Merge branch 'vyos:current' into current

132 files changed, 5542 insertions, 741 deletions

diff --git a/src/conf_mode/container.py b/src/conf_mode/container.py
index 594de3eb0..4ec9b8849 100755
--- a/src/conf_mode/container.py
+++ b/src/conf_mode/container.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -22,6 +22,7 @@ from ipaddress import ip_address
 from ipaddress import ip_network
 from json import dumps as json_write
 
+import psutil
 from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdict import dict_merge
@@ -223,6 +224,21 @@ def verify(container):
                     if not os.path.exists(source):
                         raise ConfigError(f'Volume "{volume}" source path "{source}" does not exist!')
 
+            if 'tmpfs' in container_config:
+                for tmpfs, tmpfs_config in container_config['tmpfs'].items():
+                    if 'destination' not in tmpfs_config:
+                        raise ConfigError(f'tmpfs "{tmpfs}" has no destination path configured!')
+                    if 'size' in tmpfs_config:
+                        free_mem_mb: int = psutil.virtual_memory().available / 1024 /  1024
+                        if int(tmpfs_config['size']) > free_mem_mb:
+                            Warning(f'tmpfs "{tmpfs}" size is greater than the current free memory!')
+
+                        total_mem_mb: int = (psutil.virtual_memory().total / 1024 /  1024) / 2
+                        if int(tmpfs_config['size']) > total_mem_mb:
+                            raise ConfigError(f'tmpfs "{tmpfs}" size should not be more than 50% of total system memory!')
+                    else:
+                        raise ConfigError(f'tmpfs "{tmpfs}" has no size configured!')
+
             if 'port' in container_config:
                 for tmp in container_config['port']:
                     if not {'source', 'destination'} <= set(container_config['port'][tmp]):
@@ -273,6 +289,13 @@ def verify(container):
 
     if 'registry' in container:
         for registry, registry_config in container['registry'].items():
+            if 'mirror' in registry_config:
+                if 'host_name' in registry_config['mirror'] and 'address' in registry_config['mirror']:
+                    raise ConfigError(f'Container registry mirror address/host-name are mutually exclusive!')
+
+                if 'path' in registry_config['mirror'] and not registry_config['mirror']['path'].startswith('/'):
+                    raise ConfigError('Container registry mirror path must start with "/"!')
+
             if 'authentication' not in registry_config:
                 continue
             if not {'username', 'password'} <= set(registry_config['authentication']):
@@ -287,12 +310,13 @@ def generate_run_arguments(name, container_config):
     memory = container_config['memory']
     shared_memory = container_config['shared_memory']
     restart = container_config['restart']
+    log_driver = container_config['log_driver']
 
     # Add sysctl options
     sysctl_opt = ''
     if 'sysctl' in container_config and 'parameter' in container_config['sysctl']:
         for k, v in container_config['sysctl']['parameter'].items():
-            sysctl_opt += f" --sysctl {k}={v['value']}"
+            sysctl_opt += f" --sysctl \"{k}={v['value']}\""
 
     # Add capability options. Should be in uppercase
     capabilities = ''
@@ -301,6 +325,11 @@ def generate_run_arguments(name, container_config):
             cap = cap.upper().replace('-', '_')
             capabilities += f' --cap-add={cap}'
 
+    # Grant root capabilities to the container
+    privileged = ''
+    if 'privileged' in container_config:
+        privileged = '--privileged'
+
     # Add a host device to the container /dev/x:/dev/x
     device = ''
     if 'device' in container_config:
@@ -362,6 +391,14 @@ def generate_run_arguments(name, container_config):
             prop = vol_config['propagation']
             volume += f' --volume {svol}:{dvol}:{mode},{prop}'
 
+    # Mount tmpfs
+    tmpfs = ''
+    if 'tmpfs' in container_config:
+        for tmpfs_config in container_config['tmpfs'].values():
+            dest = tmpfs_config['destination']
+            size = tmpfs_config['size']
+            tmpfs += f' --mount=type=tmpfs,tmpfs-size={size}M,destination={dest}'
+
     host_pid = ''
     if 'allow_host_pid' in container_config:
       host_pid = '--pid host'
@@ -371,9 +408,9 @@ def generate_run_arguments(name, container_config):
         for ns in container_config['name_server']:
             name_server += f'--dns {ns}'
 
-    container_base_cmd = f'--detach --interactive --tty --replace {capabilities} --cpus {cpu_quota} {sysctl_opt} ' \
-                         f'--memory {memory}m --shm-size {shared_memory}m --memory-swap 0 --restart {restart} ' \
-                         f'--name {name} {hostname} {device} {port} {name_server} {volume} {env_opt} {label} {uid} {host_pid}'
+    container_base_cmd = f'--detach --interactive --tty --replace {capabilities} {privileged} --cpus {cpu_quota} {sysctl_opt} ' \
+                         f'--memory {memory}m --shm-size {shared_memory}m --memory-swap 0 --restart {restart} --log-driver={log_driver} ' \
+                         f'--name {name} {hostname} {device} {port} {name_server} {volume} {tmpfs} {env_opt} {label} {uid} {host_pid}'
 
     entrypoint = ''
     if 'entrypoint' in container_config:
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 768bb127d..90fdded99 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,6 +17,8 @@
 import os
 import re
 
+from glob import glob
+
 from sys import exit
 from vyos.base import Warning
 from vyos.config import Config
@@ -30,6 +32,7 @@ from vyos.firewall import geoip_update
 from vyos.template import render
 from vyos.utils.dict import dict_search_args
 from vyos.utils.dict import dict_search_recursive
+from vyos.utils.file import write_file
 from vyos.utils.process import call
 from vyos.utils.process import cmd
 from vyos.utils.process import rc_cmd
@@ -37,13 +40,13 @@ from vyos.utils.network import get_vrf_members
 from vyos.utils.network import get_interface_vrf
 from vyos import ConfigError
 from vyos import airbag
-from pathlib import Path
 from subprocess import run as subp_run
 
 airbag.enable()
 
 nftables_conf = '/run/nftables.conf'
 domain_resolver_usage = '/run/use-vyos-domain-resolver-firewall'
+firewall_config_dir = "/config/firewall"
 
 sysctl_file = r'/run/sysctl/10-vyos-firewall.conf'
 
@@ -53,7 +56,8 @@ valid_groups = [
     'network_group',
     'port_group',
     'interface_group',
-    ## Added for group ussage in bridge firewall
+    'remote_group',
+    ## Added for group usage in bridge firewall
     'ipv4_address_group',
     'ipv6_address_group',
     'ipv4_network_group',
@@ -203,7 +207,7 @@ def verify_rule(firewall, family, hook, priority, rule_id, rule_conf):
         if 'jump' not in rule_conf['action']:
             raise ConfigError('jump-target defined, but action jump needed and it is not defined')
         target = rule_conf['jump_target']
-        if hook != 'name': # This is a bit clumsy, but consolidates a chunk of code. 
+        if hook != 'name': # This is a bit clumsy, but consolidates a chunk of code.
             verify_jump_target(firewall, hook, target, family, recursive=True)
         else:
             verify_jump_target(firewall, hook, target, family, recursive=False)
@@ -266,12 +270,12 @@ def verify_rule(firewall, family, hook, priority, rule_id, rule_conf):
 
             if dict_search_args(rule_conf, 'gre', 'flags', 'checksum') is None:
                 # There is no builtin match in nftables for the GRE key, so we need to do a raw lookup.
-                # The offset of the key within the packet shifts depending on the C-flag. 
-                # 99% of the time, nobody will have checksums enabled - it's usually a manual config option. 
-                # We can either assume it is unset unless otherwise directed 
+                # The offset of the key within the packet shifts depending on the C-flag.
+                # 99% of the time, nobody will have checksums enabled - it's usually a manual config option.
+                # We can either assume it is unset unless otherwise directed
                 # (confusing, requires doco to explain why it doesn't work sometimes)
-                # or, demand an explicit selection to be made for this specific match rule. 
-                # This check enforces the latter. The user is free to create rules for both cases. 
+                # or, demand an explicit selection to be made for this specific match rule.
+                # This check enforces the latter. The user is free to create rules for both cases.
                 raise ConfigError('Matching GRE tunnel key requires an explicit checksum flag match. For most cases, use "gre flags checksum unset"')
 
             if dict_search_args(rule_conf, 'gre', 'flags', 'key', 'unset') is not None:
@@ -284,7 +288,7 @@ def verify_rule(firewall, family, hook, priority, rule_id, rule_conf):
                 if gre_inner_value < 0 or gre_inner_value > 65535:
                     raise ConfigError('inner-proto outside valid ethertype range 0-65535')
             except ValueError:
-                pass # Symbolic constant, pre-validated before reaching here. 
+                pass # Symbolic constant, pre-validated before reaching here.
 
     tcp_flags = dict_search_args(rule_conf, 'tcp', 'flags')
     if tcp_flags:
@@ -311,8 +315,8 @@ def verify_rule(firewall, family, hook, priority, rule_id, rule_conf):
                 raise ConfigError('Only one of address, fqdn or geoip can be specified')
 
             if 'group' in side_conf:
-                if len({'address_group', 'network_group', 'domain_group'} & set(side_conf['group'])) > 1:
-                    raise ConfigError('Only one address-group, network-group or domain-group can be specified')
+                if len({'address_group', 'network_group', 'domain_group', 'remote_group'} & set(side_conf['group'])) > 1:
+                    raise ConfigError('Only one address-group, network-group, remote-group or domain-group can be specified')
 
                 for group in valid_groups:
                     if group in side_conf['group']:
@@ -332,7 +336,7 @@ def verify_rule(firewall, family, hook, priority, rule_id, rule_conf):
 
                         error_group = fw_group.replace("_", "-")
 
-                        if group in ['address_group', 'network_group', 'domain_group']:
+                        if group in ['address_group', 'network_group', 'domain_group', 'remote_group']:
                             types = [t for t in ['address', 'fqdn', 'geoip'] if t in side_conf]
                             if types:
                                 raise ConfigError(f'{error_group} and {types[0]} cannot both be defined')
@@ -435,6 +439,16 @@ def verify(firewall):
                 for ifname in interfaces:
                     verify_hardware_offload(ifname)
 
+    if 'offload' in firewall.get('global_options', {}).get('state_policy', {}):
+        offload_path = firewall['global_options']['state_policy']['offload']
+        if 'offload_target' not in offload_path:
+            raise ConfigError('offload-target must be specified')
+
+        offload_target = offload_path['offload_target']
+
+        if not dict_search_args(firewall, 'flowtable', offload_target):
+            raise ConfigError(f'Invalid offload-target. Flowtable "{offload_target}" does not exist on the system')
+
     if 'group' in firewall:
         for group_type in nested_group_types:
             if group_type in firewall['group']:
@@ -442,6 +456,11 @@ def verify(firewall):
                 for group_name, group in groups.items():
                     verify_nested_group(group_name, group, groups, [])
 
+        if 'remote_group' in firewall['group']:
+            for group_name, group in firewall['group']['remote_group'].items():
+                if 'url' not in group:
+                    raise ConfigError(f'remote-group {group_name} must have a url configured')
+
     for family in ['ipv4', 'ipv6', 'bridge']:
         if family in firewall:
             for chain in ['name','forward','input','output', 'prerouting']:
@@ -539,6 +558,15 @@ def verify(firewall):
 def generate(firewall):
     render(nftables_conf, 'firewall/nftables.j2', firewall)
     render(sysctl_file, 'firewall/sysctl-firewall.conf.j2', firewall)
+
+    # Cleanup remote-group cache files
+    if os.path.exists(firewall_config_dir):
+        for fw_file in os.listdir(firewall_config_dir):
+            # Delete matching files in 'config/firewall' that no longer exist as a remote-group in config
+            if fw_file.startswith("R_") and fw_file.endswith(".txt"):
+                if 'group' not in firewall or 'remote_group' not in firewall['group'] or fw_file[2:-4] not in firewall['group']['remote_group'].keys():
+                    os.unlink(os.path.join(firewall_config_dir, fw_file))
+
     return None
 
 def parse_firewall_error(output):
@@ -598,12 +626,13 @@ def apply(firewall):
 
     ## DOMAIN RESOLVER
     domain_action = 'restart'
-    if dict_search_args(firewall, 'group', 'domain_group') or firewall['ip_fqdn'].items() or firewall['ip6_fqdn'].items():
+    if dict_search_args(firewall, 'group', 'remote_group') or dict_search_args(firewall, 'group', 'domain_group') or firewall['ip_fqdn'].items() or firewall['ip6_fqdn'].items():
         text = f'# Automatically generated by firewall.py\nThis file indicates that vyos-domain-resolver service is used by the firewall.\n'
-        Path(domain_resolver_usage).write_text(text)
+        write_file(domain_resolver_usage, text)
     else:
-        Path(domain_resolver_usage).unlink(missing_ok=True)
-        if not Path('/run').glob('use-vyos-domain-resolver*'):
+        if os.path.exists(domain_resolver_usage):
+            os.unlink(domain_resolver_usage)
+        if not glob('/run/use-vyos-domain-resolver*'):
             domain_action = 'stop'
     call(f'systemctl {domain_action} vyos-domain-resolver.service')
 
@@ -611,7 +640,7 @@ def apply(firewall):
         # Call helper script to Update set contents
         if 'name' in firewall['geoip_updated'] or 'ipv6_name' in firewall['geoip_updated']:
             print('Updating GeoIP. Please wait...')
-            geoip_update(firewall)
+            geoip_update(firewall=firewall)
 
     return None
 
diff --git a/src/conf_mode/high-availability.py b/src/conf_mode/high-availability.py
index c726db8b2..005bb6cce 100755
--- a/src/conf_mode/high-availability.py
+++ b/src/conf_mode/high-availability.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_bonding.py b/src/conf_mode/interfaces_bonding.py
index 4f1141dcb..4a2317f85 100755
--- a/src/conf_mode/interfaces_bonding.py
+++ b/src/conf_mode/interfaces_bonding.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -126,9 +126,8 @@ def get_config(config=None):
     # Restore existing config level
     conf.set_level(old_level)
 
-    if dict_search('member.interface', bond):
-        for interface, interface_config in bond['member']['interface'].items():
-
+    if dict_search('member.interface', bond) is not None:
+        for interface in bond['member']['interface']:
             interface_ethernet_config = conf.get_config_dict(
                 ['interfaces', 'ethernet', interface],
                 key_mangling=('-', '_'),
@@ -137,44 +136,45 @@ def get_config(config=None):
                 with_defaults=False,
                 with_recursive_defaults=False)
 
-            interface_config['config_paths'] = dict_to_paths_values(interface_ethernet_config)
+            bond['member']['interface'][interface].update({'config_paths' :
+                dict_to_paths_values(interface_ethernet_config)})
 
             # Check if member interface is a new member
             if not conf.exists_effective(base + [ifname, 'member', 'interface', interface]):
                 bond['shutdown_required'] = {}
-                interface_config['new_added'] = {}
+                bond['member']['interface'][interface].update({'new_added' : {}})
 
             # Check if member interface is disabled
             conf.set_level(['interfaces'])
 
             section = Section.section(interface) # this will be 'ethernet' for 'eth0'
             if conf.exists([section, interface, 'disable']):
-                interface_config['disable'] = ''
+                if tmp: bond['member']['interface'][interface].update({'disable': ''})
 
             conf.set_level(old_level)
 
             # Check if member interface is already member of another bridge
             tmp = is_member(conf, interface, 'bridge')
-            if tmp: interface_config['is_bridge_member'] = tmp
+            if tmp: bond['member']['interface'][interface].update({'is_bridge_member' : tmp})
 
             # Check if member interface is already member of a bond
             tmp = is_member(conf, interface, 'bonding')
-            for tmp in is_member(conf, interface, 'bonding'):
-                if bond['ifname'] == tmp:
-                    continue
-                interface_config['is_bond_member'] = tmp
+            if ifname in tmp:
+                del tmp[ifname]
+            if tmp: bond['member']['interface'][interface].update({'is_bond_member' : tmp})
 
             # Check if member interface is used as source-interface on another interface
             tmp = is_source_interface(conf, interface)
-            if tmp: interface_config['is_source_interface'] = tmp
+            if tmp: bond['member']['interface'][interface].update({'is_source_interface' : tmp})
 
             # bond members must not have an assigned address
             tmp = has_address_configured(conf, interface)
-            if tmp: interface_config['has_address'] = {}
+            if tmp: bond['member']['interface'][interface].update({'has_address' : ''})
 
             # bond members must not have a VRF attached
             tmp = has_vrf_configured(conf, interface)
-            if tmp: interface_config['has_vrf'] = {}
+            if tmp: bond['member']['interface'][interface].update({'has_vrf' : ''})
+
     return bond
 
 
diff --git a/src/conf_mode/interfaces_bridge.py b/src/conf_mode/interfaces_bridge.py
index 637db442a..8cb0c515a 100755
--- a/src/conf_mode/interfaces_bridge.py
+++ b/src/conf_mode/interfaces_bridge.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -25,6 +25,7 @@ from vyos.configdict import has_vlan_subinterface_configured
 from vyos.configverify import verify_dhcpv6
 from vyos.configverify import verify_mirror_redirect
 from vyos.configverify import verify_vrf
+from vyos.configverify import verify_mtu_ipv6
 from vyos.ifconfig import BridgeIf
 from vyos.configdict import has_address_configured
 from vyos.configdict import has_vrf_configured
@@ -74,8 +75,9 @@ def get_config(config=None):
         for interface in list(bridge['member']['interface']):
             # Check if member interface is already member of another bridge
             tmp = is_member(conf, interface, 'bridge')
-            if tmp and bridge['ifname'] not in tmp:
-                bridge['member']['interface'][interface].update({'is_bridge_member' : tmp})
+            if ifname in tmp:
+                del tmp[ifname]
+            if tmp: bridge['member']['interface'][interface].update({'is_bridge_member' : tmp})
 
             # Check if member interface is already member of a bond
             tmp = is_member(conf, interface, 'bonding')
@@ -109,6 +111,11 @@ def get_config(config=None):
             elif interface.startswith('wlan') and interface_exists(interface):
                 set_dependents('wlan', conf, interface)
 
+            if interface.startswith('vtun'):
+                _, tmp_config = get_interface_dict(conf, ['interfaces', 'openvpn'], interface)
+                tmp = tmp_config.get('device_type') == 'tap'
+                bridge['member']['interface'][interface].update({'valid_ovpn' : tmp})
+
     # delete empty dictionary keys - no need to run code paths if nothing is there to do
     if 'member' in bridge:
         if 'interface' in bridge['member'] and len(bridge['member']['interface']) == 0:
@@ -135,6 +142,7 @@ def verify(bridge):
 
     verify_dhcpv6(bridge)
     verify_vrf(bridge)
+    verify_mtu_ipv6(bridge)
     verify_mirror_redirect(bridge)
 
     ifname = bridge['ifname']
@@ -164,6 +172,9 @@ def verify(bridge):
             if 'has_vrf' in interface_config:
                 raise ConfigError(error_msg + 'it has a VRF assigned!')
 
+            if 'bpdu_guard' in interface_config and 'root_guard' in interface_config:
+                raise ConfigError(error_msg + 'bpdu-guard and root-guard cannot be configured at the same time!')
+
             if 'enable_vlan' in bridge:
                 if 'has_vlan' in interface_config:
                     raise ConfigError(error_msg + 'it has VLAN subinterface(s) assigned!')
@@ -172,6 +183,9 @@ def verify(bridge):
                     if option in interface_config:
                         raise ConfigError('Can not use VLAN options on non VLAN aware bridge')
 
+            if interface.startswith('vtun') and not interface_config['valid_ovpn']:
+                raise ConfigError(error_msg + 'OpenVPN device-type must be set to "tap"')
+
     if 'enable_vlan' in bridge:
         if dict_search('vif.1', bridge):
             raise ConfigError(f'VLAN 1 sub interface cannot be set for VLAN aware bridge {ifname}, and VLAN 1 is always the parent interface')
diff --git a/src/conf_mode/interfaces_dummy.py b/src/conf_mode/interfaces_dummy.py
index db768b94d..0a83eb23b 100755
--- a/src/conf_mode/interfaces_dummy.py
+++ b/src/conf_mode/interfaces_dummy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_ethernet.py b/src/conf_mode/interfaces_ethernet.py
index 41c89fdf8..b112b244e 100755
--- a/src/conf_mode/interfaces_ethernet.py
+++ b/src/conf_mode/interfaces_ethernet.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -22,6 +22,7 @@ from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import get_flowtable_interfaces
 from vyos.configverify import verify_address
 from vyos.configverify import verify_dhcpv6
 from vyos.configverify import verify_interface_exists
@@ -168,6 +169,8 @@ def get_config(config=None):
     tmp = is_node_changed(conf, base + [ifname, 'evpn'])
     if tmp: ethernet.update({'frr_dict' : get_frrender_dict(conf)})
 
+    ethernet['flowtable_interfaces'] = get_flowtable_interfaces(conf)
+
     return ethernet
 
 def verify_speed_duplex(ethernet: dict, ethtool: Ethtool):
@@ -269,7 +272,38 @@ def verify_allowedbond_changes(ethernet: dict):
                               f' on interface "{ethernet["ifname"]}".' \
                               f' Interface is a bond member')
 
+def verify_flowtable(ethernet: dict):
+    ifname = ethernet['ifname']
+
+    if 'deleted' in ethernet and ifname in ethernet['flowtable_interfaces']:
+        raise ConfigError(f'Cannot delete interface "{ifname}", still referenced on a flowtable')
+
+    if 'vif_remove' in ethernet:
+        for vif in ethernet['vif_remove']:
+            vifname = f'{ifname}.{vif}'
+
+            if vifname in ethernet['flowtable_interfaces']:
+                raise ConfigError(f'Cannot delete interface "{vifname}", still referenced on a flowtable')
+
+    if 'vif_s_remove' in ethernet:
+        for vifs in ethernet['vif_s_remove']:
+            vifsname = f'{ifname}.{vifs}'
+
+            if vifsname in ethernet['flowtable_interfaces']:
+                raise ConfigError(f'Cannot delete interface "{vifsname}", still referenced on a flowtable')
+
+    if 'vif_s' in ethernet:
+        for vifs, vifs_conf in ethernet['vif_s'].items():
+            if 'vif_c_delete' in vifs_conf:
+                for vifc in vifs_conf['vif_c_delete']:
+                    vifcname = f'{ifname}.{vifs}.{vifc}'
+
+                    if vifcname in ethernet['flowtable_interfaces']:
+                        raise ConfigError(f'Cannot delete interface "{vifcname}", still referenced on a flowtable')
+
 def verify(ethernet):
+    verify_flowtable(ethernet)
+
     if 'deleted' in ethernet:
         return None
     if 'is_bond_member' in ethernet:
diff --git a/src/conf_mode/interfaces_geneve.py b/src/conf_mode/interfaces_geneve.py
index 007708d4a..11b349002 100755
--- a/src/conf_mode/interfaces_geneve.py
+++ b/src/conf_mode/interfaces_geneve.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -47,7 +47,7 @@ def get_config(config=None):
     # GENEVE interfaces are picky and require recreation if certain parameters
     # change. But a GENEVE interface should - of course - not be re-created if
     # it's description or IP address is adjusted. Feels somehow logic doesn't it?
-    for cli_option in ['remote', 'vni', 'parameters']:
+    for cli_option in ['remote', 'vni', 'parameters', 'port']:
         if is_node_changed(conf, base + [ifname, cli_option]):
             geneve.update({'rebuild_required': {}})
 
diff --git a/src/conf_mode/interfaces_input.py b/src/conf_mode/interfaces_input.py
index ad248843d..6ed0bd2cf 100755
--- a/src/conf_mode/interfaces_input.py
+++ b/src/conf_mode/interfaces_input.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_l2tpv3.py b/src/conf_mode/interfaces_l2tpv3.py
index f0a70436e..8eca1cedc 100755
--- a/src/conf_mode/interfaces_l2tpv3.py
+++ b/src/conf_mode/interfaces_l2tpv3.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_loopback.py b/src/conf_mode/interfaces_loopback.py
index a784e9ec2..bac36b7f0 100755
--- a/src/conf_mode/interfaces_loopback.py
+++ b/src/conf_mode/interfaces_loopback.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_macsec.py b/src/conf_mode/interfaces_macsec.py
index 3ede4377a..683e12ec3 100755
--- a/src/conf_mode/interfaces_macsec.py
+++ b/src/conf_mode/interfaces_macsec.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py
index a9b4e570d..5cc09da89 100755
--- a/src/conf_mode/interfaces_openvpn.py
+++ b/src/conf_mode/interfaces_openvpn.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_pppoe.py b/src/conf_mode/interfaces_pppoe.py
index 412676c7d..976702aba 100755
--- a/src/conf_mode/interfaces_pppoe.py
+++ b/src/conf_mode/interfaces_pppoe.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_pseudo-ethernet.py b/src/conf_mode/interfaces_pseudo-ethernet.py
index 446beffd3..6edd3f248 100755
--- a/src/conf_mode/interfaces_pseudo-ethernet.py
+++ b/src/conf_mode/interfaces_pseudo-ethernet.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -27,6 +27,7 @@ from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_source_interface
 from vyos.configverify import verify_vlan_config
 from vyos.configverify import verify_mtu_parent
+from vyos.configverify import verify_mtu_ipv6
 from vyos.configverify import verify_mirror_redirect
 from vyos.ifconfig import MACVLANIf
 from vyos.utils.network import interface_exists
@@ -71,6 +72,7 @@ def verify(peth):
     verify_vrf(peth)
     verify_address(peth)
     verify_mtu_parent(peth, peth['parent'])
+    verify_mtu_ipv6(peth)
     verify_mirror_redirect(peth)
     # use common function to verify VLAN configuration
     verify_vlan_config(peth)
diff --git a/src/conf_mode/interfaces_sstpc.py b/src/conf_mode/interfaces_sstpc.py
index b9d7a74fb..276fab4f9 100755
--- a/src/conf_mode/interfaces_sstpc.py
+++ b/src/conf_mode/interfaces_sstpc.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_tunnel.py b/src/conf_mode/interfaces_tunnel.py
index ee1436e49..4cf5ef115 100755
--- a/src/conf_mode/interfaces_tunnel.py
+++ b/src/conf_mode/interfaces_tunnel.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2025 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_virtual-ethernet.py b/src/conf_mode/interfaces_virtual-ethernet.py
index cb6104f59..f85c3d1de 100755
--- a/src/conf_mode/interfaces_virtual-ethernet.py
+++ b/src/conf_mode/interfaces_virtual-ethernet.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -23,6 +23,7 @@ from vyos.configdict import get_interface_dict
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_vrf
+from vyos.configverify import verify_mtu_ipv6
 from vyos.ifconfig import VethIf
 from vyos.utils.network import interface_exists
 airbag.enable()
@@ -62,6 +63,7 @@ def verify(veth):
         return None
 
     verify_vrf(veth)
+    verify_mtu_ipv6(veth)
     verify_address(veth)
 
     if 'peer_name' not in veth:
diff --git a/src/conf_mode/interfaces_vti.py b/src/conf_mode/interfaces_vti.py
index 20629c6c1..0461c4f68 100755
--- a/src/conf_mode/interfaces_vti.py
+++ b/src/conf_mode/interfaces_vti.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -20,6 +20,7 @@ from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configverify import verify_mirror_redirect
 from vyos.configverify import verify_vrf
+from vyos.configverify import verify_mtu_ipv6
 from vyos.ifconfig import VTIIf
 from vyos import ConfigError
 from vyos import airbag
@@ -40,6 +41,7 @@ def get_config(config=None):
 
 def verify(vti):
     verify_vrf(vti)
+    verify_mtu_ipv6(vti)
     verify_mirror_redirect(vti)
     return None
 
diff --git a/src/conf_mode/interfaces_vxlan.py b/src/conf_mode/interfaces_vxlan.py
index 68646e8ff..81ebf8dda 100755
--- a/src/conf_mode/interfaces_vxlan.py
+++ b/src/conf_mode/interfaces_vxlan.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -66,7 +66,8 @@ def get_config(config=None):
         vxlan.update({'vlan_to_vni_removed': {}})
         for vlan in tmp:
             vni = leaf_node_changed(conf, base + [ifname, 'vlan-to-vni', vlan, 'vni'])
-            vxlan['vlan_to_vni_removed'].update({vlan : {'vni' : vni[0]}})
+            if vni:
+                vxlan['vlan_to_vni_removed'].update({vlan : {'vni' : vni[0]}})
 
     # We need to verify that no other VXLAN tunnel is configured when external
     # mode is in use - Linux Kernel limitation
@@ -95,6 +96,8 @@ def verify(vxlan):
     if 'group' in vxlan:
         if 'source_interface' not in vxlan:
             raise ConfigError('Multicast VXLAN requires an underlaying interface')
+        if 'remote' in vxlan:
+            raise ConfigError('Both group and remote cannot be specified')
         verify_source_interface(vxlan)
 
     if not any(tmp in ['group', 'remote', 'source_address', 'source_interface'] for tmp in vxlan):
diff --git a/src/conf_mode/interfaces_wireguard.py b/src/conf_mode/interfaces_wireguard.py
index b6fd6b0b2..33d782ec6 100755
--- a/src/conf_mode/interfaces_wireguard.py
+++ b/src/conf_mode/interfaces_wireguard.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -14,11 +14,17 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import os
+
+from glob import glob
 from sys import exit
 
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_source_interface
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
@@ -29,6 +35,7 @@ from vyos.ifconfig import WireGuardIf
 from vyos.utils.kernel import check_kmod
 from vyos.utils.network import check_port_availability
 from vyos.utils.network import is_wireguard_key_pair
+from vyos.utils.process import call
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
@@ -54,11 +61,31 @@ def get_config(config=None):
     if is_node_changed(conf, base + [ifname, 'peer']):
         wireguard.update({'rebuild_required': {}})
 
+    wireguard['peers_need_resolve'] = []
+    if 'peer' in wireguard:
+        for peer, peer_config in wireguard['peer'].items():
+            if 'disable' not in peer_config and 'host_name' in peer_config:
+                wireguard['peers_need_resolve'].append(peer)
+
+    # Check if interface is used as source-interface on VXLAN interface
+    tmp = is_source_interface(conf, ifname, 'vxlan')
+    if tmp:
+        if 'deleted' not in wireguard:
+            set_dependents('vxlan', conf, tmp)
+        else:
+            wireguard['is_source_interface'] = tmp
+
     return wireguard
 
+
 def verify(wireguard):
     if 'deleted' in wireguard:
         verify_bridge_delete(wireguard)
+        if 'is_source_interface' in wireguard:
+            raise ConfigError(
+                f'Interface "{wireguard["ifname"]}" cannot be deleted as it is used '
+                f'as source interface for "{wireguard["is_source_interface"]}"!'
+            )
         return None
 
     verify_mtu_ipv6(wireguard)
@@ -72,7 +99,7 @@ def verify(wireguard):
 
     if 'port' in wireguard and 'port_changed' in wireguard:
         listen_port = int(wireguard['port'])
-        if check_port_availability('0.0.0.0', listen_port, 'udp') is not True:
+        if check_port_availability(None, listen_port, protocol='udp') is not True:
             raise ConfigError(f'UDP port {listen_port} is busy or unavailable and '
                                'cannot be used for the interface!')
 
@@ -82,48 +109,73 @@ def verify(wireguard):
         for tmp in wireguard['peer']:
             peer = wireguard['peer'][tmp]
 
+            base_error = f'WireGuard peer "{tmp}":'
+
+            if 'host_name' in peer and 'address' in peer:
+                raise ConfigError(f'{base_error} address/host-name are mutually exclusive!')
+
             if 'allowed_ips' not in peer:
-                raise ConfigError(f'Wireguard allowed-ips required for peer "{tmp}"!')
+                raise ConfigError(f'{base_error} missing mandatory allowed-ips!')
 
             if 'public_key' not in peer:
-                raise ConfigError(f'Wireguard public-key required for peer "{tmp}"!')
-
-            if ('address' in peer and 'port' not in peer) or ('port' in peer and 'address' not in peer):
-                raise ConfigError('Both Wireguard port and address must be defined '
-                                  f'for peer "{tmp}" if either one of them is set!')
+                raise ConfigError(f'{base_error} missing mandatory public-key!')
 
             if peer['public_key'] in public_keys:
-                raise ConfigError(f'Duplicate public-key defined on peer "{tmp}"')
+                raise ConfigError(f'{base_error} duplicate public-key!')
 
             if 'disable' not in peer:
                 if is_wireguard_key_pair(wireguard['private_key'], peer['public_key']):
-                    raise ConfigError(f'Peer "{tmp}" has the same public key as the interface "{wireguard["ifname"]}"')
+                    tmp = wireguard["ifname"]
+                    raise ConfigError(f'{base_error} identical public key as interface "{tmp}"!')
+
+            port_addr_error = f'{base_error} both port and address/host-name must '\
+                              'be defined if either one of them is set!'
+            if 'port' not in peer:
+                if 'host_name' in peer or 'address' in peer:
+                    raise ConfigError(port_addr_error)
+            else:
+                if 'host_name' not in peer and 'address' not in peer:
+                    raise ConfigError(port_addr_error)
 
             public_keys.append(peer['public_key'])
 
+
 def generate(wireguard):
     return None
 
+
 def apply(wireguard):
     check_kmod('wireguard')
 
-    if 'rebuild_required' in wireguard or 'deleted' in wireguard:
-        wg = WireGuardIf(**wireguard)
-        # WireGuard only supports peer removal based on the configured public-key,
-        # by deleting the entire interface this is the shortcut instead of parsing
-        # out all peers and removing them one by one.
-        #
-        # Peer reconfiguration will always come with a short downtime while the
-        # WireGuard interface is recreated (see below)
-        wg.remove()
+    wg = WireGuardIf(**wireguard)
 
-    # Create the new interface if required
-    if 'deleted' not in wireguard:
-        wg = WireGuardIf(**wireguard)
+    if 'deleted' in wireguard:
+        wg.remove()
+    else:
         wg.update(wireguard)
 
+    domain_resolver_usage = '/run/use-vyos-domain-resolver-interfaces-wireguard-' + wireguard['ifname']
+
+    ## DOMAIN RESOLVER
+    domain_action = 'restart'
+    if 'peers_need_resolve' in wireguard and len(wireguard['peers_need_resolve']) > 0 and 'disable' not in wireguard:
+        from vyos.utils.file import write_file
+
+        text = f'# Automatically generated by interfaces_wireguard.py\nThis file indicates that vyos-domain-resolver service is used by the interfaces_wireguard.\n'
+        text += "interfaces:\n" + "".join([f"  - {peer}\n" for peer in wireguard['peers_need_resolve']])
+        write_file(domain_resolver_usage, text)
+    else:
+        if os.path.exists(domain_resolver_usage):
+            os.unlink(domain_resolver_usage)
+        if not glob('/run/use-vyos-domain-resolver*'):
+            domain_action = 'stop'
+    call(f'systemctl {domain_action} vyos-domain-resolver.service')
+
+    call_dependents()
+
     return None
 
+
 if __name__ == '__main__':
     try:
         c = get_config()
diff --git a/src/conf_mode/interfaces_wireless.py b/src/conf_mode/interfaces_wireless.py
index d24675ee6..b3b909046 100755
--- a/src/conf_mode/interfaces_wireless.py
+++ b/src/conf_mode/interfaces_wireless.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/interfaces_wwan.py b/src/conf_mode/interfaces_wwan.py
index 230eb14d6..ddddbe5e8 100755
--- a/src/conf_mode/interfaces_wwan.py
+++ b/src/conf_mode/interfaces_wwan.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -26,8 +26,10 @@ from vyos.configverify import verify_authentication
 from vyos.configverify import verify_interface_exists
 from vyos.configverify import verify_mirror_redirect
 from vyos.configverify import verify_vrf
+from vyos.configverify import verify_mtu_ipv6
 from vyos.ifconfig import WWANIf
 from vyos.utils.dict import dict_search
+from vyos.utils.network import is_wwan_connected
 from vyos.utils.process import cmd
 from vyos.utils.process import call
 from vyos.utils.process import DEVNULL
@@ -98,6 +100,7 @@ def verify(wwan):
     verify_interface_exists(wwan, ifname)
     verify_authentication(wwan)
     verify_vrf(wwan)
+    verify_mtu_ipv6(wwan)
     verify_mirror_redirect(wwan)
 
     return None
@@ -135,7 +138,7 @@ def apply(wwan):
                 break
             sleep(0.250)
 
-    if 'shutdown_required' in wwan:
+    if 'shutdown_required' in wwan or (not is_wwan_connected(wwan['ifname'])):
         # we only need the modem number. wwan0 -> 0, wwan1 -> 1
         modem = wwan['ifname'].lstrip('wwan')
         base_cmd = f'mmcli --modem {modem}'
@@ -157,7 +160,7 @@ def apply(wwan):
 
         return None
 
-    if 'shutdown_required' in wwan:
+    if 'shutdown_required' in wwan or (not is_wwan_connected(wwan['ifname'])):
         ip_type = 'ipv4'
         slaac = dict_search('ipv6.address.autoconf', wwan) != None
         if 'address' in wwan:
diff --git a/src/conf_mode/load-balancing_haproxy.py b/src/conf_mode/load-balancing_haproxy.py
index 45042dd52..4c26ed0b4 100644
--- a/src/conf_mode/load-balancing_haproxy.py
+++ b/src/conf_mode/load-balancing_haproxy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -19,6 +19,7 @@ import os
 from sys import exit
 from shutil import rmtree
 
+from vyos.defaults import systemd_services
 from vyos.config import Config
 from vyos.configverify import verify_pki_certificate
 from vyos.configverify import verify_pki_ca_certificate
@@ -39,7 +40,6 @@ airbag.enable()
 
 load_balancing_dir = '/run/haproxy'
 load_balancing_conf_file = f'{load_balancing_dir}/haproxy.cfg'
-systemd_service = 'haproxy.service'
 systemd_override = '/run/systemd/system/haproxy.service.d/10-override.conf'
 
 def get_config(config=None):
@@ -65,29 +65,39 @@ def verify(lb):
         return None
 
     if 'backend' not in lb or 'service' not in lb:
-        raise ConfigError(f'"service" and "backend" must be configured!')
+        raise ConfigError('Both "service" and "backend" must be configured!')
 
     for front, front_config in lb['service'].items():
         if 'port' not in front_config:
             raise ConfigError(f'"{front} service port" must be configured!')
 
