Merge branch 'current' into current

15 files changed, 869 insertions, 634 deletions

diff --git a/src/conf_mode/interfaces_tunnel.py b/src/conf_mode/interfaces_tunnel.py
index 98ef98d12..ee1436e49 100755
--- a/src/conf_mode/interfaces_tunnel.py
+++ b/src/conf_mode/interfaces_tunnel.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 yOS maintainers and contributors
+# Copyright (C) 2018-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -13,9 +13,8 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
 from sys import exit
-
+import ipaddress
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
@@ -89,6 +88,13 @@ def verify(tunnel):
             raise ConfigError('Tunnel used for NHRP, it can not be deleted!')
 
         return None
+    if 'nhrp' in tunnel:
+        if 'address' in tunnel:
+            address_list = dict_search('address', tunnel)
+            for tunip in address_list:
+                if ipaddress.ip_network(tunip, strict=False).prefixlen != 32:
+                    raise ConfigError(
+                        'Tunnel is used for NHRP, Netmask should be /32!')
 
     verify_tunnel(tunnel)
 
diff --git a/src/conf_mode/protocols_nhrp.py b/src/conf_mode/protocols_nhrp.py
index 0bd68b7d8..ac92c9d99 100755
--- a/src/conf_mode/protocols_nhrp.py
+++ b/src/conf_mode/protocols_nhrp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright (C) 2021-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -14,95 +14,112 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import os
+from sys import exit
+from sys import argv
 
+import ipaddress
 from vyos.config import Config
-from vyos.configdict import node_changed
 from vyos.template import render
+from vyos.configverify import has_frr_protocol_in_dict
 from vyos.utils.process import run
+from vyos.utils.dict import dict_search
 from vyos import ConfigError
 from vyos import airbag
+from vyos.frrender import FRRender
+from vyos.frrender import get_frrender_dict
+from vyos.utils.process import is_systemd_service_running
+
 airbag.enable()
 
-opennhrp_conf = '/run/opennhrp/opennhrp.conf'
+nflog_redirect = 1
+nflog_multicast = 2
 nhrp_nftables_conf = '/run/nftables_nhrp.conf'
 
+
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
-    base = ['protocols', 'nhrp']
-
-    nhrp = conf.get_config_dict(base, key_mangling=('-', '_'),
-                                get_first_key=True, no_tag_node_value_mangle=True)
-    nhrp['del_tunnels'] = node_changed(conf, base + ['tunnel'])
-
-    if not conf.exists(base):
-        return nhrp
 
-    nhrp['if_tunnel'] = conf.get_config_dict(['interfaces', 'tunnel'], key_mangling=('-', '_'),
-                                get_first_key=True, no_tag_node_value_mangle=True)
+    return get_frrender_dict(conf, argv)
 
-    nhrp['profile_map'] = {}
-    profile = conf.get_config_dict(['vpn', 'ipsec', 'profile'], key_mangling=('-', '_'),
-                                get_first_key=True, no_tag_node_value_mangle=True)
 
-    for name, profile_conf in profile.items():
-        if 'bind' in profile_conf and 'tunnel' in profile_conf['bind']:
-            interfaces = profile_conf['bind']['tunnel']
-            if isinstance(interfaces, str):
-                interfaces = [interfaces]
-            for interface in interfaces:
-                nhrp['profile_map'][interface] = name
-
-    return nhrp
-
-def verify(nhrp):
-    if 'tunnel' in nhrp:
-        for name, nhrp_conf in nhrp['tunnel'].items():
-            if not nhrp['if_tunnel'] or name not in nhrp['if_tunnel']:
+def verify(config_dict):
+    if not config_dict or 'deleted' in config_dict:
+        return None
+    if 'tunnel' in config_dict:
+        for name, nhrp_conf in config_dict['tunnel'].items():
+            if not config_dict['if_tunnel'] or name not in config_dict['if_tunnel']:
                 raise ConfigError(f'Tunnel interface "{name}" does not exist')
 
-            tunnel_conf = nhrp['if_tunnel'][name]
+            tunnel_conf = config_dict['if_tunnel'][name]
+            if 'address' in tunnel_conf:
+                address_list = dict_search('address', tunnel_conf)
+                for tunip in address_list:
+                    if ipaddress.ip_network(tunip,
+                                            strict=False).prefixlen != 32:
+                        raise ConfigError(
+                            f'Tunnel {name} is used for NHRP, Netmask should be /32!')
 
             if 'encapsulation' not in tunnel_conf or tunnel_conf['encapsulation'] != 'gre':
                 raise ConfigError(f'Tunnel "{name}" is not an mGRE tunnel')
 
