeout to wait response from server (seconds)
-
-.. cfgcmd:: set vpn sstp authentication radius nas-identifier <identifier>
-
-  Value to send to RADIUS server in NAS-Identifier attribute and to be matched
-  in DM/CoA requests.
-
-.. cfgcmd:: set vpn sstp authentication radius nas-ip-address <address>
-
-  Value to send to RADIUS server in NAS-IP-Address attribute and to be matched
-  in DM/CoA requests. Also DM/CoA server will bind to that address.
-
-.. cfgcmd:: set vpn sstp authentication radius source-address <address>
-
-  Source IPv4 address used in all RADIUS server queires.
-
-.. cfgcmd:: set vpn sstp authentication radius rate-limit attribute <attribute>
-
-  Specifies which RADIUS server attribute contains the rate limit information.
-  The default attribute is `Filter-Id`.
-
-.. cfgcmd:: set vpn sstp authentication radius rate-limit enable
-
-  Enables bandwidth shaping via RADIUS.
-
-.. cfgcmd:: set vpn sstp authentication radius rate-limit vendor
-
-  Specifies the vendor dictionary, dictionary needs to be in
-  /usr/share/accel-ppp/radius.
-
-
-Example
-=======
-
-* Use local user `foo` with password `bar`
-* Client IP addresses will be provided from pool `192.0.2.0/25`
-
-.. code-block:: none
-
-  set vpn sstp authentication local-users username vyos password vyos
-  set vpn sstp authentication mode local
-  set vpn sstp gateway-address 192.0.2.254
-  set vpn sstp client-ip-pool subnet 192.0.2.0/25
-  set vpn sstp name-server 10.0.0.1
-  set vpn sstp name-server 10.0.0.2
-  set vpn sstp ssl ca-cert-file /config/auth/ca.crt
-  set vpn sstp ssl cert-file /config/auth/server.crt
-  set vpn sstp ssl key-file /config/auth/server.key
-
-Testing SSTP
-============
-
-Once you have setup your SSTP server there comes the time to do some basic
-testing. The Linux client used for testing is called sstpc_. sstpc_ requires a
-PPP configuration/peer file.
-
-The following PPP configuration tests MSCHAP-v2:
-
-.. code-block:: none
-
-  $ cat /etc/ppp/peers/vyos
-  usepeerdns
-  #require-mppe
-  #require-pap
-  require-mschap-v2
-  noauth
-  lock
-  refuse-pap
-  refuse-eap
-  refuse-chap
-  refuse-mschap
-  #refuse-mschap-v2
-  nobsdcomp
-  nodeflate
-  debug
-
-
-You can now "dial" the peer with the follwoing command: ``sstpc --log-level 4
---log-stderr --user vyos --password vyos vpn.example.com -- call vyos``.
-
-A connection attempt will be shown as:
-
-.. code-block:: none
-
-  $ sstpc --log-level 4 --log-stderr --user vyos --password vyos vpn.example.com -- call vyos
-
-  Mar 22 13:29:12 sstpc[12344]: Resolved vpn.example.com to 192.0.2.1
-  Mar 22 13:29:12 sstpc[12344]: Connected to vpn.example.com
-  Mar 22 13:29:12 sstpc[12344]: Sending Connect-Request Message
-  Mar 22 13:29:12 sstpc[12344]: SEND SSTP CRTL PKT(14)
-  Mar 22 13:29:12 sstpc[12344]:   TYPE(1): CONNECT REQUEST, ATTR(1):
-  Mar 22 13:29:12 sstpc[12344]:     ENCAP PROTO(1): 6
-  Mar 22 13:29:12 sstpc[12344]: RECV SSTP CRTL PKT(48)
-  Mar 22 13:29:12 sstpc[12344]:   TYPE(2): CONNECT ACK, ATTR(1):
-  Mar 22 13:29:12 sstpc[12344]:     CRYPTO BIND REQ(4): 40
-  Mar 22 13:29:12 sstpc[12344]: Started PPP Link Negotiation
-  Mar 22 13:29:15 sstpc[12344]: Sending Connected Message
-  Mar 22 13:29:15 sstpc[12344]: SEND SSTP CRTL PKT(112)
-  Mar 22 13:29:15 sstpc[12344]:   TYPE(4): CONNECTED, ATTR(1):
-  Mar 22 13:29:15 sstpc[12344]:     CRYPTO BIND(3): 104
-  Mar 22 13:29:15 sstpc[12344]: Connection Established
-
-  $ ip addr show ppp0
-  164: ppp0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1452 qdisc fq_codel state UNKNOWN group default qlen 3
-       link/ppp  promiscuity 0
-       inet 100.64.2.2 peer 100.64.1.1/32 scope global ppp0
-          valid_lft forever preferred_lft forever
-
-
-
-.. _sstpc: https://github.com/reliablehosting/sstp-client
-
-.. include:: /common-references.rst
diff --git a/docs/vrf.rst b/docs/vrf.rst
deleted file mode 100644
index 75075be6..00000000
--- a/docs/vrf.rst
+++ /dev/null
@@ -1,307 +0,0 @@
-.. _vrf:
-
-###
-VRF
-###
-
-:abbr:`VRF (Virtual Routing and Forwarding)` devices combined with ip rules
-provides the ability to create virtual routing and forwarding domains (aka
-VRFs, VRF-lite to be specific) in the Linux network stack. One use case is the
-multi-tenancy problem where each tenant has their own unique routing tables and
-in the very least need different default gateways.
-
-.. warning:: VRFs are an "needs testing" feature. If you think things should be
-   different then they are implemented and handled right now - please feedback
-   via a task created in Phabricator_.
-
-
-Configuration
-=============
-
-A VRF device is created with an associated route table. Network interfaces are
-then enslaved to a VRF device.
-
-.. cfgcmd:: set vrf name <name>
-
-   Create new VRF instance with `<name>`. The name is used when placing individual
-   interfaces into the VRF.
-
-.. cfgcmd:: set vrf name <name> table <id>
-
-   Configure use routing table `<id>` used by VRF `<name>`.
-
-   .. note:: A routing table ID can not be modified once it is assigned. It can
-      only be changed by deleting and re-adding the VRF instance.
-
-
-.. cfgcmd:: set vrf bind-to-all
-
-   By default the scope of the port bindings for unbound sockets is limited to
-   the default VRF. That is, it will not be matched by packets arriving on
-   interfaces enslaved to a VRF and processes may bind to the same port if
-   they bind to a VRF.
-
-   TCP & UDP services running in the default VRF context (ie., not bound to any
-   VRF device) can work across all VRF domains by enabling this option.
-
-Interfaces
-----------
-
-When VRFs are used it is not only mandatory to create a VRF but also the VRF
-itself needs to be assigned to an interface.
-
-.. cfgcmd:: set interfaces <dummy | ethernet | bonding | bridge | pppoe> <interface> vrf <name>
-
-   Assign interface identified by `<interface>` to VRF named `<name>`.
-
-Routing
--------
-
-Static
-^^^^^^
-
-Static routes are manually configured routes, which, in general, cannot be
-updated dynamically from information VyOS learns about the network topology from
-other routing protocols. However, if a link fails, the router will remove
-routes, including static routes, from the :abbr:`RIPB (Routing Information
-Base)` that used this interface to reach the next hop. In general, static
-routes should only be used for very simple network topologies, or to override
-the behavior of a dynamic routing protocol for a small number of routes. The
-collection of all routes the router has learned from its configuration or from
-its dynamic routing protocols is stored in the RIB. Unicast routes are directly
-used to determine the forwarding table used for unicast packet forwarding.
-
-Static Routes
-"""""""""""""
-
-.. cfgcmd:: set protocols vrf <name> static route <subnet> next-hop <address>
-
-   Configure next-hop `<address>` for an IPv4 static route in the VRF identified
-   by `<name>`. Multiple static routes can be created.
-
-.. cfgcmd:: set protocols vrf <name> static route <subnet> next-hop <address> disable
-
-   Disable IPv4 static route entry in the VRF identified by `<name>`
-
-.. cfgcmd:: set protocols vrf <name> static route <subnet> next-hop <address> distance <distance>
-
-   Defines next-hop distance for this route, routes with smaller administrative
-   distance are elected prior those with a higher distance.
-
-   Range is 1 to 255, default is 1.
-
-.. cfgcmd:: set protocols vrf <name> static route6 <subnet> next-hop <address>
-
-   Configure next-hop `<address>` for an IPv6 static route in the VRF identified
-   by `<name>`. Multiple IPv6 static routes can be created.
-
-.. cfgcmd:: set protocols vrf <name> static route6 <subnet> next-hop <address> disable
-
-   Disable IPv6 static route entry in the VRF identified by `<name>`.
-
-.. cfgcmd:: set protocols vrf <name> static route6 <subnet> next-hop <address> distance <distance>
-
-   Defines next-hop distance for this route, routes with smaller administrative
-   distance are elected prior those with a higher distance.
-
-   Range is 1 to 255, default is 1.
-
-   .. note:: Routes with a distance of 255 are effectively disabled and not
-      installed into the kernel.
-
-
-Leaking
-"""""""
-