         # Check if bind address:port are used by another service
-        tmp_address = front_config.get('address', '0.0.0.0')
+        tmp_address = front_config.get('address', None)
         tmp_port = front_config['port']
         if check_port_availability(tmp_address, int(tmp_port), 'tcp') is not True and \
                 not is_listen_port_bind_service(int(tmp_port), 'haproxy'):
-            raise ConfigError(f'"TCP" port "{tmp_port}" is used by another service')
+            raise ConfigError(f'TCP port "{tmp_port}" is used by another service')
+
+        if 'http_compression' in front_config:
+            if front_config['mode'] != 'http':
+                raise ConfigError(f'service {front} must be set to http mode to use http-compression!')
+            if len(front_config['http_compression']['mime_type']) == 0:
+                raise ConfigError(f'service {front} must have at least one mime-type configured to use'
+                                  f'http_compression!')
+
+        for cert in dict_search('ssl.certificate', front_config) or []:
+            verify_pki_certificate(lb, cert)
 
     for back, back_config in lb['backend'].items():
         if 'http_check' in back_config:
             http_check = back_config['http_check']
             if 'expect' in http_check and 'status' in http_check['expect'] and 'string' in http_check['expect']:
-                raise ConfigError(f'"expect status" and "expect string" can not be configured together!')
+                raise ConfigError('"expect status" and "expect string" can not be configured together!')
 
         if 'health_check' in back_config:
             if back_config['mode'] != 'tcp':
                 raise ConfigError(f'backend "{back}" can only be configured with {back_config["health_check"]} ' +
-                                  f'health-check whilst in TCP mode!')
+                                  'health-check whilst in TCP mode!')
             if 'http_check' in back_config:
                 raise ConfigError(f'backend "{back}" cannot be configured with both http-check and health-check!')
 
@@ -105,20 +115,15 @@ def verify(lb):
             if {'no_verify', 'ca_certificate'} <= set(back_config['ssl']):
                 raise ConfigError(f'backend {back} cannot have both ssl options no-verify and ca-certificate set!')
 
+            tmp = dict_search('ssl.ca_certificate', back_config)
+            if tmp: verify_pki_ca_certificate(lb, tmp)
+
     # Check if http-response-headers are configured in any frontend/backend where mode != http
     for group in ['service', 'backend']:
         for config_name, config in lb[group].items():
             if 'http_response_headers' in config and config['mode'] != 'http':
                 raise ConfigError(f'{group} {config_name} must be set to http mode to use http_response_headers!')
 
-    for front, front_config in lb['service'].items():
-        for cert in dict_search('ssl.certificate', front_config) or []:
-            verify_pki_certificate(lb, cert)
-
-    for back, back_config in lb['backend'].items():
-        tmp = dict_search('ssl.ca_certificate', back_config)
-        if tmp: verify_pki_ca_certificate(lb, tmp)
-
 
 def generate(lb):
     if not lb:
@@ -186,12 +191,11 @@ def generate(lb):
     return None
 
 def apply(lb):
+    action = 'stop'
+    if lb:
+        action = 'reload-or-restart'
     call('systemctl daemon-reload')
-    if not lb:
-        call(f'systemctl stop {systemd_service}')
-    else:
-        call(f'systemctl reload-or-restart {systemd_service}')
-
+    call(f'systemctl {action} {systemd_services["haproxy"]}')
     return None
 
 
diff --git a/src/conf_mode/load-balancing_wan.py b/src/conf_mode/load-balancing_wan.py
index 5da0b906b..dc7f1c838 100755
--- a/src/conf_mode/load-balancing_wan.py
+++ b/src/conf_mode/load-balancing_wan.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -14,24 +14,16 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import os
-
 from sys import exit
-from shutil import rmtree
 
-from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdep import set_dependents, call_dependents
 from vyos.utils.process import cmd
-from vyos.template import render
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
-load_balancing_dir = '/run/load-balance'
-load_balancing_conf_file = f'{load_balancing_dir}/wlb.conf'
-systemd_service = 'vyos-wan-load-balance.service'
-
+service = 'vyos-wan-load-balance.service'
 
 def get_config(config=None):
     if config:
@@ -40,6 +32,7 @@ def get_config(config=None):
         conf = Config()
 
     base = ['load-balancing', 'wan']
+
     lb = conf.get_config_dict(base, key_mangling=('-', '_'),
                               no_tag_node_value_mangle=True,
                               get_first_key=True,
@@ -59,87 +52,61 @@ def verify(lb):
     if not lb:
         return None
 
-    if 'interface_health' not in lb:
-        raise ConfigError(
-            'A valid WAN load-balance configuration requires an interface with a nexthop!'
-        )
-
-    for interface, interface_config in lb['interface_health'].items():
-        if 'nexthop' not in interface_config:
-            raise ConfigError(
-                f'interface-health {interface} nexthop must be specified!')
-
-        if 'test' in interface_config:
-            for test_rule, test_config in interface_config['test'].items():
-                if 'type' in test_config:
-                    if test_config['type'] == 'user-defined' and 'test_script' not in test_config:
-                        raise ConfigError(
-                            f'test {test_rule} script must be defined for test-script!'
-                        )
-
-    if 'rule' not in lb:
-        Warning(
-            'At least one rule with an (outbound) interface must be defined for WAN load balancing to be active!'
-        )
+    if 'interface_health' in lb:
+        for ifname, health_conf in lb['interface_health'].items():
+            if 'nexthop' not in health_conf:
+                raise ConfigError(f'Nexthop must be configured for interface {ifname}')
+
+            if 'test' not in health_conf:
+                continue
+
+            for test_id, test_conf in health_conf['test'].items():
+                if 'type' not in test_conf:
+                    raise ConfigError(f'No type configured for health test on interface {ifname}')
+
+                if test_conf['type'] == 'user-defined' and 'test_script' not in test_conf:
+                    raise ConfigError(f'Missing user-defined script for health test on interface {ifname}')
     else:
-        for rule, rule_config in lb['rule'].items():
-            if 'inbound_interface' not in rule_config:
-                raise ConfigError(f'rule {rule} inbound-interface must be specified!')
-            if {'failover', 'exclude'} <= set(rule_config):
-                raise ConfigError(f'rule {rule} failover cannot be configured with exclude!')
-            if {'limit', 'exclude'} <= set(rule_config):
-                raise ConfigError(f'rule {rule} limit cannot be used with exclude!')
-            if 'interface' not in rule_config:
-                if 'exclude' not in rule_config:
-                    Warning(
-                        f'rule {rule} will be inactive because no (outbound) interfaces have been defined for this rule'
-                    )
-            for direction in {'source', 'destination'}:
-                if direction in rule_config:
-                    if 'protocol' in rule_config and 'port' in rule_config[
-                            direction]:
-                        if rule_config['protocol'] not in {'tcp', 'udp'}:
-                            raise ConfigError('ports can only be specified when protocol is "tcp" or "udp"')
+        raise ConfigError('Interface health tests must be configured')
 
+    if 'rule' in lb:
+        for rule_id, rule_conf in lb['rule'].items():
+            if 'interface' not in rule_conf and 'exclude' not in rule_conf:
+                raise ConfigError(f'Interface or exclude not specified on load-balancing wan rule {rule_id}')
 
-def generate(lb):
-    if not lb:
-        # Delete /run/load-balance/wlb.conf
-        if os.path.isfile(load_balancing_conf_file):
-            os.unlink(load_balancing_conf_file)
-        # Delete old directories
-        if os.path.isdir(load_balancing_dir):
-            rmtree(load_balancing_dir, ignore_errors=True)
-        if os.path.exists('/var/run/load-balance/wlb.out'):
-            os.unlink('/var/run/load-balance/wlb.out')
+            if 'failover' in rule_conf and 'exclude' in rule_conf:
+                raise ConfigError(f'Failover cannot be configured with exclude on load-balancing wan rule {rule_id}')
 
-        return None
+            if 'limit' in rule_conf:
+                if 'exclude' in rule_conf:
+                    raise ConfigError(f'Limit cannot be configured with exclude on load-balancing wan rule {rule_id}')
 
-    # Create load-balance dir
-    if not os.path.isdir(load_balancing_dir):
-        os.mkdir(load_balancing_dir)
+                if 'rate' in rule_conf['limit'] and 'period' not in rule_conf['limit']:
+                    raise ConfigError(f'Missing "limit period" on load-balancing wan rule {rule_id}')
 
-    render(load_balancing_conf_file, 'load-balancing/wlb.conf.j2', lb)
+                if 'period' in rule_conf['limit'] and 'rate' not in rule_conf['limit']:
+                    raise ConfigError(f'Missing "limit rate" on load-balancing wan rule {rule_id}')
 
-    return None
+            for direction in ['source', 'destination']:
+                if direction in rule_conf:
+                    if 'port' in rule_conf[direction]:
+                        if 'protocol' not in rule_conf:
+                            raise ConfigError(f'Protocol required to specify port on load-balancing wan rule {rule_id}')
+
+                        if rule_conf['protocol'] not in ['tcp', 'udp', 'tcp_udp']:
+                            raise ConfigError(f'Protocol must be tcp, udp or tcp_udp to specify port on load-balancing wan rule {rule_id}')
 
+def generate(lb):
+    return None
 
 def apply(lb):
     if not lb:
-        try:
-            cmd(f'systemctl stop {systemd_service}')
-        except Exception as e:
-            print(f"Error message: {e}")
-
+        cmd(f'sudo systemctl stop {service}')
     else:
-        cmd('sudo sysctl -w net.netfilter.nf_conntrack_acct=1')
-        cmd(f'systemctl restart {systemd_service}')
+        cmd(f'sudo systemctl restart {service}')
 
     call_dependents()
 
-    return None
-
-
 if __name__ == '__main__':
     try:
         c = get_config()
diff --git a/src/conf_mode/nat.py b/src/conf_mode/nat.py
index 98b2f3f29..8763da886 100755
--- a/src/conf_mode/nat.py
+++ b/src/conf_mode/nat.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -16,13 +16,13 @@
 
 import os
 
+from glob import glob
 from sys import exit
 
 from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdep import set_dependents, call_dependents
 from vyos.template import render
-from vyos.template import is_ip_network
 from vyos.utils.kernel import check_kmod
 from vyos.utils.dict import dict_search
 from vyos.utils.dict import dict_search_args
@@ -30,7 +30,6 @@ from vyos.utils.file import write_file
 from vyos.utils.process import cmd
 from vyos.utils.process import run
 from vyos.utils.process import call
-from vyos.utils.network import is_addr_assigned
 from vyos.utils.network import interface_exists
 from vyos.firewall import fqdn_config_parse
 from vyos import ConfigError
@@ -43,7 +42,6 @@ k_mod = ['nft_nat', 'nft_chain_nat']
 nftables_nat_config = '/run/nftables_nat.conf'
 nftables_static_nat_conf = '/run/nftables_static-nat-rules.nft'
 domain_resolver_usage = '/run/use-vyos-domain-resolver-nat'
-domain_resolver_usage_firewall = '/run/use-vyos-domain-resolver-firewall'
 
 valid_groups = [
     'address_group',
@@ -176,12 +174,6 @@ def verify(nat):
                 if 'exclude' not in config and 'backend' not in config['load_balance']:
                     raise ConfigError(f'{err_msg} translation requires address and/or port')
 
-            addr = dict_search('translation.address', config)
-            if addr != None and addr != 'masquerade' and not is_ip_network(addr):
-                for ip in addr.split('-'):
-                    if not is_addr_assigned(ip):
-                        Warning(f'IP address {ip} does not exist on the system!')
-
             # common rule verification
             verify_rule(config, err_msg, nat['firewall_group'])
 
@@ -266,8 +258,8 @@ def apply(nat):
             write_file(domain_resolver_usage, text)
         elif os.path.exists(domain_resolver_usage):
             os.unlink(domain_resolver_usage)
-            if not os.path.exists(domain_resolver_usage_firewall):
-                # Firewall not using domain resolver
+
+            if not glob('/run/use-vyos-domain-resolver*'):
                 domain_action = 'stop'
         call(f'systemctl {domain_action} vyos-domain-resolver.service')
 
diff --git a/src/conf_mode/nat64.py b/src/conf_mode/nat64.py
index df501ce7f..0ea594e1a 100755
--- a/src/conf_mode/nat64.py
+++ b/src/conf_mode/nat64.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -19,6 +19,7 @@
 import csv
 import os
 import re
+import sys
 
 from ipaddress import IPv6Network, IPv6Address
 from json import dumps as json_write
@@ -26,162 +27,173 @@ from json import dumps as json_write
 from vyos import ConfigError
 from vyos import airbag
 from vyos.config import Config
-from vyos.configdict import is_node_changed
+from vyos.config import ConfigDict
+from vyos.configdiff import get_config_diff
 from vyos.utils.dict import dict_search
 from vyos.utils.file import write_file
 from vyos.utils.kernel import check_kmod
+from vyos.utils.kernel import unload_kmod
 from vyos.utils.process import cmd
 from vyos.utils.process import run
 
 airbag.enable()
 
-INSTANCE_REGEX = re.compile(r"instance-(\d+)")
-JOOL_CONFIG_DIR = "/run/jool"
+INSTANCE_REGEX = re.compile(r'instance-(\d+)')
+JOOL_CONFIG_DIR = '/run/jool'
 
 
-def get_config(config: Config | None = None) -> None:
+def get_config(config: Config | None = None) -> ConfigDict:
     if config is None:
         config = Config()
 
-    base = ["nat64"]
-    nat64 = config.get_config_dict(base, key_mangling=("-", "_"), get_first_key=True)
+    base = ['nat64']
+    nat64 = config.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+    config_diff = get_config_diff(config)
+    # get_config_dict returns an instance of ConfigDict
+    setattr(nat64, 'config_diff', config_diff)
 
     return nat64
 
 
 def verify(nat64) -> None:
-    check_kmod(["jool"])
-    base_src = ["nat64", "source", "rule"]
+    # pylint: disable=too-many-branches
+
+    config_diff = getattr(nat64, 'config_diff')
+
+    check_kmod(['jool'])
+    base_src = ['nat64', 'source', 'rule']
 
     # Load in existing instances so we can destroy any unknown
-    lines = cmd("jool instance display --csv").splitlines()
+    lines = cmd('jool instance display --csv').splitlines()
     for _, instance, _ in csv.reader(lines):
         match = INSTANCE_REGEX.fullmatch(instance)
         if not match:
-            # FIXME: Instances that don't match should be ignored but WARN'ed to the user
+            # to fix: Instances that don't match should be ignored but WARN'ed to the user
             continue
         num = match.group(1)
 
-        rules = nat64.setdefault("source", {}).setdefault("rule", {})
+        rules = nat64.setdefault('source', {}).setdefault('rule', {})
         # Mark it for deletion
         if num not in rules:
-            rules[num] = {"deleted": True}
+            rules[num] = {'deleted': True}
             continue
 
         # If the user changes the mode, recreate the instance else Jool fails with:
         # Jool error: Sorry; you can't change an instance's framework for now.
-        if is_node_changed(config, base_src + [f"instance-{num}", "mode"]):
-            rules[num]["recreate"] = True
+        if config_diff.is_node_changed(base_src + [f'instance-{num}', 'mode']):
+            rules[num]['recreate'] = True
 
         # If the user changes the pool6, recreate the instance else Jool fails with:
         # Jool error: Sorry; you can't change a NAT64 instance's pool6 for now.
-        if dict_search("source.prefix", rules[num]) and is_node_changed(
-            config,
-            base_src + [num, "source", "prefix"],
+        if dict_search('source.prefix', rules[num]) and config_diff.is_node_changed(
+            base_src + [num, 'source', 'prefix'],
         ):
-            rules[num]["recreate"] = True
+            rules[num]['recreate'] = True
 
     if not nat64:
         # nothing left to do
         return
 
-    if dict_search("source.rule", nat64):
+    if dict_search('source.rule', nat64):
         # Ensure only 1 netfilter instance per namespace
         nf_rules = filter(
-            lambda i: "deleted" not in i and i.get('mode') == "netfilter",
-            nat64["source"]["rule"].values(),
+            lambda i: 'deleted' not in i and i.get('mode') == 'netfilter',
+            nat64['source']['rule'].values(),
         )
         next(nf_rules, None)  # Discard the first element
         if next(nf_rules, None) is not None:
             raise ConfigError(
-                "Jool permits only 1 NAT64 netfilter instance (per network namespace)"
+                'Jool permits only 1 NAT64 netfilter instance (per network namespace)'
             )
 
-        for rule, instance in nat64["source"]["rule"].items():
-            if "deleted" in instance:
+        for rule, instance in nat64['source']['rule'].items():
+            if 'deleted' in instance:
                 continue
 
             # Verify that source.prefix is set and is a /96
-            if not dict_search("source.prefix", instance):
-                raise ConfigError(f"Source NAT64 rule {rule} missing source prefix")
-            src_prefix = IPv6Network(instance["source"]["prefix"])
+            if not dict_search('source.prefix', instance):
+                raise ConfigError(f'Source NAT64 rule {rule} missing source prefix')
+            src_prefix = IPv6Network(instance['source']['prefix'])
             if src_prefix.prefixlen != 96:
-                raise ConfigError(f"Source NAT64 rule {rule} source prefix must be /96")
+                raise ConfigError(f'Source NAT64 rule {rule} source prefix must be /96')
             if (int(src_prefix[0]) & int(IPv6Address('0:0:0:0:ff00::'))) != 0:
                 raise ConfigError(
                     f'Source NAT64 rule {rule} source prefix is not RFC6052-compliant: '
                     'bits 64 to 71 (9th octet) must be zeroed'
                 )
 
-            pools = dict_search("translation.pool", instance)
+            pools = dict_search('translation.pool', instance)
             if pools:
                 for num, pool in pools.items():
-                    if "address" not in pool:
+                    if 'address' not in pool:
                         raise ConfigError(
-                            f"Source NAT64 rule {rule} translation pool "
-                            f"{num} missing address/prefix"
+                            f'Source NAT64 rule {rule} translation pool '
+                            f'{num} missing address/prefix'
                         )
-                    if "port" not in pool:
+                    if 'port' not in pool:
                         raise ConfigError(
-                            f"Source NAT64 rule {rule} translation pool "
-                            f"{num} missing port(-range)"
+                            f'Source NAT64 rule {rule} translation pool '
+                            f'{num} missing port(-range)'
                         )
 
 
 def generate(nat64) -> None:
+    # pylint: disable=too-many-branches
     if not nat64:
         return
 
     os.makedirs(JOOL_CONFIG_DIR, exist_ok=True)
 
-    if dict_search("source.rule", nat64):
-        for rule, instance in nat64["source"]["rule"].items():
-            if "deleted" in instance:
+    # pylint: disable=too-many-nested-blocks
+    if dict_search('source.rule', nat64):
+        for rule, instance in nat64['source']['rule'].items():
+            if 'deleted' in instance:
                 # Delete the unused instance file
-                os.unlink(os.path.join(JOOL_CONFIG_DIR, f"instance-{rule}.json"))
+                os.unlink(os.path.join(JOOL_CONFIG_DIR, f'instance-{rule}.json'))
                 continue
 
-            name = f"instance-{rule}"
+            name = f'instance-{rule}'
             config = {
-                "instance": name,
-                "framework": "netfilter",
-                "global": {
-                    "pool6": instance["source"]["prefix"],
-                    "manually-enabled": "disable" not in instance,
+                'instance': name,
+                'framework': 'netfilter',
+                'global': {
+                    'pool6': instance['source']['prefix'],
+                    'manually-enabled': 'disable' not in instance,
                 },
                 # "bib": [],
             }
 
-            if "description" in instance:
-                config["comment"] = instance["description"]
+            if 'description' in instance:
+                config['comment'] = instance['description']
 
-            if dict_search("translation.pool", instance):
+            if dict_search('translation.pool', instance):
                 pool4 = []
                 # mark
                 mark = ''
-                if dict_search("match.mark", instance):
-                    mark = instance["match"]["mark"]
+                if dict_search('match.mark', instance):
+                    mark = instance['match']['mark']
 
-                for pool in instance["translation"]["pool"].values():
-                    if "disable" in pool:
+                for pool in instance['translation']['pool'].values():
+                    if 'disable' in pool:
                         continue
 
-                    protos = pool.get("protocol", {}).keys() or ("tcp", "udp", "icmp")
+                    protos = pool.get('protocol', {}).keys() or ('tcp', 'udp', 'icmp')
                     for proto in protos:
                         obj = {
-                            "protocol": proto.upper(),
-                            "prefix": pool["address"],
-                            "port range": pool["port"],
+                            'protocol': proto.upper(),
+                            'prefix': pool['address'],
+                            'port range': pool['port'],
                         }
                         if mark:
-                            obj["mark"] = int(mark)
-                        if "description" in pool:
-                            obj["comment"] = pool["description"]
+                            obj['mark'] = int(mark)
+                        if 'description' in pool:
+                            obj['comment'] = pool['description']
 
                         pool4.append(obj)
 
                 if pool4:
-                    config["pool4"] = pool4
+                    config['pool4'] = pool4
 
             write_file(f'{JOOL_CONFIG_DIR}/{name}.json', json_write(config, indent=2))
 
@@ -191,30 +203,30 @@ def apply(nat64) -> None:
         unload_kmod(['jool'])
         return
 
-    if dict_search("source.rule", nat64):
+    if dict_search('source.rule', nat64):
         # Deletions first to avoid conflicts
-        for rule, instance in nat64["source"]["rule"].items():
-            if not any(k in instance for k in ("deleted", "recreate")):
+        for rule, instance in nat64['source']['rule'].items():
+            if not any(k in instance for k in ('deleted', 'recreate')):
                 continue
 
-            ret = run(f"jool instance remove instance-{rule}")
+            ret = run(f'jool instance remove instance-{rule}')
             if ret != 0:
                 raise ConfigError(
-                    f"Failed to remove nat64 source rule {rule} (jool instance instance-{rule})"
+                    f'Failed to remove nat64 source rule {rule} (jool instance instance-{rule})'
                 )
 
         # Now creations
-        for rule, instance in nat64["source"]["rule"].items():
-            if "deleted" in instance:
+        for rule, instance in nat64['source']['rule'].items():
+            if 'deleted' in instance:
                 continue
 
-            name = f"instance-{rule}"
-            ret = run(f"jool -i {name} file handle {JOOL_CONFIG_DIR}/{name}.json")
+            name = f'instance-{rule}'
+            ret = run(f'jool -i {name} file handle {JOOL_CONFIG_DIR}/{name}.json')
             if ret != 0:
-                raise ConfigError(f"Failed to set jool instance {name}")
+                raise ConfigError(f'Failed to set jool instance {name}')
 
 
-if __name__ == "__main__":
+if __name__ == '__main__':
     try:
         c = get_config()
         verify(c)
@@ -222,4 +234,4 @@ if __name__ == "__main__":
         apply(c)
     except ConfigError as e:
         print(e)
-        exit(1)
+        sys.exit(1)
diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py
index 95dfae3a5..aea187d18 100755
--- a/src/conf_mode/nat66.py
+++ b/src/conf_mode/nat66.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -92,6 +92,10 @@ def verify(nat):
             if prefix != None:
                 if not is_ipv6(prefix):
                     raise ConfigError(f'{err_msg} source-prefix not specified')
+                
+            if 'destination' in config and 'group' in config['destination']:
+                if len({'address_group', 'network_group', 'domain_group'} & set(config['destination']['group'])) > 1:
+                    raise ConfigError('Only one address-group, network-group or domain-group can be specified')
 
     if dict_search('destination.rule', nat):
         for rule, config in dict_search('destination.rule', nat).items():
diff --git a/src/conf_mode/nat_cgnat.py b/src/conf_mode/nat_cgnat.py
index 3484e5873..312688b53 100755
--- a/src/conf_mode/nat_cgnat.py
+++ b/src/conf_mode/nat_cgnat.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/netns.py b/src/conf_mode/netns.py
index b57e46a0d..5a3c4e7fa 100755
--- a/src/conf_mode/netns.py
+++ b/src/conf_mode/netns.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index acea2c9be..fa6958130 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -19,6 +19,7 @@ import os
 from sys import argv
 from sys import exit
 
+from vyos.base import Message
 from vyos.config import Config
 from vyos.config import config_dict_merge
 from vyos.configdep import set_dependents
@@ -27,6 +28,8 @@ from vyos.configdict import node_changed
 from vyos.configdiff import Diff
 from vyos.configdiff import get_config_diff
 from vyos.defaults import directories
+from vyos.defaults import internal_ports
+from vyos.defaults import systemd_services
 from vyos.pki import encode_certificate
 from vyos.pki import is_ca_certificate
 from vyos.pki import load_certificate
@@ -42,9 +45,11 @@ from vyos.utils.dict import dict_search
 from vyos.utils.dict import dict_search_args
 from vyos.utils.dict import dict_search_recursive
 from vyos.utils.file import read_file
+from vyos.utils.network import check_port_availability
 from vyos.utils.process import call
 from vyos.utils.process import cmd
 from vyos.utils.process import is_systemd_service_active
+from vyos.utils.process import is_systemd_service_running
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
@@ -59,6 +64,10 @@ sync_search = [
         'path': ['service', 'https'],
     },
     {
+        'keys': ['key'],
+        'path': ['service', 'ssh'],
+    },
+    {
         'keys': ['certificate', 'ca_certificate'],
         'path': ['interfaces', 'ethernet'],
     },
@@ -128,8 +137,20 @@ def certbot_request(name: str, config: dict, dry_run: bool=True):
           f'--standalone --agree-tos --no-eff-email --expand --server {config["url"]} '\
           f'--email {config["email"]} --key-type rsa --rsa-key-size {config["rsa_key_size"]} '\
           f'{domains}'
+
+    listen_address = None
     if 'listen_address' in config:
-        tmp += f' --http-01-address {config["listen_address"]}'
+        listen_address = config['listen_address']
+
+    # When ACME is used behind a reverse proxy, we always bind to localhost
+    # whatever the CLI listen-address is configured for.
+    if ('used_by' in config and 'haproxy' in config['used_by'] and
+        is_systemd_service_running(systemd_services['haproxy']) and
+        not check_port_availability(listen_address, 80)):
+        tmp += f' --http-01-address 127.0.0.1 --http-01-port {internal_ports["certbot_haproxy"]}'
+    elif listen_address:
+        tmp += f' --http-01-address {listen_address}'
+
     # verify() does not need to actually request a cert but only test for plausability
     if dry_run:
         tmp += ' --dry-run'
@@ -150,14 +171,18 @@ def get_config(config=None):
     if len(argv) > 1 and argv[1] == 'certbot_renew':
         pki['certbot_renew'] = {}
 
-    changed_keys = ['ca', 'certificate', 'dh', 'key-pair', 'openssh', 'openvpn']
 
+    # Walk through the list of sync_translate mapping and build a list
+    # which is later used to check if the node was changed in the CLI config
+    changed_keys = []
+    for value in sync_translate.values():
+        if value not in changed_keys:
+            changed_keys.append(value)
+    # Check for changes to said given keys in the CLI config
     for key in changed_keys:
         tmp = node_changed(conf, base + [key], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
-
         if 'changed' not in pki:
             pki.update({'changed':{}})
-
         pki['changed'].update({key.replace('-', '_') : tmp})
 
     # We only merge on the defaults of there is a configuration at all
@@ -219,8 +244,8 @@ def get_config(config=None):
                             continue
 
                         path = search['path']
-                        path_str = ' '.join(path + found_path)
-                        #print(f'PKI: Updating config: {path_str} {item_name}')
+                        path_str = ' '.join(path + found_path).replace('_','-')
+                        Message(f'Updating configuration: "{path_str} {item_name}"')
 
                         if path[0] == 'interfaces':
                             ifname = found_path[0]
@@ -230,6 +255,24 @@ def get_config(config=None):
                             if not D.node_changed_presence(path):
                                 set_dependents(path[1], conf)
 
+    # Check PKI certificates if they are auto-generated by ACME. If they are,
+    # traverse the current configuration and determine the service where the
+    # certificate is used by.
+    # Required to check if we might need to run certbot behing a reverse proxy.
+    if 'certificate' in pki:
+        for name, cert_config in pki['certificate'].items():
+            if 'acme' not in cert_config:
+                continue
+            if not dict_search('system.load_balancing.haproxy', pki):
+                continue
+            used_by = []
+            for cert_list, _ in dict_search_recursive(
+                pki['system']['load_balancing']['haproxy'], 'certificate'):
+                if name in cert_list:
+                    used_by.append('haproxy')
+            if used_by:
+                pki['certificate'][name]['acme'].update({'used_by': used_by})
+
     return pki
 
 def is_valid_certificate(raw_data):
@@ -321,6 +364,15 @@ def verify(pki):
                     raise ConfigError(f'An email address is required to request '\
                                     f'certificate for "{name}" via ACME!')
 