+            if 'network_id' not in nhrp_conf:
+                raise ConfigError(f'network-id is not specified in tunnel "{name}"')
+
             if 'remote' in tunnel_conf:
                 raise ConfigError(f'Tunnel "{name}" cannot have a remote address defined')
 
-            if 'map' in nhrp_conf:
-                for map_name, map_conf in nhrp_conf['map'].items():
-                    if 'nbma_address' not in map_conf:
+            map_tunnelip = dict_search('map.tunnel_ip', nhrp_conf)
+            if map_tunnelip:
+                for map_name, map_conf in map_tunnelip.items():
+                    if 'nbma' not in map_conf:
                         raise ConfigError(f'nbma-address missing on map {map_name} on tunnel {name}')
 
-            if 'dynamic_map' in nhrp_conf:
-                for map_name, map_conf in nhrp_conf['dynamic_map'].items():
-                    if 'nbma_domain_name' not in map_conf:
-                        raise ConfigError(f'nbma-domain-name missing on dynamic-map {map_name} on tunnel {name}')
+            nhs_tunnelip = dict_search('nhs.tunnel_ip', nhrp_conf)
+            nbma_list = []
+            if nhs_tunnelip:
+                for nhs_name, nhs_conf in nhs_tunnelip.items():
+                    if 'nbma' not in nhs_conf:
+                        raise ConfigError(f'nbma-address missing on map nhs {nhs_name} on tunnel {name}')
+                    if nhs_name != 'dynamic':
+                        if len(list(dict_search('nbma', nhs_conf))) > 1:
+                            raise ConfigError(
+                                f'Static nhs tunnel-ip {nhs_name} cannot contain multiple nbma-addresses')
+                    for nbma_ip in dict_search('nbma', nhs_conf):
+                        if nbma_ip not in nbma_list:
+                            nbma_list.append(nbma_ip)
+                        else:
+                            raise ConfigError(
+                                f'Nbma address {nbma_ip} cannot be maped to several tunnel-ip')
     return None
 
-def generate(nhrp):
-    if not os.path.exists(nhrp_nftables_conf):
-        nhrp['first_install'] = True
 
-    render(opennhrp_conf, 'nhrp/opennhrp.conf.j2', nhrp)
-    render(nhrp_nftables_conf, 'nhrp/nftables.conf.j2', nhrp)
+def generate(config_dict):
+    if not has_frr_protocol_in_dict(config_dict, 'nhrp'):
+        return None
+
+    if 'deleted' in config_dict['nhrp']:
+        return None
+    render(nhrp_nftables_conf, 'frr/nhrpd_nftables.conf.j2', config_dict['nhrp'])
+
+    if config_dict and not is_systemd_service_running('vyos-configd.service'):
+        FRRender().generate(config_dict)
     return None
 
-def apply(nhrp):
+
+def apply(config_dict):
+
     nft_rc = run(f'nft --file {nhrp_nftables_conf}')
     if nft_rc != 0:
         raise ConfigError('Failed to apply NHRP tunnel firewall rules')
 
-    action = 'restart' if nhrp and 'tunnel' in nhrp else 'stop'
-    service_rc = run(f'systemctl {action} opennhrp.service')
-    if service_rc != 0:
-        raise ConfigError(f'Failed to {action} the NHRP service')
-
+    if config_dict and not is_systemd_service_running('vyos-configd.service'):
+        FRRender().apply()
     return None
 
+
 if __name__ == '__main__':
     try:
         c = get_config()
@@ -112,3 +129,4 @@ if __name__ == '__main__':
     except ConfigError as e:
         print(e)
         exit(1)
+
diff --git a/src/conf_mode/service_dhcp-server.py b/src/conf_mode/service_dhcp-server.py
index 9c59aa63d..5a729af74 100755
--- a/src/conf_mode/service_dhcp-server.py
+++ b/src/conf_mode/service_dhcp-server.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2024 VyOS maintainers and contributors
+# Copyright (C) 2018-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -38,6 +38,7 @@ from vyos.utils.network import is_subnet_connected
 from vyos.utils.network import is_addr_assigned
 from vyos import ConfigError
 from vyos import airbag
+
 airbag.enable()
 
 ctrl_config_file = '/run/kea/kea-ctrl-agent.conf'
@@ -45,13 +46,13 @@ ctrl_socket = '/run/kea/dhcp4-ctrl-socket'
 config_file = '/run/kea/kea-dhcp4.conf'
 lease_file = '/config/dhcp/dhcp4-leases.csv'
 lease_file_glob = '/config/dhcp/dhcp4-leases*'
-systemd_override = r'/run/systemd/system/kea-ctrl-agent.service.d/10-override.conf'
 user_group = '_kea'
 
 ca_cert_file = '/run/kea/kea-failover-ca.pem'
 cert_file = '/run/kea/kea-failover.pem'
 cert_key_file = '/run/kea/kea-failover-key.pem'
 