-.. cfgcmd:: set protocols vrf <name> static route <subnet> next-hop <address> next-hop-vrf <default | vrf-name>
-
-   Use this command if you have shared services or routes that should be shared
-   between multiple VRF instances. This will add an IPv4 route to VRF `<name>`
-   routing table to reach a `<subnet>` via a next-hop gatewys `<address>` in
-   a different VRF or leak it into the default VRF.
-
-.. cfgcmd:: set protocols vrf <name> static route6 <subnet> next-hop <address> next-hop-vrf <default | vrf-name>
-
-   Use this command if you have shared services or routes that should be shared
-   between multiple VRF instances. This will add an IPv6 route to VRF `<name>`
-   routing table to reach a `<subnet>` via a next-hop gatewys `<address>` in
-   a different VRF or leak it into the default VRF.
-
-
-Interface Routes
-""""""""""""""""
-
-.. cfgcmd:: set protocols vrf <name> static interface-route <subnet> next-hop-interface <interface>
-
-   Allows you to configure the next-hop interface for an interface-based IPv4
-   static route. `<interface>` will be the next-hop interface where trafic is
-   routed for the given `<subnet>`.
-
-.. cfgcmd:: set protocols vrf <name> static interface-route <subnet> next-hop-interface <interface> disable
-
-   Disables interface-based IPv4 static route.
-
-.. cfgcmd:: set protocols vrf <name> static interface-route <subnet> next-hop-interface <interface> distance <distance>
-
-   Defines next-hop distance for this route, routes with smaller administrative
-   distance are elected prior those with a higher distance.
-
-   Range is 1 to 255, default is 1.
-
-.. cfgcmd:: set protocols vrf <name> static interface-route6 <subnet> next-hop-interface <interface>
-
-   Allows you to configure the next-hop interface for an interface-based IPv6
-   static route. `<interface>` will be the next-hop interface where trafic is
-   routed for the given `<subnet>`.
-
-.. cfgcmd:: set protocols vrf <name> static interface-route6 <subnet> next-hop-interface <interface> disable
-
-   Disables interface-based IPv6 static route.
-
-.. cfgcmd:: set protocols vrf <name> static interface-route6 <subnet> next-hop-interface <interface> distance <distance>
-
-   Defines next-hop distance for this route, routes with smaller administrative
-   distance are elected prior those with a higher distance.
-
-   Range is 1 to 255, default is 1.
-
-Blackhole
-"""""""""
-
-.. cfgcmd:: set protocols vrf <name> static route <subnet> blackhole
-
-   Use this command to configure a "black-hole" route on the router. A
-   black-hole route is a route for which the system silently discard packets
-   that are matched. This prevents networks leaking out public interfaces, but
-   it does not prevent them from being used as a more specific route inside your
-   network.
-
-.. cfgcmd:: set protocols vrf <name> static route <subnet> blackhole distance <distance>
-
-   Defines blackhole distance for this route, routes with smaller administrative
-   distance are elected prior those with a higher distance.
-
-.. cfgcmd:: set protocols vrf <name> static route6 <subnet> blackhole
-
-   Use this command to configure a "black-hole" route on the router. A
-   black-hole route is a route for which the system silently discard packets
-   that are matched. This prevents networks leaking out public interfaces, but
-   it does not prevent them from being used as a more specific route inside your
-   network.
-
-.. cfgcmd:: set protocols vrf <name> static route6 <subnet> blackhole distance <distance>
-
-   Defines blackhole distance for this route, routes with smaller administrative
-   distance are elected prior those with a higher distance.
-
-
-Operation
-=========
-
-It is not sufficient to only configure a VRF but VRFs must be maintained, too.
-For VR Fmaintenance the followin operational commands are in place.
-
-.. opcmd:: show vrf
-
-   List VRFs that have been created
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show vrf
-     VRF name          state     mac address        flags                     interfaces
-     --------          -----     -----------        -----                     ----------
-     blue              up        de:c4:83:d8:74:24  noarp,master,up,lower_up  dum200,eth0.302
-     red               up        be:36:ce:02:df:aa  noarp,master,up,lower_up  dum100,eth0.300,bond0.100,peth0
-
-   .. note:: Command should probably be extended to list also the real interfaces
-      assigned to this one VRF to get a better overview.
-
-.. opcmd:: show vrf <name>
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show vrf name blue
-     VRF name          state     mac address        flags                     interfaces
-     --------          -----     -----------        -----                     ----------
-     blue              up        de:c4:83:d8:74:24  noarp,master,up,lower_up  dum200,eth0.302
-
-.. opcmd:: show ip route vrf <name>
-
-   Display IPv4 routing table for VRF identified by `<name>`.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show ip route vrf blue
-     Codes: K - kernel route, C - connected, S - static, R - RIP,
-            O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
-            T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
-            F - PBR, f - OpenFabric,
-            > - selected route, * - FIB route, q - queued route, r - rejected route
-
-     VRF blue:
-     K   0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 00:00:50
-     S>* 172.16.0.0/16 [1/0] via 192.0.2.1, dum1, 00:00:02
-     C>* 192.0.2.0/24 is directly connected, dum1, 00:00:06
-
-
-.. opcmd:: show ipv6 route vrf <name>
-
-   Display IPv6 routing table for VRF identified by `<name>`.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ show ipv6 route vrf red
-     Codes: K - kernel route, C - connected, S - static, R - RIPng,
-            O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table,
-            v - VNC, V - VNC-Direct, A - Babel, D - SHARP, F - PBR,
-            f - OpenFabric,
-            > - selected route, * - FIB route, q - queued route, r - rejected route
-
-     VRF red:
-     K   ::/0 [255/8192] unreachable (ICMP unreachable), 00:43:20
-     C>* 2001:db8::/64 is directly connected, dum1, 00:02:19
-     C>* fe80::/64 is directly connected, dum1, 00:43:19
-     K>* ff00::/8 [0/256] is directly connected, dum1, 00:43:19
-
-
-.. opcmd:: ping <host> vrf <name>
-
-   The ping command is used to test whether a network host is reachable or not.
-
-   Ping uses ICMP protocol's mandatory ECHO_REQUEST datagram to elicit an
-   ICMP ECHO_RESPONSE from a host or gateway. ECHO_REQUEST datagrams (pings)
-   will have an IP and ICMP header, followed by "struct timeval" and an
-   arbitrary number of pad bytes used to fill out the packet.
-
-   When doing fault isolation with ping, your should first run it on the local
-   host, to verify that the local network interface is up and running. Then,
-   continue with hosts and gateways further down the road towards your
-   destination. Round-trip times and packet loss statistics are computed.
-
-   Duplicate packets are not included in the packet loss calculation, although
-   the round-trip time of these packets is used in calculating the minimum/
-   average/maximum round-trip time numbers.
-
-   Ping command can be interrupted at any given time using `<Ctrl>+c`- A brief
-   statistic is shown afterwards.
-
-   .. code-block:: none
-
-     vyos@vyos:~$ ping 192.0.2.1 vrf red
-     PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data.
-     64 bytes from 192.0.2.1: icmp_seq=1 ttl=64 time=0.070 ms
-     64 bytes from 192.0.2.1: icmp_seq=2 ttl=64 time=0.078 ms
-     ^C
-     --- 192.0.2.1 ping statistics ---
-     2 packets transmitted, 2 received, 0% packet loss, time 4ms
-     rtt min/avg/max/mdev = 0.070/0.074/0.078/0.004 ms
-
-.. opcmd:: traceroute vrf <name> [ipv4 | ipv6] <host>
-
-   Displays the route packets take to a network host utilizing VRF instance
-   identified by `<name>`. When using the IPv4 or IPv6 option, display the route
-   packets take to the for the given hosts IP address family. This option is
-   useful when the host specified is a hostname rather than an IP address.
-
-
-.. include:: common-references.rst
-- 
cgit v1.2.3