+                listen_address = None
+                if 'listen_address' in cert_conf['acme']:
+                    listen_address = cert_conf['acme']['listen_address']
+
+                if 'used_by' not in cert_conf['acme']:
+                    if not check_port_availability(listen_address, 80):
+                        raise ConfigError('Port 80 is already in use and not available '\
+                                          f'to provide ACME challenge for "{name}"!')
+
                 if 'certbot_renew' not in pki:
                     # Only run the ACME command if something on this entity changed,
                     # as this is time intensive
@@ -366,7 +418,8 @@ def verify(pki):
             if 'country' in default_values:
                 country = default_values['country']
                 if len(country) != 2 or not country.isalpha():
-                    raise ConfigError(f'Invalid default country value. Value must be 2 alpha characters.')
+                    raise ConfigError('Invalid default country value. '\
+                                      'Value must be 2 alpha characters.')
 
     if 'changed' in pki:
         # if the list is getting longer, we can move to a dict() and also embed the
@@ -374,27 +427,35 @@ def verify(pki):
         for search in sync_search:
             for key in search['keys']:
                 changed_key = sync_translate[key]
-
                 if changed_key not in pki['changed']:
                     continue
-
                 for item_name in pki['changed'][changed_key]:
                     node_present = False
                     if changed_key == 'openvpn':
                         node_present = dict_search_args(pki, 'openvpn', 'shared_secret', item_name)
                     else:
                         node_present = dict_search_args(pki, changed_key, item_name)
+                    # If the node is still present, we can skip the check
+                    # as we are not deleting it
+                    if node_present:
+                        continue
 
-                    if not node_present:
-                        search_dict = dict_search_args(pki['system'], *search['path'])
-
-                        if not search_dict:
-                            continue
+                    search_dict = dict_search_args(pki['system'], *search['path'])
+                    if not search_dict:
+                        continue
 
-                        for found_name, found_path in dict_search_recursive(search_dict, key):
-                            if found_name == item_name:
-                                path_str = " ".join(search['path'] + found_path)
-                                raise ConfigError(f'PKI object "{item_name}" still in use by "{path_str}"')
+                    for found_name, found_path in dict_search_recursive(search_dict, key):
+                        # Check if the name matches either by string compare, or beeing
+                        # part of a list
+                        if ((isinstance(found_name, str) and found_name == item_name) or
+                            (isinstance(found_name, list) and item_name in found_name)):
+                            # We do not support _ in CLI paths - this is only a convenience
+                            # as we mangle all - to _, now it's time to reverse this!
+                            path_str = ' '.join(search['path'] + found_path).replace('_','-')
+                            object = changed_key.replace('_','-')
+                            tmp = f'Embedded PKI {object} with name "{item_name}" is still '\
+                                  f'in use by CLI path "{path_str}"'
+                            raise ConfigError(tmp)
 
     return None
 
@@ -440,13 +501,21 @@ def generate(pki):
         for name, cert_conf in pki['certificate'].items():
             if 'acme' in cert_conf:
                 certbot_list.append(name)
-                # generate certificate if not found on disk
+                # There is no ACME/certbot managed certificate presend on the
+                # system, generate it
                 if name not in certbot_list_on_disk:
                     certbot_request(name, cert_conf['acme'], dry_run=False)
+                    # Now that the certificate was properly generated we have
+                    # the PEM files on disk. We need to add the certificate to
+                    # certbot_list_on_disk to automatically import the CA chain
+                    certbot_list_on_disk.append(name)
+                # We alredy had an ACME managed certificate on the system, but
+                # something changed in the configuration
                 elif changed_certificates != None and name in changed_certificates:
-                    # when something for the certificate changed, we should delete it
+                    # Delete old ACME certificate first
                     if name in certbot_list_on_disk:
                         certbot_delete(name)
+                    # Request new certificate via certbot
                     certbot_request(name, cert_conf['acme'], dry_run=False)
 
     # Cleanup certbot configuration and certificates if no longer in use by CLI
@@ -482,7 +551,7 @@ def generate(pki):
             if not ca_cert_present:
                 tmp = dict_search_args(pki, 'ca', f'{autochain_prefix}{cert}', 'certificate')
                 if not bool(tmp) or tmp != cert_chain_base64:
-                    print(f'Adding/replacing automatically imported CA certificate for "{cert}" ...')
+                    Message(f'Add/replace automatically imported CA certificate for "{cert}" ...')
                     add_cli_node(['pki', 'ca', f'{autochain_prefix}{cert}', 'certificate'], value=cert_chain_base64)
 
     return None
diff --git a/src/conf_mode/policy.py b/src/conf_mode/policy.py
index a90e33e81..84962c807 100755
--- a/src/conf_mode/policy.py
+++ b/src/conf_mode/policy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -14,6 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import re
 from sys import exit
 
 from vyos.config import Config
@@ -24,9 +25,20 @@ from vyos.frrender import get_frrender_dict
 from vyos.utils.dict import dict_search
 from vyos.utils.process import is_systemd_service_running
 from vyos import ConfigError
+from vyos.base import Warning
 from vyos import airbag
 airbag.enable()
 
+# Sanity checks for large-community-list regex:
+# * Require complete 3-tuples, no blank members. Catch missed & doubled colons. 
+# * Permit appropriate community separators (whitespace, underscore)
+# * Permit common regex between tuples while requiring at least one separator
+#   (eg, "1:1:1_.*_4:4:4", matching "1:1:1 4:4:4" and "1:1:1 2:2:2 4:4:4",
+#        but not "1:1:13 24:4:4")
+# Best practice: stick with basic patterns, mind your wildcards and whitespace.
+# Regex that doesn't match this pattern will be allowed with a warning. 
+large_community_regex_pattern = r'([^: _]+):([^: _]+):([^: _]+)([ _]([^:]+):([^: _]+):([^: _]+))*'
+
 def community_action_compatibility(actions: dict) -> bool:
     """
     Check compatibility of values in community and large community sections
@@ -147,6 +159,10 @@ def verify(config_dict):
                     if 'regex' not in rule_config:
                         raise ConfigError(f'A regex {mandatory_error}')
 
+                if policy_type == 'large_community_list':
+                    if not re.fullmatch(large_community_regex_pattern, rule_config['regex']):
+                        Warning(f'"policy large-community-list {instance} rule {rule} regex" does not follow expected form and may not match as expected.')
+
                 if policy_type in ['prefix_list', 'prefix_list6']:
                     if 'prefix' not in rule_config:
                         raise ConfigError(f'A prefix {mandatory_error}')
diff --git a/src/conf_mode/policy_local-route.py b/src/conf_mode/policy_local-route.py
index 9be2bc227..77b39e59f 100755
--- a/src/conf_mode/policy_local-route.py
+++ b/src/conf_mode/policy_local-route.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/policy_route.py b/src/conf_mode/policy_route.py
index 223175b8a..15d735f75 100755
--- a/src/conf_mode/policy_route.py
+++ b/src/conf_mode/policy_route.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -21,13 +21,16 @@ from sys import exit
 
 from vyos.base import Warning
 from vyos.config import Config
+from vyos.configdiff import get_config_diff, Diff
 from vyos.template import render
 from vyos.utils.dict import dict_search_args
+from vyos.utils.dict import dict_search_recursive
 from vyos.utils.process import cmd
 from vyos.utils.process import run
 from vyos.utils.network import get_vrf_tableid
 from vyos.defaults import rt_global_table
 from vyos.defaults import rt_global_vrf
+from vyos.firewall import geoip_update
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
@@ -43,6 +46,43 @@ valid_groups = [
     'interface_group'
 ]
 
+def geoip_updated(conf, policy):
+    diff = get_config_diff(conf)
+    node_diff = diff.get_child_nodes_diff(['policy'], expand_nodes=Diff.DELETE, recursive=True)
+
+    out = {
+        'name': [],
+        'ipv6_name': [],
+        'deleted_name': [],
+        'deleted_ipv6_name': []
+    }
+    updated = False
+
+    for key, path in dict_search_recursive(policy, 'geoip'):
+        set_name = f'GEOIP_CC_{path[0]}_{path[1]}_{path[3]}'
+        if (path[0] == 'route'):
+            out['name'].append(set_name)
+        elif (path[0] == 'route6'):
+            set_name = f'GEOIP_CC6_{path[0]}_{path[1]}_{path[3]}'
+            out['ipv6_name'].append(set_name)
+
+        updated = True
+
+    if 'delete' in node_diff:
+        for key, path in dict_search_recursive(node_diff['delete'], 'geoip'):
+            set_name = f'GEOIP_CC_{path[0]}_{path[1]}_{path[3]}'
+            if (path[0] == 'route'):
+                out['deleted_name'].append(set_name)
+            elif (path[0] == 'route6'):
+                set_name = f'GEOIP_CC6_{path[0]}_{path[1]}_{path[3]}'
+                out['deleted_ipv6_name'].append(set_name)
+            updated = True
+
+    if updated:
+        return out
+
+    return False
+
 def get_config(config=None):
     if config:
         conf = config
@@ -60,6 +100,7 @@ def get_config(config=None):
     if 'dynamic_group' in policy['firewall_group']:
         del policy['firewall_group']['dynamic_group']
 
+    policy['geoip_updated'] = geoip_updated(conf, policy)
     return policy
 
 def verify_rule(policy, name, rule_conf, ipv6, rule_id):
@@ -203,6 +244,12 @@ def apply(policy):
 
     apply_table_marks(policy)
 
+    if policy['geoip_updated']:
+        # Call helper script to Update set contents
+        if 'name' in policy['geoip_updated'] or 'ipv6_name' in policy['geoip_updated']:
+            print('Updating GeoIP. Please wait...')
+            geoip_update(policy=policy)
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/protocols_babel.py b/src/conf_mode/protocols_babel.py
index 80a847af8..a683031bd 100755
--- a/src/conf_mode/protocols_babel.py
+++ b/src/conf_mode/protocols_babel.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_bfd.py b/src/conf_mode/protocols_bfd.py
index d3bc3e961..953611f24 100755
--- a/src/conf_mode/protocols_bfd.py
+++ b/src/conf_mode/protocols_bfd.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_bgp.py b/src/conf_mode/protocols_bgp.py
index c4af717af..fe5740a18 100755
--- a/src/conf_mode/protocols_bgp.py
+++ b/src/conf_mode/protocols_bgp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -316,6 +316,7 @@ def verify(config_dict):
                     Warning(f'BGP neighbor "{peer}" requires address-family!')
 
                 # Peer-group member cannot override remote-as of peer-group
+                peer_group = None
                 if 'peer_group' in peer_config:
                     peer_group = peer_config['peer_group']
                     if 'remote_as' in peer_config and 'remote_as' in bgp['peer_group'][peer_group]:
@@ -330,6 +331,27 @@ def verify(config_dict):
                             peer_group = peer_config['interface']['v6only']['peer_group']
                             if 'remote_as' in peer_config['interface']['v6only'] and 'remote_as' in bgp['peer_group'][peer_group]:
                                 raise ConfigError(f'Peer-group member "{peer}" cannot override remote-as of peer-group "{peer_group}"!')
+                            
+                for afi in ['ipv4_unicast', 'ipv4_multicast', 'ipv4_labeled_unicast', 'ipv4_flowspec',
+                            'ipv6_unicast', 'ipv6_multicast', 'ipv6_labeled_unicast', 'ipv6_flowspec',
+                            'l2vpn_evpn']:
+                    if dict_search(
+                        f'address_family.{afi}.route_reflector_client',
+                        peer_config,
+                    ) == {} or (
+                        peer_group
+                        and dict_search(
+                            f'peer_group.{peer_group}.address_family.{afi}.route_reflector_client',
+                            bgp,
+                        )
+                        == {}
+                    ):
+                        peer_as = verify_remote_as(peer_config, bgp)
+                        if peer_as != 'internal' and peer_as != bgp['system_as']:
+                            raise ConfigError('route-reflector-client only supported for iBGP peers')
+                    else:
+                        # It doesn’t make sense to check the remote-as of a peer group.
+                        pass
 
                 # Only checks for ipv4 and ipv6 neighbors
                 # Check if neighbor address is assigned as system interface address
@@ -412,16 +434,7 @@ def verify(config_dict):
                         if tmp in afi_config['route_map']:
                             verify_route_map(afi_config['route_map'][tmp], bgp)
 
-                if 'route_reflector_client' in afi_config:
-                    peer_group_as = peer_config.get('remote_as')
-
-                    if peer_group_as is None or (peer_group_as != 'internal' and peer_group_as != bgp['system_as']):
-                        raise ConfigError('route-reflector-client only supported for iBGP peers')
-                    else:
-                        if 'peer_group' in peer_config:
-                            peer_group_as = dict_search(f'peer_group.{peer_group}.remote_as', bgp)
-                            if peer_group_as is None or (peer_group_as != 'internal' and peer_group_as != bgp['system_as']):
-                                raise ConfigError('route-reflector-client only supported for iBGP peers')
+                # route-reflector-client verification has been moved to neighbor-only part
 
             # T5833 not all AFIs are supported for VRF
             if 'vrf' in bgp and 'address_family' in peer_config:
@@ -523,12 +536,24 @@ def verify(config_dict):
                         raise ConfigError(
                             'Please unconfigure import vrf commands before using vpn commands in dependent VRFs!')
 
+                # Verify if the route-map exists
+                if dict_search('route_map.vrf.import', afi_config) is not None:
+                    verify_route_map(afi_config['route_map']['vrf']['import'], bgp)
+
+                if (dict_search('route_map.vrf.import', afi_config) is not None
+                        or  dict_search('import.vrf', afi_config) is not None):
                     # FRR error: please unconfigure vpn to vrf commands before
                     # using import vrf commands
-                    if 'vpn' in afi_config['import'] or dict_search('export.vpn', afi_config) != None:
+                    if (dict_search('import.vpn', afi_config) is not None
+                            or dict_search('export.vpn', afi_config) is not None):
                         raise ConfigError('Please unconfigure VPN to VRF commands before '\
                                           'using "import vrf" commands!')
 
+                    if (dict_search('route_map.vpn.import', afi_config) is not None
+                            or dict_search('route_map.vpn.export', afi_config) is not None) :
+                        raise ConfigError('Please unconfigure route-map VPN to VRF commands before '\
+                                          'using "import vrf" commands!')
+
                 # Verify that the export/import route-maps do exist
                 for export_import in ['export', 'import']:
                     tmp = dict_search(f'route_map.vpn.{export_import}', afi_config)
diff --git a/src/conf_mode/protocols_eigrp.py b/src/conf_mode/protocols_eigrp.py
index 324ff883f..e127a3a07 100755
--- a/src/conf_mode/protocols_eigrp.py
+++ b/src/conf_mode/protocols_eigrp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_failover.py b/src/conf_mode/protocols_failover.py
index e7e44db84..9b50cc1ed 100755
--- a/src/conf_mode/protocols_failover.py
+++ b/src/conf_mode/protocols_failover.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_igmp-proxy.py b/src/conf_mode/protocols_igmp-proxy.py
index 9a07adf05..c2d2fea5b 100755
--- a/src/conf_mode/protocols_igmp-proxy.py
+++ b/src/conf_mode/protocols_igmp-proxy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_isis.py b/src/conf_mode/protocols_isis.py
index 1c994492e..8b1408f57 100755
--- a/src/conf_mode/protocols_isis.py
+++ b/src/conf_mode/protocols_isis.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_mpls.py b/src/conf_mode/protocols_mpls.py
index 33d9a6dae..d534ad2e3 100755
--- a/src/conf_mode/protocols_mpls.py
+++ b/src/conf_mode/protocols_mpls.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_nhrp.py b/src/conf_mode/protocols_nhrp.py
index ac92c9d99..be08080b1 100755
--- a/src/conf_mode/protocols_nhrp.py
+++ b/src/conf_mode/protocols_nhrp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2025 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_openfabric.py b/src/conf_mode/protocols_openfabric.py
index 7df11fb20..f490d28bf 100644
--- a/src/conf_mode/protocols_openfabric.py
+++ b/src/conf_mode/protocols_openfabric.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_ospf.py b/src/conf_mode/protocols_ospf.py
index c06c0aafc..9421765a1 100755
--- a/src/conf_mode/protocols_ospf.py
+++ b/src/conf_mode/protocols_ospf.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,6 +17,7 @@
 from sys import exit
 from sys import argv
 
+from vyos.base import Warning
 from vyos.config import Config
 from vyos.configverify import verify_common_route_maps
 from vyos.configverify import verify_route_map
@@ -62,6 +63,16 @@ def verify(config_dict):
     if 'area' in ospf:
           networks = []
           for area, area_config in ospf['area'].items():
+              # Implemented as warning to not break existing configurations
+              if area == '0' and dict_search('area_type.nssa', area_config) != None:
+                  Warning('You cannot configure NSSA to backbone!')
+              # Implemented as warning to not break existing configurations
+              if area == '0' and dict_search('area_type.stub', area_config) != None:
+                  Warning('You cannot configure STUB to backbone!')
+              # Implemented as warning to not break existing configurations
+              if len(area_config['area_type']) > 1:
+                  Warning(f'Only one area-type is supported for area "{area}"!')
+
               if 'import_list' in area_config:
                   acl_import = area_config['import_list']
                   if acl_import: verify_access_list(acl_import, ospf)
diff --git a/src/conf_mode/protocols_ospfv3.py b/src/conf_mode/protocols_ospfv3.py
index 2563eb7d5..1d2eceb8f 100755
--- a/src/conf_mode/protocols_ospfv3.py
+++ b/src/conf_mode/protocols_ospfv3.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_pim.py b/src/conf_mode/protocols_pim.py
index 632099964..bb55aada0 100755
--- a/src/conf_mode/protocols_pim.py
+++ b/src/conf_mode/protocols_pim.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_pim6.py b/src/conf_mode/protocols_pim6.py
index 03a79139a..f7803246a 100755
--- a/src/conf_mode/protocols_pim6.py
+++ b/src/conf_mode/protocols_pim6.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_rip.py b/src/conf_mode/protocols_rip.py
index ec9dfbb8b..c6adcde5b 100755
--- a/src/conf_mode/protocols_rip.py
+++ b/src/conf_mode/protocols_rip.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_ripng.py b/src/conf_mode/protocols_ripng.py
index 9a9ac8ec8..e5babf2e8 100755
--- a/src/conf_mode/protocols_ripng.py
+++ b/src/conf_mode/protocols_ripng.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_rpki.py b/src/conf_mode/protocols_rpki.py
index ef0250e3d..5ba23c141 100755
--- a/src/conf_mode/protocols_rpki.py
+++ b/src/conf_mode/protocols_rpki.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -18,6 +18,7 @@ import os
 
 from glob import glob
 from sys import exit
+from sys import argv
 
 from vyos.config import Config
 from vyos.configverify import has_frr_protocol_in_dict
@@ -39,13 +40,18 @@ def get_config(config=None):
         conf = config
     else:
         conf = Config()
-    return get_frrender_dict(conf)
+    return get_frrender_dict(conf, argv)
 
 def verify(config_dict):
     if not has_frr_protocol_in_dict(config_dict, 'rpki'):
         return None
 
-    rpki = config_dict['rpki']
+    vrf = None
+    if 'vrf_context' in config_dict:
+        vrf = config_dict['vrf_context']
+
+    # eqivalent of the C foo ? 'a' : 'b' statement
+    rpki = vrf and config_dict['vrf']['name'][vrf]['protocols']['rpki'] or config_dict['rpki']
 
     if 'cache' in rpki:
         preferences = []
@@ -79,7 +85,12 @@ def generate(config_dict):
     if not has_frr_protocol_in_dict(config_dict, 'rpki'):
         return None
 
-    rpki = config_dict['rpki']
+    vrf = None
+    if 'vrf_context' in config_dict:
+        vrf = config_dict['vrf_context']
+
+    # eqivalent of the C foo ? 'a' : 'b' statement
+    rpki = vrf and config_dict['vrf']['name'][vrf]['protocols']['rpki'] or config_dict['rpki']
 
     if 'cache' in rpki:
         for cache, cache_config in rpki['cache'].items():
diff --git a/src/conf_mode/protocols_segment-routing.py b/src/conf_mode/protocols_segment-routing.py
index f2bd42a79..4020a0917 100755
--- a/src/conf_mode/protocols_segment-routing.py
+++ b/src/conf_mode/protocols_segment-routing.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_static.py b/src/conf_mode/protocols_static.py
index 1b9e51167..7c730ca81 100755
--- a/src/conf_mode/protocols_static.py
+++ b/src/conf_mode/protocols_static.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_static_arp.py b/src/conf_mode/protocols_static_arp.py
index b141f1141..87dc5229e 100755
--- a/src/conf_mode/protocols_static_arp.py
+++ b/src/conf_mode/protocols_static_arp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/protocols_static_neighbor-proxy.py b/src/conf_mode/protocols_static_neighbor-proxy.py
index 8a1ea1df9..bda737e75 100755
--- a/src/conf_mode/protocols_static_neighbor-proxy.py
+++ b/src/conf_mode/protocols_static_neighbor-proxy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/qos.py b/src/conf_mode/qos.py
index 59e307a39..4ea900bb8 100755
--- a/src/conf_mode/qos.py
+++ b/src/conf_mode/qos.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -15,7 +15,8 @@
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 
 from sys import exit
-from netifaces import interfaces
+
+from netifaces import interfaces # pylint: disable = no-name-in-module
 
 from vyos.base import Warning
 from vyos.config import Config
@@ -85,7 +86,13 @@ def _clean_conf_dict(conf):
         }
     """
     if isinstance(conf, dict):
-        return {node: _clean_conf_dict(val) for node, val in conf.items() if val != {} and _clean_conf_dict(val) != {}}
+        preserve_empty_nodes = {'syn', 'ack'}
+
+        return {
+            node: _clean_conf_dict(val)
+            for node, val in conf.items()
+            if (val != {} and _clean_conf_dict(val) != {}) or node in preserve_empty_nodes
+        }
     else:
         return conf
 
diff --git a/src/conf_mode/service_aws_glb.py b/src/conf_mode/service_aws_glb.py
index d1ed5a07b..aa5ec5ebe 100755
--- a/src/conf_mode/service_aws_glb.py
+++ b/src/conf_mode/service_aws_glb.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_broadcast-relay.py b/src/conf_mode/service_broadcast-relay.py
index d35954718..b3f38dd21 100755
--- a/src/conf_mode/service_broadcast-relay.py
+++ b/src/conf_mode/service_broadcast-relay.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2017-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,7 +17,7 @@
 import os
 
 from glob import glob
-from netifaces import AF_INET
+from socket import AF_INET
 from sys import exit
 
 from vyos.config import Config
diff --git a/src/conf_mode/service_config-sync.py b/src/conf_mode/service_config-sync.py
index 4b8a7f6ee..32001ce57 100755
--- a/src/conf_mode/service_config-sync.py
+++ b/src/conf_mode/service_config-sync.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_conntrack-sync.py b/src/conf_mode/service_conntrack-sync.py
index 3a233a172..5eb4ca0e5 100755
--- a/src/conf_mode/service_conntrack-sync.py
+++ b/src/conf_mode/service_conntrack-sync.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_console-server.py b/src/conf_mode/service_console-server.py
index b112add3f..82386babf 100755
--- a/src/conf_mode/service_console-server.py
+++ b/src/conf_mode/service_console-server.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -98,6 +98,12 @@ def generate(proxy):
     return None
 
 def apply(proxy):
+    if not os.path.exists('/etc/dropbear/dropbear_rsa_host_key'):
+        call('dropbearkey -t rsa -s 4096 -f /etc/dropbear/dropbear_rsa_host_key')
+
+    if not os.path.exists('/etc/dropbear/dropbear_ecdsa_host_key'):
+        call('dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key')
+
     call('systemctl daemon-reload')
     call('systemctl stop dropbear@*.service conserver-server.service')
 
diff --git a/src/conf_mode/service_dhcp-relay.py b/src/conf_mode/service_dhcp-relay.py
index 37d708847..ebdf5e8ee 100755
--- a/src/conf_mode/service_dhcp-relay.py
+++ b/src/conf_mode/service_dhcp-relay.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_dhcp-server.py b/src/conf_mode/service_dhcp-server.py
index 5a729af74..a273dff50 100755
--- a/src/conf_mode/service_dhcp-server.py
+++ b/src/conf_mode/service_dhcp-server.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2025 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -16,11 +16,13 @@
 
 import os
 
+from sys import exit
+from sys import argv
+
 from glob import glob
 from ipaddress import ip_address
 from ipaddress import ip_network
 from netaddr import IPRange
-from sys import exit
 
 from vyos.config import Config
 from vyos.pki import wrap_certificate
@@ -29,9 +31,9 @@ from vyos.template import render
 from vyos.utils.dict import dict_search
 from vyos.utils.dict import dict_search_args
 from vyos.utils.file import chmod_775
-from vyos.utils.file import chown
 from vyos.utils.file import makedir
 from vyos.utils.file import write_file
+from vyos.utils.permission import chown
 from vyos.utils.process import call
 from vyos.utils.network import interface_exists
 from vyos.utils.network import is_subnet_connected
@@ -41,16 +43,53 @@ from vyos import airbag
 
 airbag.enable()
 
-ctrl_config_file = '/run/kea/kea-ctrl-agent.conf'
-ctrl_socket = '/run/kea/dhcp4-ctrl-socket'
-config_file = '/run/kea/kea-dhcp4.conf'
-lease_file = '/config/dhcp/dhcp4-leases.csv'
-lease_file_glob = '/config/dhcp/dhcp4-leases*'
+ctrl_socket = ''
+config_file = ''
+config_file_d2 = ''
+lease_file = ''
+lease_file_glob = ''
+
+ca_cert_file = ''
+cert_file = ''
+cert_key_file = ''
+
 user_group = '_kea'
 
-ca_cert_file = '/run/kea/kea-failover-ca.pem'
-cert_file = '/run/kea/kea-failover.pem'
-cert_key_file = '/run/kea/kea-failover-key.pem'
+
+def _override_for_vrf(vrf_name):
+    """
+    This function is intended to override global vars when vrf is enabled
+    """
+    global ctrl_socket, config_file, config_file_d2, lease_file, lease_file_glob
+    global ca_cert_file, cert_file, cert_key_file
+
+    ctrl_socket = f'/run/kea/dhcp4-{vrf_name}-ctrl-socket'
+    config_file = f'/run/kea/kea-{vrf_name}-dhcp4.conf'
+    config_file_d2 = f'/run/kea/kea-{vrf_name}-dhcp-ddns.conf'
+    lease_file = f'/config/dhcp/dhcp4-{vrf_name}-leases.csv'
+    lease_file_glob = f'/config/dhcp/dhcp4-{vrf_name}-leases*'
+
+    ca_cert_file = f'/run/kea/kea-{vrf_name}-failover-ca.pem'
+    cert_file = f'/run/kea/kea-{vrf_name}-failover.pem'
+    cert_key_file = f'/run/kea/kea-{vrf_name}-failover-key.pem'
+
+
+def _reset_vars():
+    """
+    This function is intended to reset global vars when vrf is not enabled
+    """
+    global ctrl_socket, config_file, config_file_d2, lease_file, lease_file_glob
+    global ca_cert_file, cert_file, cert_key_file
+
+    ctrl_socket = '/run/kea/dhcp4-ctrl-socket'
+    config_file = '/run/kea/kea-dhcp4.conf'
+    config_file_d2 = '/run/kea/kea-dhcp-ddns.conf'
+    lease_file = '/config/dhcp/dhcp4-leases.csv'
+    lease_file_glob = '/config/dhcp/dhcp4-leases*'
+
+    ca_cert_file = '/run/kea/kea-failover-ca.pem'
+    cert_file = '/run/kea/kea-failover.pem'
+    cert_key_file = '/run/kea/kea-failover-key.pem'
 
 
 def dhcp_slice_range(exclude_list, range_dict):
@@ -125,7 +164,19 @@ def get_config(config=None):
         conf = config
     else:
         conf = Config()
-    base = ['service', 'dhcp-server']
+
+    # if running in vrf, set base diffrently
+    if argv and len(argv) > 1:
+        vrf_name = argv[1]
+        base = ['vrf', 'name', vrf_name, 'service', 'dhcp-server']
+
+        # vrf is defined, override other vars aswell
+        _override_for_vrf(vrf_name)
+    else:
+        base = ['service', 'dhcp-server']
+
+        # vrf is not defined reset vars
+        _reset_vars()
     if not conf.exists(base):
         return None
 
@@ -137,6 +188,10 @@ def get_config(config=None):
         with_recursive_defaults=True,
     )
 
+    # add vrf context if present
+    if argv and len(argv) > 1:
+        dhcp['vrf_context'] = argv[1]
+
     if 'shared_network_name' in dhcp:
         for network, network_config in dhcp['shared_network_name'].items():
             if 'subnet' in network_config:
@@ -171,6 +226,15 @@ def get_config(config=None):
 
     return dhcp
 
+def verify_ddns_domain_servers(domain_type, domain):
+    if 'dns_server' in domain:
+        invalid_servers = []
+        for server_no, server_config in domain['dns_server'].items():
+            if 'address' not in server_config:
+                invalid_servers.append(server_no)
+        if len(invalid_servers) > 0:
+            raise ConfigError(f'{domain_type} DNS servers {", ".join(invalid_servers)} in DDNS configuration need to have an IP address')
+    return None
 
 def verify(dhcp):
     # bail out early - looks like removal from running config
@@ -423,6 +487,22 @@ def verify(dhcp):
         if not interface_exists(interface):
             raise ConfigError(f'listen-interface "{interface}" does not exist')
 
+    if 'dynamic_dns_update' in dhcp:
+        ddns = dhcp['dynamic_dns_update']
+        if 'tsig_key' in ddns:
+            invalid_keys = []
+            for tsig_key_name, tsig_key_config in ddns['tsig_key'].items():
+                if not ('algorithm' in tsig_key_config and 'secret' in tsig_key_config):
+                    invalid_keys.append(tsig_key_name)
+            if len(invalid_keys) > 0:
+                raise ConfigError(f'Both algorithm and secret need to be set for TSIG keys: {", ".join(invalid_keys)}')
+
+        if 'forward_domain' in ddns:
+            verify_ddns_domain_servers('Forward', ddns['forward_domain'])
+
+        if 'reverse_domain' in ddns:
+            verify_ddns_domain_servers('Reverse', ddns['reverse_domain'])
+
     return None
 
 
@@ -480,25 +560,31 @@ def generate(dhcp):
             dhcp['high_availability']['ca_cert_file'] = ca_cert_file
 
     render(
-        ctrl_config_file,
-        'dhcp-server/kea-ctrl-agent.conf.j2',
-        dhcp,
-        user=user_group,
-        group=user_group,
-    )
-    render(
         config_file,
         'dhcp-server/kea-dhcp4.conf.j2',
         dhcp,
         user=user_group,
         group=user_group,
     )
+    if 'dynamic_dns_update' in dhcp:
+        render(
+            config_file_d2,
+            'dhcp-server/kea-dhcp-ddns.conf.j2',
+            dhcp,
+            user=user_group,
+            group=user_group
+        )
 
     return None
 
 
 def apply(dhcp):
-    services = ['kea-ctrl-agent', 'kea-dhcp4-server', 'kea-dhcp-ddns-server']
+    # if running in vrf, set base diffrently
+    if argv and len(argv) > 1:
+        vrf_name = argv[1]
+        services = [f'kea-dhcp4-server@{vrf_name}', f'kea-dhcp-ddns-server@{vrf_name}']
+    else:
+        services = ['kea-dhcp4-server', 'kea-dhcp-ddns-server']
 
     if not dhcp or 'disable' in dhcp:
         for service in services:
@@ -512,10 +598,7 @@ def apply(dhcp):
     for service in services:
         action = 'restart'
 
-        if service == 'kea-dhcp-ddns-server' and 'dynamic_dns_update' not in dhcp:
-            action = 'stop'
-
-        if service == 'kea-ctrl-agent' and 'high_availability' not in dhcp:
+        if 'kea-dhcp-ddns-server' in service and 'dynamic_dns_update' not in dhcp:
             action = 'stop'
 
         call(f'systemctl {action} {service}.service')
diff --git a/src/conf_mode/service_dhcpv6-relay.py b/src/conf_mode/service_dhcpv6-relay.py
index 6537ca3c2..4547b608c 100755
--- a/src/conf_mode/service_dhcpv6-relay.py
+++ b/src/conf_mode/service_dhcpv6-relay.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_dhcpv6-server.py b/src/conf_mode/service_dhcpv6-server.py
index 7af88007c..a5febd303 100755
--- a/src/conf_mode/service_dhcpv6-server.py
+++ b/src/conf_mode/service_dhcpv6-server.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -16,42 +16,89 @@
 
 import os
 
+from sys import exit
+from sys import argv
+
 from glob import glob
 from ipaddress import ip_address
 from ipaddress import ip_network
-from sys import exit
 
 from vyos.config import Config
 from vyos.template import render
 from vyos.utils.process import call
 from vyos.utils.file import chmod_775
-from vyos.utils.file import chown
 from vyos.utils.file import makedir
 from vyos.utils.file import write_file
 from vyos.utils.dict import dict_search
 from vyos.utils.network import is_subnet_connected
+from vyos.utils.permission import chown
 from vyos import ConfigError
 from vyos import airbag
+
 airbag.enable()
 
-config_file = '/run/kea/kea-dhcp6.conf'
-ctrl_socket = '/run/kea/dhcp6-ctrl-socket'
-lease_file = '/config/dhcp/dhcp6-leases.csv'
-lease_file_glob = '/config/dhcp/dhcp6-leases*'
+
+config_file = ''
+ctrl_socket = ''
+lease_file = ''
+lease_file_glob = ''
+
 user_group = '_kea'
 
+
+def _override_for_vrf(vrf_name):
+    """
+    This function is intended to override some of the global vars
+    """
+    global ctrl_socket, config_file, lease_file, lease_file_glob
+
+    config_file = f'/run/kea/kea-{vrf_name}-dhcp6.conf'
+    ctrl_socket = f'/run/kea/dhcp6-{vrf_name}-ctrl-socket'
+    lease_file = f'/config/dhcp/dhcp6-{vrf_name}-leases.csv'
+    lease_file_glob = f'/config/dhcp/dhcp6-{vrf_name}-leases*'
+
+
+def _reset_vars():
+    """
+    This function is intended to reset global vars when vrf is not enabled
+    """
+    global ctrl_socket, config_file, lease_file, lease_file_glob
+
+    config_file = '/run/kea/kea-dhcp6.conf'
+    ctrl_socket = '/run/kea/dhcp6-ctrl-socket'
+    lease_file = '/config/dhcp/dhcp6-leases.csv'
+    lease_file_glob = '/config/dhcp/dhcp6-leases*'
+
+
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
-    base = ['service', 'dhcpv6-server']
+
+    # if running in vrf, set base diffrently
+    if argv and len(argv) > 1:
+        vrf_name = argv[1]
+        base = ['vrf', 'name', vrf_name, 'service', 'dhcpv6-server']
+
+        # vrf is defined, override other vars aswell
+        _override_for_vrf(vrf_name)
+    else:
+        base = ['service', 'dhcpv6-server']
+
+        # vrf is not defined reset vars
+        _reset_vars()
     if not conf.exists(base):
         return None
 
-    dhcpv6 = conf.get_config_dict(base, key_mangling=('-', '_'),
-                                  get_first_key=True,
-                                  no_tag_node_value_mangle=True)
+    dhcpv6 = conf.get_config_dict(
+        base, key_mangling=('-', '_'), get_first_key=True, no_tag_node_value_mangle=True
+    )
+
+    # add vrf context if present
+    if argv and len(argv) > 1:
+        dhcpv6['vrf_context'] = argv[1]
+
     return dhcpv6
 
 def verify(dhcpv6):
@@ -239,8 +286,14 @@ def generate(dhcpv6):
     return None
 
 def apply(dhcpv6):
+    # if running in vrf, set base diffrently
+    if argv and len(argv) > 1:
+        vrf_name = argv[1]
+        service_name = f'kea-dhcp6-server@{vrf_name}.service'
+    else:
+        service_name = 'kea-dhcp6-server.service'
+
     # bail out early - looks like removal from running config
-    service_name = 'kea-dhcp6-server.service'
     if not dhcpv6 or 'disable' in dhcpv6:
         # DHCP server is removed in the commit
         call(f'systemctl stop {service_name}')
diff --git a/src/conf_mode/service_dns_dynamic.py b/src/conf_mode/service_dns_dynamic.py
index 5f5303856..b321d5f51 100755
--- a/src/conf_mode/service_dns_dynamic.py
+++ b/src/conf_mode/service_dns_dynamic.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_dns_forwarding.py b/src/conf_mode/service_dns_forwarding.py
index e3bdbc9f8..cd0c6a38a 100755
--- a/src/conf_mode/service_dns_forwarding.py
+++ b/src/conf_mode/service_dns_forwarding.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -366,6 +366,13 @@ def apply(dns):
                     hc.add_name_server_tags_recursor(['dhcp-' + interface,
                                                       'dhcpv6-' + interface ])
 
+        # add dhcp interfaces
+        if 'dhcp' in dns:
+            for interface in dns['dhcp']:
+                if interface_exists(interface):
+                    hc.add_name_server_tags_recursor(['dhcp-' + interface,
+                                                      'dhcpv6-' + interface ])
+
         # hostsd will generate the forward-zones file
         # the list and keys() are required as get returns a dict, not list
         hc.delete_forward_zones(list(hc.get_forward_zones().keys()))
diff --git a/src/conf_mode/service_event-handler.py b/src/conf_mode/service_event-handler.py
index 5028ef52f..1b9e7ff53 100755
--- a/src/conf_mode/service_event-handler.py
+++ b/src/conf_mode/service_event-handler.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_https.py b/src/conf_mode/service_https.py
index 9e58b4c72..38bb485e7 100755
--- a/src/conf_mode/service_https.py
+++ b/src/conf_mode/service_https.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -28,6 +28,7 @@ from vyos.configverify import verify_vrf
 from vyos.configverify import verify_pki_certificate
 from vyos.configverify import verify_pki_ca_certificate
 from vyos.configverify import verify_pki_dh_parameters
+from vyos.configdiff import get_config_diff
 from vyos.defaults import api_config_state
 from vyos.pki import wrap_certificate
 from vyos.pki import wrap_private_key
@@ -79,6 +80,14 @@ def get_config(config=None):
 
     # merge CLI and default dictionary
     https = config_dict_merge(default_values, https)
+
+    # some settings affecting nginx will require a restart:
+    # for example, a reload will not suffice when binding the listen address
+    # after nginx has started and dropped privileges; add flag here
+    diff = get_config_diff(conf)
+    children_changed = diff.node_changed_children(base)
+    https['nginx_restart_required'] = bool(set(children_changed) != set(['api']))
+
     return https
 
 def verify(https):
@@ -208,7 +217,10 @@ def apply(https):
     elif is_systemd_service_active(http_api_service_name):
         call(f'systemctl stop {http_api_service_name}')
 