+
 def dhcp_slice_range(exclude_list, range_dict):
     """
     This function is intended to slice a DHCP range. What does it mean?
@@ -74,19 +75,17 @@ def dhcp_slice_range(exclude_list, range_dict):
     range_last_exclude = ''
 
     for e in exclude_list:
-        if (ip_address(e) >= ip_address(range_start)) and \
-           (ip_address(e) <= ip_address(range_stop)):
+        if (ip_address(e) >= ip_address(range_start)) and (
+            ip_address(e) <= ip_address(range_stop)
+        ):
             range_last_exclude = e
 
     for e in exclude_list:
-        if (ip_address(e) >= ip_address(range_start)) and \
-           (ip_address(e) <= ip_address(range_stop)):
-
+        if (ip_address(e) >= ip_address(range_start)) and (
+            ip_address(e) <= ip_address(range_stop)
+        ):
             # Build new address range ending one address before exclude address
-            r = {
-                'start' : range_start,
-                'stop' : str(ip_address(e) -1)
-            }
+            r = {'start': range_start, 'stop': str(ip_address(e) - 1)}
 
             if 'option' in range_dict:
                 r['option'] = range_dict['option']
@@ -104,10 +103,7 @@ def dhcp_slice_range(exclude_list, range_dict):
             # Take care of last IP address range spanning from the last exclude
             # address (+1) to the end of the initial configured range
             if ip_address(e) == ip_address(range_last_exclude):
-                r = {
-                  'start': str(ip_address(e) + 1),
-                  'stop': str(range_stop)
-                }
+                r = {'start': str(ip_address(e) + 1), 'stop': str(range_stop)}
 
                 if 'option' in range_dict:
                     r['option'] = range_dict['option']
@@ -115,14 +111,15 @@ def dhcp_slice_range(exclude_list, range_dict):
                 if not (ip_address(r['start']) > ip_address(r['stop'])):
                     output.append(r)
         else:
-          # if the excluded address was not part of the range, we simply return
-          # the entire ranga again
-          if not range_last_exclude:
-              if range_dict not in output:
-                  output.append(range_dict)
+            # if the excluded address was not part of the range, we simply return
+            # the entire ranga again
+            if not range_last_exclude:
+                if range_dict not in output:
+                    output.append(range_dict)
 
     return output
 
+
 def get_config(config=None):
     if config:
         conf = config
@@ -132,10 +129,13 @@ def get_config(config=None):
     if not conf.exists(base):
         return None
 
-    dhcp = conf.get_config_dict(base, key_mangling=('-', '_'),
-                                no_tag_node_value_mangle=True,
-                                get_first_key=True,
-                                with_recursive_defaults=True)
+    dhcp = conf.get_config_dict(
+        base,
+        key_mangling=('-', '_'),
+        no_tag_node_value_mangle=True,
+        get_first_key=True,
+        with_recursive_defaults=True,
+    )
 
     if 'shared_network_name' in dhcp:
         for network, network_config in dhcp['shared_network_name'].items():
@@ -147,22 +147,31 @@ def get_config(config=None):
                         new_range_id = 0
                         new_range_dict = {}
                         for r, r_config in subnet_config['range'].items():
-                            for slice in dhcp_slice_range(subnet_config['exclude'], r_config):
-                                new_range_dict.update({new_range_id : slice})
-                                new_range_id +=1
+                            for slice in dhcp_slice_range(
+                                subnet_config['exclude'], r_config
+                            ):
+                                new_range_dict.update({new_range_id: slice})
+                                new_range_id += 1
 
                         dhcp['shared_network_name'][network]['subnet'][subnet].update(
-                                {'range' : new_range_dict})
+                            {'range': new_range_dict}
+                        )
 
     if len(dhcp['high_availability']) == 1:
         ## only default value for mode is set, need to remove ha node
         del dhcp['high_availability']
     else:
         if dict_search('high_availability.certificate', dhcp):
-            dhcp['pki'] = conf.get_config_dict(['pki'], key_mangling=('-', '_'), get_first_key=True, no_tag_node_value_mangle=True)
+            dhcp['pki'] = conf.get_config_dict(
+                ['pki'],
+                key_mangling=('-', '_'),
+                get_first_key=True,
+                no_tag_node_value_mangle=True,
+            )
 
     return dhcp
 
+
 def verify(dhcp):
     # bail out early - looks like removal from running config
     if not dhcp or 'disable' in dhcp:
@@ -170,13 +179,15 @@ def verify(dhcp):
 