From b8a2fd5e578f200928a457b9f967ed92619bda88 Mon Sep 17 00:00:00 2001
From: rebortg <github@ghlr.de>
Date: Tue, 8 Dec 2020 15:12:56 +0100
Subject: fix build error after merge

---
 docs/_include/interface-common-with-dhcp.txt | 2 +-
 docs/_include/interface-common.txt           | 4 ++--
 docs/_include/interface-vlan-8021ad.txt      | 8 ++++----
 docs/_include/interface-vlan-8021q.txt       | 8 ++++----
 docs/configuration/protocols/index.rst       | 2 +-
 docs/configuration/protocols/isis.rst        | 2 +-
 docs/contributing/documentation.rst          | 2 +-
 7 files changed, 14 insertions(+), 14 deletions(-)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-common-with-dhcp.txt b/docs/_include/interface-common-with-dhcp.txt
index 46dddb9b..47b4796f 100644
--- a/docs/_include/interface-common-with-dhcp.txt
+++ b/docs/_include/interface-common-with-dhcp.txt
@@ -16,6 +16,6 @@
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+.. cmdinclude:: /_include/interface-dhcpv6-prefix-delegation.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
diff --git a/docs/_include/interface-common.txt b/docs/_include/interface-common.txt
index 79269fe3..5a997482 100644
--- a/docs/_include/interface-common.txt
+++ b/docs/_include/interface-common.txt
@@ -22,11 +22,11 @@
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-ip.txt
+.. cmdinclude:: /_include/interface-ip.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
-.. cmdinclude:: ../_include/interface-ipv6.txt
+.. cmdinclude:: /_include/interface-ipv6.txt
   :var0: {{ var0 }}
   :var1: {{ var1 }}
 
diff --git a/docs/_include/interface-vlan-8021ad.txt b/docs/_include/interface-vlan-8021ad.txt
index 6a34786f..0a1722dc 100644
--- a/docs/_include/interface-vlan-8021ad.txt
+++ b/docs/_include/interface-vlan-8021ad.txt
@@ -88,7 +88,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-ip.txt
+.. cmdinclude:: /_include/interface-ip.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -98,7 +98,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-ipv6.txt
+.. cmdinclude:: /_include/interface-ipv6.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -140,7 +140,7 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+.. cmdinclude:: /_include/interface-dhcpv6-prefix-delegation.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif-s
@@ -150,4 +150,4 @@ tag is the one closer/closest to the Ethernet header, its name is S-TAG
    :var6: <vlan-id>
    :var7: 20
 
-.. include:: ../common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/_include/interface-vlan-8021q.txt b/docs/_include/interface-vlan-8021q.txt
index e4ed9db0..63f4433f 100644
--- a/docs/_include/interface-vlan-8021q.txt
+++ b/docs/_include/interface-vlan-8021q.txt
@@ -71,14 +71,14 @@ term used for this is ``vif``.
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-ip.txt
+.. cmdinclude:: /_include/interface-ip.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-ipv6.txt
+.. cmdinclude:: /_include/interface-ipv6.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
@@ -108,11 +108,11 @@ term used for this is ``vif``.
    :var3: <vlan-id>
    :var4: 10
 
-.. cmdinclude:: ../_include/interface-dhcpv6-prefix-delegation.txt
+.. cmdinclude:: /_include/interface-dhcpv6-prefix-delegation.txt
    :var0: {{ var0 }}
    :var1: {{ var1 }}
    :var2: vif
    :var3: <vlan-id>
    :var4: 10
 
-.. include:: ../common-references.rst
+.. include:: /_include/common-references.txt
diff --git a/docs/configuration/protocols/index.rst b/docs/configuration/protocols/index.rst
index 819db4df..8ef35b5d 100644
--- a/docs/configuration/protocols/index.rst
+++ b/docs/configuration/protocols/index.rst
@@ -11,7 +11,7 @@ Protocols
    bgp
    igmp
    igmp-proxy
-   is-is
+   isis
    mpls
    ospf
    ospfv3
diff --git a/docs/configuration/protocols/isis.rst b/docs/configuration/protocols/isis.rst
index 807dca83..64cc2535 100644
--- a/docs/configuration/protocols/isis.rst
+++ b/docs/configuration/protocols/isis.rst
@@ -1,4 +1,4 @@
-.. include:: ../_include/need_improvement.txt
+.. include:: /_include/need_improvement.txt
 
 .. _isis:
 
diff --git a/docs/contributing/documentation.rst b/docs/contributing/documentation.rst
index 1766d6ca..ddd21396 100644
--- a/docs/contributing/documentation.rst
+++ b/docs/contributing/documentation.rst
@@ -213,7 +213,7 @@ file and replace the ``{{ var0 }}`` - ``{{ var9 }}`` with the correct value
 
 .. code-block:: none
 
-   .. cmdinclude:: interface-address.txt
+   .. cmdinclude:: /_include/interface-address.txt
       :var0: ethernet
       :var1: eth1
 
-- 
cgit v1.2.3


From f6f4facc250df64a5b3b2d14d5088e9b9922c133 Mon Sep 17 00:00:00 2001
From: rebortg <github@ghlr.de>
Date: Tue, 8 Dec 2020 19:26:58 +0100
Subject: update submodule version

---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index 64d6e689..2a25efce 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit 64d6e689a8274845a49e6931eda6cda04615de42
+Subproject commit 2a25efce5f3e03385a4fa1a412d6f41a07e9d483
-- 
cgit v1.2.3