-    call(f'systemctl reload-or-restart {https_service_name}')
+    if https['nginx_restart_required']:
+        call(f'systemctl restart {https_service_name}')
+    else:
+        call(f'systemctl reload-or-restart {https_service_name}')
 
 if __name__ == '__main__':
     try:
diff --git a/src/conf_mode/service_ids_ddos-protection.py b/src/conf_mode/service_ids_ddos-protection.py
deleted file mode 100755
index 276a71fcb..000000000
--- a/src/conf_mode/service_ids_ddos-protection.py
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import os
-
-from sys import exit
-
-from vyos.config import Config
-from vyos.template import render
-from vyos.utils.process import call
-from vyos import ConfigError
-from vyos import airbag
-airbag.enable()
-
-config_file = r'/run/fastnetmon/fastnetmon.conf'
-networks_list = r'/run/fastnetmon/networks_list'
-excluded_networks_list = r'/run/fastnetmon/excluded_networks_list'
-attack_dir = '/var/log/fastnetmon_attacks'
-
-def get_config(config=None):
-    if config:
-        conf = config
-    else:
-        conf = Config()
-    base = ['service', 'ids', 'ddos-protection']
-    if not conf.exists(base):
-        return None
-
-    fastnetmon = conf.get_config_dict(base, key_mangling=('-', '_'),
-                                      get_first_key=True,
-                                      with_recursive_defaults=True)
-
-    return fastnetmon
-
-def verify(fastnetmon):
-    if not fastnetmon:
-        return None
-
-    if 'mode' not in fastnetmon:
-        raise ConfigError('Specify operating mode!')
-
-    if fastnetmon.get('mode') == 'mirror' and 'listen_interface' not in fastnetmon:
-        raise ConfigError("Incorrect settings for 'mode mirror': must specify interface(s) for traffic mirroring")
-
-    if fastnetmon.get('mode') == 'sflow' and 'listen_address' not in fastnetmon.get('sflow', {}):
-        raise ConfigError("Incorrect settings for 'mode sflow': must specify sFlow 'listen-address'")
-
-    if 'alert_script' in fastnetmon:
-        if os.path.isfile(fastnetmon['alert_script']):
-            # Check script permissions
-            if not os.access(fastnetmon['alert_script'], os.X_OK):
-                raise ConfigError('Script "{alert_script}" is not executable!'.format(fastnetmon['alert_script']))
-        else:
-           raise ConfigError('File "{alert_script}" does not exists!'.format(fastnetmon))
-
-def generate(fastnetmon):
-    if not fastnetmon:
-        for file in [config_file, networks_list]:
-            if os.path.isfile(file):
-                os.unlink(file)
-
-        return None
-
-    # Create dir for log attack details
-    if not os.path.exists(attack_dir):
-        os.mkdir(attack_dir)
-
-    render(config_file, 'ids/fastnetmon.j2', fastnetmon)
-    render(networks_list, 'ids/fastnetmon_networks_list.j2', fastnetmon)
-    render(excluded_networks_list, 'ids/fastnetmon_excluded_networks_list.j2', fastnetmon)
-    return None
-
-def apply(fastnetmon):
-    systemd_service = 'fastnetmon.service'
-    if not fastnetmon:
-        # Stop fastnetmon service if removed
-        call(f'systemctl stop {systemd_service}')
-    else:
-        call(f'systemctl reload-or-restart {systemd_service}')
-
-    return None
-
-if __name__ == '__main__':
-    try:
-        c = get_config()
-        verify(c)
-        generate(c)
-        apply(c)
-    except ConfigError as e:
-        print(e)
-        exit(1)
diff --git a/src/conf_mode/service_ipoe-server.py b/src/conf_mode/service_ipoe-server.py
index a14d4b5b6..50628947e 100755
--- a/src/conf_mode/service_ipoe-server.py
+++ b/src/conf_mode/service_ipoe-server.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -88,6 +88,12 @@ def verify(ipoe):
                     'Can configure username with Lua script only for RADIUS authentication'
                 )
 
+        if dict_search('external_dhcp.dhcp_relay', iface_config):
+            if not dict_search('external_dhcp.giaddr', iface_config):
+                raise ConfigError(
+                    f'"external-dhcp dhcp-relay" requires "giaddr" to be set for interface {interface}'
+                )
+
     verify_accel_ppp_authentication(ipoe, local_users=False)
     verify_accel_ppp_ip_pool(ipoe)
     verify_accel_ppp_name_servers(ipoe)
diff --git a/src/conf_mode/service_lldp.py b/src/conf_mode/service_lldp.py
index 04b1db880..50e9a49e6 100755
--- a/src/conf_mode/service_lldp.py
+++ b/src/conf_mode/service_lldp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2017-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_mdns_repeater.py b/src/conf_mode/service_mdns_repeater.py
index b0ece031c..aa10a687e 100755
--- a/src/conf_mode/service_mdns_repeater.py
+++ b/src/conf_mode/service_mdns_repeater.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2017-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -18,7 +18,9 @@ import os
 
 from json import loads
 from sys import exit
-from netifaces import ifaddresses, AF_INET, AF_INET6
+from socket import AF_INET
+from socket import AF_INET6
+from netifaces import ifaddresses # pylint: disable = no-name-in-module
 
 from vyos.config import Config
 from vyos.configverify import verify_interface_exists
diff --git a/src/conf_mode/service_monitoring_network_event.py b/src/conf_mode/service_monitoring_network_event.py
new file mode 100644
index 000000000..f43ea23ca
--- /dev/null
+++ b/src/conf_mode/service_monitoring_network_event.py
@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+#
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import json
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.utils.file import write_file
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+vyos_network_event_logger_config = r'/run/vyos-network-event-logger.conf'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'monitoring', 'network-event']
+    if not conf.exists(base):
+        return None
+
+    monitoring = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                      get_first_key=True,
+                                      no_tag_node_value_mangle=True)
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    monitoring = conf.merge_defaults(monitoring, recursive=True)
+
+    return monitoring
+
+
+def verify(monitoring):
+    if not monitoring:
+        return None
+
+    return None
+
+
+def generate(monitoring):
+    if not monitoring:
+        # Delete config
+        if os.path.exists(vyos_network_event_logger_config):
+            os.unlink(vyos_network_event_logger_config)
+
+        return None
+
+    # Create config
+    log_conf_json = json.dumps(monitoring, indent=4)
+    write_file(vyos_network_event_logger_config, log_conf_json)
+
+    return None
+
+
+def apply(monitoring):
+    # Reload systemd manager configuration
+    systemd_service = 'vyos-network-event-logger.service'
+
+    if not monitoring:
+        call(f'systemctl stop {systemd_service}')
+        return
+
+    call(f'systemctl restart {systemd_service}')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_monitoring_prometheus.py b/src/conf_mode/service_monitoring_prometheus.py
index 9a07d8593..b02f9f154 100755
--- a/src/conf_mode/service_monitoring_prometheus.py
+++ b/src/conf_mode/service_monitoring_prometheus.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -23,6 +23,7 @@ from vyos.configdict import is_node_changed
 from vyos.configverify import verify_vrf
 from vyos.template import render
 from vyos.utils.process import call
+from vyos.utils.process import is_systemd_service_active
 from vyos import ConfigError
 from vyos import airbag
 
@@ -48,9 +49,21 @@ def get_config(config=None):
     if not conf.exists(base):
         return None
 
-    monitoring = conf.get_config_dict(
-        base, key_mangling=('-', '_'), get_first_key=True, with_recursive_defaults=True
-    )
+    monitoring = {}
+    exporters = {
+        'node_exporter': base + ['node-exporter'],
+        'frr_exporter': base + ['frr-exporter'],
+        'blackbox_exporter': base + ['blackbox-exporter'],
+    }
+
+    for exporter_name, exporter_base in exporters.items():
+        if conf.exists(exporter_base):
+            monitoring[exporter_name] = conf.get_config_dict(
+                exporter_base,
+                key_mangling=('-', '_'),
+                get_first_key=True,
+                with_recursive_defaults=True,
+            )
 
     tmp = is_node_changed(conf, base + ['node-exporter', 'vrf'])
     if tmp:
@@ -161,11 +174,14 @@ def apply(monitoring):
     # Reload systemd manager configuration
     call('systemctl daemon-reload')
     if not monitoring or 'node_exporter' not in monitoring:
-        call(f'systemctl stop {node_exporter_systemd_service}')
+        if is_systemd_service_active(node_exporter_systemd_service):
+            call(f'systemctl stop {node_exporter_systemd_service}')
     if not monitoring or 'frr_exporter' not in monitoring:
-        call(f'systemctl stop {frr_exporter_systemd_service}')
+        if is_systemd_service_active(frr_exporter_systemd_service):
+            call(f'systemctl stop {frr_exporter_systemd_service}')
     if not monitoring or 'blackbox_exporter' not in monitoring:
-        call(f'systemctl stop {blackbox_exporter_systemd_service}')
+        if is_systemd_service_active(blackbox_exporter_systemd_service):
+            call(f'systemctl stop {blackbox_exporter_systemd_service}')
 
     if not monitoring:
         return
diff --git a/src/conf_mode/service_monitoring_telegraf.py b/src/conf_mode/service_monitoring_telegraf.py
index db870aae5..de8097e11 100755
--- a/src/conf_mode/service_monitoring_telegraf.py
+++ b/src/conf_mode/service_monitoring_telegraf.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_monitoring_zabbix-agent.py b/src/conf_mode/service_monitoring_zabbix-agent.py
index f17146a8d..5f3a8d4b5 100755
--- a/src/conf_mode/service_monitoring_zabbix-agent.py
+++ b/src/conf_mode/service_monitoring_zabbix-agent.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_ndp-proxy.py b/src/conf_mode/service_ndp-proxy.py
index 024ad79f2..f42ee9be8 100755
--- a/src/conf_mode/service_ndp-proxy.py
+++ b/src/conf_mode/service_ndp-proxy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_ntp.py b/src/conf_mode/service_ntp.py
index 32563aa0e..fbdcd6b58 100755
--- a/src/conf_mode/service_ntp.py
+++ b/src/conf_mode/service_ntp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_pppoe-server.py b/src/conf_mode/service_pppoe-server.py
index ac697c509..d910e770d 100755
--- a/src/conf_mode/service_pppoe-server.py
+++ b/src/conf_mode/service_pppoe-server.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -73,7 +73,9 @@ def get_config(config=None):
     # https://phabricator.accel-ppp.org/T3
     conditions = [is_node_changed(conf, base + ['client-ip-pool']),
                   is_node_changed(conf, base + ['client-ipv6-pool']),
-                  is_node_changed(conf, base + ['interface'])]
+                  is_node_changed(conf, base + ['interface']),
+                  is_node_changed(conf, base + ['authentication','radius','dynamic-author']),
+                  is_node_changed(conf, base + ['authentication','mode'])]
     if any(conditions):
         pppoe.update({'restart_required': {}})
     pppoe['server_type'] = 'pppoe'
diff --git a/src/conf_mode/service_router-advert.py b/src/conf_mode/service_router-advert.py
index 88d767bb8..4345bea1d 100755
--- a/src/conf_mode/service_router-advert.py
+++ b/src/conf_mode/service_router-advert.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_salt-minion.py b/src/conf_mode/service_salt-minion.py
index edf74b0c0..9e9940175 100755
--- a/src/conf_mode/service_salt-minion.py
+++ b/src/conf_mode/service_salt-minion.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_sla.py b/src/conf_mode/service_sla.py
index ba5e645f0..0a7b81073 100755
--- a/src/conf_mode/service_sla.py
+++ b/src/conf_mode/service_sla.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_snmp.py b/src/conf_mode/service_snmp.py
index 1174b1238..c6059c260 100755
--- a/src/conf_mode/service_snmp.py
+++ b/src/conf_mode/service_snmp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -22,6 +22,7 @@ from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdict import dict_merge
 from vyos.configverify import verify_vrf
+from vyos.defaults import systemd_services
 from vyos.snmpv3_hashgen import plaintext_to_md5
 from vyos.snmpv3_hashgen import plaintext_to_sha1
 from vyos.snmpv3_hashgen import random
@@ -43,7 +44,7 @@ config_file_access  = r'/usr/share/snmp/snmpd.conf'
 config_file_user    = r'/var/lib/snmp/snmpd.conf'
 default_script_dir  = r'/config/user-data/'
 systemd_override    = r'/run/systemd/system/snmpd.service.d/override.conf'
-systemd_service     = 'snmpd.service'
+systemd_service     = systemd_services['snmpd']
 
 def get_config(config=None):
     if config:
@@ -146,6 +147,9 @@ def verify(snmp):
         return None
 
     if 'user' in snmp['v3']:
+        if 'engineid' not in snmp['v3']:
+            raise ConfigError(f'EngineID must be configured for SNMPv3!')
+
         for user, user_config in snmp['v3']['user'].items():
             if 'group' not in user_config:
                 raise ConfigError(f'Group membership required for user "{user}"!')
diff --git a/src/conf_mode/service_ssh.py b/src/conf_mode/service_ssh.py
index 759f87bb2..bf8afe8b7 100755
--- a/src/conf_mode/service_ssh.py
+++ b/src/conf_mode/service_ssh.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -23,14 +23,15 @@ from syslog import LOG_INFO
 from vyos.config import Config
 from vyos.configdict import is_node_changed
 from vyos.configverify import verify_vrf
-from vyos.configverify import verify_pki_ca_certificate
+from vyos.configverify import verify_pki_openssh_key
+from vyos.defaults import config_files
 from vyos.utils.process import call
 from vyos.template import render
 from vyos import ConfigError
 from vyos import airbag
-from vyos.pki import find_chain
-from vyos.pki import encode_certificate
-from vyos.pki import load_certificate
+from vyos.pki import encode_public_key
+from vyos.pki import load_openssh_public_key
+from vyos.utils.dict import dict_search_recursive
 from vyos.utils.file import write_file
 
 airbag.enable()
@@ -44,8 +45,7 @@ key_rsa = '/etc/ssh/ssh_host_rsa_key'
 key_dsa = '/etc/ssh/ssh_host_dsa_key'
 key_ed25519 = '/etc/ssh/ssh_host_ed25519_key'
 
-trusted_user_ca_key = '/etc/ssh/trusted_user_ca_key'
-
+trusted_user_ca = config_files['sshd_user_ca']
 
 def get_config(config=None):
     if config:
@@ -55,10 +55,8 @@ def get_config(config=None):
     base = ['service', 'ssh']
     if not conf.exists(base):
         return None
-
-    ssh = conf.get_config_dict(
-        base, key_mangling=('-', '_'), get_first_key=True, with_pki=True
-    )
+    ssh = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True, with_pki=True)
 
     tmp = is_node_changed(conf, base + ['vrf'])
     if tmp:
@@ -68,14 +66,27 @@ def get_config(config=None):
     # options which we need to update into the dictionary retrived.
     ssh = conf.merge_defaults(ssh, recursive=True)
 
-    # pass config file path - used in override template
-    ssh['config_file'] = config_file
-
     # Ignore default XML values if config doesn't exists
     # Delete key from dict
     if not conf.exists(base + ['dynamic-protection']):
         del ssh['dynamic_protection']
 
+    # See if any user has specified a list of principal names that are accepted
+    # for certificate authentication.
+    tmp = conf.get_config_dict(['system', 'login', 'user'],
+                                key_mangling=('-', '_'),
+                                no_tag_node_value_mangle=True,
+                                get_first_key=True)
+
+    for value, _ in dict_search_recursive(tmp, 'principal'):
+        # Only enable principal handling if SSH trusted-user-ca is set
+        if 'trusted_user_ca' in ssh:
+            ssh['has_principals'] = {}
+        # We do only need to execute this code path once as we need to know
+        # if any one of the local users has a principal set or not - this
+        # accounts for the entire system.
+        break
+
     return ssh
 
 
@@ -86,15 +97,8 @@ def verify(ssh):
     if 'rekey' in ssh and 'data' not in ssh['rekey']:
         raise ConfigError('Rekey data is required!')
 
-    if 'trusted_user_ca_key' in ssh:
-        if 'ca_certificate' not in ssh['trusted_user_ca_key']:
-            raise ConfigError('CA certificate is required for TrustedUserCAKey')
-
-        ca_key_name = ssh['trusted_user_ca_key']['ca_certificate']
-        verify_pki_ca_certificate(ssh, ca_key_name)
-        pki_ca_cert = ssh['pki']['ca'][ca_key_name]
-        if 'certificate' not in pki_ca_cert or not pki_ca_cert['certificate']:
-            raise ConfigError(f"CA certificate '{ca_key_name}' is not valid or missing")
+    if 'trusted_user_ca' in ssh:
+        verify_pki_openssh_key(ssh, ssh['trusted_user_ca'])
 
     verify_vrf(ssh)
     return None
@@ -119,23 +123,17 @@ def generate(ssh):
         syslog(LOG_INFO, 'SSH ed25519 host key not found, generating new key!')
         call(f'ssh-keygen -q -N "" -t ed25519 -f {key_ed25519}')
 
-    if 'trusted_user_ca_key' in ssh:
-        ca_key_name = ssh['trusted_user_ca_key']['ca_certificate']
-        pki_ca_cert = ssh['pki']['ca'][ca_key_name]
-
-        loaded_ca_cert = load_certificate(pki_ca_cert['certificate'])
-        loaded_ca_certs = {
-            load_certificate(c['certificate'])
-            for c in ssh['pki']['ca'].values()
-            if 'certificate' in c
-        }
-
-        ca_full_chain = find_chain(loaded_ca_cert, loaded_ca_certs)
-        write_file(
-            trusted_user_ca_key, '\n'.join(encode_certificate(c) for c in ca_full_chain)
-        )
-    elif os.path.exists(trusted_user_ca_key):
-        os.unlink(trusted_user_ca_key)
+    if 'trusted_user_ca' in ssh:
+        key_name = ssh['trusted_user_ca']
+        openssh_cert = ssh['pki']['openssh'][key_name]
+        loaded_ca_cert = load_openssh_public_key(openssh_cert['public']['key'],
+                                                 openssh_cert['public']['type'])
+        tmp = encode_public_key(loaded_ca_cert, encoding='OpenSSH',
+                                key_format='OpenSSH')
+        write_file(trusted_user_ca, tmp, trailing_newline=True)
+    else:
+        if os.path.exists(trusted_user_ca):
+            os.unlink(trusted_user_ca)
 
     render(config_file, 'ssh/sshd_config.j2', ssh)
 
diff --git a/src/conf_mode/service_stunnel.py b/src/conf_mode/service_stunnel.py
index 8ec762548..5ea5b88b4 100644
--- a/src/conf_mode/service_stunnel.py
+++ b/src/conf_mode/service_stunnel.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -19,7 +19,7 @@ from shutil import rmtree
 
 from sys import exit
 
-from netifaces import AF_INET
+from socket import AF_INET
 from psutil import net_if_addrs
 
 from vyos.config import Config
diff --git a/src/conf_mode/service_suricata.py b/src/conf_mode/service_suricata.py
index 1ce170145..728c5607e 100755
--- a/src/conf_mode/service_suricata.py
+++ b/src/conf_mode/service_suricata.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_tftp-server.py b/src/conf_mode/service_tftp-server.py
index 5b7303c40..dc5ec5674 100755
--- a/src/conf_mode/service_tftp-server.py
+++ b/src/conf_mode/service_tftp-server.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/service_webproxy.py b/src/conf_mode/service_webproxy.py
index 12ae4135e..7a4954de2 100755
--- a/src/conf_mode/service_webproxy.py
+++ b/src/conf_mode/service_webproxy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_acceleration.py b/src/conf_mode/system_acceleration.py
index d2cf44ff0..3e7a06465 100755
--- a/src/conf_mode/system_acceleration.py
+++ b/src/conf_mode/system_acceleration.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -70,11 +70,12 @@ def verify(qat):
         # PCI id | Chipset
         # 19e2 -> C3xx
         # 37c8 -> C62x
+        # 37c9 -> C62xvf
         # 0435 -> DH895
         # 6f54 -> D15xx
         # 18ee -> QAT_200XX
         data = re.findall(
-            '(8086:19e2)|(8086:37c8)|(8086:0435)|(8086:6f54)|(8086:18ee)', output)
+            '(8086:19e2)|(8086:37c[8-9])|(8086:0435)|(8086:6f54)|(8086:18ee)', output)
         # If QAT devices found
         if not data:
             raise ConfigError('No QAT acceleration device found')
diff --git a/src/conf_mode/system_config-management.py b/src/conf_mode/system_config-management.py
index a3ce66512..c1d83af34 100755
--- a/src/conf_mode/system_config-management.py
+++ b/src/conf_mode/system_config-management.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_conntrack.py b/src/conf_mode/system_conntrack.py
index f25ed8d10..eed1a4458 100755
--- a/src/conf_mode/system_conntrack.py
+++ b/src/conf_mode/system_conntrack.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -32,7 +32,6 @@ from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
-conntrack_config = r'/etc/modprobe.d/vyatta_nf_conntrack.conf'
 sysctl_file = r'/run/sysctl/10-vyos-conntrack.conf'
 nftables_ct_file = r'/run/nftables-ct.conf'
 vyos_conntrack_logger_config = r'/run/vyos-conntrack-logger.conf'
@@ -204,7 +203,6 @@ def generate(conntrack):
                 elif path[0] == 'ipv6':
                     conntrack['ipv6_firewall_action'] = 'accept'
 
-    render(conntrack_config, 'conntrack/vyos_nf_conntrack.conf.j2', conntrack)
     render(sysctl_file, 'conntrack/sysctl.conf.j2', conntrack)
     render(nftables_ct_file, 'conntrack/nftables-ct.j2', conntrack)
 
diff --git a/src/conf_mode/system_console.py b/src/conf_mode/system_console.py
index b380e0521..fe910c1b0 100755
--- a/src/conf_mode/system_console.py
+++ b/src/conf_mode/system_console.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,9 +17,11 @@
 import os
 from pathlib import Path
 
+from vyos.base import Warning
 from vyos.config import Config
 from vyos.utils.process import call
 from vyos.utils.serial import restart_login_consoles
+from vyos.utils.serial import is_tty
 from vyos.system import grub_util
 from vyos.template import render
 from vyos import ConfigError
@@ -66,6 +68,8 @@ def verify(console):
             # and it can not be used as a serial interface
             if not os.path.isdir(by_bus_dir) or not os.path.exists(by_bus_device):
                 raise ConfigError(f'Device {device} does not support beeing used as tty')
+        if not is_tty(device):
+            Warning(f'Device "{device}" used for console is not a TTY!')
 
     return None
 
@@ -98,6 +102,9 @@ def generate(console):
                 raise ConfigError(f'Device {device} does not support beeing used as tty')
 
     for device, device_config in console['device'].items():
+        # Do not render getty configuration if specified device is not a TTY.
+        if not is_tty(device):
+            continue
         config_file = base_dir + f'/serial-getty@{device}.service'
         Path(f'{base_dir}/getty.target.wants').mkdir(exist_ok=True)
         getty_wants_symlink = base_dir + f'/getty.target.wants/serial-getty@{device}.service'
@@ -119,8 +126,6 @@ def generate(console):
 def apply(console):
     # Reset screen blanking
     call('/usr/bin/setterm -blank 0 -powersave off -powerdown 0 -term linux </dev/tty1 >/dev/tty1 2>&1')
-    # Reload systemd manager configuration
-    call('systemctl daemon-reload')
 
     # Service control moved to vyos.utils.serial to unify checks and prompts. 
     # If users are connected, we want to show an informational message on completing 
diff --git a/src/conf_mode/system_flow-accounting.py b/src/conf_mode/system_flow-accounting.py
index 925c4a562..618227fc0 100755
--- a/src/conf_mode/system_flow-accounting.py
+++ b/src/conf_mode/system_flow-accounting.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_frr.py b/src/conf_mode/system_frr.py
index d9ac543d0..06af37ad8 100755
--- a/src/conf_mode/system_frr.py
+++ b/src/conf_mode/system_frr.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_host-name.py b/src/conf_mode/system_host-name.py
index 3f245f166..2a5592484 100755
--- a/src/conf_mode/system_host-name.py
+++ b/src/conf_mode/system_host-name.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -23,6 +23,7 @@ import vyos.hostsd_client
 from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdict import leaf_node_changed
+from vyos.defaults import systemd_services
 from vyos.ifconfig import Section
 from vyos.template import is_ip
 from vyos.utils.process import cmd
@@ -174,11 +175,13 @@ def apply(config):
 
     # Restart services that use the hostname
     if hostname_new != hostname_old:
-        call("systemctl restart rsyslog.service")
+        tmp = systemd_services['syslog']
+        call(f'systemctl restart {tmp}')
 
     # If SNMP is running, restart it too
     if process_named_running('snmpd') and config['snmpd_restart_reqired']:
-        call('systemctl restart snmpd.service')
+        tmp = systemd_services['snmpd']
+        call(f'systemctl restart {tmp}')
 
     return None
 
diff --git a/src/conf_mode/system_ip.py b/src/conf_mode/system_ip.py
index 7f3796168..13471eb3b 100755
--- a/src/conf_mode/system_ip.py
+++ b/src/conf_mode/system_ip.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -53,6 +53,11 @@ def verify(config_dict):
         for protocol, protocol_options in opt['protocol'].items():
             if 'route_map' in protocol_options:
                 verify_route_map(protocol_options['route_map'], opt)
+
+    if dict_search('import_table', opt):
+        for table_num, import_config in opt['import_table'].items():
+            if dict_search('route_map', import_config):
+                verify_route_map(import_config['route_map'], opt)
     return
 
 def generate(config_dict):
diff --git a/src/conf_mode/system_ipv6.py b/src/conf_mode/system_ipv6.py
index 309869b2f..35f343d82 100755
--- a/src/conf_mode/system_ipv6.py
+++ b/src/conf_mode/system_ipv6.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_lcd.py b/src/conf_mode/system_lcd.py
index eb88224d1..1e97414dc 100755
--- a/src/conf_mode/system_lcd.py
+++ b/src/conf_mode/system_lcd.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright 2020-2022 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_login.py b/src/conf_mode/system_login.py
index d3a969d9b..c2562be7b 100755
--- a/src/conf_mode/system_login.py
+++ b/src/conf_mode/system_login.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -14,7 +14,9 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import re
 import os
+import json
 
 from passlib.hosts import linux_context
 from psutil import users
@@ -24,15 +26,20 @@ from pwd import getpwuid
 from sys import exit
 from time import sleep
 
+from vyos.base import Warning
 from vyos.config import Config
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
 from vyos.configverify import verify_vrf
 from vyos.template import render
 from vyos.template import is_ipv4
+from vyos.utils.auth import EPasswdStrength
+from vyos.utils.auth import evaluate_strength
 from vyos.utils.auth import get_current_user
 from vyos.utils.configfs import delete_cli_node
 from vyos.utils.configfs import add_cli_node
 from vyos.utils.dict import dict_search
-from vyos.utils.file import chown
+from vyos.utils.permission import chown
 from vyos.utils.process import cmd
 from vyos.utils.process import call
 from vyos.utils.process import run
@@ -126,6 +133,7 @@ def get_config(config=None):
                                                  max_uid=MIN_TACACS_UID) + cli_users
         login['tacacs_min_uid'] = MIN_TACACS_UID
 
+    set_dependents('ssh', conf)
     return login
 
 def verify(login):
@@ -146,12 +154,34 @@ def verify(login):
                 if s_user.pw_name == user and s_user.pw_uid < MIN_USER_UID:
                     raise ConfigError(f'User "{user}" can not be created, conflict with local system account!')
 
+            # T6353: Check password for complexity using cracklib.
+            # A user password should be sufficiently complex
+            plaintext_password = dict_search(
+                path='authentication.plaintext_password',
+                dict_object=user_config
+            ) or None
+
+            failed_check_status = [EPasswdStrength.WEAK, EPasswdStrength.ERROR]
+            if plaintext_password is not None:
+                result = evaluate_strength(plaintext_password)
+                if result['strength'] in failed_check_status:
+                    Warning(result['error'])
+
             for pubkey, pubkey_options in (dict_search('authentication.public_keys', user_config) or {}).items():
                 if 'type' not in pubkey_options:
                     raise ConfigError(f'Missing type for public-key "{pubkey}"!')
                 if 'key' not in pubkey_options:
                     raise ConfigError(f'Missing key for public-key "{pubkey}"!')
 
+            if 'operator' in user_config:
+                op_groups = dict_search('operator.group', user_config)
+                if op_groups:
+                    for og in op_groups:
+                        if dict_search(f'operator_group.{og}', login) is None:
+                            raise ConfigError(f'Operator group {og} does not exist')
+                else:
+                    raise ConfigError(f'User {user} is configured as an operator but is not assigned to any operator groups')
+
     if {'radius', 'tacacs'} <= set(login):
         raise ConfigError('Using both RADIUS and TACACS at the same time is not supported!')
 
@@ -287,6 +317,28 @@ def generate(login):
         if os.path.isfile(autologout_file):
             os.unlink(autologout_file)
 
+    # Operator groups and group membership
+    operator_config = {'users': {}, 'groups': {}}
+    if 'user' in login:
+        for user, user_config in login['user'].items():
+            op_groups = dict_search('operator.group', user_config)
+            if op_groups:
+                operator_config['users'][user] = op_groups
+
+    if 'operator_group' in login:
+        operator_config['groups'] = login['operator_group']
+
+        # Convert permissions strings to list
+        # so that the operational command runner doesn't have to
+        for g in operator_config['groups']:
+            policy = dict_search(f'command_policy.allow', operator_config['groups'][g])
+            if policy is not None:
+                policy = list(map(lambda s: re.split(r'\s+', s), policy))
+                operator_config['groups'][g]['command_policy']['allow'] = policy
+
+    with open('/etc/vyos/operators.json', 'w') as of:
+        json.dump(operator_config, of)
+
     return None
 
 
@@ -316,7 +368,11 @@ def apply(login):
             if tmp: command += f" --home '{tmp}'"
             else: command += f" --home '/home/{user}'"
 
-            command += f' --groups frr,frrvty,vyattacfg,sudo,adm,dip,disk,_kea {user}'
+            if 'operator' not in user_config:
+                command += f' --groups frr,frrvty,vyattacfg,sudo,adm,dip,disk,_kea'
+
+            command += f' {user}'
+
             try:
                 cmd(command)
                 # we should not rely on the value stored in user_config['home_directory'], as a
@@ -329,6 +385,17 @@ def apply(login):
                        user_config, permission=0o600,
                        formater=lambda _: _.replace("&quot;", '"'),
                        user=user, group='users')
+
+                principals_file = f'{home_dir}/.ssh/authorized_principals'
+                if dict_search('authentication.principal', user_config):
+                    render(principals_file, 'login/authorized_principals.j2',
+                           user_config, permission=0o600,
+                           formater=lambda _: _.replace("&quot;", '"'),
+                           user=user, group='users')
+                else:
+                    if os.path.exists(principals_file):
+                        os.unlink(principals_file)
+
             except Exception as e:
                 raise ConfigError(f'Adding user "{user}" raised exception: "{e}"')
 
@@ -345,14 +412,15 @@ def apply(login):
                     chown(home_dir, user=user, recursive=True)
 
             # Generate 2FA/MFA One-Time-Pad configuration
+            google_auth_file = f'{home_dir}/.google_authenticator'
             if dict_search('authentication.otp.key', user_config):
                 enable_otp = True
-                render(f'{home_dir}/.google_authenticator', 'login/pam_otp_ga.conf.j2',
+                render(google_auth_file, 'login/pam_otp_ga.conf.j2',
                        user_config, permission=0o400, user=user, group='users')
             else:
                 # delete configuration as it's not enabled for the user
-                if os.path.exists(f'{home_dir}/.google_authenticator'):
-                    os.remove(f'{home_dir}/.google_authenticator')
+                if os.path.exists(google_auth_file):
+                    os.unlink(google_auth_file)
 
             # Lock/Unlock local user account
             lock_unlock = '--unlock'
@@ -366,6 +434,22 @@ def apply(login):
                 # Disable user to prevent re-login
                 call(f'usermod -s /sbin/nologin {user}')
 
+                home_dir = getpwnam(user).pw_dir
+                # Remove SSH authorized keys file
+                authorized_keys_file = f'{home_dir}/.ssh/authorized_keys'
+                if os.path.exists(authorized_keys_file):
+                    os.unlink(authorized_keys_file)
+
+                # Remove SSH authorized principals file
+                principals_file = f'{home_dir}/.ssh/authorized_principals'
+                if os.path.exists(principals_file):
+                    os.unlink(principals_file)
+
+                # Remove Google Authenticator file
+                google_auth_file = f'{home_dir}/.google_authenticator'
+                if os.path.exists(google_auth_file):
+                    os.unlink(google_auth_file)
+
                 # Logout user if he is still logged in
                 if user in list(set([tmp[0] for tmp in users()])):
                     print(f'{user} is logged in, forcing logout!')
@@ -404,8 +488,9 @@ def apply(login):
     # Enable/disable Google authenticator
     cmd('pam-auth-update --disable mfa-google-authenticator')
     if enable_otp:
-        cmd(f'pam-auth-update --enable mfa-google-authenticator')
+        cmd('pam-auth-update --enable mfa-google-authenticator')
 
+    call_dependents()
     return None
 
 
diff --git a/src/conf_mode/system_login_banner.py b/src/conf_mode/system_login_banner.py
index 5826d8042..9d5fba65f 100755
--- a/src/conf_mode/system_login_banner.py
+++ b/src/conf_mode/system_login_banner.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -95,8 +95,12 @@ def apply(banner):
         render(POSTLOGIN_FILE, 'login/default_motd.j2', banner,
             permission=0o644, user='root', group='root')
 
-    render(POSTLOGIN_VYOS_FILE, 'login/motd_vyos_nonproduction.j2', banner,
-        permission=0o644, user='root', group='root')
+    if banner['version_data']['build_type'] != 'release':
+        render(POSTLOGIN_VYOS_FILE, 'login/motd_vyos_nonproduction.j2',
+            banner,
+            permission=0o644,
+            user='root',
+            group='root')
 
     return None
 
diff --git a/src/conf_mode/system_logs.py b/src/conf_mode/system_logs.py
index 8ad4875d4..f0e742d1b 100755
--- a/src/conf_mode/system_logs.py
+++ b/src/conf_mode/system_logs.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_option.py b/src/conf_mode/system_option.py
index e2832cde6..303557412 100755
--- a/src/conf_mode/system_option.py
+++ b/src/conf_mode/system_option.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -33,6 +33,7 @@ from vyos.utils.process import cmd
 from vyos.utils.process import is_systemd_service_running
 from vyos.utils.network import is_addr_assigned
 from vyos.utils.network import is_intf_addr_assigned
+from vyos.utils.system import sysctl_write
 from vyos.configdep import set_dependents
 from vyos.configdep import call_dependents
 from vyos import ConfigError
@@ -86,7 +87,7 @@ def verify(options):
 
         if 'source_address' in config:
             if not is_addr_assigned(config['source_address']):
-                raise ConfigError('No interface with give address specified!')
+                raise ConfigError('No interface with given address specified!')
 
     if 'ssh_client' in options:
         config = options['ssh_client']
@@ -122,7 +123,14 @@ def generate(options):
     render(ssh_config, 'system/ssh_config.j2', options)
     render(usb_autosuspend, 'system/40_usb_autosuspend.j2', options)
 
+    # XXX: This code path and if statements must be kept in sync with the Kernel
+    # option handling in image_installer.py:get_cli_kernel_options(). This
+    # occurance is used for having the appropriate options passed to GRUB
+    # when re-configuring options on the CLI.
     cmdline_options = []
+    kernel_opts = options.get('kernel', {})
+    k_cpu_opts = kernel_opts.get('cpu', {})
+    k_memory_opts = kernel_opts.get('memory', {})
     if 'kernel' in options:
         if 'disable_mitigations' in options['kernel']:
             cmdline_options.append('mitigations=off')
@@ -131,8 +139,51 @@ def generate(options):
         if 'amd_pstate_driver' in options['kernel']:
             mode = options['kernel']['amd_pstate_driver']
             cmdline_options.append(
-                f'initcall_blacklist=acpi_cpufreq_init amd_pstate={mode}'
-            )
+                f'initcall_blacklist=acpi_cpufreq_init amd_pstate={mode}')
+        if 'quiet' in options['kernel']:
+            cmdline_options.append('quiet')
+
+    if 'disable_hpet' in kernel_opts:
+        cmdline_options.append('hpet=disable')
+
+    if 'disable_mce' in kernel_opts:
+        cmdline_options.append('mce=off')
+
+    if 'disable_softlockup' in kernel_opts:
+        cmdline_options.append('nosoftlockup')
+
+    # CPU options
+    isol_cpus = k_cpu_opts.get('isolate_cpus')
+    if isol_cpus:
+        cmdline_options.append(f'isolcpus={isol_cpus}')
+
+    nohz_full = k_cpu_opts.get('nohz_full')
+    if nohz_full:
+        cmdline_options.append(f'nohz_full={nohz_full}')
+
+    rcu_nocbs = k_cpu_opts.get('rcu_no_cbs')
+    if rcu_nocbs:
+        cmdline_options.append(f'rcu_nocbs={rcu_nocbs}')
+
+    if 'disable_nmi_watchdog' in k_cpu_opts:
+        cmdline_options.append('nmi_watchdog=0')
+
+    # Memory options
+    if 'disable_numa_balancing' in k_memory_opts:
+        cmdline_options.append('numa_balancing=disable')
+
+    default_hp_size = k_memory_opts.get('default_hugepage_size')
+    if default_hp_size:
+        cmdline_options.append(f'default_hugepagesz={default_hp_size}')
+
+    hp_sizes = k_memory_opts.get('hugepage_size')
+    if hp_sizes:
+        for size, settings in hp_sizes.items():
+            cmdline_options.append(f'hugepagesz={size}')
+            count = settings.get('hugepage_count')
+            if count:
+                cmdline_options.append(f'hugepages={count}')
+
     grub_util.update_kernel_cmdline_options(' '.join(cmdline_options))
 
     return None
@@ -216,6 +267,41 @@ def apply(options):
         else:
             write_file(kernel_dynamic_debug, f'module {module} -p')
 