     # If DHCP is enabled we need one share-network
     if 'shared_network_name' not in dhcp:
-        raise ConfigError('No DHCP shared networks configured.\n' \
-                          'At least one DHCP shared network must be configured.')
+        raise ConfigError(
+            'No DHCP shared networks configured.\n'
+            'At least one DHCP shared network must be configured.'
+        )
 
     # Inspect shared-network/subnet
     listen_ok = False
     subnets = []
-    shared_networks =  len(dhcp['shared_network_name'])
+    shared_networks = len(dhcp['shared_network_name'])
     disabled_shared_networks = 0
 
     subnet_ids = []
@@ -187,12 +198,16 @@ def verify(dhcp):
             disabled_shared_networks += 1
 
         if 'subnet' not in network_config:
-            raise ConfigError(f'No subnets defined for {network}. At least one\n' \
-                              'lease subnet must be configured.')
+            raise ConfigError(
+                f'No subnets defined for {network}. At least one\n'
+                'lease subnet must be configured.'
+            )
 
         for subnet, subnet_config in network_config['subnet'].items():
             if 'subnet_id' not in subnet_config:
-                raise ConfigError(f'Unique subnet ID not specified for subnet "{subnet}"')
+                raise ConfigError(
+                    f'Unique subnet ID not specified for subnet "{subnet}"'
+                )
 
             if subnet_config['subnet_id'] in subnet_ids:
                 raise ConfigError(f'Subnet ID for subnet "{subnet}" is not unique')
@@ -203,32 +218,46 @@ def verify(dhcp):
             if 'static_route' in subnet_config:
                 for route, route_option in subnet_config['static_route'].items():
                     if 'next_hop' not in route_option:
-                        raise ConfigError(f'DHCP static-route "{route}" requires router to be defined!')
+                        raise ConfigError(
+                            f'DHCP static-route "{route}" requires router to be defined!'
+                        )
 
             # Check if DHCP address range is inside configured subnet declaration
             if 'range' in subnet_config:
                 networks = []
                 for range, range_config in subnet_config['range'].items():
                     if not {'start', 'stop'} <= set(range_config):
-                        raise ConfigError(f'DHCP range "{range}" start and stop address must be defined!')
+                        raise ConfigError(
+                            f'DHCP range "{range}" start and stop address must be defined!'
+                        )
 
                     # Start/Stop address must be inside network
                     for key in ['start', 'stop']:
                         if ip_address(range_config[key]) not in ip_network(subnet):
-                            raise ConfigError(f'DHCP range "{range}" {key} address not within shared-network "{network}, {subnet}"!')
+                            raise ConfigError(
+                                f'DHCP range "{range}" {key} address not within shared-network "{network}, {subnet}"!'
+                            )
 
                     # Stop address must be greater or equal to start address
-                    if ip_address(range_config['stop']) < ip_address(range_config['start']):
-                        raise ConfigError(f'DHCP range "{range}" stop address must be greater or equal\n' \
-                                          'to the ranges start address!')
+                    if ip_address(range_config['stop']) < ip_address(
+                        range_config['start']
+                    ):
+                        raise ConfigError(
+                            f'DHCP range "{range}" stop address must be greater or equal\n'
+                            'to the ranges start address!'
+                        )
 
                     for network in networks:
                         start = range_config['start']
                         stop = range_config['stop']
                         if start in network:
-                            raise ConfigError(f'Range "{range}" start address "{start}" already part of another range!')
+                            raise ConfigError(
+                                f'Range "{range}" start address "{start}" already part of another range!'
+                            )
                         if stop in network:
-                            raise ConfigError(f'Range "{range}" stop address "{stop}" already part of another range!')
+                            raise ConfigError(
+                                f'Range "{range}" stop address "{stop}" already part of another range!'
+                            )
 
                     tmp = IPRange(range_config['start'], range_config['stop'])
                     networks.append(tmp)
@@ -237,12 +266,16 @@ def verify(dhcp):
             if 'exclude' in subnet_config:
                 for exclude in subnet_config['exclude']:
                     if ip_address(exclude) not in ip_network(subnet):
-                        raise ConfigError(f'Excluded IP address "{exclude}" not within shared-network "{network}, {subnet}"!')
+                        raise ConfigError(
+                            f'Excluded IP address "{exclude}" not within shared-network "{network}, {subnet}"!'
+                        )
 