From dd2b63e441ce0d48ae1cbe8d1abac9e4d55c2465 Mon Sep 17 00:00:00 2001
From: jack9603301 <jack9603301@163.com>
Date: Wed, 9 Dec 2020 16:53:33 +0800
Subject: interface: mirror: Upload Port Mirror(SPAN) Document

---
 docs/_include/interface-mirror.txt         | 17 +++++++++++++++++
 docs/configuration/interfaces/bonding.rst  |  5 +++++
 docs/configuration/interfaces/bridge.rst   |  5 +++++
 docs/configuration/interfaces/ethernet.rst |  5 +++++
 4 files changed, 32 insertions(+)
 create mode 100644 docs/_include/interface-mirror.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-mirror.txt b/docs/_include/interface-mirror.txt
new file mode 100644
index 00000000..8cdbf77d
--- /dev/null
+++ b/docs/_include/interface-mirror.txt
@@ -0,0 +1,17 @@
+SPAN port mirroring can copy the inbound/outbound traffic of the interface to the 
+specified interface, usually the interface can be connected to some special equipment,
+such as behavior control system, intrusion detection system and traffic collector, 
+and can copy all related traffic from this port
+
+VyOS uses the `mirror` option to configure port mirroring. The configuration is divided
+into 2 different directions. Destination ports should be configured for different traffic directions.
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> mirror ingress <monitor-interface>
+
+   Configure port mirroring for `interface` inbound traffic and copy the traffic to `monitor-interface`
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> mirror egress <monitor-interface>
+
+   Configure port mirroring for `interface` outbound traffic and copy the traffic to `monitor-interface`
+
+   
diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst
index 8ec8f34d..547594e5 100644
--- a/docs/configuration/interfaces/bonding.rst
+++ b/docs/configuration/interfaces/bonding.rst
@@ -263,6 +263,11 @@ VLAN
    :var0: bond
    :var1: bond0
 
+Port Mirror (SPAN)
+==================
+.. cmdinclude:: ../../_include/interface-mirror.txt
+   :var0: ethernet
+
 *******
 Example
 *******
diff --git a/docs/configuration/interfaces/bridge.rst b/docs/configuration/interfaces/bridge.rst
index 766d2aa5..a471b8f8 100644
--- a/docs/configuration/interfaces/bridge.rst
+++ b/docs/configuration/interfaces/bridge.rst
@@ -135,6 +135,11 @@ VLAN
    can either be an individual VLAN id or a range of VLAN ids delimited by a
    hyphen.
 
+Port Mirror (SPAN)
+==================
+.. cmdinclude:: ../../_include/interface-mirror.txt
+   :var0: ethernet
+
 *******
 Example
 *******
diff --git a/docs/configuration/interfaces/ethernet.rst b/docs/configuration/interfaces/ethernet.rst
index 9311c947..562aeabc 100644
--- a/docs/configuration/interfaces/ethernet.rst
+++ b/docs/configuration/interfaces/ethernet.rst
@@ -83,6 +83,11 @@ QinQ (802.1ad)
    :var0: ethernet
    :var1: eth0
 
+Port Mirror (SPAN)
+==================
+.. cmdinclude:: ../../_include/interface-mirror.txt
+   :var0: ethernet
+
 *********
 Operation
 *********
-- 
cgit v1.2.3


From 4ae8c8104ae7e496ced996fc4d927d934f48a068 Mon Sep 17 00:00:00 2001
From: rebortg <rebortg@users.noreply.github.com>
Date: Thu, 10 Dec 2020 07:47:10 +0000
Subject: Update vyos-1x submodule

---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index 2a25efce..2f5de3cf 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit 2a25efce5f3e03385a4fa1a412d6f41a07e9d483
+Subproject commit 2f5de3cfadec3b708b4b332d154b3b619f4d873e
-- 
cgit v1.2.3


From 95a2a8af1835a3409430e24352056f44ba07e6c5 Mon Sep 17 00:00:00 2001
From: rebortg <github@ghlr.de>
Date: Thu, 10 Dec 2020 09:22:51 +0100
Subject: prefixdelegation correct command

---
 docs/_include/interface-dhcpv6-prefix-delegation.txt | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-dhcpv6-prefix-delegation.txt b/docs/_include/interface-dhcpv6-prefix-delegation.txt
index 99132d17..6a001949 100644
--- a/docs/_include/interface-dhcpv6-prefix-delegation.txt
+++ b/docs/_include/interface-dhcpv6-prefix-delegation.txt
@@ -4,7 +4,7 @@ VyOS 1.3 (equuleus) supports DHCPv6-PD (:rfc:`3633`). DHCPv6 Prefix Delegation
 is supported by most ISPs who provide native IPv6 for consumers on fixed networks.
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  {{ var5 }} {{ var6 }} dhcpv6-option pd <id> length <length>
+  {{ var5 }} {{ var6 }} dhcpv6-options pd <id> length <length>
 
   Some ISPs by default only delegate a /64 prefix. To request for a specific
   prefix size use this option to request for a bigger delegation for this pd
@@ -20,7 +20,7 @@ is supported by most ISPs who provide native IPv6 for consumers on fixed network
     set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options pd 0 length 56
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  {{ var5 }} {{ var6 }} dhcpv6-option pd <id> interface <delegatee> address <address>
+  {{ var5 }} {{ var6 }} dhcpv6-options pd <id> interface <delegatee> address <address>
 
   Specify the interface address used locally on the interfcae where the prefix
   has been delegated to. ID must be a decimal integer.
@@ -35,10 +35,10 @@ is supported by most ISPs who provide native IPv6 for consumers on fixed network
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-option pd 0 interface eth8 address 65534
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options pd 0 interface eth8 address 65534
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  {{ var5 }} {{ var6 }} dhcpv6-option pd <id> interface <delegatee> sla-id <id>
+  {{ var5 }} {{ var6 }} dhcpv6-options pd <id> interface <delegatee> sla-id <id>
 
   Specify the identifier value of the site-level aggregator (SLA) on the
   interface. ID must be a decimal number greater then 0 which fits in the
@@ -51,5 +51,5 @@ is supported by most ISPs who provide native IPv6 for consumers on fixed network
 
   .. code-block:: none
 
-    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-option pd 0 interface eth8 sla-id 1
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options pd 0 interface eth8 sla-id 1
 
-- 
cgit v1.2.3


From 2d11378b6a03462319276033b11d4ba51d6f0ded Mon Sep 17 00:00:00 2001
From: rebortg <github@ghlr.de>
Date: Fri, 11 Dec 2020 22:40:31 +0100
Subject: _include files: fix lint errors

---
 docs/_include/common-references.txt                |  5 ++++-
 .../interface-dhcpv6-prefix-delegation.txt         | 11 ++++++++--
 docs/_include/interface-disable-flow-control.txt   |  9 ++++----
 docs/_include/interface-mirror.txt                 | 25 +++++++++++++---------
 docs/_include/interface-vlan-8021q.txt             | 24 +++++++++++----------
 5 files changed, 46 insertions(+), 28 deletions(-)

(limited to 'docs/_include')

diff --git a/docs/_include/common-references.txt b/docs/_include/common-references.txt
index 79881972..de4f76e7 100644
--- a/docs/_include/common-references.txt
+++ b/docs/_include/common-references.txt
@@ -1,6 +1,9 @@
+.. stop_vyoslinter
+
 .. _`accel-ppp`: https://accel-ppp.org/
 .. _`Secure Socket Tunneling Protocol`: https://en.wikipedia.org/wiki/Secure_Socket_Tunneling_Protocol
 .. _Phabricator: https://phabricator.vyos.net/
-
 .. _802.1ad: https://en.wikipedia.org/wiki/IEEE_802.1ad
 .. _802.1q: https://en.wikipedia.org/wiki/IEEE_802.1Q
+
+.. start_vyoslinter
\ No newline at end of file
diff --git a/docs/_include/interface-dhcpv6-prefix-delegation.txt b/docs/_include/interface-dhcpv6-prefix-delegation.txt
index 6a001949..1ef94c14 100644
--- a/docs/_include/interface-dhcpv6-prefix-delegation.txt
+++ b/docs/_include/interface-dhcpv6-prefix-delegation.txt
@@ -1,7 +1,8 @@
 **DHCPv6 Prefix Delegation (PD)**
 