+    if 'resource_limits' in options:
+        unit_map = {'M': 1 << 20, 'G': 1 << 30}
+
+        total_pages = 0
+        total_bytes = 0
+
+        hp_sizes = options.get('kernel', {}).get('memory', {}).get('hugepage_size', {})
+        for size_str, hp_config in hp_sizes.items():
+            pages = int(hp_config.get('hugepage_count', 0))
+            total_pages += pages
+            total_bytes += pages * int(size_str[:-1]) * unit_map[size_str[-1]]
+
+        # Minimum recommended system values
+        max_map_count_min = 65530  # ensures large workload compatibility
+        shmmax_min = 8589934592  # 8 GiB safe default for large allocations
+
+        max_map_count_conf = options['resource_limits'].get('max_map_count', 'auto')
+        shmmax_conf = options['resource_limits'].get('shmmax', 'auto')
+
+        parameters = {
+            'vm.max_map_count': (
+                max(total_pages * 2, max_map_count_min)
+                if max_map_count_conf == 'auto'
+                else int(max_map_count_conf)
+            ),
+            'kernel.shmmax': (
+                max(total_bytes, shmmax_min)
+                if shmmax_conf == 'auto'
+                else int(shmmax_conf)
+            ),
+        }
+
+        for parameter, value in parameters.items():
+            sysctl_write(parameter, value)
+
 
 if __name__ == '__main__':
     try:
diff --git a/src/conf_mode/system_proxy.py b/src/conf_mode/system_proxy.py
index 079c43e7e..3843ad527 100755
--- a/src/conf_mode/system_proxy.py
+++ b/src/conf_mode/system_proxy.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_sflow.py b/src/conf_mode/system_sflow.py
index 41119b494..c5fe5641f 100755
--- a/src/conf_mode/system_sflow.py
+++ b/src/conf_mode/system_sflow.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2023-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -54,13 +54,14 @@ def verify(sflow):
     # Check if configured sflow agent-address exist in the system
     if 'agent_address' in sflow:
         tmp = sflow['agent_address']
-        if not is_addr_assigned(tmp):
+        if not is_addr_assigned(tmp, include_vrf=True):
             raise ConfigError(
                 f'Configured "sflow agent-address {tmp}" does not exist in the system!'
             )
 
     # Check if at least one interface is configured
-    if 'interface' not in sflow:
+    # Skip this check if VPP is enabled
+    if 'interface' not in sflow and 'vpp' not in sflow:
         raise ConfigError(
             'sFlow requires at least one interface to be configured!')
 
diff --git a/src/conf_mode/system_sysctl.py b/src/conf_mode/system_sysctl.py
index f6b02023d..8e018ec0b 100755
--- a/src/conf_mode/system_sysctl.py
+++ b/src/conf_mode/system_sysctl.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_syslog.py b/src/conf_mode/system_syslog.py
index eb2f02eb3..c1a8baa1d 100755
--- a/src/conf_mode/system_syslog.py
+++ b/src/conf_mode/system_syslog.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -20,17 +20,22 @@ from sys import exit
 
 from vyos.base import Warning
 from vyos.config import Config
-from vyos.configdict import is_node_changed
 from vyos.configverify import verify_vrf
+from vyos.defaults import systemd_services
+from vyos.utils.network import is_addr_assigned
 from vyos.utils.process import call
 from vyos.template import render
+from vyos.template import is_ipv4
+from vyos.template import is_ipv6
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
-rsyslog_conf = '/etc/rsyslog.d/00-vyos.conf'
+rsyslog_conf = '/run/rsyslog/rsyslog.conf'
 logrotate_conf = '/etc/logrotate.d/vyos-rsyslog'
-systemd_override = r'/run/systemd/system/rsyslog.service.d/override.conf'
+
+systemd_socket = 'syslog.socket'
+systemd_service = systemd_services['syslog']
 
 def get_config(config=None):
     if config:
@@ -46,23 +51,17 @@ def get_config(config=None):
 
     syslog.update({ 'logrotate' : logrotate_conf })
 
-    tmp = is_node_changed(conf, base + ['vrf'])
-    if tmp: syslog.update({'restart_required': {}})
-
     syslog = conf.merge_defaults(syslog, recursive=True)
-    if syslog.from_defaults(['global']):
-        del syslog['global']
-
-    if (
-        'global' in syslog
-        and 'preserve_fqdn' in syslog['global']
-        and conf.exists(['system', 'host-name'])
-        and conf.exists(['system', 'domain-name'])
-    ):
-        hostname = conf.return_value(['system', 'host-name'])
-        domain = conf.return_value(['system', 'domain-name'])
-        fqdn = f'{hostname}.{domain}'
-        syslog['global']['local_host_name'] = fqdn
+    if syslog.from_defaults(['local']):
+        del syslog['local']
+
+    if 'preserve_fqdn' in syslog:
+        if conf.exists(['system', 'host-name']):
+            tmp = conf.return_value(['system', 'host-name'])
+            syslog['preserve_fqdn']['host_name'] = tmp
+        if conf.exists(['system', 'domain-name']):
+            tmp  = conf.return_value(['system', 'domain-name'])
+            syslog['preserve_fqdn']['domain_name'] = tmp
 
     return syslog
 
@@ -70,13 +69,33 @@ def verify(syslog):
     if not syslog:
         return None
 
-    if 'host' in syslog:
-         for host, host_options in syslog['host'].items():
-             if 'protocol' in host_options and host_options['protocol'] == 'udp':
-                 if 'format' in host_options and 'octet_counted' in host_options['format']:
-                     Warning(f'Syslog UDP transport for "{host}" should not use octet-counted format!')
-
-    verify_vrf(syslog)
+    if 'preserve_fqdn' in syslog:
+        if 'host_name' not in syslog['preserve_fqdn']:
+            Warning('No "system host-name" defined - cannot set syslog FQDN!')
+        if 'domain_name' not in syslog['preserve_fqdn']:
+            Warning('No "system domain-name" defined - cannot set syslog FQDN!')
+
+    if 'remote' in syslog:
+        for remote, remote_options in syslog['remote'].items():
+            if 'protocol' in remote_options and remote_options['protocol'] == 'udp':
+                if 'format' in remote_options and 'octet_counted' in remote_options['format']:
+                    Warning(f'Syslog UDP transport for "{remote}" should not use octet-counted format!')
+
+            if 'vrf' in remote_options:
+                verify_vrf(remote_options)
+
+            if 'source_address' in remote_options:
+                vrf = None
+                if 'vrf' in remote_options:
+                    vrf = remote_options['vrf']
+                if not is_addr_assigned(remote_options['source_address'], vrf):
+                    raise ConfigError('No interface with given address specified!')
+
+                source_address = remote_options['source_address']
+                if ((is_ipv4(remote) and is_ipv6(source_address)) or
+                    (is_ipv6(remote) and is_ipv4(source_address))):
+                    raise ConfigError(f'Source-address "{source_address}" does not match '\
+                                      f'address-family of remote "{remote}"!')
 
 def generate(syslog):
     if not syslog:
@@ -88,26 +107,15 @@ def generate(syslog):
         return None
 
     render(rsyslog_conf, 'rsyslog/rsyslog.conf.j2', syslog)
-    render(systemd_override, 'rsyslog/override.conf.j2', syslog)
     render(logrotate_conf, 'rsyslog/logrotate.j2', syslog)
-
-    # Reload systemd manager configuration
-    call('systemctl daemon-reload')
     return None
 
 def apply(syslog):
-    systemd_socket = 'syslog.socket'
-    systemd_service = 'syslog.service'
     if not syslog:
         call(f'systemctl stop {systemd_service} {systemd_socket}')
         return None
 
-    # we need to restart the service if e.g. the VRF name changed
-    systemd_action = 'reload-or-restart'
-    if 'restart_required' in syslog:
-        systemd_action = 'restart'
-
-    call(f'systemctl {systemd_action} {systemd_service}')
+    call(f'systemctl reload-or-restart {systemd_service}')
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/system_task-scheduler.py b/src/conf_mode/system_task-scheduler.py
index 129be5d3c..c0253006a 100755
--- a/src/conf_mode/system_task-scheduler.py
+++ b/src/conf_mode/system_task-scheduler.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2017 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_timezone.py b/src/conf_mode/system_timezone.py
index 39770fdb4..54ffb88ee 100755
--- a/src/conf_mode/system_timezone.py
+++ b/src/conf_mode/system_timezone.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_update-check.py b/src/conf_mode/system_update-check.py
index 71ac13e51..7ed736eac 100755
--- a/src/conf_mode/system_update-check.py
+++ b/src/conf_mode/system_update-check.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/system_wireless.py b/src/conf_mode/system_wireless.py
index e0ca0ab8e..2d377c50a 100644
--- a/src/conf_mode/system_wireless.py
+++ b/src/conf_mode/system_wireless.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index 25604d2a2..dcb9f9c69 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2025 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -64,6 +64,7 @@ swanctl_dir        = '/etc/swanctl'
 charon_conf        = '/etc/strongswan.d/charon.conf'
 charon_dhcp_conf   = '/etc/strongswan.d/charon/dhcp.conf'
 charon_radius_conf = '/etc/strongswan.d/charon/eap-radius.conf'
+charon_systemd_conf = '/etc/strongswan.d/charon-systemd.conf'
 interface_conf     = '/etc/strongswan.d/interfaces_use.conf'
 swanctl_conf       = f'{swanctl_dir}/swanctl.conf'
 
@@ -156,6 +157,8 @@ def get_config(config=None):
                         _, vti = get_interface_dict(conf, ['interfaces', 'vti'], vti_interface)
                         ipsec['vti_interface_dicts'][vti_interface] = vti
 
+    ipsec['vpp_ipsec_exists'] = conf.exists(['vpp', 'settings', 'ipsec'])
+
     return ipsec
 
 def get_dhcp_address(iface):
@@ -484,6 +487,17 @@ def verify(ipsec):
             else:
                 raise ConfigError(f"Missing ike-group on site-to-site peer {peer}")
 
+            # verify encryption algorithm compatibility for IKE with VPP
+            if ipsec['vpp_ipsec_exists']:
+                ike_group = ipsec['ike_group'][peer_conf['ike_group']]
+                for proposal, proposal_config in ike_group.get('proposal', {}).items():
+                    algs = ['gmac', 'serpent', 'twofish']
+                    if any(alg in proposal_config['encryption'] for alg in algs):
+                        raise ConfigError(
+                            f'Encryption algorithm {proposal_config["encryption"]} cannot be used '
+                            f'for IKE proposal {proposal} for site-to-site peer {peer} with VPP'
+                        )
+
             if 'authentication' not in peer_conf or 'mode' not in peer_conf['authentication']:
                 raise ConfigError(f"Missing authentication on site-to-site peer {peer}")
 
@@ -562,7 +576,7 @@ def verify(ipsec):
 
                     esp_group_name = tunnel_conf['esp_group'] if 'esp_group' in tunnel_conf else peer_conf['default_esp_group']
 
-                    if esp_group_name not in ipsec['esp_group']:
+                    if esp_group_name not in ipsec.get('esp_group'):
                         raise ConfigError(f"Invalid esp-group on tunnel {tunnel} for site-to-site peer {peer}")
 
                     esp_group = ipsec['esp_group'][esp_group_name]
@@ -574,6 +588,18 @@ def verify(ipsec):
                         if ('local' in tunnel_conf and 'prefix' in tunnel_conf['local']) or ('remote' in tunnel_conf and 'prefix' in tunnel_conf['remote']):
                             raise ConfigError(f"Local/remote prefix cannot be used with ESP transport mode on tunnel {tunnel} for site-to-site peer {peer}")
 
+                    # verify ESP encryption algorithm compatibility with VPP
+                    # because Marvel plugin for VPP doesn't support all algorithms that Strongswan does
+                    if ipsec['vpp_ipsec_exists']:
+                        for proposal, proposal_config in esp_group.get('proposal', {}).items():
+                            algs = ['aes128', 'aes192', 'aes256', 'aes128gcm128', 'aes192gcm128', 'aes256gcm128']
+                            if proposal_config['encryption'] not in algs:
+                                raise ConfigError(
+                                    f'Encryption algorithm {proposal_config["encryption"]} cannot be used '
+                                    f'for ESP proposal {proposal} on tunnel {tunnel} for site-to-site peer {peer} with VPP'
+                                )
+
+
 def cleanup_pki_files():
     for path in [CERT_PATH, CA_PATH, CRL_PATH, KEY_PATH, PUBKEY_PATH]:
         if not os.path.exists(path):
@@ -670,6 +696,8 @@ def generate(ipsec):
                 generate_pki_files_x509(ipsec['pki'], rw_conf['authentication']['x509'])
 
     if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']:
+        DEFAULT_TS_PREFIX = 'dynamic'
+
         for peer, peer_conf in ipsec['site_to_site']['peer'].items():
             if f'peer_{peer}' in ipsec['dhcp_no_address']:
                 continue
@@ -698,10 +726,16 @@ def generate(ipsec):
                     passthrough = None
 
                     for local_prefix in local_prefixes:
+                        if local_prefix == DEFAULT_TS_PREFIX:
+                            continue
+
                         for remote_prefix in remote_prefixes:
+                            if remote_prefix == DEFAULT_TS_PREFIX:
+                                continue
+
                             local_net = ipaddress.ip_network(local_prefix)
                             remote_net = ipaddress.ip_network(remote_prefix)
-                            if local_net.overlaps(remote_net):
+                            if local_net.subnet_of(remote_net):
                                 if passthrough is None:
                                     passthrough = []
                                 passthrough.append(local_prefix)
@@ -720,6 +754,7 @@ def generate(ipsec):
     render(charon_conf, 'ipsec/charon.j2', ipsec)
     render(charon_dhcp_conf, 'ipsec/charon/dhcp.conf.j2', ipsec)
     render(charon_radius_conf, 'ipsec/charon/eap-radius.conf.j2', ipsec)
+    render(charon_systemd_conf, 'ipsec/charon_systemd.conf.j2', ipsec)
     render(interface_conf, 'ipsec/interfaces_use.conf.j2', ipsec)
     render(swanctl_conf, 'ipsec/swanctl.conf.j2', ipsec)
 
diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py
index 04ccbcec3..d6f5e4c28 100755
--- a/src/conf_mode/vpn_l2tp.py
+++ b/src/conf_mode/vpn_l2tp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/vpn_openconnect.py b/src/conf_mode/vpn_openconnect.py
index 42785134f..78cdaa179 100755
--- a/src/conf_mode/vpn_openconnect.py
+++ b/src/conf_mode/vpn_openconnect.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -37,19 +37,22 @@ from passlib.hash import sha512_crypt
 from time import sleep
 
 from vyos import airbag
+
 airbag.enable()
 
-cfg_dir        = '/run/ocserv'
-ocserv_conf    = cfg_dir + '/ocserv.conf'
-ocserv_passwd  = cfg_dir + '/ocpasswd'
+cfg_dir = '/run/ocserv'
+ocserv_conf = cfg_dir + '/ocserv.conf'
+ocserv_passwd = cfg_dir + '/ocpasswd'
 ocserv_otp_usr = cfg_dir + '/users.oath'
-radius_cfg     = cfg_dir + '/radiusclient.conf'
+radius_cfg = cfg_dir + '/radiusclient.conf'
 radius_servers = cfg_dir + '/radius_servers'
 
+
 # Generate hash from user cleartext password
 def get_hash(password):
     return sha512_crypt.hash(password)
 
+
 def get_config(config=None):
     if config:
         conf = config
@@ -59,78 +62,133 @@ def get_config(config=None):
     if not conf.exists(base):
         return None
 
-    ocserv = conf.get_config_dict(base, key_mangling=('-', '_'),
-                                  get_first_key=True,
-                                  with_recursive_defaults=True,
-                                  with_pki=True)
+    ocserv = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        with_recursive_defaults=True,
+        with_pki=True,
+    )
 
     return ocserv
 
+
 def verify(ocserv):
     if ocserv is None:
         return None
     # Check if listen-ports not binded other services
     # It can be only listen by 'ocserv-main'
     for proto, port in ocserv.get('listen_ports').items():
-        if check_port_availability(ocserv['listen_address'], int(port), proto) is not True and \
-                not is_listen_port_bind_service(int(port), 'ocserv-main'):
+        if check_port_availability(
+            ocserv['listen_address'], int(port), proto
+        ) is not True and not is_listen_port_bind_service(int(port), 'ocserv-main'):
             raise ConfigError(f'"{proto}" port "{port}" is used by another service')
 
     # Check accounting
-    if "accounting" in ocserv:
-        if "mode" in ocserv["accounting"] and "radius" in ocserv["accounting"]["mode"]:
-            if not origin["accounting"]['radius']['server']:
-                raise ConfigError('OpenConnect accounting mode radius requires at least one RADIUS server')
-            if "authentication" not in ocserv or "mode" not in ocserv["authentication"]:
-                raise ConfigError('Accounting depends on OpenConnect authentication configuration')
-            elif "radius" not in ocserv["authentication"]["mode"]:
-                raise ConfigError('RADIUS accounting must be used with RADIUS authentication')
+    if 'accounting' in ocserv:
+        if 'mode' in ocserv['accounting'] and 'radius' in ocserv['accounting']['mode']:
+            if not ocserv['accounting']['radius']['server']:
+                raise ConfigError(
+                    'OpenConnect accounting mode radius requires at least one RADIUS server'
+                )
+            if 'authentication' not in ocserv or 'mode' not in ocserv['authentication']:
+                raise ConfigError(
+                    'Accounting depends on OpenConnect authentication configuration'
+                )
+            elif 'radius' not in ocserv['authentication']['mode']:
+                raise ConfigError(
+                    'RADIUS accounting must be used with RADIUS authentication'
+                )
 
     # Check authentication
-    if "authentication" in ocserv:
-        if "mode" in ocserv["authentication"]:
-            if ("local" in ocserv["authentication"]["mode"] and
-                "radius" in ocserv["authentication"]["mode"]):
-                    raise ConfigError('OpenConnect authentication modes are mutually-exclusive, remove either local or radius from your configuration')
-            if "radius" in ocserv["authentication"]["mode"]:
-                if not ocserv["authentication"]['radius']['server']:
-                    raise ConfigError('OpenConnect authentication mode radius requires at least one RADIUS server')
-            if "local" in ocserv["authentication"]["mode"]:
-                if not ocserv.get("authentication", {}).get("local_users"):
-                    raise ConfigError('OpenConnect mode local required at least one user')
-                if not ocserv["authentication"]["local_users"]["username"]:
-                    raise ConfigError('OpenConnect mode local required at least one user')
+    if 'authentication' in ocserv:
+        if 'mode' in ocserv['authentication']:
+            if (
+                'local' in ocserv['authentication']['mode']
+                and 'radius' in ocserv['authentication']['mode']
+            ):
+                raise ConfigError(
+                    'OpenConnect authentication modes are mutually-exclusive, remove either local or radius from your configuration'
+                )
+            if 'radius' in ocserv['authentication']['mode']:
+                if 'server' not in ocserv['authentication']['radius']:
+                    raise ConfigError(
+                        'OpenConnect authentication mode radius requires at least one RADIUS server'
+                    )
+            if 'local' in ocserv['authentication']['mode']:
+                if not ocserv.get('authentication', {}).get('local_users'):
+                    raise ConfigError(
+                        'OpenConnect mode local required at least one user'
+                    )
+                if not ocserv['authentication']['local_users']['username']:
+                    raise ConfigError(
+                        'OpenConnect mode local required at least one user'
+                    )
                 else:
                     # For OTP mode: verify that each local user has an OTP key
-                    if "otp" in ocserv["authentication"]["mode"]["local"]:
+                    if 'otp' in ocserv['authentication']['mode']['local']:
                         users_wo_key = []
-                        for user, user_config in ocserv["authentication"]["local_users"]["username"].items():
+                        for user, user_config in ocserv['authentication'][
+                            'local_users'
+                        ]['username'].items():
                             # User has no OTP key defined
-                            if dict_search('otp.key', user_config) == None:
+                            if dict_search('otp.key', user_config) is None:
                                 users_wo_key.append(user)
                         if users_wo_key:
-                            raise ConfigError(f'OTP enabled, but no OTP key is configured for these users:\n{users_wo_key}')
+                            raise ConfigError(
+                                f'OTP enabled, but no OTP key is configured for these users:\n{users_wo_key}'
+                            )
                     # For password (and default) mode: verify that each local user has password
-                    if "password" in ocserv["authentication"]["mode"]["local"] or "otp" not in ocserv["authentication"]["mode"]["local"]:
+                    if (
+                        'password' in ocserv['authentication']['mode']['local']
+                        or 'otp' not in ocserv['authentication']['mode']['local']
+                    ):
                         users_wo_pswd = []
-                        for user in ocserv["authentication"]["local_users"]["username"]:
-                            if not "password" in ocserv["authentication"]["local_users"]["username"][user]:
+                        for user in ocserv['authentication']['local_users']['username']:
+                            if (
+                                'password'
+                                not in ocserv['authentication']['local_users'][
+                                    'username'
+                                ][user]
+                            ):
                                 users_wo_pswd.append(user)
                         if users_wo_pswd:
-                            raise ConfigError(f'password required for users:\n{users_wo_pswd}')
+                            raise ConfigError(
+                                f'password required for users:\n{users_wo_pswd}'
+                            )
 
             # Validate that if identity-based-config is configured all child config nodes are set
-            if 'identity_based_config' in ocserv["authentication"]:
-                if 'disabled' not in ocserv["authentication"]["identity_based_config"]:
-                    Warning("Identity based configuration files is a 3rd party addition. Use at your own risk, this might break the ocserv daemon!")
-                    if 'mode' not in ocserv["authentication"]["identity_based_config"]:
-                        raise ConfigError('OpenConnect radius identity-based-config enabled but mode not selected')
-                    elif 'group' in ocserv["authentication"]["identity_based_config"]["mode"] and "radius" not in ocserv["authentication"]["mode"]:
-                        raise ConfigError('OpenConnect config-per-group must be used with radius authentication')
-                    if 'directory' not in ocserv["authentication"]["identity_based_config"]:
-                        raise ConfigError('OpenConnect identity-based-config enabled but directory not set')
-                    if 'default_config' not in ocserv["authentication"]["identity_based_config"]:
-                        raise ConfigError('OpenConnect identity-based-config enabled but default-config not set')
+            if 'identity_based_config' in ocserv['authentication']:
+                if 'disabled' not in ocserv['authentication']['identity_based_config']:
+                    Warning(
+                        'Identity based configuration files is a 3rd party addition. Use at your own risk, this might break the ocserv daemon!'
+                    )
+                    if 'mode' not in ocserv['authentication']['identity_based_config']:
+                        raise ConfigError(
+                            'OpenConnect radius identity-based-config enabled but mode not selected'
+                        )
+                    elif (
+                        'group'
+                        in ocserv['authentication']['identity_based_config']['mode']
+                        and 'radius' not in ocserv['authentication']['mode']
+                    ):
+                        raise ConfigError(
+                            'OpenConnect config-per-group must be used with radius authentication'
+                        )
+                    if (
+                        'directory'
+                        not in ocserv['authentication']['identity_based_config']
+                    ):
+                        raise ConfigError(
+                            'OpenConnect identity-based-config enabled but directory not set'
+                        )
+                    if (
+                        'default_config'
+                        not in ocserv['authentication']['identity_based_config']
+                    ):
+                        raise ConfigError(
+                            'OpenConnect identity-based-config enabled but default-config not set'
+                        )
         else:
             raise ConfigError('OpenConnect authentication mode required')
     else:
@@ -149,94 +207,162 @@ def verify(ocserv):
             verify_pki_ca_certificate(ocserv, ca_cert)
 
     # Check network settings
-    if "network_settings" in ocserv:
-        if "push_route" in ocserv["network_settings"]:
+    if 'network_settings' in ocserv:
+        if 'push_route' in ocserv['network_settings']:
             # Replace default route
-            if "0.0.0.0/0" in ocserv["network_settings"]["push_route"]:
-                ocserv["network_settings"]["push_route"].remove("0.0.0.0/0")
-                ocserv["network_settings"]["push_route"].append("default")
+            if '0.0.0.0/0' in ocserv['network_settings']['push_route']:
+                ocserv['network_settings']['push_route'].remove('0.0.0.0/0')
+                ocserv['network_settings']['push_route'].append('default')
         else:
-            ocserv["network_settings"]["push_route"] = ["default"]
+            ocserv['network_settings']['push_route'] = ['default']
     else:
         raise ConfigError('OpenConnect network settings required!')
 
+
 def generate(ocserv):
     if not ocserv:
         return None
 
-    if "radius" in ocserv["authentication"]["mode"]:
+    if 'radius' in ocserv['authentication']['mode']:
         if dict_search(ocserv, 'accounting.mode.radius'):
             # Render radius client configuration
             render(radius_cfg, 'ocserv/radius_conf.j2', ocserv)
-            merged_servers = ocserv["accounting"]["radius"]["server"] | ocserv["authentication"]["radius"]["server"]
+            merged_servers = (
+                ocserv['accounting']['radius']['server']
+                | ocserv['authentication']['radius']['server']
+            )
             # Render radius servers
             # Merge the accounting and authentication servers into a single dictionary
-            render(radius_servers, 'ocserv/radius_servers.j2', {'server': merged_servers})
+            render(
+                radius_servers, 'ocserv/radius_servers.j2', {'server': merged_servers}
+            )
         else:
             # Render radius client configuration
             render(radius_cfg, 'ocserv/radius_conf.j2', ocserv)
             # Render radius servers
-            render(radius_servers, 'ocserv/radius_servers.j2', ocserv["authentication"]["radius"])
-    elif "local" in ocserv["authentication"]["mode"]:
+            render(
+                radius_servers,
+                'ocserv/radius_servers.j2',
+                ocserv['authentication']['radius'],
+            )
+    elif 'local' in ocserv['authentication']['mode']:
         # if mode "OTP", generate OTP users file parameters
-        if "otp" in ocserv["authentication"]["mode"]["local"]:
-            if "local_users" in ocserv["authentication"]:
-                for user in ocserv["authentication"]["local_users"]["username"]:
+        if 'otp' in ocserv['authentication']['mode']['local']:
+            if 'local_users' in ocserv['authentication']:
+                for user in ocserv['authentication']['local_users']['username']:
                     # OTP token type from CLI parameters:
-                    otp_interval = str(ocserv["authentication"]["local_users"]["username"][user]["otp"].get("interval"))
-                    token_type = ocserv["authentication"]["local_users"]["username"][user]["otp"].get("token_type")
-                    otp_length = str(ocserv["authentication"]["local_users"]["username"][user]["otp"].get("otp_length"))
-                    if token_type == "hotp-time":
-                        otp_type = "HOTP/T" + otp_interval
-                    elif token_type == "hotp-event":
-                        otp_type = "HOTP/E"
+                    otp_interval = str(
+                        ocserv['authentication']['local_users']['username'][user][
+                            'otp'
+                        ].get('interval')
+                    )
+                    token_type = ocserv['authentication']['local_users']['username'][
+                        user
+                    ]['otp'].get('token_type')
+                    otp_length = str(
+                        ocserv['authentication']['local_users']['username'][user][
+                            'otp'
+                        ].get('otp_length')
+                    )
+                    if token_type == 'hotp-time':
+                        otp_type = 'HOTP/T' + otp_interval
+                    elif token_type == 'hotp-event':
+                        otp_type = 'HOTP/E'
                     else:
-                        otp_type = "HOTP/T" + otp_interval
-                    ocserv["authentication"]["local_users"]["username"][user]["otp"]["token_tmpl"] = otp_type + "/" + otp_length
+                        otp_type = 'HOTP/T' + otp_interval
+                    ocserv['authentication']['local_users']['username'][user]['otp'][
+                        'token_tmpl'
+                    ] = otp_type + '/' + otp_length
         # if there is a password, generate hash
-        if "password" in ocserv["authentication"]["mode"]["local"] or not "otp" in ocserv["authentication"]["mode"]["local"]:
-            if "local_users" in ocserv["authentication"]:
-                for user in ocserv["authentication"]["local_users"]["username"]:
-                    ocserv["authentication"]["local_users"]["username"][user]["hash"] = get_hash(ocserv["authentication"]["local_users"]["username"][user]["password"])
-
-        if "password-otp" in ocserv["authentication"]["mode"]["local"]:
+        if (
+            'password' in ocserv['authentication']['mode']['local']
+            or 'otp' not in ocserv['authentication']['mode']['local']
+        ):
+            if 'local_users' in ocserv['authentication']:
+                for user in ocserv['authentication']['local_users']['username']:
+                    ocserv['authentication']['local_users']['username'][user][
+                        'hash'
+                    ] = get_hash(
+                        ocserv['authentication']['local_users']['username'][user][
+                            'password'
+                        ]
+                    )
+
+        if 'password-otp' in ocserv['authentication']['mode']['local']:
             # Render local users ocpasswd
-            render(ocserv_passwd, 'ocserv/ocserv_passwd.j2', ocserv["authentication"]["local_users"])
+            render(
+                ocserv_passwd,
+                'ocserv/ocserv_passwd.j2',
+                ocserv['authentication']['local_users'],
+            )
             # Render local users OTP keys
-            render(ocserv_otp_usr, 'ocserv/ocserv_otp_usr.j2', ocserv["authentication"]["local_users"])
-        elif "password" in ocserv["authentication"]["mode"]["local"]:
+            render(
+                ocserv_otp_usr,
+                'ocserv/ocserv_otp_usr.j2',
+                ocserv['authentication']['local_users'],
+            )
+        elif 'password' in ocserv['authentication']['mode']['local']:
             # Render local users ocpasswd
-            render(ocserv_passwd, 'ocserv/ocserv_passwd.j2', ocserv["authentication"]["local_users"])
-        elif "otp" in ocserv["authentication"]["mode"]["local"]:
+            render(
+                ocserv_passwd,
+                'ocserv/ocserv_passwd.j2',
+                ocserv['authentication']['local_users'],
+            )
+        elif 'otp' in ocserv['authentication']['mode']['local']:
             # Render local users OTP keys
-            render(ocserv_otp_usr, 'ocserv/ocserv_otp_usr.j2', ocserv["authentication"]["local_users"])
+            render(
+                ocserv_otp_usr,
+                'ocserv/ocserv_otp_usr.j2',
+                ocserv['authentication']['local_users'],
+            )
         else:
             # Render local users ocpasswd
-            render(ocserv_passwd, 'ocserv/ocserv_passwd.j2', ocserv["authentication"]["local_users"])
+            render(
+                ocserv_passwd,
+                'ocserv/ocserv_passwd.j2',
+                ocserv['authentication']['local_users'],
+            )
     else:
-        if "local_users" in ocserv["authentication"]:
-            for user in ocserv["authentication"]["local_users"]["username"]:
-                ocserv["authentication"]["local_users"]["username"][user]["hash"] = get_hash(ocserv["authentication"]["local_users"]["username"][user]["password"])
+        if 'local_users' in ocserv['authentication']:
+            for user in ocserv['authentication']['local_users']['username']:
+                ocserv['authentication']['local_users']['username'][user]['hash'] = (
+                    get_hash(
+                        ocserv['authentication']['local_users']['username'][user][
+                            'password'
+                        ]
+                    )
+                )
             # Render local users
-            render(ocserv_passwd, 'ocserv/ocserv_passwd.j2', ocserv["authentication"]["local_users"])
+            render(
+                ocserv_passwd,
+                'ocserv/ocserv_passwd.j2',
+                ocserv['authentication']['local_users'],
+            )
 
-    if "ssl" in ocserv:
+    if 'ssl' in ocserv:
         cert_file_path = os.path.join(cfg_dir, 'cert.pem')
         cert_key_path = os.path.join(cfg_dir, 'cert.key')
 
-
         if 'certificate' in ocserv['ssl']:
             cert_name = ocserv['ssl']['certificate']
             pki_cert = ocserv['pki']['certificate'][cert_name]
 
             loaded_pki_cert = load_certificate(pki_cert['certificate'])
-            loaded_ca_certs = {load_certificate(c['certificate'])
-                for c in ocserv['pki']['ca'].values()} if 'ca' in ocserv['pki'] else {}
+            loaded_ca_certs = (
+                {
+                    load_certificate(c['certificate'])
+                    for c in ocserv['pki']['ca'].values()
+                }
+                if 'ca' in ocserv['pki']
+                else {}
+            )
 
             cert_full_chain = find_chain(loaded_pki_cert, loaded_ca_certs)
 
-            write_file(cert_file_path,
-                '\n'.join(encode_certificate(c) for c in cert_full_chain))
+            write_file(
+                cert_file_path,
+                '\n'.join(encode_certificate(c) for c in cert_full_chain),
+            )
 
             if 'private' in pki_cert and 'key' in pki_cert['private']:
                 write_file(cert_key_path, wrap_private_key(pki_cert['private']['key']))
@@ -250,7 +376,8 @@ def generate(ocserv):
                 loaded_ca_cert = load_certificate(pki_ca_cert['certificate'])
                 ca_full_chain = find_chain(loaded_ca_cert, loaded_ca_certs)
                 ca_chains.append(
-                    '\n'.join(encode_certificate(c) for c in ca_full_chain))
+                    '\n'.join(encode_certificate(c) for c in ca_full_chain)
+                )
 
             write_file(ca_cert_file_path, '\n'.join(ca_chains))
 