             # At least one DHCP address range or static-mapping required
             if 'range' not in subnet_config and 'static_mapping' not in subnet_config:
-                raise ConfigError(f'No DHCP address range or active static-mapping configured\n' \
-                                  f'within shared-network "{network}, {subnet}"!')
+                raise ConfigError(
+                    f'No DHCP address range or active static-mapping configured\n'
+                    f'within shared-network "{network}, {subnet}"!'
+                )
 
             if 'static_mapping' in subnet_config:
                 # Static mappings require just a MAC address (will use an IP from the dynamic pool if IP is not set)
@@ -251,29 +284,42 @@ def verify(dhcp):
                 used_duid = []
                 for mapping, mapping_config in subnet_config['static_mapping'].items():
                     if 'ip_address' in mapping_config:
-                        if ip_address(mapping_config['ip_address']) not in ip_network(subnet):
-                            raise ConfigError(f'Configured static lease address for mapping "{mapping}" is\n' \
-                                              f'not within shared-network "{network}, {subnet}"!')
-
-                        if ('mac' not in mapping_config and 'duid' not in mapping_config) or \
-                            ('mac' in mapping_config and 'duid' in mapping_config):
-                            raise ConfigError(f'Either MAC address or Client identifier (DUID) is required for '
-                                              f'static mapping "{mapping}" within shared-network "{network}, {subnet}"!')
+                        if ip_address(mapping_config['ip_address']) not in ip_network(
+                            subnet
+                        ):
+                            raise ConfigError(
+                                f'Configured static lease address for mapping "{mapping}" is\n'
+                                f'not within shared-network "{network}, {subnet}"!'
+                            )
+
+                        if (
+                            'mac' not in mapping_config and 'duid' not in mapping_config
+                        ) or ('mac' in mapping_config and 'duid' in mapping_config):
+                            raise ConfigError(
+                                f'Either MAC address or Client identifier (DUID) is required for '
+                                f'static mapping "{mapping}" within shared-network "{network}, {subnet}"!'
+                            )
 
                         if 'disable' not in mapping_config:
                             if mapping_config['ip_address'] in used_ips:
-                                raise ConfigError(f'Configured IP address for static mapping "{mapping}" already exists on another static mapping')
+                                raise ConfigError(
+                                    f'Configured IP address for static mapping "{mapping}" already exists on another static mapping'
+                                )
                             used_ips.append(mapping_config['ip_address'])
 
                     if 'disable' not in mapping_config:
                         if 'mac' in mapping_config:
                             if mapping_config['mac'] in used_mac:
-                                raise ConfigError(f'Configured MAC address for static mapping "{mapping}" already exists on another static mapping')
+                                raise ConfigError(
+                                    f'Configured MAC address for static mapping "{mapping}" already exists on another static mapping'
+                                )
                             used_mac.append(mapping_config['mac'])
 
                         if 'duid' in mapping_config:
                             if mapping_config['duid'] in used_duid:
-                                raise ConfigError(f'Configured DUID for static mapping "{mapping}" already exists on another static mapping')
+                                raise ConfigError(
+                                    f'Configured DUID for static mapping "{mapping}" already exists on another static mapping'
+                                )
                             used_duid.append(mapping_config['duid'])
 
             # There must be one subnet connected to a listen interface.
@@ -284,73 +330,102 @@ def verify(dhcp):
 
             # Subnets must be non overlapping
             if subnet in subnets:
-                raise ConfigError(f'Configured subnets must be unique! Subnet "{subnet}"\n'
-                                   'defined multiple times!')
+                raise ConfigError(
+                    f'Configured subnets must be unique! Subnet "{subnet}"\n'
+                    'defined multiple times!'
+                )
             subnets.append(subnet)
 
             # Check for overlapping subnets
             net = ip_network(subnet)
             for n in subnets:
                 net2 = ip_network(n)
-                if (net != net2):
+                if net != net2:
                     if net.overlaps(net2):
-                        raise ConfigError(f'Conflicting subnet ranges: "{net}" overlaps "{net2}"!')
+                        raise ConfigError(
+                            f'Conflicting subnet ranges: "{net}" overlaps "{net2}"!'
+                        )
 
     # Prevent 'disable' for shared-network if only one network is configured
     if (shared_networks - disabled_shared_networks) < 1:
-        raise ConfigError(f'At least one shared network must be active!')
+        raise ConfigError('At least one shared network must be active!')
 