 VyOS 1.3 (equuleus) supports DHCPv6-PD (:rfc:`3633`). DHCPv6 Prefix Delegation
-is supported by most ISPs who provide native IPv6 for consumers on fixed networks.
+is supported by most ISPs who provide native IPv6 for consumers on fixed
+networks.
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
   {{ var5 }} {{ var6 }} dhcpv6-options pd <id> length <length>
@@ -20,7 +21,8 @@ is supported by most ISPs who provide native IPv6 for consumers on fixed network
     set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options pd 0 length 56
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
-  {{ var5 }} {{ var6 }} dhcpv6-options pd <id> interface <delegatee> address <address>
+  {{ var5 }} {{ var6 }} dhcpv6-options pd <id> interface <delegatee>
+  address <address>
 
   Specify the interface address used locally on the interfcae where the prefix
   has been delegated to. ID must be a decimal integer.
@@ -29,10 +31,15 @@ is supported by most ISPs who provide native IPv6 for consumers on fixed network
   complete interface address. The default is to use the EUI-64 address of the
   interface.
 
+  .. stop_vyoslinter
+
   Example: Delegate a /64 prefix to interface eth8 which will use a local
   address on this router of ``<prefix>::ffff``, as the address 65534 will
   correspond to ``ffff`` in hexadecimal notation.
 
+  .. start_vyoslinter
+
+
   .. code-block:: none
 
     set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} dhcpv6-options pd 0 interface eth8 address 65534
diff --git a/docs/_include/interface-disable-flow-control.txt b/docs/_include/interface-disable-flow-control.txt
index 2b319b22..347f1145 100644
--- a/docs/_include/interface-disable-flow-control.txt
+++ b/docs/_include/interface-disable-flow-control.txt
@@ -1,4 +1,5 @@
-.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }} disable-flow-control
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+   disable-flow-control
 
   Ethernet flow control is a mechanism for temporarily stopping the transmission
   of data on Ethernet family computer networks. The goal of this mechanism is to
@@ -8,9 +9,9 @@
   802.3x standard.
 
   A sending station (computer or network switch) may be transmitting data faster
-  than the other end of the link can accept it. Using flow control, the receiving
-  station can signal the sender requesting suspension of transmissions until the
-  receiver catches up.
+  than the other end of the link can accept it. Using flow control, the
+  receiving station can signal the sender requesting suspension of
+  transmissions until the receiver catches up.
 
   Use this command to disable the generation of Ethernet flow control (pause
   frames).
diff --git a/docs/_include/interface-mirror.txt b/docs/_include/interface-mirror.txt
index 8cdbf77d..a3d12220 100644
--- a/docs/_include/interface-mirror.txt
+++ b/docs/_include/interface-mirror.txt
@@ -1,17 +1,22 @@
-SPAN port mirroring can copy the inbound/outbound traffic of the interface to the 
-specified interface, usually the interface can be connected to some special equipment,
-such as behavior control system, intrusion detection system and traffic collector, 
-and can copy all related traffic from this port
+SPAN port mirroring can copy the inbound/outbound traffic of the interface to
+the specified interface, usually the interface can be connected to some special
+equipment, such as behavior control system, intrusion detection system and
+traffic collector, and can copy all related traffic from this port
 
-VyOS uses the `mirror` option to configure port mirroring. The configuration is divided
-into 2 different directions. Destination ports should be configured for different traffic directions.
+VyOS uses the `mirror` option to configure port mirroring. The configuration
+is divided into 2 different directions. Destination ports should be configured
+for different traffic directions.
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> mirror ingress <monitor-interface>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> mirror
+   ingress <monitor-interface>
 
-   Configure port mirroring for `interface` inbound traffic and copy the traffic to `monitor-interface`
+   Configure port mirroring for `interface` inbound traffic and copy the
+   traffic to `monitor-interface`
 
-.. cfgcmd:: set interfaces {{ var0 }} <interface> mirror egress <monitor-interface>
+.. cfgcmd:: set interfaces {{ var0 }} <interface> mirror egress
+   <monitor-interface>
 
-   Configure port mirroring for `interface` outbound traffic and copy the traffic to `monitor-interface`
+   Configure port mirroring for `interface` outbound traffic and copy the
+   traffic to `monitor-interface`
 
    
diff --git a/docs/_include/interface-vlan-8021q.txt b/docs/_include/interface-vlan-8021q.txt
index 63f4433f..1a527590 100644
--- a/docs/_include/interface-vlan-8021q.txt
+++ b/docs/_include/interface-vlan-8021q.txt
@@ -1,20 +1,22 @@
-IEEE 802.1q_, often referred to as Dot1q, is the networking standard that supports
-virtual LANs (VLANs) on an IEEE 802.3 Ethernet network. The standard defines a
-system of VLAN tagging for Ethernet frames and the accompanying procedures to be
-used by bridges and switches in handling such frames. The standard also contains
-provisions for a quality-of-service prioritization scheme commonly known as IEEE
-802.1p and defines the Generic Attribute Registration Protocol.
+IEEE 802.1q_, often referred to as Dot1q, is the networking standard that
+supports virtual LANs (VLANs) on an IEEE 802.3 Ethernet network. The standard
+defines a system of VLAN tagging for Ethernet frames and the accompanying
+procedures to be used by bridges and switches in handling such frames.
+The standard also contains provisions for a quality-of-service prioritization
+scheme commonly known as IEEE 802.1p and defines the
+Generic Attribute Registration Protocol.
 
 Portions of the network which are VLAN-aware (i.e., IEEE 802.1q_ conformant) can
 include VLAN tags. When a frame enters the VLAN-aware portion of the network, a
-tag is added to represent the VLAN membership. Each frame must be distinguishable
-as being within exactly one VLAN. A frame in the VLAN-aware portion of the network
-that does not contain a VLAN tag is assumed to be flowing on the native VLAN.
+tag is added to represent the VLAN membership. Each frame must be
+distinguishable as being within exactly one VLAN. A frame in the VLAN-aware
+portion of the network that does not contain a VLAN tag is assumed to be
+flowing on the native VLAN.
 
 The standard was developed by IEEE 802.1, a working group of the IEEE 802
 standards committee, and continues to be actively revised. One of the notable
-revisions is 802.1Q-2014 which incorporated IEEE 802.1aq (Shortest Path Bridging)
-and much of the IEEE 802.1d standard.
+revisions is 802.1Q-2014 which incorporated IEEE 802.1aq
+(Shortest Path Bridging) and much of the IEEE 802.1d standard.
 