@@ -269,11 +396,13 @@ def apply(ocserv):
         counter = 0
         while True:
             # exit early when service runs
-            if is_systemd_service_running("ocserv.service"):
+            if is_systemd_service_running('ocserv.service'):
                 break
             sleep(0.250)
             if counter > 5:
-                raise ConfigError('OpenConnect failed to start, check the logs for details')
+                raise ConfigError(
+                    'OpenConnect failed to start, check the logs for details'
+                )
                 break
             counter += 1
 
diff --git a/src/conf_mode/vpn_pptp.py b/src/conf_mode/vpn_pptp.py
index c0d8330bd..c11619779 100755
--- a/src/conf_mode/vpn_pptp.py
+++ b/src/conf_mode/vpn_pptp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py
index 7490fd0e0..5382fc711 100755
--- a/src/conf_mode/vpn_sstp.py
+++ b/src/conf_mode/vpn_sstp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/conf_mode/vpp.py b/src/conf_mode/vpp.py
new file mode 100755
index 000000000..9517f85f3
--- /dev/null
+++ b/src/conf_mode/vpp.py
@@ -0,0 +1,735 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from pathlib import Path
+
+from pyroute2.iproute import IPRoute
+
+try:
+    from vpp_papi import VPPIOError, VPPValueError
+except ImportError:  # pylint: disable=import-error
+    VPPIOError = VPPValueError = None
+
+from vyos import ConfigError
+from vyos import airbag
+from vyos.base import Warning
+from vyos.config import Config, config_dict_merge
+from vyos.configdep import set_dependents, call_dependents
+from vyos.configdict import node_changed, leaf_node_changed
+from vyos.ifconfig import Section
+from vyos.logger import getLogger
+from vyos.template import render
+from vyos.utils.boot import boot_configuration_complete
+from vyos.utils.kernel import check_kmod
+from vyos.utils.kernel import unload_kmod
+from vyos.utils.kernel import list_loaded_modules
+from vyos.utils.process import call
+
+from vyos.vpp import VPPControl
+from vyos.vpp import control_host
+from vyos.vpp.config_deps import deps_xconnect_dict
+from vyos.vpp.config_verify import (
+    verify_dev_driver,
+    verify_vpp_minimum_cpus,
+    verify_vpp_minimum_memory,
+    verify_vpp_settings_cpu_and_corelist_workers,
+    verify_vpp_settings_cpu_corelist_workers,
+    verify_vpp_cpu_main_core,
+    verify_vpp_settings_cpu_skip_cores,
+    verify_vpp_settings_cpu_workers,
+    verify_vpp_nat44_workers,
+    verify_vpp_memory,
+    verify_vpp_statseg_size,
+    verify_vpp_interfaces_dpdk_num_queues,
+    verify_routes_count,
+    verify_vpp_main_heap_size,
+)
+from vyos.vpp.config_filter import iface_filter_eth
+from vyos.vpp.utils import EthtoolGDrvinfo
+from vyos.vpp.configdb import JSONStorage
+
+airbag.enable()
+
+service_name = 'vpp'
+service_conf = Path(f'/run/vpp/{service_name}.conf')
+systemd_override = '/run/systemd/system/vpp.service.d/10-override.conf'
+
+vpp_log = getLogger(
+    service_name, format='%(filename)s[%(process)d]: %(message)s', address='/dev/log'
+)
+
+dependency_interface_type_map = {
+    'vpp_interfaces_bonding': 'bonding',
+    'vpp_interfaces_bridge': 'bridge',
+    'vpp_interfaces_ethernet': 'ethernet',
+    'vpp_interfaces_geneve': 'geneve',
+    'vpp_interfaces_gre': 'gre',
+    'vpp_interfaces_ipip': 'ipip',
+    'vpp_interfaces_loopback': 'loopback',
+    'vpp_interfaces_vxlan': 'vxlan',
+    'vpp_interfaces_xconnect': 'xconnect',
+}
+
+# dict of drivers that needs to be overrided
+override_drivers: dict[str, str] = {
+    'hv_netvsc': 'uio_hv_generic',
+    'ena': 'vfio-pci',
+}
+
+# drivers that does not use PCIe addresses
+not_pci_drv: list[str] = ['hv_netvsc']
+
+# drivers that support interrupt RX mode for DPDK and XDP
+drivers_support_interrupt: dict[str, list] = {
+    'atlantic': ['dpdk', 'xdp'],
+    'bnx2x': ['dpdk'],
+    'e1000': ['dpdk'],
+    'ena': ['dpdk', 'xdp'],
+    'i40e': ['dpdk', 'xdp'],
+    'ice': ['dpdk', 'xdp'],
+    'igb': ['xdp'],
+    'igc': ['dpdk', 'xdp'],
+    'ixgbe': ['dpdk', 'xdp'],
+    'qede': ['dpdk', 'xdp'],
+    'vmxnet3': ['xdp'],
+    'virtio_net': ['xdp'],
+}
+
+
+def _load_module(module_name: str):
+    """
+    Load a kernel module
+
+    Args:
+        module_name (str): Name of the module to load.
+    """
+    if module_name in list_loaded_modules():
+        vpp_log.info(f"Module '{module_name}' is alrady loaded")
+        return
+    try:
+        check_kmod(module_name)
+        vpp_log.info(f"Module '{module_name}' loaded successfully")
+    except Exception as e:
+        vpp_log.error(f"Failed to load module '{module_name}': {e}")
+        raise
+
+
+def _unload_module(module_name: str):
+    """
+    Unload a kernel module
+
+    Args:
+        module_name (str): Name of the module to unload.
+    """
+    if module_name not in list_loaded_modules():
+        vpp_log.info(f"Module '{module_name}' is not loaded")
+        return
+    try:
+        unload_kmod(module_name)
+        vpp_log.info(f"Module '{module_name}' unloaded successfully")
+    except Exception as e:
+        vpp_log.error(f"Failed to unload module '{module_name}': {e}")
+        raise
+
+
+def get_config(config=None):
+    # use persistent config to store interfaces data between executions
+    # this is required because some interfaces after they are connected
+    # to VPP is really hard or impossible to restore without knowing
+    # their original parameters (like IDs)
+    persist_config = JSONStorage('vpp_conf')
+    eth_ifaces_persist: dict[str, dict[str, str]] = persist_config.read(
+        'eth_ifaces', {}
+    )
+
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp']
+    base_settings = ['vpp', 'settings']
+
+    # find interfaces removed from VPP
+    effective_config = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    xconn_members = deps_xconnect_dict(conf)
+
+    removed_ifaces = []
+    tmp = node_changed(conf, base_settings + ['interface'])
+    if tmp:
+        for removed_iface in tmp:
+            to_append = {
+                'iface_name': removed_iface,
+                'driver': effective_config['settings']['interface'][removed_iface][
+                    'driver'
+                ],
+            }
+            removed_ifaces.append(to_append)
+            # add an interface to a list of interfaces that need
+            # to be reinitialized after the commit
+            set_dependents('ethernet', conf, removed_iface)
+
+    # NAT dependency
+    if conf.exists(['vpp', 'nat44']):
+        set_dependents('vpp_nat', conf)
+    if conf.exists(['vpp', 'nat', 'cgnat']):
+        set_dependents('vpp_nat_cgnat', conf)
+
+    # sFlow dependency
+    if conf.exists(['vpp', 'sflow']):
+        set_dependents('vpp_sflow', conf)
+
+    # ACL dependency
+    if conf.exists(['vpp', 'acl']):
+        set_dependents('vpp_acl', conf)
+
+    if not conf.exists(base):
+        return {
+            'removed_ifaces': removed_ifaces,
+            'xconn_members': xconn_members,
+            'persist_config': eth_ifaces_persist,
+        }
+
+    config = conf.get_config_dict(
+        base,
+        get_first_key=True,
+        key_mangling=('-', '_'),
+        no_tag_node_value_mangle=True,
+    )
+
+    # Get default values which we need to conditionally update into the
+    # dictionary retrieved.
+    default_values = conf.get_config_defaults(**config.kwargs, recursive=True)
+
+    # delete 'xdp-options' from defaults if driver is DPDK
+    for iface, iface_config in config.get('settings', {}).get('interface', {}).items():
+        if iface_config.get('driver') == 'dpdk':
+            del default_values['settings']['interface'][iface]['xdp_options']
+
+    config = config_dict_merge(default_values, config)
+
+    # Ignore default XML values if config doesn't exists
+    if not conf.exists(base_settings + ['ipsec']):
+        del config['settings']['ipsec']
+
+    # add running config
+    if effective_config:
+        default_values_effective = conf.get_config_defaults(
+            **effective_config.kwargs, recursive=True
+        )
+        config['effective'] = config_dict_merge(
+            default_values_effective, effective_config
+        )
+
+    if 'settings' in config:
+        if 'interface' in config['settings']:
+            for iface, iface_config in config['settings']['interface'].items():
+                # Driver must be configured to continue
+                if 'driver' not in iface_config:
+                    raise ConfigError(
+                        f'"driver" must be configured for {iface} interface!'
+                    )
+
+                old_driver = leaf_node_changed(
+                    conf, base_settings + ['interface', iface, 'driver']
+                )
+
+                # Get current kernel module, required for extra verification and
+                # logic for VMBus interfaces
+                config['settings']['interface'][iface]['kernel_module'] = (
+                    EthtoolGDrvinfo(iface).driver
+                )
+
+                # filter unsupported config nodes
+                iface_filter_eth(conf, iface)
+                set_dependents('ethernet', conf, iface)
+                # Interfaces with changed driver should be removed/readded
+                if old_driver and old_driver[0] == 'dpdk':
+                    removed_ifaces.append(
+                        {
+                            'iface_name': iface,
+                            'driver': 'dpdk',
+                        }
+                    )
+
+                # Get PCI address or device ID
+                if iface_config['driver'] == 'dpdk':
+                    if 'dpdk_options' not in iface_config:
+                        iface_config['dpdk_options'] = {}
+                    # Check in a persistent config first
+                    id_from_persisten_conf = eth_ifaces_persist.get(iface, {}).get(
+                        'dev_id'
+                    )
+                    if id_from_persisten_conf:
+                        iface_config['dpdk_options']['dev_id'] = id_from_persisten_conf
+                    else:
+                        try:
+                            iface_to_search = iface
+                            if old_driver and old_driver[0] == 'xdp':
+                                iface_to_search = f'defunct_{iface}'
+                            iface_config['dpdk_options']['dev_id'] = (
+                                control_host.get_dev_id(iface_to_search)
+                            )
+                        except Exception:
+                            # Return empty address if all attempts failed
+                            # We will catch this in verify()
+                            iface_config['dpdk_options']['dev_id'] = ''
+                # prepare XDP interface parameters
+                if iface_config['driver'] == 'xdp':
+                    xdp_api_params = {
+                        'rxq_size': int(iface_config['xdp_options']['rx_queue_size']),
+                        'txq_size': int(iface_config['xdp_options']['tx_queue_size']),
+                    }
+                    if iface_config['xdp_options']['num_rx_queues'] == 'all':
+                        xdp_api_params['rxq_num'] = 0
+                    else:
+                        xdp_api_params['rxq_num'] = int(
+                            iface_config['xdp_options']['num_rx_queues']
+                        )
+                    if 'zero-copy' in iface_config['xdp_options']:
+                        xdp_api_params['mode'] = 'zero-copy'
+                    if 'zero-copy' in iface_config['xdp_options']:
+                        xdp_api_params['flags'] = 'no_syscall_lock'
+                    iface_config['xdp_api_params'] = xdp_api_params
+
+    if removed_ifaces:
+        config['removed_ifaces'] = removed_ifaces
+        config['xconn_members'] = xconn_members
+
+    # Dependencies
+    for dependency, interface_type in dependency_interface_type_map.items():
+        # if conf.exists(base + ['interfaces', interface_type]):
+        if effective_config.get('interfaces', {}).get(interface_type):
+            for iface, iface_config in (
+                config.get('interfaces', {}).get(interface_type, {}).items()
+            ):
+                # filter unsupported config nodes
+                if interface_type == 'ethernet':
+                    iface_filter_eth(conf, iface)
+                set_dependents(dependency, conf, iface)
+
+    # Save important info about all interfaces that cannot be retrieved later
+    # Add new interfaces (only if they are first time seen in a config)
+    for iface, iface_config in config.get('settings', {}).get('interface', {}).items():
+        if iface not in effective_config.get('settings', {}).get('interface', {}):
+            eth_ifaces_persist[iface] = {
+                'original_driver': config['settings']['interface'][iface][
+                    'kernel_module'
+                ],
+            }
+            eth_ifaces_persist[iface]['bus_id'] = control_host.get_bus_name(iface)
+            eth_ifaces_persist[iface]['dev_id'] = control_host.get_dev_id(iface)
+
+    # Get kernel settings for hugepages
+    kernel_memory_settings = conf.get_config_dict(
+        ['system', 'option', 'kernel', 'memory'],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+    config['kernel_memory_settings'] = kernel_memory_settings
+
+    # Return to config dictionary
+    config['persist_config'] = eth_ifaces_persist
+
+    return config
+
+
+def verify(config):
+    # bail out early - looks like removal from running config
+    if not config or ('removed_ifaces' in config and 'settings' not in config):
+        return None
+
+    if 'settings' not in config:
+        raise ConfigError('"settings interface" is required but not set!')
+
+    if 'interface' not in config['settings']:
+        raise ConfigError('"settings interface" is required but not set!')
+
+    # check if the system meets minimal requirements
+    verify_vpp_minimum_cpus()
+    verify_vpp_minimum_memory()
+
+    # check if Ethernet interfaces exist
+    ethernet_ifaces = Section.interfaces('ethernet')
+    for iface in config['settings']['interface'].keys():
+        if iface not in ethernet_ifaces:
+            raise ConfigError(f'Interface {iface} does not exist or is not Ethernet!')
+
+    # Resource usage checks
+    workers = 0
+
+    if 'cpu' in config['settings']:
+        cpu_settings = config['settings']['cpu']
+
+        # Check if there are enough CPU cores to skip according to config
+        if 'skip_cores' in cpu_settings:
+            skip_cores = int(cpu_settings['skip_cores'])
+            verify_vpp_settings_cpu_skip_cores(skip_cores)
+
+        # Check whether the workers and corelist-workers are configured properly
+        verify_vpp_settings_cpu_and_corelist_workers(cpu_settings)
+
+        # Check if there are enough CPU cores to add workers
+        if 'workers' in cpu_settings:
+            workers = verify_vpp_settings_cpu_workers(cpu_settings)
+
+        if 'main_core' in cpu_settings:
+            verify_vpp_cpu_main_core(cpu_settings)
+
+        # Check the CPU main core not falling to the corelist-workers
+        if 'corelist_workers' in cpu_settings:
+            workers = verify_vpp_settings_cpu_corelist_workers(cpu_settings)
+
+    if 'workers' in config['settings']['nat44']:
+        verify_vpp_nat44_workers(
+            workers=workers, nat44_workers=config['settings']['nat44']['workers']
+        )
+
+    verify_vpp_main_heap_size(config['settings'])
+    verify_vpp_statseg_size(config['settings'])
+
+    # Check if available memory is enough for current VPP config
+    verify_vpp_memory(config)
+
+    # ensure DPDK/XDP settings are properly configured
+    for iface, iface_config in config['settings']['interface'].items():
+        # check if selected driver is supported, but only for new interfaces
+        if iface not in config.get('effective', {}).get('settings', {}).get(
+            'interface', {}
+        ):
+            if not verify_dev_driver(iface, iface_config['driver']):
+                raise ConfigError(
+                    f'Driver {iface_config["driver"]} is not compatible with interface {iface}!'
+                )
+        if iface_config['driver'] == 'xdp' and 'xdp_options' in iface_config:
+            if iface_config['xdp_options']['num_rx_queues'] != 'all':
+                Warning(f'Not all RX queues will be connected to VPP for {iface}!')
+
+        if iface_config['driver'] == 'xdp' and 'dpdk_options' in iface_config:
+            raise ConfigError('DPDK options are not applicable for XDP driver!')
+
+        if iface_config['driver'] == 'dpdk' and 'xdp_options' in iface_config:
+            raise ConfigError('XDP options are not applicable for DPDK driver!')
+
+        if iface_config['driver'] == 'dpdk' and 'dpdk_options' in iface_config:
+            if 'num_rx_queues' in iface_config['dpdk_options']:
+                rx_queues = int(iface_config['dpdk_options']['num_rx_queues'])
+                verify_vpp_interfaces_dpdk_num_queues(
+                    qtype='receive', num_queues=rx_queues, workers=workers
+                )
+
+            if 'num_tx_queues' in iface_config['dpdk_options']:
+                tx_queues = int(iface_config['dpdk_options']['num_tx_queues'])
+                verify_vpp_interfaces_dpdk_num_queues(
+                    qtype='transmit', num_queues=tx_queues, workers=workers
+                )
+
+        # RX-mode verification
+        rx_mode = iface_config.get('rx_mode')
+        if rx_mode and rx_mode != 'polling':
+            # By default drivers operate in polling mode. Not all NIC drivers support
+            # RX mode interrupt and adaptive
+            driver = config.get('persist_config').get(iface).get('original_driver')
+            if (
+                driver not in drivers_support_interrupt
+                or iface_config['driver'] not in drivers_support_interrupt[driver]
+            ):
+                raise ConfigError(
+                    f'RX mode {rx_mode} is not supported for interface {iface}'
+                )
+
+    # check GRE tunnels as part of the bridge, only tunnel-type teb is allowed
+    #   set vpp interfaces bridge br1 member interface gre1
+    #   set vpp interfaces gre gre1 tunnel-type teb
+    if 'interfaces' in config:
+        if 'bridge' in config['interfaces']:
+            for iface, iface_config in config['interfaces']['bridge'].items():
+                if 'member' in iface_config:
+                    for member in iface_config['member'].get('interface', []):
+                        if member.startswith('gre'):
+                            if (
+                                'gre' in config['interfaces']
+                                and config['interfaces']['gre']
+                                .get(member, {})
+                                .get('tunnel_type')
+                                != 'teb'
+                            ):
+                                raise ConfigError(
+                                    f'Only tunnel-type teb is allowed for GRE interfaces in bridge {iface}'
+                                )
+
+        # Only one multipoint GRE tunnel is allowed from the same source address
+        #   set vpp interfaces gre gre0 mode 'point-to-multipoint'
+        #   set vpp interfaces gre gre0 remote '0.0.0.0'
+        #   set vpp interfaces gre gre0 source-address '192.0.2.1'
+        #   set vpp interfaces gre gre1 mode 'point-to-multipoint'
+        #   set vpp interfaces gre gre1 remote '0.0.0.0'
+        #   set vpp interfaces gre gre1 source-address '192.0.2.1'
+        if 'gre' in config['interfaces']:
+            for iface, iface_config in config['interfaces']['gre'].items():
+                if iface_config['mode'] == 'point-to-multipoint':
+                    for other_iface, other_iface_config in config['interfaces'][
+                        'gre'
+                    ].items():
+                        if (
+                            other_iface_config['mode'] == 'point-to-multipoint'
+                            and other_iface_config['source_address']
+                            == iface_config['source_address']
+                            and iface != other_iface
+                        ):
+                            raise ConfigError(
+                                'Only one multipoint GRE tunnel is allowed from the same source address'
+                            )
+
+    # Check if deleted interfaces are not xconnect memebrs
+    for iface_config in config.get('removed_ifaces', []):
+        if iface_config['iface_name'] in config.get('xconn_members', {}):
+            raise ConfigError(
+                f'Interface {iface_config["iface_name"]} is an xconnect member and cannot be removed'
+            )
+
+    verify_routes_count(config['settings'], workers)
+
+
+def generate(config):
+    if not config or ('removed_ifaces' in config and 'settings' not in config):
+        # Remove old config and return
+        service_conf.unlink(missing_ok=True)
+        return None
+
+    render(service_conf, 'vpp/startup.conf.j2', config['settings'])
+    render(systemd_override, 'vpp/override.conf.j2', config)
+
+    return None
+
+
+def initialize_interface(iface, driver, iface_config) -> None:
+    # DPDK - rescan PCI to use a proper driver
+    if driver == 'dpdk' and iface_config['original_driver'] not in not_pci_drv:
+        control_host.pci_rescan(iface_config['dev_id'])
+        # rename to the proper name
+        iface_new_name: str = control_host.get_eth_name(iface_config['dev_id'])
+        control_host.rename_iface(iface_new_name, iface)
+
+    # XDP - rename an interface, disable promisc and XDP
+    if driver == 'xdp':
+        control_host.set_promisc(f'defunct_{iface}', 'off')
+        control_host.rename_iface(f'defunct_{iface}', iface)
+        control_host.xdp_remove(iface)
+
+    # Rename Mellanox NIC to a normal name
+    try:
+        if control_host.get_eth_driver(f'defunct_{iface}') == 'mlx5_core':
+            control_host.rename_iface(f'defunct_{iface}', iface)
+    except FileNotFoundError:
+        pass
+
+    # Replace a driver with original for VMBus interfaces and rename it
+    if driver == 'dpdk' and iface_config['original_driver'] in override_drivers:
+        control_host.override_driver(iface_config['bus_id'], iface_config['dev_id'])
+        iface_new_name: str = control_host.get_eth_name(iface_config['dev_id'])
+        control_host.rename_iface(iface_new_name, iface)
+
+
+def apply(config):
+    # modrpobe modules
+    modules = ('vfio_iommu_type1', 'vfio_pci', 'vfio_pci_core', 'vfio')
+    # Open persistent config
+    # It is required for operations with interfaces
+    persist_config = JSONStorage('vpp_conf')
+    if not config or ('removed_ifaces' in config and 'settings' not in config):
+        # Cleanup persistent config
+        persist_config.delete()
+        # And stop the service
+        call(f'systemctl stop {service_name}.service')
+        # Unlod modules (modprobe -r)
+        for module in modules:
+            _unload_module(module)
+    else:
+        # Some interfaces required extra preparation before VPP can be started
+        if 'settings' in config and 'interface' in config.get('settings'):
+            # modprobe vfio
+            if any(
+                iface_config.get('driver') == 'dpdk'
+                for iface_config in config['settings']['interface'].values()
+            ):
+                for module in modules:
+                    _load_module(module)
+
+            for iface, iface_config in config['settings']['interface'].items():
+                if iface_config['driver'] == 'dpdk':
+                    # ena interfaces require noiommu mode
+                    if iface_config['kernel_module'] == 'ena':
+                        control_host.unsafe_noiommu_mode(True)
+
+                    if iface_config['kernel_module'] in override_drivers:
+                        control_host.override_driver(
+                            config['persist_config'][iface]['bus_id'],
+                            config['persist_config'][iface]['dev_id'],
+                            override_drivers[iface_config['kernel_module']],
+                        )
+
+        call('systemctl daemon-reload')
+        call(f'systemctl restart {service_name}.service')
+
+    # Initialize interfaces removed from VPP
+    for iface in config.get('removed_ifaces', []):
+        initialize_interface(
+            iface['iface_name'],
+            iface['driver'],
+            config['persist_config'][iface['iface_name']],
+        )
+
+        # Remove what is not in the config anymore
+        if iface['iface_name'] not in config.get('settings', {}).get('interface', {}):
+            del config['persist_config'][iface['iface_name']]
+
+    if 'settings' in config and 'interface' in config.get('settings'):
+        # connect to VPP
+        # must be performed multiple attempts because API is not available
+        # immediately after the service restart
+        try:
+            vpp_control = VPPControl(attempts=20, interval=500)
+
+            # preconfigure LCP plugin
+            if 'ignore_kernel_routes' in config.get('settings', {}).get('lcp', {}):
+                vpp_control.cli_cmd('lcp param route-no-paths off')
+            else:
+                vpp_control.cli_cmd('lcp param route-no-paths on')
+            # add interfaces
+            iproute = IPRoute()
+            for iface, iface_config in config['settings']['interface'].items():
+                # promisc option for DPDK interfaces
+                if iface_config['driver'] == 'dpdk':
+                    if 'promisc' in iface_config['dpdk_options']:
+                        if_index = vpp_control.get_sw_if_index(iface)
+                        vpp_control.api.sw_interface_set_promisc(
+                            sw_if_index=if_index, promisc_on=True
+                        )
+                # add XDP interfaces
+                if iface_config['driver'] == 'xdp':
+                    control_host.rename_iface(iface, f'defunct_{iface}')
+                    vpp_control.xdp_iface_create(
+                        host_if=f'defunct_{iface}',
+                        name=iface,
+                        **iface_config['xdp_api_params'],
+                    )
+                    # replicate MAC address of a real interface
+                    real_mac = control_host.get_eth_mac(f'defunct_{iface}')
+                    vpp_control.set_iface_mac(iface, real_mac)
+                    if 'promisc' in iface_config['xdp_options']:
+                        control_host.set_promisc(f'defunct_{iface}', 'on')
+                    control_host.set_status(f'defunct_{iface}', 'up')
+                    control_host.flush_ip(f'defunct_{iface}')
+                # Rename Mellanox interfaces to hide them and create LCP properly
+                if (
+                    iface in Section.interfaces()
+                    and control_host.get_eth_driver(iface) == 'mlx5_core'
+                ):
+                    control_host.rename_iface(iface, f'defunct_{iface}')
+                    control_host.set_status(f'defunct_{iface}', 'up')
+                    control_host.flush_ip(f'defunct_{iface}')
+                # Create lcp
+                if iface not in Section.interfaces():
+                    vpp_control.lcp_pair_add(iface, iface)
+
+                # For unknown reasons, if multiple interfaces later try to be
+                # initialized by configuration scripts, some of them may stuck
+                # in an endless UP/DOWN loop
+                # We found two workarounds - pause initialization (requires
+                # main code modifications).
+                # And this one
+                dev_index = iproute.link_lookup(ifname=iface)[0]
+                iproute.link('set', index=dev_index, state='up')
+
+                # Set rx-mode. Should be configured after interface state set to UP
+                rx_mode = iface_config.get('rx_mode')
+                if rx_mode:
+                    # to hardware side
+                    vpp_control.iface_rxmode(iface, rx_mode)
+                    # to kernel side
+                    lcp_name = vpp_control.lcp_pair_find(vpp_name_hw=iface).get(
+                        'vpp_name_kernel'
+                    )
+                    vpp_control.iface_rxmode(lcp_name, rx_mode)
+
+            # Syncronize routes via LCP
+            vpp_control.lcp_resync()
+
+            # NAT44 settings
+            nat44_settings = config['settings'].get('nat44', {})
+
+            enable_forwarding = True
+            if 'no_forwarding' in nat44_settings:
+                enable_forwarding = False
+            vpp_control.enable_disable_nat44_forwarding(enable_forwarding)
+
+            vpp_control.set_nat44_session_limit(
+                int(nat44_settings.get('session_limit'))
+            )
+
+            if nat44_settings.get('workers'):
+                bitmask = 0
+                for worker_range in nat44_settings['workers']:
+                    worker_numbers = worker_range.split('-')
+                    for wid in range(
+                        int(worker_numbers[0]), int(worker_numbers[-1]) + 1
+                    ):
+                        bitmask |= 1 << wid
+                vpp_control.set_nat_workers(bitmask)
+
+        except (VPPIOError, VPPValueError) as e:
+            # if cannot connect to VPP or an error occurred then
+            # we need to stop vpp service and initialize interfaces
+            call(f'systemctl stop {service_name}.service')
+            for iface, iface_config in config['settings']['interface'].items():
+                initialize_interface(
+                    iface, iface_config['driver'], config['persist_config'][iface]
+                )
+
+            raise ConfigError(
+                f'An error occurred: {e}. '
+                'VPP service will be restarted with the previous configuration'
+            )
+
+    # Save persistent config
+    if 'persist_config' in config and config['persist_config']:
+        persist_config.write('eth_ifaces', config['persist_config'])
+
+    # reinitialize interfaces, but not during the first boot
+    if boot_configuration_complete():
+        call_dependents()
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_acl.py b/src/conf_mode/vpp_acl.py
new file mode 100644
index 000000000..cbc915226
--- /dev/null
+++ b/src/conf_mode/vpp_acl.py
@@ -0,0 +1,400 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import ipaddress
+
+from vyos import ConfigError
+
+from vyos.configdiff import Diff
+from vyos.configdict import node_changed
+from vyos.config import Config
+from vyos.utils.network import get_protocol_by_name
+
+from vyos.vpp.utils import cli_ifaces_list
+from vyos.vpp.acl import Acl
+
+
+# TCP flag names to bit values
+TCP_FLAGS = {
+    'FIN': 0x01,
+    'SYN': 0x02,
+    'RST': 0x04,
+    'PSH': 0x08,
+    'ACK': 0x10,
+    'URG': 0x20,
+    'ECN': 0x40,
+    'CWR': 0x80,
+}
+
+# ACL action flags
+action_map = {
+    'deny': 0,
+    'permit': 1,
+    'permit-reflect': 2,
+}
+
+
+def get_tcp_mask_value(set_flags, unset_flags):
+    mask = 0
+    value = 0
+
+    for flag in set_flags + unset_flags:
+        bit = TCP_FLAGS.get(flag.upper())
+        mask |= bit
+        if flag in set_flags:
+            value |= bit
+
+    return mask, value
+
+
+def get_port_first_last(port_range, protocol):
+    first_port = 0
+    last_port = 65535
+    if not port_range:
+        if protocol in ['icmp', 'ipv6-icmp']:
+            last_port = 255
+    elif '-' not in port_range:
+        first_port = last_port = port_range
+    else:
+        first_port, last_port = port_range.split('-')
+    return int(first_port), int(last_port)
+
+
+def create_ip_rules_list(rules):
+    rules_list = []
+    for rule in rules.values():
+        r = {
+            'is_permit': action_map[rule.get('action')],
+            'src_prefix': rule.get('source', {}).get('prefix', ''),
+            'dst_prefix': rule.get('destination', {}).get('prefix', ''),
+            'proto': (
+                int(get_protocol_by_name(rule.get('protocol')))
+                if rule.get('protocol') != 'all'
+                else 0
+            ),
+        }
+
+        tcp_flags = rule.get('tcp_flags', {})
+        set_flags = [flag for flag in tcp_flags if flag != 'not']
+        unet_flags = list(tcp_flags.get('not', {}).keys())
+        tcp_mask, tcp_value = get_tcp_mask_value(set_flags, unet_flags)
+        r['tcp_flags_mask'] = tcp_mask
+        r['tcp_flags_value'] = tcp_value
+
+        src_ports = rule.get('source', {}).get('port')
+        src_first_port, src_last_port = get_port_first_last(
+            src_ports, rule.get('protocol')
+        )
+        r['srcport_or_icmptype_first'] = src_first_port
+        r['srcport_or_icmptype_last'] = src_last_port
+
+        dst_ports = rule.get('destination', {}).get('port')
+        dst_first_port, dst_last_port = get_port_first_last(
+            dst_ports, rule.get('protocol')
+        )
+        r['dstport_or_icmpcode_first'] = dst_first_port
+        r['dstport_or_icmpcode_last'] = dst_last_port
+
+        rules_list.append(r)
+
+    return rules_list
+
+
+def create_macip_rules_list(rules):
+    rules_list = []
+    for rule in rules.values():
+        r = {
+            'is_permit': action_map[rule.get('action')],
+            'src_prefix': rule.get('prefix', ''),
+            'src_mac': rule.get('mac_address', ''),
+            'src_mac_mask': rule.get('mac_mask', ''),
+        }
+        rules_list.append(r)
+
+    return rules_list
+
+
+def get_config(config=None) -> dict:
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'acl']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dictionary for deletion
+    effective_config = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if not config:
+        config['remove'] = True
+
+    changed_ip_ifaces = node_changed(
+        conf,
+        base + ['ip', 'interface'],
+        key_mangling=('-', '_'),
+        recursive=True,
+        expand_nodes=Diff.DELETE | Diff.ADD,
+    )
+
+    changed_macip_ifaces = node_changed(
+        conf,
+        base + ['macip', 'interface'],
+        key_mangling=('-', '_'),
+        recursive=True,
+        expand_nodes=Diff.DELETE | Diff.ADD,
+    )
+
+    config.update(
+        {
+            'changed_ip_ifaces': changed_ip_ifaces,
+            'changed_macip_ifaces': changed_macip_ifaces,
+            'vpp_ifaces': cli_ifaces_list(conf),
+        }
+    )
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    return config
+
+
+def verify(config):
+    if 'remove' in config or 'remove_vpp' in config:
+        return None
+
+    for acl_type in ['ip', 'macip']:
+        if acl_type in config:
+            acl = config.get(acl_type)
+            if 'tag_name' not in acl:
+                raise ConfigError(f'"tag-name" is required for "acl {acl_type}"')
+
+            for acl_name, acl_config in acl.get('tag_name').items():
+                if 'rule' not in acl_config:
+                    raise ConfigError(f'Rules must be configured for ACL {acl_name}')
+
+                for rule, rule_config in acl_config.get('rule').items():
+                    err_msg = f'Configuration error for {acl_type} ACL {acl_name} in rule {rule}:'
+                    if 'action' not in rule_config:
+                        raise ConfigError(f'{err_msg} action must be defined')
+
+            for iface, iface_config in acl.get('interface', {}).items():
+                if iface not in config.get('vpp_ifaces'):
+                    raise ConfigError(
+                        f'{iface} must be a VPP interface for ACL interface'
+                    )
+
+    if 'ip' in config:
+        acl = config.get('ip')
+        for acl_name, acl_config in acl.get('tag_name').items():
+            for rule, rule_config in acl_config.get('rule').items():
+                err_msg = (
+                    f'Configuration error for {acl_type} ACL {acl_name} in rule {rule}:'
+                )
+
+                # verify IPv4 and IPv6 address family
+                src_prefix = rule_config.get('source', {}).get('prefix')
+                dst_prefix = rule_config.get('destination', {}).get('prefix')
+                src = ipaddress.ip_network(src_prefix) if src_prefix else None
+                dst = ipaddress.ip_network(dst_prefix) if dst_prefix else None
+
+                if src and dst:
+                    if src.version != dst.version:
+                        raise ConfigError(
+                            f'{err_msg} source and destination prefixes must be from the same IP family'
+                        )
+                elif src or dst:
+                    family = src.version if src else dst.version
+                    if family == 6:
+                        raise ConfigError(
+                            f'{err_msg} both source and destination prefixes must be defined for IPv6'
+                        )
+
+                # verify protocol
+                protocol = rule_config.get('protocol')
+                if protocol != 'all':
+                    proto = get_protocol_by_name(protocol)
+                    if not isinstance(proto, int) and (
+                        not proto.isdigit() or int(proto) > 147
+                    ):
+                        raise ConfigError(
+                            f'{err_msg} protocol name {protocol} is not valid'
+                        )
+
+                # verify TCP flags
+                if 'tcp_flags' in rule_config:
+                    if rule_config.get('protocol') != 'tcp':
+                        raise ConfigError(
+                            f'{err_msg} protocol must be tcp when specifying tcp flags'
+                        )
+
+                    not_flags = rule_config.get('tcp_flags').get('not', [])
+                    if not_flags:
+                        duplicates = [
+                            flag
+                            for flag in rule_config.get('tcp_flags')
+                            if flag in not_flags
+                        ]
+                        if duplicates:
+                            raise ConfigError(
+                                f'{err_msg} cannot match a tcp flag as set and not set: {duplicates}'
+                            )
+
+        for iface, iface_config in acl.get('interface', {}).items():
+            if not any(key in iface_config for key in ('input', 'output')):
+                raise ConfigError(
+                    f'Please specify direction input/output for interface {iface}'
+                )
+
+            for direction in ['input', 'output']:
+                if direction in iface_config:
+                    iface_acl = iface_config.get(direction)
+                    if 'acl_tag' not in iface_acl:
+                        raise ConfigError(
+                            f'"acl-tag" is required for {direction} interface {iface}'
+                        )
+
+                    used_names = []
+                    for tag, tag_conf in iface_acl.get('acl_tag').items():
+                        if 'tag_name' not in tag_conf:
+                            raise ConfigError(
+                                f'"tag-name" is required for {direction} interface {iface} with acl-tag {tag}'
+                            )
+                        name = tag_conf.get('tag_name')
+                        if name not in acl.get('tag_name').keys():
+                            raise ConfigError(
+                                f'ACL with tag-name {name} does not exist. '
+                                f'Cannot use it for {direction} interface {iface}'
+                            )
+                        if name in used_names:
+                            raise ConfigError(
+                                f'ACL with tag-name {name} is already used for {direction} interface {iface}'
+                            )
+                        used_names.append(name)
+
+    if 'macip' in config:
+        acl = config.get('macip')
+        for iface, iface_config in acl.get('interface', {}).items():
+            if 'tag_name' not in iface_config:
+                raise ConfigError(f'"tag-name" is required for interface {iface}')
+            name = iface_config.get('tag_name')
+            if name not in acl.get('tag_name').keys():
+                raise ConfigError(
+                    f'ACL with tag-name {name} does not exist. Cannot use it for interface {iface}'
+                )
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    acl = Acl()
+
+    if 'effective' in config:
+        # Delete ACL ip
+        if 'ip' in config.get('effective'):
+            remove_config_ip = config.get('effective').get('ip')
+
+            # Delete ACL interfaces
+            for interface in config.get('changed_ip_ifaces'):
+                acl.delete_acl_interface(interface)
+
+            # Delete ACLs
+            for acl_name in remove_config_ip.get('tag_name'):
+                if acl_name not in config.get('ip', {}).get('tag_name', {}):
+                    acl.delete_acl(acl_name)
+
+        # Delete ACL macip
+        if 'macip' in config.get('effective'):
+            remove_config_macip = config.get('effective').get('macip')
+
+            # Delete ACL interfaces
+            for interface in config.get('changed_macip_ifaces'):
+                acl.delete_acl_macip_interface(interface)
+
+            # Delete ACL macip
+            for acl_name in remove_config_macip.get('tag_name'):
+                if acl_name not in config.get('macip', {}).get('tag_name', {}):
+                    acl.delete_acl_macip(acl_name)
+
+    if 'remove' in config:
+        return None
+
+    # Add or replace ACL ip
+    config_ip = config.get('ip', {})
+    for acl_name in config_ip.get('tag_name', {}):
+        rules = create_ip_rules_list(
+            config_ip.get('tag_name').get(acl_name).get('rule')
+        )
+        acl.add_replace_acl(acl_name, rules)
+
+    for iface, iface_config in config_ip.get('interface', {}).items():
+        input_tags = [
+            v['tag_name']
+            for v in iface_config.get('input', {}).get('acl_tag', {}).values()
+        ]
+        output_tags = [
+            v['tag_name']
+            for v in iface_config.get('output', {}).get('acl_tag', {}).values()
+        ]
+        acl.add_acl_interface(iface, input_tags, output_tags)
+
+    # Add or replace ACL macip
+    config_macip = config.get('macip', {})
+    for acl_name in config_macip.get('tag_name', {}):
+        rules = create_macip_rules_list(
+            config_macip.get('tag_name').get(acl_name).get('rule')
+        )
+        acl.add_replace_acl_macip(acl_name, rules)
+
+    for iface, iface_config in config_macip.get('interface', {}).items():
+        acl.add_acl_macip_interface(iface, iface_config.get('tag_name'))
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_interfaces_bonding.py b/src/conf_mode/vpp_interfaces_bonding.py
new file mode 100644
index 000000000..098cf8bed
--- /dev/null
+++ b/src/conf_mode/vpp_interfaces_bonding.py
@@ -0,0 +1,234 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos.config import Config
+from vyos.configdict import leaf_node_changed
+from vyos.configdep import set_dependents, call_dependents
+from vyos import ConfigError
+
+from vyos.vpp.interface import BondInterface
+from vyos.vpp.config_deps import deps_xconnect_dict
+from vyos.vpp.config_verify import (
+    verify_vpp_remove_xconnect_interface,
+    verify_vpp_remove_kernel_interface,
+    verify_vpp_change_kernel_interface,
+    verify_vpp_exists_kernel_interface,
+)
+from vyos.vpp.utils import cli_ifaces_list, cli_ifaces_lcp_kernel_list
+
+
+def _get_bond_mode(mode_name: str) -> int:
+    """Convert VyOS CLI name bonding mode to VPP compatible"""
+    mode_mapping = {
+        'round-robin': 1,
+        'active-backup': 2,
+        'xor-hash': 3,
+        'broadcast': 4,
+        '802.3ad': 5,
+    }
+
+    return mode_mapping.get(mode_name, 5)
+
+
+def _get_bond_lb(lb_name: str) -> int:
+    """Convert VyOS CLI name bonding load balance to VPP compatible"""
+    lb_mapping = {
+        'layer2': 0,
+        'layer2+3': 2,
+        'layer3+4': 1,
+    }
+
+    return lb_mapping.get(lb_name, 5)
+
+
+def get_config(config=None) -> dict:
+    """Get Bonding interface configuration
+
+    Args:
+        config (vyos.config.Config, optional): The VyOS configuration dictionary
+    Returns:
+        dict: Bonding interface configuration
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'interfaces', 'bonding']
+    base_kernel_interfaces = ['vpp', 'kernel-interfaces']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dicitonary per interface delete
+    effective_config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    if not conf.exists(base + [ifname]):
+        config['remove'] = True
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    config['vpp_ifaces'] = cli_ifaces_list(conf, 'candidate')
+
+    # Get global 'vpp kernel-interfaces' for verify
+    config['vpp_kernel_interfaces'] = conf.get_config_dict(
+        base_kernel_interfaces,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    # list of all kernel interfaces `vpp interface xxx kernel-interface xxx`
+    config['candidate_kernel_interfaces'] = cli_ifaces_lcp_kernel_list(conf)
+
+    # convert values to VPP compatible
+    if 'mode' in config:
+        config['mode'] = _get_bond_mode(config['mode'])
+    if 'hash_policy' in config:
+        config['hash_policy'] = _get_bond_lb(config['hash_policy'])
+
+    tmp = leaf_node_changed(conf, base + [ifname, 'kernel-interface'])
+    if tmp:
+        config['kernel_interface_removed'] = tmp
+
+    # Dependency
+    config['xconn_members'] = deps_xconnect_dict(conf)
+    if ifname in config['xconn_members']:
+        for xconn_iface in config['xconn_members'][ifname]:
+            set_dependents('vpp_interfaces_xconnect', conf, xconn_iface)
+
+    if conf.exists(base + [ifname, 'kernel-interface']):
+        if effective_config.get('kernel_interface') or __name__ != '__main__':
+            iface = config.get('kernel_interface')
+            if conf.exists(['vpp', 'kernel-interfaces', iface]):
+                set_dependents('vpp_kernel_interface', conf, iface)
+
+    # NAT dependency
+    if conf.exists(['vpp', 'nat44']):
+        set_dependents('vpp_nat', conf)
+    if conf.exists(['vpp', 'nat', 'cgnat']):
+        set_dependents('vpp_nat_cgnat', conf)
+
+    # ACL dependency
+    if conf.exists(['vpp', 'acl']):
+        set_dependents('vpp_acl', conf)
+
+    config['ifname'] = ifname
+
+    return config
+
+
+def verify(config):
+    if 'remove_vpp' in config:
+        return None
+
+    verify_vpp_remove_kernel_interface(config)
+    verify_vpp_remove_xconnect_interface(config)
+
+    # Member must belong to VPP
+    for iface in config.get('member', {}).get('interface', []):
+        if iface not in config['vpp_ifaces']:
+            raise ConfigError(f'{iface} must be a VPP interface for bonding')
+
+    if 'remove' in config:
+        return None
+
+    verify_vpp_change_kernel_interface(config)
+    verify_vpp_exists_kernel_interface(config)
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    ifname = config.get('ifname')
+    # remove old members
+    if 'effective' in config:
+        members = config['effective'].get('member', {}).get('interface', [])
+
+        kernel_interface = config['effective'].get('kernel_interface', '')
+        i = BondInterface(ifname, kernel_interface=kernel_interface)
+        for member in members:
+            i.detach_member(interface=member)
+
+        if 'kernel_interface' in config['effective']:
+            i.kernel_delete()
+        # Delete bonding interface
+        i.delete()
+
+    if 'remove' in config:
+        return None
+
+    # Create a new one
+    mode = config.get('mode')
+    lb = config.get('hash_policy')
+    members = config.get('member', {}).get('interface', [])
+    mac = config.get('mac', '')
+    kernel_interface = config.get('kernel_interface', '')
+    state = 'up' if 'disable' not in config else 'down'
+
+    i = BondInterface(ifname, mode, lb, mac, kernel_interface, state)
+    i.add()
+    # Add members to bond
+    if members:
+        for member in members:
+            i.add_member(interface=member)
+
+    call_dependents()
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_interfaces_bridge.py b/src/conf_mode/vpp_interfaces_bridge.py
new file mode 100644
index 000000000..64722c10c
--- /dev/null
+++ b/src/conf_mode/vpp_interfaces_bridge.py
@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos.config import Config
+from vyos.configdict import node_changed
+from vyos import ConfigError
+from vyos.vpp.interface import BridgeInterface
+from vyos.vpp.utils import iftunnel_transform
+
+
+def get_config(config=None) -> dict:
+    """Get Bridge interface configuration
+
+    Args:
+        config (vyos.config.Config, optional): The VyOS configuration dictionary
+    Returns:
+        dict: Bridge interface configuration
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'interfaces', 'bridge']
+    vpp_interfaces = ['vpp', 'settings', 'interface']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dicitonary per interface delete
+    effective_config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    if not conf.exists(base + [ifname]):
+        config['remove'] = True
+
+    # Get global vpp interfaces for verify
+    config['vpp_interfaces'] = conf.get_config_dict(
+        vpp_interfaces,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    # determine which members have been removed
+    interfaces_removed = node_changed(conf, base + [ifname, 'member', 'interface'])
+    if interfaces_removed:
+        config['members_removed'] = interfaces_removed
+
+    config['ifname'] = ifname
+
+    return config
+
+
+def verify(config):
+    if 'remove' in config or 'remove_vpp' in config:
+        return None
+
+    # Check if interface exists in vpp before adding to bridge-domain
+
+    allowed_prefixes = ('bond', 'gre', 'geneve', 'lo', 'vxlan')
+
+    if 'member' in config:
+        bvi_exists = False
+        for member, member_config in (
+            config.get('member', {}).get('interface', {}).items()
+        ):
+            # Check if the interface exists in VPP settings or starts with allowed prefixes
+            if not (
+                member in config.get('vpp_interfaces', {})
+                or member.startswith(allowed_prefixes)
+            ):
+                raise ConfigError(
+                    f"Interface '{member}' not found in 'vpp settings interface' or does not start with allowed prefixes {allowed_prefixes}"
+                )
+
+            # Check if BVI is already defined, only one BVI per bridge domain is allowed
+            if 'bvi' in member_config:
+                if bvi_exists:
+                    raise ConfigError("Only one BVI per bridge domain is allowed")
+                if not member.startswith('lo'):
+                    raise ConfigError("BVI can only be defined on loopback interface")
+                bvi_exists = True
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    ifname = config.get('ifname')
+    # vxlan10 in the vpp is vxlan_tunnel10
+    interface_transform_filter = ('geneve', 'vxlan')
+    # update members
+    if 'members_removed' in config:
+        i = BridgeInterface(ifname)
+        for member in config.get('members_removed'):
+            if member.startswith(interface_transform_filter):
+                member = iftunnel_transform(member)
+            if member.startswith('lo'):
+                # interface name in VPP is loopX
+                member = member.replace('lo', 'loop')
+            elif member.startswith('bond'):
+                # interface name in VPP is BondEthernetX
+                member = member.replace('bond', 'BondEthernet')
+            i.detach_member(member=member)
+
+    # Delete bridge domain
+    if 'effective' in config:
+        ifname = config.get('ifname')
+        i = BridgeInterface(ifname)
+        i.delete()
+
+    if 'remove' in config:
+        return None
+
+    # Add bridge domain
+    members = config.get('member', {}).get('interface', '')
+    i = BridgeInterface(ifname)
+    i.add()
+    # Add members to bridge
+    if members:
+        br = BridgeInterface(ifname)
+        port_type = 0
+        for member, member_config in members.items():
+            if member.startswith(interface_transform_filter):
+                member = iftunnel_transform(member)
+            if member.startswith('lo'):
+                # interface name in VPP is loopX
+                member = member.replace('lo', 'loop')
+                if 'bvi' in member_config:
+                    port_type = 1
+            elif member.startswith('bond'):
+                # interface name in VPP is BondEthernetX
+                member = member.replace('bond', 'BondEthernet')
+
+            br.add_member(member=member, port_type=port_type)
+            # set default port type 0 (not BVI)
+            port_type = 0
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_interfaces_ethernet.py b/src/conf_mode/vpp_interfaces_ethernet.py
new file mode 100644
index 000000000..81050444e
--- /dev/null
+++ b/src/conf_mode/vpp_interfaces_ethernet.py
@@ -0,0 +1,134 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos.config import Config
+from vyos.configdep import set_dependents
+from vyos import ConfigError
+from vyos.vpp.config_verify import verify_vpp_remove_xconnect_interface
+
+
+def get_config(config=None) -> dict:
+    """Get Ethernet interface configuration
+
+    Args:
+        config (vyos.config.Config, optional): The VyOS configuration dictionary
+    Returns:
+        dict: Ethernet interface configuration
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'interfaces', 'ethernet']
+    base_interfaces_xconnect = ['vpp', 'interfaces', 'xconnect']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get effective config as we need full dicitonary per interface delete
+    effective_config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if not conf.exists(base + [ifname]):
+        config = conf.get_config_dict(
+            base + [ifname],
+            key_mangling=('-', '_'),
+            get_first_key=True,
+            no_tag_node_value_mangle=True,
+        )
+        config.update({'remove': effective_config})
+    else:
+        # Get config_dict with default values
+        config = conf.get_config_dict(
+            base + [ifname],
+            key_mangling=('-', '_'),
+            get_first_key=True,
+            no_tag_node_value_mangle=True,
+            with_defaults=True,
+            with_recursive_defaults=True,
+        )
+
+    # Get global 'vpp interfaces xconnect'
+    config['vpp_interfaces_xconnect'] = conf.get_config_dict(
+        base_interfaces_xconnect,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    # Dependency
+    for xcon_name, xcon_config in config.get('vpp_interfaces_xconnect').items():
+        for member_name in xcon_config.get('member', {}).get('interface', []):
+            if member_name == ifname:
+                set_dependents('vpp_interfaces_xconnect', conf, xcon_name)
+
+    if conf.exists(base + [ifname, 'kernel-interface']):
+        iface = config.get('kernel_interface')
+        if conf.exists(['vpp', 'kernel-interfaces', iface]):
+            set_dependents('vpp_kernel_interface', conf, iface)
+
+    config['ifname'] = ifname
+    return config
+
+
+def verify(config):
+    verify_vpp_remove_xconnect_interface(config)
+    if 'remove' in config:
+        return None
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    # Delete interface
+    if 'remove' in config:
+        pass
+        # remove_config = config.get('remove')
+        # ifname = config.get('ifname')
+        # src_addr = remove_config.get('source_address')
+        # dst_addr = remove_config.get('remote')
+        # vni = int(remove_config.get('vni'))
+        # v = VXLANInterface(ifname, src_addr, dst_addr, vni)
+        # v.delete()
+    else:
+        pass
+        # ifname = config.get('ifname')
+        # kernel_interface = config.get('kernel_interface', '')
+        # v = VXLANInterface(ifname, src_addr, dst_addr, vni, kernel_interface)
+        # v.add()
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_interfaces_geneve.py b/src/conf_mode/vpp_interfaces_geneve.py
new file mode 100644
index 000000000..efac4e65a
--- /dev/null
+++ b/src/conf_mode/vpp_interfaces_geneve.py
@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos import ConfigError
+
+from vyos.config import Config
+from vyos.configdict import leaf_node_changed
+from vyos.configdep import set_dependents, call_dependents
+from vyos.template import is_interface
+
+from vyos.vpp.interface import GeneveInterface
+from vyos.vpp.config_deps import deps_xconnect_dict
+from vyos.vpp.config_verify import (
+    verify_vpp_remove_kernel_interface,
+    verify_vpp_change_kernel_interface,
+    verify_vpp_remove_xconnect_interface,
+    verify_vpp_exists_kernel_interface,
+)
+from vyos.vpp.utils import cli_ifaces_lcp_kernel_list
+
+
+def get_config(config=None) -> dict:
+    """Get Geneve interface configuration
+
+    Args:
+        config (vyos.config.Config, optional): The VyOS configuration dictionary
+        recursive_defaults (bool, optional): Include recursive defaults
+    Returns:
+        dict: Geneve interface configuration
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'interfaces', 'geneve']
+    base_kernel_interfaces = ['vpp', 'kernel-interfaces']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dicitonary per interface delete
+    effective_config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    if not conf.exists(base + [ifname]):
+        config['remove'] = True
+
+    # Get global 'vpp kernel-interfaces' for verify
+    config['vpp_kernel_interfaces'] = conf.get_config_dict(
+        base_kernel_interfaces,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    tmp = leaf_node_changed(conf, base + [ifname, 'kernel-interface'])
+    if tmp:
+        config['kernel_interface_removed'] = tmp
+
+    # list of all kernel interfaces `vpp interface xxx kernel-interface xxx`
+    config['candidate_kernel_interfaces'] = cli_ifaces_lcp_kernel_list(conf)
+
+    # Dependency
+    config['xconn_members'] = deps_xconnect_dict(conf)
+    if ifname in config['xconn_members']:
+        for xconn_iface in config['xconn_members'][ifname]:
+            set_dependents('vpp_interfaces_xconnect', conf, xconn_iface)
+
+    if effective_config.get('kernel_interface'):