     if 'high_availability' in dhcp:
         for key in ['name', 'remote', 'source_address', 'status']:
             if key not in dhcp['high_availability']:
                 tmp = key.replace('_', '-')
-                raise ConfigError(f'DHCP high-availability requires "{tmp}" to be specified!')
+                raise ConfigError(
+                    f'DHCP high-availability requires "{tmp}" to be specified!'
+                )
 
         if len({'certificate', 'ca_certificate'} & set(dhcp['high_availability'])) == 1:
-            raise ConfigError(f'DHCP secured high-availability requires both certificate and CA certificate')
+            raise ConfigError(
+                'DHCP secured high-availability requires both certificate and CA certificate'
+            )
 
         if 'certificate' in dhcp['high_availability']:
             cert_name = dhcp['high_availability']['certificate']
 
             if cert_name not in dhcp['pki']['certificate']:
-                raise ConfigError(f'Invalid certificate specified for DHCP high-availability')
-
-            if not dict_search_args(dhcp['pki']['certificate'], cert_name, 'certificate'):
-                raise ConfigError(f'Invalid certificate specified for DHCP high-availability')
-
-            if not dict_search_args(dhcp['pki']['certificate'], cert_name, 'private', 'key'):
-                raise ConfigError(f'Missing private key on certificate specified for DHCP high-availability')
+                raise ConfigError(
+                    'Invalid certificate specified for DHCP high-availability'
+                )
+
+            if not dict_search_args(
+                dhcp['pki']['certificate'], cert_name, 'certificate'
+            ):
+                raise ConfigError(
+                    'Invalid certificate specified for DHCP high-availability'
+                )
+
+            if not dict_search_args(
+                dhcp['pki']['certificate'], cert_name, 'private', 'key'
+            ):
+                raise ConfigError(
+                    'Missing private key on certificate specified for DHCP high-availability'
+                )
 
         if 'ca_certificate' in dhcp['high_availability']:
             ca_cert_name = dhcp['high_availability']['ca_certificate']
             if ca_cert_name not in dhcp['pki']['ca']:
-                raise ConfigError(f'Invalid CA certificate specified for DHCP high-availability')
+                raise ConfigError(
+                    'Invalid CA certificate specified for DHCP high-availability'
+                )
 
             if not dict_search_args(dhcp['pki']['ca'], ca_cert_name, 'certificate'):
-                raise ConfigError(f'Invalid CA certificate specified for DHCP high-availability')
+                raise ConfigError(
+                    'Invalid CA certificate specified for DHCP high-availability'
+                )
 
-    for address in (dict_search('listen_address', dhcp) or []):
+    for address in dict_search('listen_address', dhcp) or []:
         if is_addr_assigned(address, include_vrf=True):
             listen_ok = True
             # no need to probe further networks, we have one that is valid
             continue
         else:
-            raise ConfigError(f'listen-address "{address}" not configured on any interface')
+            raise ConfigError(
+                f'listen-address "{address}" not configured on any interface'
+            )
 
     if not listen_ok:
-        raise ConfigError('None of the configured subnets have an appropriate primary IP address on any\n'
-                          'broadcast interface configured, nor was there an explicit listen-address\n'
-                          'configured for serving DHCP relay packets!')
+        raise ConfigError(
+            'None of the configured subnets have an appropriate primary IP address on any\n'
+            'broadcast interface configured, nor was there an explicit listen-address\n'
+            'configured for serving DHCP relay packets!'
+        )
 
     if 'listen_address' in dhcp and 'listen_interface' in dhcp:
-        raise ConfigError(f'Cannot define listen-address and listen-interface at the same time')
+        raise ConfigError(
+            'Cannot define listen-address and listen-interface at the same time'
+        )
 
-    for interface in (dict_search('listen_interface', dhcp) or []):
+    for interface in dict_search('listen_interface', dhcp) or []:
         if not interface_exists(interface):
             raise ConfigError(f'listen-interface "{interface}" does not exist')
 
     return None
 
+
 def generate(dhcp):
     # bail out early - looks like removal from running config
     if not dhcp or 'disable' in dhcp:
@@ -382,8 +457,12 @@ def generate(dhcp):
             cert_name = dhcp['high_availability']['certificate']
             cert_data = dhcp['pki']['certificate'][cert_name]['certificate']
             key_data = dhcp['pki']['certificate'][cert_name]['private']['key']
-            write_file(cert_file, wrap_certificate(cert_data), user=user_group, mode=0o600)
-            write_file(cert_key_file, wrap_private_key(key_data), user=user_group, mode=0o600)
+            write_file(
+                cert_file, wrap_certificate(cert_data), user=user_group, mode=0o600
+            )
+            write_file(
+                cert_key_file, wrap_private_key(key_data), user=user_group, mode=0o600
+            )
 
             dhcp['high_availability']['cert_file'] = cert_file
             dhcp['high_availability']['cert_key_file'] = cert_key_file
@@ -391,17 +470,33 @@ def generate(dhcp):
         if 'ca_certificate' in dhcp['high_availability']:
             ca_cert_name = dhcp['high_availability']['ca_certificate']
             ca_cert_data = dhcp['pki']['ca'][ca_cert_name]['certificate']
-            write_file(ca_cert_file, wrap_certificate(ca_cert_data), user=user_group, mode=0o600)
+            write_file(
+                ca_cert_file,
+                wrap_certificate(ca_cert_data),
+                user=user_group,
+                mode=0o600,
+            )
 