 802.1q VLAN interfaces are represented as virtual sub-interfaces in VyOS. The
 term used for this is ``vif``.
-- 
cgit v1.2.3


From 92113f4ad21f0ae5abc67ecc0fd485a6e7f0ee54 Mon Sep 17 00:00:00 2001
From: rebortg <rebortg@users.noreply.github.com>
Date: Mon, 14 Dec 2020 06:19:41 +0000
Subject: Update vyos-1x submodule

---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index 2f5de3cf..86f377f6 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit 2f5de3cfadec3b708b4b332d154b3b619f4d873e
+Subproject commit 86f377f65248263e85fd0156e22daf0daf3c5fc4
-- 
cgit v1.2.3


From 8653820090714e5702431556872876783011f9ab Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Sun, 20 Dec 2020 13:19:43 +0100
Subject: dhcpv6-options: add DUID description

---
 docs/_include/interface-dhcpv6-options.txt | 13 +++++++++++++
 1 file changed, 13 insertions(+)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-dhcpv6-options.txt b/docs/_include/interface-dhcpv6-options.txt
index e7eaffb1..e047e92a 100644
--- a/docs/_include/interface-dhcpv6-options.txt
+++ b/docs/_include/interface-dhcpv6-options.txt
@@ -1,3 +1,16 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} dhcpv6-options duid <duid>
+
+  The DHCP unique identifier (DUID) is used by a client to get an IP address
+  from a DHCPv6 server. It has a 2-byte DUID type field, and a variable-length
+  identifier field up to 128 bytes. Its actual length depends on its type. The
+  server compares the DUID with its database and delivers configuration data
+  (address, lease times, DNS servers, etc.) to the client.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} duid '0e:00:00:01:00:01:27:71:db:f0:00:50:56:bf:c5:6d'
+
 .. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
   {{ var5 }} {{ var6 }} dhcpv6-options parameters-only
 
-- 
cgit v1.2.3


From 84ea67db630846210df983f4ab4cb966a550790a Mon Sep 17 00:00:00 2001
From: jack9603301 <jack9603301@163.com>
Date: Sun, 20 Dec 2020 22:24:48 +0800
Subject: Examples of adding VLAN awareness and port mirroring

---
 docs/_include/interface-mirror.txt         | 12 ++++++++++++
 docs/configuration/interfaces/bonding.rst  |  4 +++-
 docs/configuration/interfaces/bridge.rst   | 22 +++++++++++++++++++++-
 docs/configuration/interfaces/ethernet.rst |  2 ++
 4 files changed, 38 insertions(+), 2 deletions(-)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-mirror.txt b/docs/_include/interface-mirror.txt
index a3d12220..7903299a 100644
--- a/docs/_include/interface-mirror.txt
+++ b/docs/_include/interface-mirror.txt
@@ -12,11 +12,23 @@ for different traffic directions.
 
    Configure port mirroring for `interface` inbound traffic and copy the
    traffic to `monitor-interface`
+   
+   Example: Mirror the inbound traffic of `{{ var1 }}` port to `eth2`
+   
+   .. code-block:: none
+   
+     set interfaces {{ var0 }} {{ var1 }} mirror ingress {{ var2 }} 
 
 .. cfgcmd:: set interfaces {{ var0 }} <interface> mirror egress
    <monitor-interface>
 
    Configure port mirroring for `interface` outbound traffic and copy the
    traffic to `monitor-interface`
+   
+   Example: Mirror the outbound traffic of `{{ var1 }}` port to `eth2`
+   
+   .. code-block:: none
+   
+     set interfaces {{ var0 }} {{ var1 }} mirror egress {{ var2 }} 
 
    
diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst
index 84f00132..92601b37 100644
--- a/docs/configuration/interfaces/bonding.rst
+++ b/docs/configuration/interfaces/bonding.rst
@@ -266,7 +266,9 @@ VLAN
 Port Mirror (SPAN)
 ==================
 .. cmdinclude:: ../../_include/interface-mirror.txt
-   :var0: ethernet
+   :var0: bonding
+   :var1: bond1
+   :var2: eth3
 
 *******
 Example
diff --git a/docs/configuration/interfaces/bridge.rst b/docs/configuration/interfaces/bridge.rst
index a471b8f8..17e3d50b 100644
--- a/docs/configuration/interfaces/bridge.rst
+++ b/docs/configuration/interfaces/bridge.rst
@@ -127,6 +127,12 @@ VLAN
    VLAN tag enters the port, the data packet will be forced to add a tag of a
    specific vlan id. When the vlan id flag flows out, the tag of the vlan id
    will be stripped
+   
+   Example: Set `eth0` member port to be native VLAN 2
+   
+   .. code-block:: none
+
+     set interfaces bridge br1 member interface eth0 native-vlan 2
 
 .. cfgcmd:: set interfaces bridge <interface> member interface <member>
    allowed-vlan <vlan-id>
@@ -134,11 +140,25 @@ VLAN
    Allows specific VLAN IDs to pass through the bridge member interface. This
    can either be an individual VLAN id or a range of VLAN ids delimited by a
    hyphen.
+   
+   Example: Set `eth0` member port to be allowed VLAN 4
+   
+   .. code-block:: none
+   
+     set interfaces bridge br1 member interface eth0 allowed-vlan 4
+  
+   Example: Set `eth0` member port to be allowed VLAN 6-8
+   
+   .. code-block:: none
+   
+     set interfaces bridge br1 member interface eth0 allowed-vlan 6-8
 
 Port Mirror (SPAN)
 ==================
 .. cmdinclude:: ../../_include/interface-mirror.txt
-   :var0: ethernet
+   :var0: bridge
+   :var1: br1
+   :var2: eth3
 
 *******
 Example
diff --git a/docs/configuration/interfaces/ethernet.rst b/docs/configuration/interfaces/ethernet.rst
index b4151dd2..c1ee724b 100644
--- a/docs/configuration/interfaces/ethernet.rst
+++ b/docs/configuration/interfaces/ethernet.rst
@@ -87,6 +87,8 @@ Port Mirror (SPAN)
 ==================
 .. cmdinclude:: ../../_include/interface-mirror.txt
    :var0: ethernet
+   :var1: eth1
+   :var2: eth3
 
 *********
 Operation
-- 
cgit v1.2.3


From 6a9c069b73c200ef3e9433f134f1b2cbd16ebd95 Mon Sep 17 00:00:00 2001
From: jack9603301 <jack9603301@163.com>
Date: Mon, 21 Dec 2020 01:08:13 +0800
Subject: Fix spelling errors

---
 docs/_include/interface-mirror.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-mirror.txt b/docs/_include/interface-mirror.txt
index 7903299a..f2b340fe 100644
--- a/docs/_include/interface-mirror.txt
+++ b/docs/_include/interface-mirror.txt
@@ -13,7 +13,7 @@ for different traffic directions.
    Configure port mirroring for `interface` inbound traffic and copy the
    traffic to `monitor-interface`
    
-   Example: Mirror the inbound traffic of `{{ var1 }}` port to `eth2`
+   Example: Mirror the inbound traffic of `{{ var1 }}` port to `{{ var2 }}`
    
    .. code-block:: none
    
@@ -25,7 +25,7 @@ for different traffic directions.
    Configure port mirroring for `interface` outbound traffic and copy the
    traffic to `monitor-interface`
    
-   Example: Mirror the outbound traffic of `{{ var1 }}` port to `eth2`
+   Example: Mirror the outbound traffic of `{{ var1 }}` port to `{{ var2 }}`
    
    .. code-block:: none
    
-- 
cgit v1.2.3


From 5d5fae3e0a89c50f807c0ab65c9c6401c15c4547 Mon Sep 17 00:00:00 2001
From: rebortg <rebortg@users.noreply.github.com>
Date: Mon, 21 Dec 2020 06:21:09 +0000
Subject: Update vyos-1x submodule