+        if conf.exists(base + [ifname, 'kernel-interface']):
+            iface = config.get('kernel_interface')
+            if conf.exists(['vpp', 'kernel-interfaces', iface]):
+                set_dependents('vpp_kernel_interface', conf, iface)
+
+    config['ifname'] = ifname
+    return config
+
+
+def verify(config):
+    # No need to verify anything if vpp is removed
+    if 'remove_vpp' in config:
+        return None
+
+    # Verify that removed kernel interface is not used in 'vpp kernel-interfaces'.
+    # vpp interfaces geneve geneveX kernel-interface vpp-tunX
+    # vpp kernel-interface vpp-tunX
+    verify_vpp_remove_kernel_interface(config)
+
+    verify_vpp_remove_xconnect_interface(config)
+
+    if 'remove' in config:
+        return None
+
+    required_keys = {'source_address', 'remote', 'vni'}
+    if not all(key in config for key in required_keys):
+        missing_keys = required_keys - set(config.keys())
+        raise ConfigError(
+            f"Required options are missing: {', '.join(missing_keys).replace('_', '-')}"
+        )
+
+    # Change 'vpp interfaces geneve geneveX kernel-interface vpp-tunX'
+    #     => 'vpp interfaces geneve geneveX kernel-interface vpp-tunY'
+    # check if we have kernel interface config 'vpp kernel-interface vpp-tunX'
+    verify_vpp_change_kernel_interface(config)
+    verify_vpp_exists_kernel_interface(config)
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    ifname = config.get('ifname')
+    # Delete interface
+    if 'effective' in config:
+        remove_config = config.get('effective')
+        src_addr = remove_config.get('source_address')
+        dst_addr = remove_config.get('remote')
+        vni = int(remove_config.get('vni'))
+        i = GeneveInterface(ifname, src_addr, dst_addr, vni)
+        i.delete()
+
+    if 'remove' in config:
+        return None
+
+    # Add interface
+    src_addr = config.get('source_address')
+    dst_addr = config.get('remote')
+    vni = int(config.get('vni'))
+    kernel_interface = config.get('kernel_interface', '')
+    i = GeneveInterface(ifname, src_addr, dst_addr, vni, kernel_interface)
+    i.add()
+
+    # Add kernel-interface (LCP) if interface is not exist
+    if 'kernel_interface' in config and not is_interface(kernel_interface):
+        i.kernel_add()
+
+    call_dependents()
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_interfaces_gre.py b/src/conf_mode/vpp_interfaces_gre.py
new file mode 100644
index 000000000..0b60d06b5
--- /dev/null
+++ b/src/conf_mode/vpp_interfaces_gre.py
@@ -0,0 +1,222 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos import ConfigError
+
+from vyos.config import Config
+from vyos.configdict import leaf_node_changed
+from vyos.configdep import set_dependents, call_dependents
+from vyos.template import is_interface
+
+from vyos.vpp.interface import GREInterface
+from vyos.vpp.config_deps import deps_xconnect_dict
+from vyos.vpp.config_verify import (
+    verify_vpp_remove_kernel_interface,
+    verify_vpp_change_kernel_interface,
+    verify_vpp_remove_xconnect_interface,
+    verify_vpp_exists_kernel_interface,
+    verify_vpp_tunnel_source_address,
+)
+from vyos.vpp.utils import cli_ifaces_lcp_kernel_list, cli_ethernet_with_vifs_ifaces
+
+
+def get_config(config=None) -> dict:
+    """Get GRE interface configuration
+
+    Args:
+        config (vyos.config.Config, optional): The VyOS configuration dictionary
+    Returns:
+        dict: GRE interface configuration
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'interfaces', 'gre']
+    base_kernel_interfaces = ['vpp', 'kernel-interfaces']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dicitonary per interface delete
+    effective_config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    if not conf.exists(base + [ifname]):
+        config['remove'] = True
+
+    # Get global 'vpp kernel-interfaces' for verify
+    config['vpp_kernel_interfaces'] = conf.get_config_dict(
+        base_kernel_interfaces,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    tmp = leaf_node_changed(conf, base + [ifname, 'kernel-interface'])
+    if tmp:
+        config['kernel_interface_removed'] = tmp
+
+    # list of all kernel interfaces `vpp interface xxx kernel-interface xxx`
+    config['candidate_kernel_interfaces'] = cli_ifaces_lcp_kernel_list(conf)
+
+    # list of all Ethernet interfaces with vifs
+    config['vpp_ether_vif_ifaces'] = cli_ethernet_with_vifs_ifaces(conf)
+
+    # Dependency
+    config['xconn_members'] = deps_xconnect_dict(conf)
+    if ifname in config['xconn_members']:
+        for xconn_iface in config['xconn_members'][ifname]:
+            set_dependents('vpp_interfaces_xconnect', conf, xconn_iface)
+
+    if effective_config.get('kernel_interface'):
+        if conf.exists(base + [ifname, 'kernel-interface']):
+            iface = config.get('kernel_interface')
+            if conf.exists(['vpp', 'kernel-interfaces', iface]):
+                set_dependents('vpp_kernel_interface', conf, iface)
+
+    # NAT dependency
+    if conf.exists(['vpp', 'nat44']):
+        set_dependents('vpp_nat', conf)
+    if conf.exists(['vpp', 'nat', 'cgnat']):
+        set_dependents('vpp_nat_cgnat', conf)
+
+    # ACL dependency
+    if conf.exists(['vpp', 'acl']):
+        set_dependents('vpp_acl', conf)
+
+    config['ifname'] = ifname
+    return config
+
+
+def verify(config):
+    # No need to verify anything if vpp is removed
+    if 'remove_vpp' in config:
+        return None
+
+    # Verify that removed kernel interface is not used in 'vpp kernel-interfaces'.
+    # vpp interfaces gre greX kernel-interface vpp-tunX
+    # vpp kernel-interface vpp-tunX
+    verify_vpp_remove_kernel_interface(config)
+
+    verify_vpp_remove_xconnect_interface(config)
+
+    # config removed
+    if 'remove' in config:
+        return None
+
+    # source-address and remote are mandatory options
+    required_keys = {'source_address', 'remote', 'mode', 'tunnel_type'}
+    if not all(key in config for key in required_keys):
+        missing_keys = required_keys - set(config.keys())
+        raise ConfigError(
+            f"Required options are missing: {', '.join(missing_keys).replace('_', '-')}"
+        )
+
+    # verify source address and remote address
+    verify_vpp_tunnel_source_address(config)
+    if config.get('source_address') == config.get('remote'):
+        raise ConfigError('Remote address must not be the same as source address')
+
+    # check multipoint mode
+    if config.get('mode') == 'point-to-multipoint':
+        # For multipoint mode, remote IP must be 0.0.0.0
+        if config.get('remote') != '0.0.0.0':
+            raise ConfigError('For point-to-multipoint mode, remote must be 0.0.0.0')
+
+    # Change 'vpp interfaces gre greX kernel-interface vpp-tunX'
+    #     => 'vpp interfaces gre greX kernel-interface vpp-tunY'
+    # check if we have kernel interface config 'vpp kernel-interface vpp-tunX'
+    verify_vpp_change_kernel_interface(config)
+    verify_vpp_exists_kernel_interface(config)
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    ifname = config.get('ifname')
+    # Delete interface
+    if 'effective' in config:
+        remove_config = config.get('effective')
+        src_addr = remove_config.get('source_address')
+        dst_addr = remove_config.get('remote')
+        i = GREInterface(ifname, src_addr, dst_addr)
+        i.delete()
+
+    if 'remove' in config:
+        return None
+
+    # Add interface
+    src_addr = config.get('source_address')
+    dst_addr = config.get('remote')
+    kernel_interface = config.get('kernel_interface', '')
+    mode = config.get('mode')
+    tunnel_type = config.get('tunnel_type')
+    state = 'up' if 'disable' not in config else 'down'
+    i = GREInterface(
+        ifname, src_addr, dst_addr, tunnel_type, mode, kernel_interface, state
+    )
+    i.add()
+
+    # Add kernel-interface (LCP) if interface is not exist
+    if 'kernel_interface' in config and not is_interface(kernel_interface):
+        i.kernel_add()
+
+    call_dependents()
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_interfaces_ipip.py b/src/conf_mode/vpp_interfaces_ipip.py
new file mode 100644
index 000000000..e4db1e93c
--- /dev/null
+++ b/src/conf_mode/vpp_interfaces_ipip.py
@@ -0,0 +1,211 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos import ConfigError
+
+from vyos.config import Config
+from vyos.configdict import leaf_node_changed
+from vyos.configdep import set_dependents, call_dependents
+
+from vyos.vpp.interface import IPIPInterface
+from vyos.vpp.config_deps import deps_xconnect_dict
+from vyos.vpp.config_verify import (
+    verify_vpp_remove_kernel_interface,
+    verify_vpp_change_kernel_interface,
+    verify_vpp_remove_xconnect_interface,
+    verify_vpp_exists_kernel_interface,
+    verify_vpp_tunnel_source_address,
+)
+from vyos.vpp.utils import cli_ifaces_lcp_kernel_list, cli_ethernet_with_vifs_ifaces
+
+
+def get_config(config=None) -> dict:
+    """Get IPIP interface configuration
+
+    Args:
+        config (vyos.config.Config, optional): The VyOS configuration dictionary
+    Returns:
+        dict: IPIP interface configuration
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'interfaces', 'ipip']
+    base_kernel_interfaces = ['vpp', 'kernel-interfaces']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dicitonary per interface delete
+    effective_config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if not config:
+        config['remove'] = True
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    # Get global 'vpp kernel-interfaces' for verify
+    config['vpp_kernel_interfaces'] = conf.get_config_dict(
+        base_kernel_interfaces,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    tmp = leaf_node_changed(conf, base + [ifname, 'kernel-interface'])
+    if tmp:
+        config['kernel_interface_removed'] = tmp
+
+    # list of all kernel interfaces `vpp interface xxx kernel-interface xxx`
+    config['candidate_kernel_interfaces'] = cli_ifaces_lcp_kernel_list(conf)
+
+    # list of all Ethernet interfaces with vifs
+    config['vpp_ether_vif_ifaces'] = cli_ethernet_with_vifs_ifaces(conf)
+
+    # Dependency
+    config['xconn_members'] = deps_xconnect_dict(conf)
+    if ifname in config['xconn_members']:
+        for xconn_iface in config['xconn_members'][ifname]:
+            set_dependents('vpp_interfaces_xconnect', conf, xconn_iface)
+
+    if config.get('effective', {}).get('kernel_interface'):
+        iface = config.get('kernel_interface')
+        if iface:
+            if iface in config.get('vpp_kernel_interfaces'):
+                set_dependents('vpp_kernel_interface', conf, iface)
+
+    # NAT dependency
+    if conf.exists(['vpp', 'nat44']):
+        set_dependents('vpp_nat', conf)
+    if conf.exists(['vpp', 'nat', 'cgnat']):
+        set_dependents('vpp_nat_cgnat', conf)
+
+    # ACL dependency
+    if conf.exists(['vpp', 'acl']):
+        set_dependents('vpp_acl', conf)
+
+    config['ifname'] = ifname
+
+    return config
+
+
+def verify(config):
+    # No need to verify anything if vpp is removed
+    if 'remove_vpp' in config:
+        return None
+
+    # Verify that removed kernel interface is not used in 'vpp kernel-interfaces'.
+    # vpp interfaces ipip ipipX kernel-interface vpp-tunX
+    # vpp kernel-interface vpp-tunX
+    verify_vpp_remove_kernel_interface(config)
+
+    verify_vpp_remove_xconnect_interface(config)
+
+    # config removed
+    if 'remove' in config:
+        return None
+
+    # source-address and remote are mandatory options
+    required_keys = {'source_address', 'remote'}
+    if not all(key in config for key in required_keys):
+        missing_keys = required_keys - set(config.keys())
+        raise ConfigError(
+            f"Required options are missing: {', '.join(missing_keys).replace('_', '-')}"
+        )
+
+    # verify source address and remote address
+    verify_vpp_tunnel_source_address(config)
+    if config.get('source_address') == config.get('remote'):
+        raise ConfigError('Remote address must not be the same as source address')
+
+    # Change 'vpp interfaces ipip ipipX kernel-interface vpp-tunX'
+    #     => 'vpp interfaces ipip ipipX kernel-interface vpp-tunY'
+    # check if we have kernel interface config 'vpp kernel-interface vpp-tunX'
+    verify_vpp_change_kernel_interface(config)
+    verify_vpp_exists_kernel_interface(config)
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    ifname = config.get('ifname')
+    # Delete interface
+    if 'effective' in config:
+        remove_config = config.get('effective')
+        src_addr = remove_config.get('source_address')
+        dst_addr = remove_config.get('remote')
+        i = IPIPInterface(ifname, src_addr, dst_addr)
+        i.delete()
+
+    if 'remove' in config:
+        return None
+
+    # Add interface
+    src_addr = config.get('source_address')
+    dst_addr = config.get('remote')
+    kernel_interface = config.get('kernel_interface', '')
+    state = 'up' if 'disable' not in config else 'down'
+    i = IPIPInterface(ifname, src_addr, dst_addr, kernel_interface, state)
+    i.add()
+
+    if 'kernel_interface' in config:
+        i.kernel_add()
+
+    call_dependents()
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_interfaces_loopback.py b/src/conf_mode/vpp_interfaces_loopback.py
new file mode 100644
index 000000000..8874ecf2d
--- /dev/null
+++ b/src/conf_mode/vpp_interfaces_loopback.py
@@ -0,0 +1,174 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos import ConfigError
+
+from vyos.config import Config
+from vyos.configdict import leaf_node_changed
+from vyos.configdep import set_dependents, call_dependents
+from vyos.template import is_interface
+
+from vyos.vpp.interface import LoopbackInterface
+from vyos.vpp.config_verify import (
+    verify_vpp_remove_kernel_interface,
+    verify_vpp_change_kernel_interface,
+    verify_vpp_exists_kernel_interface,
+)
+from vyos.vpp.utils import cli_ifaces_lcp_kernel_list
+
+
+def get_config(config=None) -> dict:
+    """Get Loopback interface configuration
+
+    Args:
+        config (vyos.config.Config, optional): The VyOS configuration dictionary
+    Returns:
+        dict: Loopback interface configuration
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'interfaces', 'loopback']
+    base_kernel_interfaces = ['vpp', 'kernel-interfaces']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dicitonary per interface delete
+    effective_config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    if not conf.exists(base + [ifname]):
+        config['remove'] = True
+
+    # Get global 'vpp kernel-interfaces' for verify
+    config['vpp_kernel_interfaces'] = conf.get_config_dict(
+        base_kernel_interfaces,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    tmp = leaf_node_changed(conf, base + [ifname, 'kernel-interface'])
+    if tmp:
+        config['kernel_interface_removed'] = tmp
+
+    # list of all kernel interfaces `vpp interface xxx kernel-interface xxx`
+    config['candidate_kernel_interfaces'] = cli_ifaces_lcp_kernel_list(conf)
+
+    # Dependency
+    if effective_config.get('kernel_interface'):
+        if conf.exists(base + [ifname, 'kernel-interface']):
+            iface = config.get('kernel_interface')
+            if conf.exists(['vpp', 'kernel-interfaces', iface]):
+                set_dependents('vpp_kernel_interface', conf, iface)
+
+    # NAT dependency
+    if conf.exists(['vpp', 'nat44']):
+        set_dependents('vpp_nat', conf)
+    if conf.exists(['vpp', 'nat', 'cgnat']):
+        set_dependents('vpp_nat_cgnat', conf)
+
+    # ACL dependency
+    if conf.exists(['vpp', 'acl']):
+        set_dependents('vpp_acl', conf)
+
+    config['ifname'] = ifname
+    return config
+
+
+def verify(config):
+    # No need to verify anything if vpp is removed
+    if 'remove_vpp' in config:
+        return None
+
+    verify_vpp_remove_kernel_interface(config)
+
+    if 'remove' in config:
+        return None
+
+    verify_vpp_change_kernel_interface(config)
+    verify_vpp_exists_kernel_interface(config)
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    ifname = config.get('ifname')
+    # Delete interface
+    if 'effective' in config:
+        i = LoopbackInterface(ifname)
+        i.delete()
+
+    if 'remove' in config:
+        return None
+
+    # Add interface
+    kernel_interface = config.get('kernel_interface', '')
+    state = 'up' if 'disable' not in config else 'down'
+    i = LoopbackInterface(ifname, kernel_interface, state)
+    i.add()
+
+    # Add kernel-interface (LCP) if interface is not exist
+    if 'kernel_interface' in config and not is_interface(kernel_interface):
+        i.kernel_add()
+
+    call_dependents()
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_interfaces_vxlan.py b/src/conf_mode/vpp_interfaces_vxlan.py
new file mode 100644
index 000000000..355139ffa
--- /dev/null
+++ b/src/conf_mode/vpp_interfaces_vxlan.py
@@ -0,0 +1,218 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos import ConfigError
+
+from vyos.config import Config
+from vyos.configdict import leaf_node_changed
+from vyos.configdep import set_dependents, call_dependents
+from vyos.template import is_interface
+
+from vyos.vpp.interface import VXLANInterface
+from vyos.vpp.config_deps import deps_bridge_dict
+from vyos.vpp.config_deps import deps_xconnect_dict
+from vyos.vpp.config_verify import (
+    verify_vpp_remove_kernel_interface,
+    verify_vpp_change_kernel_interface,
+    verify_vpp_remove_xconnect_interface,
+    verify_vpp_exists_kernel_interface,
+    verify_vpp_tunnel_source_address,
+)
+from vyos.vpp.utils import cli_ifaces_lcp_kernel_list, cli_ethernet_with_vifs_ifaces
+
+
+def get_config(config=None) -> dict:
+    """Get VXLAN interface configuration
+
+    Args:
+        config (vyos.config.Config, optional): The VyOS configuration dictionary
+    Returns:
+        dict: VXLAN interface configuration
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'interfaces', 'vxlan']
+    base_kernel_interfaces = ['vpp', 'kernel-interfaces']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dicitonary per interface delete
+    effective_config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    if not conf.exists(base + [ifname]):
+        config['remove'] = True
+
+    # Get global 'vpp kernel-interfaces' for verify
+    config['vpp_kernel_interfaces'] = conf.get_config_dict(
+        base_kernel_interfaces,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    tmp = leaf_node_changed(conf, base + [ifname, 'kernel-interface'])
+    if tmp:
+        config['kernel_interface_removed'] = tmp
+
+    # list of all kernel interfaces `vpp interface xxx kernel-interface xxx`
+    config['candidate_kernel_interfaces'] = cli_ifaces_lcp_kernel_list(conf)
+
+    # list of all Ethernet interfaces with vifs
+    config['vpp_ether_vif_ifaces'] = cli_ethernet_with_vifs_ifaces(conf)
+
+    # Dependency
+    config['xconn_members'] = deps_xconnect_dict(conf)
+    if ifname in config['xconn_members']:
+        for xconn_iface in config['xconn_members'][ifname]:
+            set_dependents('vpp_interfaces_xconnect', conf, xconn_iface)
+
+    config['bridge_members'] = deps_bridge_dict(conf)
+    if ifname in config['bridge_members']:
+        for bridge_iface in config['bridge_members'][ifname]:
+            set_dependents('vpp_interfaces_bridge', conf, bridge_iface)
+
+    if effective_config.get('kernel_interface'):
+        if conf.exists(base + [ifname, 'kernel-interface']):
+            iface = config.get('kernel_interface')
+            if conf.exists(['vpp', 'kernel-interfaces', iface]):
+                set_dependents('vpp_kernel_interface', conf, iface)
+
+    # NAT dependency
+    if conf.exists(['vpp', 'nat44']):
+        set_dependents('vpp_nat', conf)
+    if conf.exists(['vpp', 'nat', 'cgnat']):
+        set_dependents('vpp_nat_cgnat', conf)
+
+    # ACL dependency
+    if conf.exists(['vpp', 'acl']):
+        set_dependents('vpp_acl', conf)
+
+    config['ifname'] = ifname
+    return config
+
+
+def verify(config):
+    # No need to verify anything if vpp is removed
+    if 'remove_vpp' in config:
+        return None
+
+    # Verify that removed kernel interface is not used in 'vpp kernel-interfaces'.
+    # vpp interfaces vxlan vxlanX kernel-interface vpp-tunX
+    # vpp kernel-interface vpp-tunX
+    verify_vpp_remove_kernel_interface(config)
+
+    verify_vpp_remove_xconnect_interface(config)
+
+    if 'remove' in config:
+        return None
+
+    required_keys = {'source_address', 'remote', 'vni'}
+    if not all(key in config for key in required_keys):
+        missing_keys = required_keys - set(config.keys())
+        raise ConfigError(
+            f"Required options are missing: {', '.join(missing_keys).replace('_', '-')}"
+        )
+
+    # verify source address and remote address
+    verify_vpp_tunnel_source_address(config)
+    if config.get('source_address') == config.get('remote'):
+        raise ConfigError('Remote address must not be the same as source address')
+
+    # Change 'vpp interfaces vxlan greX kernel-interface vpp-tunX'
+    #     => 'vpp interfaces gre vxlanX kernel-interface vpp-tunY'
+    # check if we have kernel interface config 'vpp kernel-interface vpp-tunX'
+    verify_vpp_change_kernel_interface(config)
+    verify_vpp_exists_kernel_interface(config)
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    ifname = config.get('ifname')
+    # Delete interface
+    if 'effective' in config:
+        remove_config = config.get('effective')
+        src_addr = remove_config.get('source_address')
+        dst_addr = remove_config.get('remote')
+        vni = int(remove_config.get('vni'))
+        i = VXLANInterface(ifname, src_addr, dst_addr, vni)
+        i.delete()
+
+    if 'remove' in config:
+        return None
+
+    # Add interface
+    src_addr = config.get('source_address')
+    dst_addr = config.get('remote')
+    vni = int(config.get('vni'))
+    kernel_interface = config.get('kernel_interface', '')
+    state = 'up' if 'disable' not in config else 'down'
+    i = VXLANInterface(ifname, src_addr, dst_addr, vni, kernel_interface, state)
+    i.add()
+
+    # Add kernel-interface (LCP) if interface is not exist
+    if 'kernel_interface' in config and not is_interface(kernel_interface):
+        i.kernel_add()
+
+    call_dependents()
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_interfaces_xconnect.py b/src/conf_mode/vpp_interfaces_xconnect.py
new file mode 100644
index 000000000..994332ba2
--- /dev/null
+++ b/src/conf_mode/vpp_interfaces_xconnect.py
@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos.config import Config
+from vyos import ConfigError
+from vyos.vpp.config_deps import deps_xconnect_dict
+from vyos.vpp.interface import XconnectInterface
+from vyos.vpp.utils import cli_ifaces_list
+
+
+def get_config(config=None) -> dict:
+    """Get Xconnect interface configuration
+
+    Args:
+        config (vyos.config.Config, optional): The VyOS configuration dictionary
+    Returns:
+        dict: Bridge interface configuration
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'interfaces', 'xconnect']
+    vpp_interfaces = ['vpp', 'settings', 'interface']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dicitonary per interface delete
+    effective_config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if not config:
+        config['remove'] = True
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    # Get global vpp interfaces for verify
+    config['vpp_interfaces'] = conf.get_config_dict(
+        vpp_interfaces,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    config['xconn_members'] = deps_xconnect_dict(conf)
+    config['vpp_ifaces'] = cli_ifaces_list(conf, 'candidate')
+
+    config['ifname'] = ifname
+
+    return config
+
+
+def verify(config):
+    if 'remove' in config or 'remove_vpp' in config:
+        return None
+
+    # Xconnect requires 2 members
+    if len(config.get('member', {}).get('interface')) != 2:
+        raise ConfigError('Cross connect requires 2 members')
+
+    # Member must belong to VPP
+    for iface in config.get('member', {}).get('interface', []):
+        if iface not in config['vpp_ifaces']:
+            raise ConfigError(f'{iface} must be a VPP interface for xconnect')
+
+    # Each interface can belong only to one xconnect
+    for xconn_member, xconn_ifaces in config['xconn_members'].items():
+        if len(xconn_ifaces) > 1:
+            raise ConfigError(
+                f'Interface {xconn_member} added to more than one xconnect: {xconn_ifaces}'
+            )
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    ifname = config.get('ifname')
+
+    # Delete xconnect
+    if 'effective' in config:
+        remove_config = config.get('effective')
+        members = remove_config.get('member', {}).get('interface')
+        i = XconnectInterface(ifname, members=members)
+        i.del_l2_xconnect()
+
+    if 'remove' in config:
+        return None
+
+    # Add xconnect
+    members = config.get('member', {}).get('interface')
+    state = 'up' if 'disable' not in config else 'down'
+    i = XconnectInterface(ifname, members=members, state=state)
+    i.add_l2_xconnect()
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_kernel-interfaces.py b/src/conf_mode/vpp_kernel-interfaces.py
new file mode 100644
index 000000000..85706094e
--- /dev/null
+++ b/src/conf_mode/vpp_kernel-interfaces.py
@@ -0,0 +1,199 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import os
+
+from vyos.config import Config
+from vyos.configdict import leaf_node_changed
+from vyos.configdict import node_changed
+from vyos import ConfigError
+from vyos.ifconfig import Interface
+from vyos.utils.network import interface_exists
+from vyos.utils.process import call
+from vyos.vpp import VPPControl
+
+
+def get_config(config=None) -> dict:
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'kernel-interfaces']
+
+    ifname = os.environ['VYOS_TAGNODE_VALUE']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base + [ifname],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dicitonary per interface delete
+    if __name__ == '__main__':
+        effective_config = conf.get_config_dict(
+            base + [ifname],
+            key_mangling=('-', '_'),
+            effective=True,
+            get_first_key=True,
+            no_tag_node_value_mangle=True,
+        )
+    # if a file was started as dependency, we are starting from empty config
+    else:
+        effective_config = {}
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    address_removed = leaf_node_changed(conf, base + [ifname, 'address'])
+    if address_removed:
+        config['address_removed'] = address_removed
+
+    description_removed = leaf_node_changed(conf, base + [ifname, 'description'])
+    if description_removed:
+        config['description_removed'] = {}
+
+    vlans_removed = node_changed(conf, base + [ifname, 'vif'])
+    if vlans_removed:
+        config['vlans_removed'] = vlans_removed
+
+    config['ifname'] = ifname
+
+    return config
+
+
+def verify(config):
+    if 'remove' in config or 'remove_vpp' in config:
+        return None
+
+    # Interface must exists before it is configured
+    if not interface_exists(config['ifname']):
+        raise ConfigError(
+            f'Interface {config["ifname"]} must be created before using in configuration'
+        )
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    ifname = config.get('ifname')
+    i = Interface(ifname)
+    # update/remove addresses
+    if 'address_removed' in config:
+        for address in config['address_removed']:
+            i.del_addr(address)
+    # remove description
+    if 'description_removed' in config:
+        i.set_alias('')
+
+    # remove VLANs
+    if 'vlans_removed' in config:
+        for vlan in config['vlans_removed']:
+            call(f'ip link del dev {ifname}.{vlan}')
+
+    # Delete
+    if 'remove' in config:
+        pass
+    else:
+        # Add address
+        if 'address' in config:
+            for address in config['address']:
+                i.add_addr(address)
+        # Set MTU
+        if 'mtu' in config:
+            i.set_mtu(config.get('mtu'))
+        # Set description
+        if 'description' in config:
+            i.set_alias(config.get('description'))
+        # Admin state down
+        if 'disable' in config:
+            i.set_admin_state('down')
+        else:
+            i.set_admin_state('up')
+
+        for vlan, vlan_config in config.get('vif', {}).items():
+            if vlan not in config.get('effective', {}).get('vif', {}).keys():
+                call(
+                    f'ip link add link {ifname} name {ifname}.{vlan} type vlan id {vlan}'
+                )
+                call(f'ip link set dev {ifname}.{vlan} up')
+            v = Interface(f'{ifname}.{vlan}')
+
+            # VLAN address
+            addresses_effective = (
+                config.get('effective', {})
+                .get('vif', {})
+                .get(vlan, {})
+                .get('address', [])
+            )
+            addresses_candidate = vlan_config.get('address', [])
+
+            for ipaddr in addresses_effective:
+                if ipaddr not in addresses_candidate:
+                    v.del_addr(ipaddr)
+            for ipaddr in addresses_candidate:
+                if ipaddr not in addresses_effective:
+                    v.add_addr(ipaddr)
+
+            # VLAN description
+            description_effective = (
+                config.get('effective', {})
+                .get('vif', {})
+                .get(vlan, {})
+                .get('description', '')
+            )
+            description_candidate = vlan_config.get('description', '')
+
+            if description_candidate:
+                v.set_alias(description_candidate)
+            elif description_effective and not description_candidate:
+                v.set_alias('')
+
+            v.set_admin_state('up')
+
+    # Set rx-mode
+    rx_mode = config.get('rx_mode')
+    if rx_mode:
+        vpp_control = VPPControl()
+        lcp_name = vpp_control.lcp_pair_find(kernel_name=ifname).get('vpp_name_kernel')
+        vpp_control.iface_rxmode(lcp_name, rx_mode)
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_nat.py b/src/conf_mode/vpp_nat.py
new file mode 100644
index 000000000..7c9fd2765
--- /dev/null
+++ b/src/conf_mode/vpp_nat.py
@@ -0,0 +1,488 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+import ipaddress
+
+from vyos import ConfigError
+
+from vyos.configdiff import Diff
+from vyos.configdict import node_changed
+from vyos.config import Config
+from vyos.utils.network import get_interface_address
+
+from vyos.vpp.utils import cli_ifaces_list
+from vyos.vpp.nat.nat44 import Nat44
+
+
+protocol_map = {
+    'all': 0,
+    'icmp': 1,
+    'tcp': 6,
+    'udp': 17,
+}
+
+
+def get_config(config=None) -> dict:
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'nat44']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dictionary for deletion
+    effective_config = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if not config:
+        config['remove'] = True
+        return config
+
+    config_changed = node_changed(
+        conf,
+        base,
+        key_mangling=('-', '_'),
+        recursive=True,
+        expand_nodes=Diff.DELETE | Diff.ADD,
+    )
+
+    changed_static_rules = node_changed(
+        conf,
+        base + ['static', 'rule'],
+        key_mangling=('-', '_'),
+        recursive=True,
+        expand_nodes=Diff.DELETE | Diff.ADD,
+    )
+
+    changed_exclude_rules = node_changed(
+        conf,
+        base + ['exclude', 'rule'],
+        key_mangling=('-', '_'),
+        recursive=True,
+        expand_nodes=Diff.DELETE | Diff.ADD,
+    )
+
+    if not config_changed:
+        changed_static_rules = list(config.get('static', {}).get('rule', {}).keys())
+        changed_exclude_rules = list(config.get('exclude', {}).get('rule', {}).keys())
+
+    config.update(
+        {
+            'changed_static_rules': changed_static_rules,
+            'changed_exclude_rules': changed_exclude_rules,
+            'vpp_ifaces': cli_ifaces_list(conf),
+        }
+    )
+
+    if conf.exists(['vpp', 'settings', 'nat44', 'timeout']):
+        timeouts = conf.get_config_dict(
+            ['vpp', 'settings', 'nat44', 'timeout'],
+            key_mangling=('-', '_'),
+            with_defaults=True,
+        )
+        config.update(timeouts)
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    return config
+
+
+def convert_range_to_list_ips(address_range) -> list:
+    """Converts IP range to a list of IPs .
+
+    Example:
+    % ip = IPOperations('192.0.0.1-192.0.2.5')
+    % ip.convert_prefix_to_list_ips()
+    ['192.0.2.1', '192.0.2.2', '192.0.2.3', '192.0.2.4', '192.0.2.5']
+    """
+    if '-' in address_range:
+        start_ip, end_ip = address_range.split('-')
+        start_ip = ipaddress.ip_address(start_ip)
+        end_ip = ipaddress.ip_address(end_ip)
+        return [
+            str(ipaddress.ip_address(ip))
+            for ip in range(int(start_ip), int(end_ip) + 1)
+        ]
+    else:
+        return [address_range]
+
+
+def verify(config):
+    if 'remove' in config or 'remove_vpp' in config:
+        return None
+
+    if 'interface' not in config:
+        raise ConfigError('Interfaces must be configured for NAT44')
+
+    required_keys = {'inside', 'outside'}
+    missing_keys = required_keys - set(config['interface'].keys())
+    if missing_keys:
+        raise ConfigError(
+            f'Both inside and outside interfaces must be configured. Please add: {", ".join(missing_keys)}'
+        )
+
+    for interface in config['interface']['inside']:
+        if interface not in config['vpp_ifaces']:
+            raise ConfigError(
+                f'{interface} must be a VPP interface for inside NAT interface'
+            )
+    for interface in config['interface']['outside']:
+        if interface not in config['vpp_ifaces']:
+            raise ConfigError(
+                f'{interface} must be a VPP interface for outside NAT interface'
+            )
+
+    if not config.get('address_pool', {}).get('translation') and not config.get(
+        'static', {}
+    ).get('rule'):
+        raise ConfigError('"address-pool translation" or "static rule" is required')
+
+    addresses_translation = []
+    addresses_twice_nat = []
+    if 'address_pool' in config:
+        address_pool = config.get('address_pool')
+        if 'translation' in address_pool:
+            if not address_pool['translation'].get('address') and not address_pool[
+                'translation'
+            ].get('interface'):
+                raise ConfigError(
+                    '"address-pool translation" requires address or interface'
+                )
+
+            for address_range in address_pool['translation'].get('address', []):
+                addresses = convert_range_to_list_ips(address_range)
+                for address in addresses:
+                    if address in addresses_translation:
+                        raise ConfigError(
+                            f'Address {address} is already in use in "address-pool translation address"'
+                        )
+                    addresses_translation.append(address)
+
+            for interface in address_pool['translation'].get('interface', []):
+                if interface not in config['vpp_ifaces']:
+                    raise ConfigError(
+                        f'{interface} must be a VPP interface for "address-pool translation interface"'
+                    )
+                iface_address = (
+                    get_interface_address(interface)
+                    .get('addr_info', [])[0]
+                    .get('local')
+                )
+                addresses_translation.append(iface_address)
+
+        if 'twice_nat' in address_pool:
+            if not address_pool['twice_nat'].get('address') and not address_pool[
+                'twice_nat'
+            ].get('interface'):
+                raise ConfigError(
+                    '"address-pool twice-nat" requires address or interface'
+                )
+
+            for address_range in address_pool['twice_nat'].get('address', []):
+                addresses = convert_range_to_list_ips(address_range)
+                for address in addresses:
+                    if address in addresses_twice_nat:
+                        raise ConfigError(
+                            f'Address {address} is already in use in "address-pool twice-nat address"'
+                        )
+                    addresses_twice_nat.append(address)
+
+            for interface in address_pool['twice_nat'].get('interface', []):
+                if interface not in config['vpp_ifaces']:
+                    raise ConfigError(
+                        f'{interface} must be a VPP interface for "address-pool twice-nat interface"'
+                    )
+                iface_address = (
+                    get_interface_address(interface)
+                    .get('addr_info', [])[0]
+                    .get('local')
+                )
+                addresses_twice_nat.append(iface_address)
+
+    if 'static' in config:
+        addresses_with_ports = set()
+        addresses_without_ports = set()
+        local_addresses = set()
+
+        for rule, rule_config in config['static']['rule'].items():
+            error_msg = f'Configuration error in static rule {rule}:'
+
+            if not rule_config.get('local', {}).get('address'):
+                raise ConfigError(f'{error_msg} local settings require address')
+
+            if not rule_config.get('external', {}).get('address'):
+                raise ConfigError(f'{error_msg} external settings require address')
+
+            has_local_port = 'port' in rule_config.get('local', {})
+            has_external_port = 'port' in rule_config.get('external', {})
+
+            if not has_external_port == has_local_port:
+                raise ConfigError(
+                    f'{error_msg} source and destination ports must either '
+                    'both be specified, or neither must be specified'
+                )
+
+            ext_address = rule_config['external']['address']
+            port = rule_config['external'].get('port')
+            local_address = rule_config['local']['address']
+
+            if port:
+                pair = (ext_address, port)
+                if (
+                    pair in addresses_with_ports
+                    or ext_address in addresses_without_ports
+                ):
+                    raise ConfigError(
+                        f'{error_msg} external address/port is already in use!'
+                    )
+                addresses_with_ports.add(pair)
+                if ext_address not in addresses_translation:
+                    raise ConfigError(
+                        f'{error_msg} external address {ext_address} is not in "address-pool translation"'
+                    )
+
+            else:
+                if ext_address in addresses_without_ports or any(
+                    addr == ext_address for addr, _ in addresses_with_ports
+                ):
+                    raise ConfigError(
+                        f'{error_msg} external address is already in use!'
+                    )
+                addresses_without_ports.add(ext_address)
+
+                if local_address in local_addresses:
+                    raise ConfigError(
+                        f'{error_msg} local address {local_address} is already in use'
+                    )
+                local_addresses.add(local_address)
+
+            options = rule_config.get('options', {})
+            if all(key in options for key in ('twice_nat', 'self_twice_nat')):
+                raise ConfigError(
+                    f'{error_msg} cannot set both options "twice-nat" and "self-twice-nat"'
+                )
+            if any(key in options for key in ('twice_nat', 'self_twice_nat')):
+                if not has_local_port or rule_config['protocol'] == 'all':
+                    raise ConfigError(
+                        f'{error_msg} twice-nat/self-twice-nat options require port and protocol to be set'
+                    )
+                if not config.get('address_pool', {}).get('twice_nat'):
+                    raise ConfigError(
+                        f'{error_msg} twice-nat/self-twice-nat options require "address-pool twice-nat" to be set'
+                    )
+            if 'twice_nat_address' in options:
+                if not any(key in options for key in ('twice_nat', 'self_twice_nat')):
+                    raise ConfigError(
+                        f'{error_msg} twice-nat/self-twice-nat option required when twice-nat-address is set'
+                    )
+                tn_address = options['twice_nat_address']
+                if tn_address not in addresses_twice_nat:
+                    raise ConfigError(
+                        f'{error_msg} twice-nat-address {tn_address} is not in "address-pool twice-nat"'
+                    )
+
+    if 'exclude' in config:
+        for rule, rule_config in config['exclude']['rule'].items():
+            keys = {'local_address', 'external_interface'}
+            if not any(key in rule_config for key in keys):
+                raise ConfigError(
+                    f'Local-address or external-interface must be specified for exclude rule {rule}'
+                )
+            if all(key in rule_config for key in keys):
+                raise ConfigError(
+                    f'Cannot set both address and interface for exclude rule {rule}'
+                )
+            if (
+                'external_interface' in rule_config
+                and rule_config.get('external_interface') not in config['vpp_ifaces']
+            ):
+                raise ConfigError(
+                    f'{rule_config["external_interface"]} must be a VPP interface for exclude rule {rule}'
+                )
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    n = Nat44()
+
+    if 'remove' in config:
+        n.disable_nat44_ed()
+        return None
+
+    if 'effective' in config:
+        remove_config = config.get('effective')
+        # Delete inside interfaces
+        for interface in remove_config['interface']['inside']:
+            if interface not in config.get('interface', {}).get('inside', []):
+                n.delete_nat44_interface_inside(interface)
+        # Delete outside interfaces
+        for interface in remove_config['interface']['outside']:
+            if interface not in config.get('interface', {}).get('outside', []):
+                n.delete_nat44_interface_outside(interface)
+        # Delete address pool
+        address_pool = config.get('address_pool', {})
+        for address in (
+            remove_config.get('address_pool', {})
+            .get('translation', {})
+            .get('address', [])
+        ):
+            if address not in address_pool.get('translation', {}).get('address', []):
+                n.delete_nat44_address_range(address, twice_nat=False)
+        for interface in (
+            remove_config.get('address_pool', {})
+            .get('translation', {})
+            .get('interface', [])
+        ):
+            if interface not in address_pool.get('translation', {}).get(
+                'interface', []
+            ):
+                n.delete_nat44_interface_address(interface, twice_nat=False)
+        for address in (
+            remove_config.get('address_pool', {})
+            .get('twice_nat', {})
+            .get('address', [])
+        ):
+            if address not in address_pool.get('twice_nat', {}).get('address', []):
+                n.delete_nat44_address_range(address, twice_nat=True)
+        for interface in (
+            remove_config.get('address_pool', {})
+            .get('twice_nat', {})
+            .get('interface', [])
+        ):
+            if interface not in address_pool.get('twice_nat', {}).get('interface', []):
+                n.delete_nat44_interface_address(interface, twice_nat=True)
+        # Delete NAT static mapping rules
+        for rule in config['changed_static_rules']:
+            if rule in remove_config.get('static', {}).get('rule', {}):
+                rule_config = remove_config['static']['rule'][rule]
+                n.delete_nat44_static_mapping(
+                    local_ip=rule_config.get('local').get('address'),
+                    external_ip=rule_config.get('external', {}).get('address', ''),
+                    local_port=int(rule_config.get('local', {}).get('port', 0)),
+                    external_port=int(rule_config.get('external', {}).get('port', 0)),
+                    protocol=protocol_map[rule_config.get('protocol', 'all')],
+                    twice_nat='twice_nat' in rule_config.get('options', {}),
+                    self_twice_nat='self_twice_nat' in rule_config.get('options', {}),
+                    out2in='out_to_in_only' in rule_config.get('options', {}),
+                    pool_ip=rule_config.get('options', {}).get('twice_nat_address'),
+                )
+        # Delete NAT exclude rules
+        for rule in config['changed_exclude_rules']:
+            if rule in remove_config.get('exclude', {}).get('rule', {}):
+                rule_config = remove_config['exclude']['rule'][rule]
+                n.delete_nat44_identity_mapping(
+                    ip_address=rule_config.get('local_address'),
+                    protocol=protocol_map[rule_config.get('protocol', 'all')],
+                    port=int(rule_config.get('local_port', 0)),
+                    interface=rule_config.get('external_interface'),
+                )
+
+    # Add NAT44
+    n.enable_nat44_ed()
+    # Add inside interfaces
+    for interface in config['interface']['inside']:
+        n.add_nat44_interface_inside(interface)
+    # Add outside interfaces
+    for interface in config['interface']['outside']:
+        n.add_nat44_interface_outside(interface)
+    # Add translation pool
+    for address in (
+        config.get('address_pool', {}).get('translation', {}).get('address', [])
+    ):
+        n.add_nat44_address_range(address, twice_nat=False)
+    for interface in (
+        config.get('address_pool', {}).get('translation', {}).get('interface', [])
+    ):
+        n.add_nat44_interface_address(interface, twice_nat=False)
+    for address in (
+        config.get('address_pool', {}).get('twice_nat', {}).get('address', [])
+    ):
+        n.add_nat44_address_range(address, twice_nat=True)
+    for interface in (
+        config.get('address_pool', {}).get('twice_nat', {}).get('interface', [])
+    ):
+        n.add_nat44_interface_address(interface, twice_nat=True)
+    # Add NAT static mapping rules
+    for rule in config['changed_static_rules']:
+        if rule in config.get('static', {}).get('rule', {}):
+            rule_config = config['static']['rule'][rule]
+            n.add_nat44_static_mapping(
+                local_ip=rule_config.get('local').get('address'),
+                external_ip=rule_config.get('external', {}).get('address', ''),
+                local_port=int(rule_config.get('local', {}).get('port', 0)),
+                external_port=int(rule_config.get('external', {}).get('port', 0)),
+                protocol=protocol_map[rule_config.get('protocol', 'all')],
+                twice_nat='twice_nat' in rule_config.get('options', {}),
+                self_twice_nat='self_twice_nat' in rule_config.get('options', {}),
+                out2in='out_to_in_only' in rule_config.get('options', {}),
+                pool_ip=rule_config.get('options', {}).get('twice_nat_address'),
+            )
+    # Add NAT exclude rules
+    for rule in config['changed_exclude_rules']:
+        if rule in config.get('exclude', {}).get('rule', {}):
+            rule_config = config['exclude']['rule'][rule]
+            n.add_nat44_identity_mapping(
+                ip_address=rule_config.get('local_address'),
+                protocol=protocol_map[rule_config.get('protocol', 'all')],
+                port=int(rule_config.get('local_port', 0)),
+                interface=rule_config.get('external_interface'),
+            )
+    if 'timeout' in config:
+        n.set_nat_timeouts(
+            icmp=int(config.get('timeout').get('icmp')),
+            udp=int(config.get('timeout').get('udp')),
+            tcp_established=int(config.get('timeout').get('tcp_established')),
+            tcp_transitory=int(config.get('timeout').get('tcp_transitory')),
+        )
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_nat_cgnat.py b/src/conf_mode/vpp_nat_cgnat.py
new file mode 100644
index 000000000..be2386ba2
--- /dev/null
+++ b/src/conf_mode/vpp_nat_cgnat.py
@@ -0,0 +1,218 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from vyos import ConfigError
+from vyos.config import Config, config_dict_merge
+from vyos.configdict import node_changed
+from vyos.configdiff import Diff
+from vyos.vpp.utils import cli_ifaces_list
+
+from vyos.vpp.nat.det44 import Det44
+
+
+def get_config(config=None) -> dict:
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'nat', 'cgnat']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if not conf.exists(['vpp']):
+        config['remove_vpp'] = True
+        return config
+
+    # Get effective config as we need full dictionary to delete
+    effective_config = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if not config:
+        config['remove'] = True
+
+    # Get default values which we need to conditionally update into the
+    # dictionary retrieved.
+    default_values = conf.get_config_defaults(**config.kwargs, recursive=True)
+    config = config_dict_merge(default_values, config)
+
+    config_changed = node_changed(
+        conf,
+        base,
+        key_mangling=('-', '_'),
+        recursive=True,
+        expand_nodes=Diff.DELETE | Diff.ADD,
+    )
+
+    changed_rules = node_changed(
+        conf,
+        base + ['rule'],
+        key_mangling=('-', '_'),
+        recursive=True,
+        expand_nodes=Diff.DELETE | Diff.ADD,
+    )
+
+    if not config_changed:
+        changed_rules = list(config.get('rule', {}).keys())
+
+    config.update(
+        {
+            'changed_rules': changed_rules,
+            'vpp_ifaces': cli_ifaces_list(conf),
+        }
+    )
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    return config
+
+
+def verify(config):
+    if 'remove' in config or 'remove_vpp' in config:
+        return None
+
+    if 'interface' not in config:
+        raise ConfigError('Interfaces must be configured for CGNAT')
+    if 'rule' not in config:
+        raise ConfigError('Rules must be configured for CGNAT')
+
+    required_keys = {'inside', 'outside'}
+    missing_keys = required_keys - set(config['interface'].keys())
+    if missing_keys:
+        raise ConfigError(
+            f'Both inside and outside interfaces must be configured. '
+            f'Please add: {", ".join(missing_keys)}'
+        )
+
+    conflict_ifaces = set(config['interface']['inside']).intersection(
+        set(config['interface']['outside'])
+    )
+    if conflict_ifaces:
+        raise ConfigError(
+            f'Interface cannot be both inside and outside. '
+            f'Please choose a side for: {", ".join(conflict_ifaces)} '
+        )
+
+    for interface in config['interface']['inside']:
+        if interface not in config['vpp_ifaces']:
+            raise ConfigError(
+                f'{interface} must be a VPP interface for inside CGNAT interface'
+            )
+    for interface in config['interface']['outside']:
+        if interface not in config['vpp_ifaces']:
+            raise ConfigError(
+                f'{interface} must be a VPP interface for outside CGNAT interface'
+            )
+
+    required_keys = {'outside_prefix', 'inside_prefix'}
+    for rule in config['rule']:
+        missing_keys = required_keys - set(config['rule'][rule].keys())
+        if missing_keys:
+            raise ConfigError(
+                f'Both inside-prefix and outside-prefix must be configured in rule {rule}. '
+                f'Please add: {", ".join(missing_keys).replace("_", "-")}'
+            )
+
+
+def generate(config):
+    pass
+
+
+def apply(config):
+    if 'remove_vpp' in config:
+        return None
+
+    cgnat = Det44()
+
+    if 'remove' in config:
+        cgnat.disable_det44_plugin()
+        return None
+
+    if 'effective' in config:
+        remove_config = config.get('effective')
+        # Delete inside interfaces
+        for interface in remove_config['interface']['inside']:
+            if interface not in config.get('interface', {}).get('inside', []):
+                cgnat.delete_det44_interface_inside(interface)
+        # Delete outside interfaces
+        for interface in remove_config['interface']['outside']:
+            if interface not in config.get('interface', {}).get('outside', []):
+                cgnat.delete_det44_interface_outside(interface)
+        # Delete CGNAT rules
+        for rule in config['changed_rules']:
+            if rule in remove_config.get('rule', {}):
+                rule_config = remove_config['rule'][rule]
+                in_addr, in_plen = rule_config['inside_prefix'].split('/')
+                out_addr, out_plen = rule_config['outside_prefix'].split('/')
+                cgnat.delete_det44_mapping(
+                    in_addr=in_addr,
+                    in_plen=int(in_plen),
+                    out_addr=out_addr,
+                    out_plen=int(out_plen),
+                )
+
+    # Add DET44
+    cgnat.enable_det44_plugin()
+    # Add inside interfaces
+    for interface in config['interface']['inside']:
+        cgnat.add_det44_interface_inside(interface)
+    # Add outside interfaces
+    for interface in config['interface']['outside']:
+        cgnat.add_det44_interface_outside(interface)
+    # Add CGNAT rules
+    for rule in config['changed_rules']:
+        if rule in config.get('rule', {}):
+            rule_config = config['rule'][rule]
+            in_addr, in_plen = rule_config['inside_prefix'].split('/')
+            out_addr, out_plen = rule_config['outside_prefix'].split('/')
+            cgnat.add_det44_mapping(
+                in_addr=in_addr,
+                in_plen=int(in_plen),
+                out_addr=out_addr,
+                out_plen=int(out_plen),
+            )
+    # Set CGNAT timeouts
+    cgnat.set_det44_timeouts(
+        icmp=int(config['timeout']['icmp']),
+        udp=int(config['timeout']['udp']),
+        tcp_established=int(config['timeout']['tcp_established']),
+        tcp_transitory=int(config['timeout']['tcp_transitory']),
+    )
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpp_sflow.py b/src/conf_mode/vpp_sflow.py
new file mode 100644
index 000000000..7da4c24d6
--- /dev/null
+++ b/src/conf_mode/vpp_sflow.py
@@ -0,0 +1,145 @@
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+from vyos import ConfigError
+from vyos.config import Config
+from vyos.vpp.utils import cli_ifaces_list
+from vyos.vpp import VPPControl
+
+
+def get_config(config=None) -> dict:
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vpp', 'sflow']
+
+    # Get config_dict with default values
+    config = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True,
+    )
+
+    # Get effective config as we need full dictionary for deletion
+    effective_config = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        effective=True,
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    # Get system sflow configuration to check for server
+    system_sflow = conf.get_config_dict(
+        ['system', 'sflow'],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+    )
+
+    if system_sflow:
+        config['system_sflow'] = system_sflow
+
+    if not config:
+        config['remove'] = True
+        return config
+
+    # Add list of VPP interfaces to the config
+    config.update({'vpp_ifaces': cli_ifaces_list(conf)})
+
+    if effective_config:
+        config.update({'effective': effective_config})
+
+    return config
+
+
+def verify(config):
+    if 'remove' in config:
+        return None
+
+    # Check if interface section exists
+    if 'interface' not in config:
+        return None
+
+    # Verify that all interfaces specified exist in VPP
+    for interface in config['interface']:
+        if interface not in config['vpp_ifaces']:
+            raise ConfigError(
+                f'{interface} must be a VPP interface for sFlow monitoring'
+            )
+
+    # Verify sample rate is a positive integer
+    if 'sample_rate' in config:
+        try:
+            sample_rate = int(config['sample_rate'])
+            if sample_rate <= 0:
+                raise ConfigError('sFlow sample rate must be a positive integer')
+        except ValueError:
+            raise ConfigError('sFlow sample rate must be a valid integer')
+
+    # Verify that system sflow has enable-vpp defined
+    if 'system_sflow' not in config or 'vpp' not in config.get('system_sflow', {}):
+        raise ConfigError(
+            'sFlow enable-vpp must be defined under system sflow configuration'
+        )
+
+
+def generate(config):
+    # No templates to render for sFlow
+    pass
+
+
+def apply(config):
+    # Initialize VPP control API
+    vpp = VPPControl(attempts=20, interval=500)
+
+    if 'remove' in config:
+        # Disable sFlow on all interfaces
+        for interface in config.get('effective', {}).get('interface', []):
+            vpp.cli_cmd(f'sflow enable-disable {interface} disable')
+        return None
+
+    # Configure sample rate if specified
+    if 'sample_rate' in config:
+        vpp.cli_cmd(f'sflow sampling-rate {config["sample_rate"]}')
+
+    # Configure interfaces
+    if 'interface' in config:
+        # Enable sFlow on specified interfaces
+        for interface in config['interface']:
+            vpp.cli_cmd(f'sflow enable-disable {interface}')
+
+        # Disable sFlow on interfaces that were removed from config
+        effective_interfaces = config.get('effective', {}).get('interface', [])
+        if effective_interfaces:
+            for interface in effective_interfaces:
+                if interface not in config['interface']:
+                    vpp.cli_cmd(f'sflow enable-disable {interface} disable')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vrf.py b/src/conf_mode/vrf.py
index 8baf55857..1eacba112 100755
--- a/src/conf_mode/vrf.py
+++ b/src/conf_mode/vrf.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -18,6 +18,8 @@ from sys import exit
 from jmespath import search
 from json import loads
 