             dhcp['high_availability']['ca_cert_file'] = ca_cert_file
 
-        render(systemd_override, 'dhcp-server/10-override.conf.j2', dhcp)
-
-    render(ctrl_config_file, 'dhcp-server/kea-ctrl-agent.conf.j2', dhcp, user=user_group, group=user_group)
-    render(config_file, 'dhcp-server/kea-dhcp4.conf.j2', dhcp, user=user_group, group=user_group)
+    render(
+        ctrl_config_file,
+        'dhcp-server/kea-ctrl-agent.conf.j2',
+        dhcp,
+        user=user_group,
+        group=user_group,
+    )
+    render(
+        config_file,
+        'dhcp-server/kea-dhcp4.conf.j2',
+        dhcp,
+        user=user_group,
+        group=user_group,
+    )
 
     return None
 
+
 def apply(dhcp):
     services = ['kea-ctrl-agent', 'kea-dhcp4-server', 'kea-dhcp-ddns-server']
 
@@ -427,6 +522,7 @@ def apply(dhcp):
 
     return None
 
+
 if __name__ == '__main__':
     try:
         c = get_config()
diff --git a/src/conf_mode/system_flow-accounting.py b/src/conf_mode/system_flow-accounting.py
index a12ee363d..925c4a562 100755
--- a/src/conf_mode/system_flow-accounting.py
+++ b/src/conf_mode/system_flow-accounting.py
@@ -18,7 +18,6 @@ import os
 import re
 
 from sys import exit
-from ipaddress import ip_address
 
 from vyos.config import Config
 from vyos.config import config_dict_merge
@@ -159,9 +158,9 @@ def get_config(config=None):
 
     # delete individual flow type defaults - should only be added if user
     # sets this feature
-    for flow_type in ['sflow', 'netflow']:
-        if flow_type not in flow_accounting and flow_type in default_values:
-            del default_values[flow_type]
+    flow_type = 'netflow'
+    if flow_type not in flow_accounting and flow_type in default_values:
+        del default_values[flow_type]
 
     flow_accounting = config_dict_merge(default_values, flow_accounting)
 
@@ -171,9 +170,9 @@ def verify(flow_config):
     if not flow_config:
         return None
 
-    # check if at least one collector is enabled
-    if 'sflow' not in flow_config and 'netflow' not in flow_config and 'disable_imt' in flow_config:
-        raise ConfigError('You need to configure at least sFlow or NetFlow, ' \
+    # check if collector is enabled
+    if 'netflow' not in flow_config and 'disable_imt' in flow_config:
+        raise ConfigError('You need to configure NetFlow, ' \
                           'or not set "disable-imt" for flow-accounting!')
 
     # Check if at least one interface is configured
@@ -185,45 +184,7 @@ def verify(flow_config):
     for interface in flow_config['interface']:
         verify_interface_exists(flow_config, interface, warning_only=True)
 
-    # check sFlow configuration
-    if 'sflow' in flow_config:
-        # check if at least one sFlow collector is configured
-        if 'server' not in flow_config['sflow']:
-            raise ConfigError('You need to configure at least one sFlow server!')
-
-        # check that all sFlow collectors use the same IP protocol version
-        sflow_collector_ipver = None
-        for server in flow_config['sflow']['server']:
-            if sflow_collector_ipver:
-                if sflow_collector_ipver != ip_address(server).version:
-                    raise ConfigError("All sFlow servers must use the same IP protocol")
-            else:
-                sflow_collector_ipver = ip_address(server).version
-
-        # check if vrf is defined for Sflow
-        verify_vrf(flow_config)
-        sflow_vrf = None
-        if 'vrf' in flow_config:
-            sflow_vrf = flow_config['vrf']
-
-        # check agent-id for sFlow: we should avoid mixing IPv4 agent-id with IPv6 collectors and vice-versa
-        for server in flow_config['sflow']['server']:
-            if 'agent_address' in flow_config['sflow']:
-                if ip_address(server).version != ip_address(flow_config['sflow']['agent_address']).version:
-                    raise ConfigError('IPv4 and IPv6 addresses can not be mixed in "sflow agent-address" and "sflow '\
-                                      'server". You need to set the same IP version for both "agent-address" and '\
-                                      'all sFlow servers')
-
-        if 'agent_address' in flow_config['sflow']:
-            tmp = flow_config['sflow']['agent_address']
-            if not is_addr_assigned(tmp, sflow_vrf):
-                raise ConfigError(f'Configured "sflow agent-address {tmp}" does not exist in the system!')
-
-        # Check if configured sflow source-address exist in the system
-        if 'source_address' in flow_config['sflow']:
-            if not is_addr_assigned(flow_config['sflow']['source_address'], sflow_vrf):
-                tmp = flow_config['sflow']['source_address']
-                raise ConfigError(f'Configured "sflow source-address {tmp}" does not exist on the system!')
+    verify_vrf(flow_config)
 