---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index 86f377f6..089b5f10 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit 86f377f65248263e85fd0156e22daf0daf3c5fc4
+Subproject commit 089b5f10aaa3f7976eb3f9165e805babdbf2a564
-- 
cgit v1.2.3


From 2b55a3a72fca5975724836df2d857de77fb12e7f Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Wed, 23 Dec 2020 14:30:45 +0100
Subject: xdp: use common include for both ethernet and bond

---
 docs/_include/interface-xdp.txt            | 24 ++++++++++++++++++++++++
 docs/configuration/interfaces/bonding.rst  |  8 ++++++++
 docs/configuration/interfaces/ethernet.rst | 21 +++------------------
 3 files changed, 35 insertions(+), 18 deletions(-)
 create mode 100644 docs/_include/interface-xdp.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-xdp.txt b/docs/_include/interface-xdp.txt
new file mode 100644
index 00000000..6f5f88c1
--- /dev/null
+++ b/docs/_include/interface-xdp.txt
@@ -0,0 +1,24 @@
+.. cfgcmd:: set interfaces {{ var0 }} <interface> xdp
+
+  Enable support for Linux :abbr:`XDP (eXpress Data Path)` on recent 1.3 rolling
+  releases. You must enable it for every interface which should participate in
+  the XDP forwarding.
+
+  XDP is an eBPF based high performance data path merged in the Linux kernel
+  since version 4.8. The idea behind XDP is to add an early hook in the RX path
+  of the kernel, and let a user supplied eBPF program decide the fate of the
+  packet. The hook is placed in the NIC driver just after the interrupt
+  processing, and before any memory allocation needed by the network stack
+  itself, because memory allocation can be an expensive operation.
+
+  .. warning:: This is highly experimental!
+
+  .. note:: Enabling this feature will break any form of NAT or Firewalling on
+    this interface, as XDP is handled way earlier in the driver then iptables/
+    nftables.
+
+  Example:
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} xdp
\ No newline at end of file
diff --git a/docs/configuration/interfaces/bonding.rst b/docs/configuration/interfaces/bonding.rst
index 92601b37..bf7cfc2c 100644
--- a/docs/configuration/interfaces/bonding.rst
+++ b/docs/configuration/interfaces/bonding.rst
@@ -256,6 +256,13 @@ Bond options
    The maximum number of targets that can be specified is 16. The default value
    is no IP addresses.
 
+Offloading
+----------
+
+.. cmdinclude:: /_include/interface-xdp.txt
+   :var0: bonding
+   :var1: bond0
+
 VLAN
 ====
 
@@ -265,6 +272,7 @@ VLAN
 
 Port Mirror (SPAN)
 ==================
+
 .. cmdinclude:: ../../_include/interface-mirror.txt
    :var0: bonding
    :var1: bond1
diff --git a/docs/configuration/interfaces/ethernet.rst b/docs/configuration/interfaces/ethernet.rst
index 8c6bcc07..2eca130f 100644
--- a/docs/configuration/interfaces/ethernet.rst
+++ b/docs/configuration/interfaces/ethernet.rst
@@ -92,24 +92,9 @@ Offloading
   the IPv4 ID is not sequentially incrementing it will be altered so that it is
   when a frame assembled via GRO is segmented via GSO.
 
-.. cfgcmd:: set interfaces ethernet <interface> xdp
-
-  Enable support for Linux :abbr:`XDP (eXpress Data Path)` on recent 1.3 rolling
-  releases. You must enable it for every interface which should participate in
-  the XDP forwarding.
-
-  XDP is an eBPF based high performance data path merged in the Linux kernel
-  since version 4.8. The idea behind XDP is to add an early hook in the RX path
-  of the kernel, and let a user supplied eBPF program decide the fate of the
-  packet. The hook is placed in the NIC driver just after the interrupt
-  processing, and before any memory allocation needed by the network stack
-  itself, because memory allocation can be an expensive operation.
-
-  .. warning:: This is highly experimental!
-
-  .. note:: Enabling this feature will break any form of NAT or Firewalling on
-    this interface, as XDP is handled way earlier in the driver then iptables/
-    nftables.
+.. cmdinclude:: /_include/interface-xdp.txt
+   :var0: ethernet
+   :var1: eth0
 
 VLAN
 ====
-- 
cgit v1.2.3


From f24d3637e5ecb07f202f04996007255c640f45e2 Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Wed, 23 Dec 2020 14:49:46 +0100
Subject: xdp: referece XDP router from APNIC

---
 docs/_include/interface-xdp.txt | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'docs/_include')

diff --git a/docs/_include/interface-xdp.txt b/docs/_include/interface-xdp.txt
index 6f5f88c1..d87151fc 100644
--- a/docs/_include/interface-xdp.txt
+++ b/docs/_include/interface-xdp.txt
@@ -17,6 +17,9 @@
     this interface, as XDP is handled way earlier in the driver then iptables/
     nftables.
 
+  Enabling this feature will only load the XDP router code as described here:
+  https://blog.apnic.net/2020/04/30/how-to-build-an-xdp-based-bgp-peering-router/
+
   Example:
 
   .. code-block:: none
-- 
cgit v1.2.3


From 8ff455f2e31646986d80d52b77298f6fafc2f08a Mon Sep 17 00:00:00 2001
From: rebortg <rebortg@users.noreply.github.com>
Date: Mon, 28 Dec 2020 06:22:29 +0000
Subject: Update vyos-1x submodule

---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index 089b5f10..ffd64cf4 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit 089b5f10aaa3f7976eb3f9165e805babdbf2a564
+Subproject commit ffd64cf473450688d654eeb25f158eb8196d9e23
-- 
cgit v1.2.3


From 91a07725badb093da149f35045ad40d9673ecbbd Mon Sep 17 00:00:00 2001
From: Christian Poessinger <christian@poessinger.com>
Date: Tue, 29 Dec 2020 12:04:47 +0100
Subject: ethernet: eapol: use re-includable interface definition

---
 docs/_include/interface-eapol.txt          | 37 ++++++++++++++++++++++++++++++
 docs/configuration/interfaces/ethernet.rst | 36 +++--------------------------
 2 files changed, 40 insertions(+), 33 deletions(-)
 create mode 100644 docs/_include/interface-eapol.txt

(limited to 'docs/_include')

diff --git a/docs/_include/interface-eapol.txt b/docs/_include/interface-eapol.txt
new file mode 100644
index 00000000..68e5073d
--- /dev/null
+++ b/docs/_include/interface-eapol.txt
@@ -0,0 +1,37 @@
+:abbr:`EAP (Extensible Authentication Protocol)` over LAN (EAPoL) is a network
+port authentication protocol used in IEEE 802.1X (Port Based Network Access
+Control) developed to give a generic network sign-on to access network
+resources.
+
+EAPoL comes with an identify option. We automatically use the interface MAC
+address as identity parameter.
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} eapol ca-cert-file <file>
+
+  SSL :abbr:`CA (Certificate Authority)` x509 PEM file used afor authentication
+  of the remote side.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} eapol ca-cert-file /config/auth/ca.pem
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} eapol cert-file <file>
+
+  SSL/x509 public certificate file provided by the client to authenticate
+  against the 802.1x system.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} eapol cert-file /config/auth/public.pem
+
+.. cfgcmd:: set interfaces {{ var0 }} <interface> {{ var2 }} {{ var3 }}
+  {{ var5 }} {{ var6 }} eapol key-file <file>
+
+  SSL/x509 private certificate file provided by the client to authenticate
+  against the 802.1x system.
+
+  .. code-block:: none
+
+    set interfaces {{ var0 }} {{ var1 }} {{ var2 }} {{ var4 }} {{ var5 }} {{ var7 }} eapol key-file /config/auth/private.key
diff --git a/docs/configuration/interfaces/ethernet.rst b/docs/configuration/interfaces/ethernet.rst
index 4392c1c8..d7bc8518 100644
--- a/docs/configuration/interfaces/ethernet.rst
+++ b/docs/configuration/interfaces/ethernet.rst
@@ -99,40 +99,10 @@ Offloading
 Authentication (EAPoL)
 ----------------------
 