+import vyos.defaults
+
 from vyos.config import Config
 from vyos.configdict import node_changed
 from vyos.configverify import verify_route_map
@@ -163,6 +165,11 @@ def verify(vrf):
             if 'table' not in vrf_config:
                 raise ConfigError(f'VRF "{name}" table id is mandatory!')
 
+            if int(vrf_config['table']) == vyos.defaults.rt_global_vrf:
+                raise ConfigError(
+                    f'VRF "{name}" table id {vrf_config["table"]} cannot be used!'
+                )
+
             # routing table id can't be changed - OS restriction
             if interface_exists(name):
                 tmp = get_vrf_tableid(name)
@@ -233,7 +240,7 @@ def apply(vrf):
                 vrf_iface.set_dhcpv6(False)
 
             # Remove nftables conntrack zone map item
-            nft_del_element = f'delete element inet vrf_zones ct_iface_map {{ "{tmp}" }}'
+            nft_del_element = f'delete element inet vrf_zones ct_iface_map {{ \'"{tmp}"\' }}'
             # Check if deleting is possible first to avoid raising errors
             _, err = popen(f'nft --check {nft_del_element}')
             if not err:
@@ -313,7 +320,7 @@ def apply(vrf):
             state = 'down' if 'disable' in config else 'up'
             vrf_if.set_admin_state(state)
             # Add nftables conntrack zone map item
-            nft_add_element = f'add element inet vrf_zones ct_iface_map {{ "{name}" : {table} }}'
+            nft_add_element = f'add element inet vrf_zones ct_iface_map {{ \'"{name}"\' : {table} }}'
             cmd(f'nft {nft_add_element}')
 
         # Only call into nftables as long as there is nothing setup to avoid wasting