-:abbr:`EAP (Extensible Authentication Protocol)` over LAN (EAPoL) is a network
-port authentication protocol used in IEEE 802.1X (Port Based Network Access
-Control) developed to give a generic network sign-on to access network
-resources.
-
-EAPoL comes with an identify option. We automatically use the interface MAC
-address as identity parameter.
-
-.. cfgcmd:: set interfaces ethernet <interface> eapol ca-cert-file <file>
-
-  SSL :abbr:`CA (Certificate Authority)` x509 PEM file used afor authentication
-  of the remote side.
-
-  .. code-block: none
-
-    set interfaces ethernet eth0 eapol ca-cert-file /config/auth/ca.pem
-
-.. cfgcmd:: set interfaces ethernet <interface> eapol cert-file <file>
-
-  SSL/x509 public certificate file provided by the client to authenticate
-  against the 802.1x system.
-
-  .. code-block: none
-
-    set interfaces ethernet eth0 eapol cert-file /config/auth/public.pem
-
-.. cfgcmd:: set interfaces ethernet <interface> eapol key-file <file>
-
-  SSL/x509 private certificate file provided by the client to authenticate
-  against the 802.1x system.
-
-  .. code-block: none
+.. cmdinclude:: /_include/interface-eapol.txt
+   :var0: ethernet
+   :var1: eth0
 
-    set interfaces ethernet eth0 eapol key-file /config/auth/private.key
 
 VLAN
 ====
-- 
cgit v1.2.3


From 874f59eb0a78248dbeea6e74cab4ac142bb88637 Mon Sep 17 00:00:00 2001
From: rebortg <rebortg@users.noreply.github.com>
Date: Mon, 4 Jan 2021 06:26:55 +0000
Subject: Update vyos-1x submodule

---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index ffd64cf4..f4625c9e 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit ffd64cf473450688d654eeb25f158eb8196d9e23
+Subproject commit f4625c9ee2f54992ed96f113ff52c5a9993ea769
-- 
cgit v1.2.3


From 6f54a84f5ce197dad57a13ffc76c6ce8d74d298e Mon Sep 17 00:00:00 2001
From: rebortg <rebortg@users.noreply.github.com>
Date: Mon, 11 Jan 2021 06:34:32 +0000
Subject: Update vyos-1x submodule

---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index f4625c9e..4fb6160f 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit f4625c9ee2f54992ed96f113ff52c5a9993ea769
+Subproject commit 4fb6160fb72717ce65cc1dbd814b80a1d1a4e756
-- 
cgit v1.2.3


From a8c4ab39697a57fcee661c7e0f6351bba5151f45 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 18 Jan 2021 20:13:01 +0100
Subject: Update vyos-1x submodule (#432)

Co-authored-by: rebortg <rebortg@users.noreply.github.com>
---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index 4fb6160f..c9e630b4 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit 4fb6160fb72717ce65cc1dbd814b80a1d1a4e756
+Subproject commit c9e630b446f069b3a803c1e7c22e559797bce975
-- 
cgit v1.2.3


From a2806637c0e8e0ce949727c7ca10aaa23e5ceaf3 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 26 Jan 2021 16:51:35 +0100
Subject: Update vyos-1x submodule (#436)

Co-authored-by: rebortg <rebortg@users.noreply.github.com>
---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index c9e630b4..73cc357b 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit c9e630b446f069b3a803c1e7c22e559797bce975
+Subproject commit 73cc357b757eb6129db286709812996ebcc4fd19
-- 
cgit v1.2.3


From 1c31ad7918c35c5500af3508253c007dfdffac38 Mon Sep 17 00:00:00 2001
From: rebortg <rebortg@users.noreply.github.com>
Date: Mon, 1 Feb 2021 06:21:04 +0000
Subject: Update vyos-1x submodule

---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index 73cc357b..8076176e 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit 73cc357b757eb6129db286709812996ebcc4fd19
+Subproject commit 8076176ec68915b1148829f63ad3da25441f27e7
-- 
cgit v1.2.3


From f7749b67c67c7addcd8a6bf676f1c9ab418fea53 Mon Sep 17 00:00:00 2001
From: Robert Göhler <github@ghlr.de>
Date: Wed, 3 Feb 2021 16:02:18 +0100
Subject: Coverage: reenable coverage page progress (#441)

* Github: correct branch for vyos-1x submodule

* Coverage: reenable coverage page progress

* Update vyos-1x submodule (#24)

Co-authored-by: rebortg <rebortg@users.noreply.github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: rebortg <rebortg@users.noreply.github.com>
---
 .github/workflows/submodules.yml | 2 +-
 .gitmodules                      | 2 +-
 docs/_ext/vyos.py                | 4 ++--
 docs/_include/vyos-1x            | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'docs/_include')

diff --git a/.github/workflows/submodules.yml b/.github/workflows/submodules.yml
index 129cc895..ccbb64a6 100644
--- a/.github/workflows/submodules.yml
+++ b/.github/workflows/submodules.yml
@@ -16,7 +16,7 @@ jobs:
           git submodule status
           git submodule update --init --force
           cd docs/_include/vyos-1x
-          git checkout current
+          git checkout equuleus
           git pull
           git submodule status
       - name: Create Pull Request
diff --git a/.gitmodules b/.gitmodules
index d3d92138..ff51611b 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,4 +1,4 @@
 [submodule "docs/_include/vyos-1x"]
 	path = docs/_include/vyos-1x
 	url = https://github.com/vyos/vyos-1x
-	branch = current
+	branch = equuleus
diff --git a/docs/_ext/vyos.py b/docs/_ext/vyos.py
index a4e130e5..46ebae36 100644
--- a/docs/_ext/vyos.py
+++ b/docs/_ext/vyos.py
@@ -20,8 +20,8 @@ def setup(app):
 
     app.add_config_value(
         'vyos_working_commands',
-        #get_working_commands(),
-        {"cfgcmd": [], "opcmd": []},
+        get_working_commands(),
+        #{"cfgcmd": [], "opcmd": []},
         'html'
     )
     app.add_config_value(
diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index 8076176e..86209c67 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit 8076176ec68915b1148829f63ad3da25441f27e7
+Subproject commit 86209c679c6b7ca9d5bac1f67ffd391b9b16c008
-- 
cgit v1.2.3


From 9083a708210b217b23f319f585fcf0dff039e5de Mon Sep 17 00:00:00 2001
From: rebortg <rebortg@users.noreply.github.com>
Date: Mon, 8 Feb 2021 06:17:50 +0000
Subject: vyos-1x: update current branch

---
 docs/_include/vyos-1x | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'docs/_include')

diff --git a/docs/_include/vyos-1x b/docs/_include/vyos-1x
index 86209c67..0dd41096 160000
--- a/docs/_include/vyos-1x
+++ b/docs/_include/vyos-1x
@@ -1 +1 @@
-Subproject commit 86209c679c6b7ca9d5bac1f67ffd391b9b16c008
+Subproject commit 0dd41096f14771ffa476f52793308bffac51b59a
-- 
cgit v1.2.3