     # check NetFlow configuration
     if 'netflow' in flow_config:
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index e22b7550c..25604d2a2 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2024 VyOS maintainers and contributors
+# Copyright (C) 2021-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -86,8 +86,6 @@ def get_config(config=None):
         conf = Config()
     base = ['vpn', 'ipsec']
     l2tp_base = ['vpn', 'l2tp', 'remote-access', 'ipsec-settings']
-    if not conf.exists(base):
-        return None
 
     # retrieve common dictionary keys
     ipsec = conf.get_config_dict(base, key_mangling=('-', '_'),
@@ -95,6 +93,14 @@ def get_config(config=None):
                                  get_first_key=True,
                                  with_pki=True)
 
+    ipsec['nhrp_exists'] = conf.exists(['protocols', 'nhrp', 'tunnel'])
+    if ipsec['nhrp_exists']:
+        set_dependents('nhrp', conf)
+
+    if not conf.exists(base):
+        ipsec.update({'deleted' : ''})
+        return ipsec
+
     # We have to cleanup the default dict, as default values could
     # enable features which are not explicitly enabled on the
     # CLI. E.g. dead-peer-detection defaults should not be injected
@@ -115,7 +121,6 @@ def get_config(config=None):
     ipsec['dhcp_no_address'] = {}
     ipsec['install_routes'] = 'no' if conf.exists(base + ["options", "disable-route-autoinstall"]) else default_install_routes
     ipsec['interface_change'] = leaf_node_changed(conf, base + ['interface'])
-    ipsec['nhrp_exists'] = conf.exists(['protocols', 'nhrp', 'tunnel'])
 
     if ipsec['nhrp_exists']:
         set_dependents('nhrp', conf)
@@ -196,8 +201,8 @@ def verify_pki_rsa(pki, rsa_conf):
     return True
 
 def verify(ipsec):
-    if not ipsec:
-        return None
+    if not ipsec or 'deleted' in ipsec:
+        return
 
     if 'authentication' in ipsec:
         if 'psk' in ipsec['authentication']:
@@ -624,7 +629,7 @@ def generate_pki_files_rsa(pki, rsa_conf):
 def generate(ipsec):
     cleanup_pki_files()
 
-    if not ipsec:
+    if not ipsec or 'deleted' in ipsec:
         for config_file in [charon_dhcp_conf, charon_radius_conf, interface_conf, swanctl_conf]:
             if os.path.isfile(config_file):
                 os.unlink(config_file)
@@ -721,15 +726,12 @@ def generate(ipsec):
 
 def apply(ipsec):
     systemd_service = 'strongswan.service'
-    if not ipsec:
+    if not ipsec or 'deleted' in ipsec:
         call(f'systemctl stop {systemd_service}')
-
         if vti_updown_db_exists():
             remove_vti_updown_db()
-
     else:
         call(f'systemctl reload-or-restart {systemd_service}')
-
         if ipsec['enabled_vti_interfaces']:
             with open_vti_updown_db_for_create_or_update() as db:
                 db.removeAllOtherInterfaces(ipsec['enabled_vti_interfaces'])
@@ -737,7 +739,7 @@ def apply(ipsec):
                 db.commit(lambda interface: ipsec['vti_interface_dicts'][interface])
         elif vti_updown_db_exists():
             remove_vti_updown_db()
-
+    if ipsec:
         if ipsec.get('nhrp_exists', False):
             try:
                 call_dependents()
@@ -746,7 +748,6 @@ def apply(ipsec):
                 # ConfigError("ConfigError('Interface ethN requires an IP address!')")
                 pass
 
-
 if __name__ == '__main__':
     try:
         ipsec = get_config()
diff --git a/src/conf_mode/vrf.py b/src/conf_mode/vrf.py
index 74780b601..8baf55857 100755
--- a/src/conf_mode/vrf.py
+++ b/src/conf_mode/vrf.py
@@ -149,8 +149,9 @@ def verify(vrf):
                                   f'static routes installed!')
 
     if 'name' in vrf:
-        reserved_names = ["add", "all", "broadcast", "default", "delete", "dev",
-                          "get", "inet", "mtu", "link", "type", "vrf"]
+        reserved_names = ['add', 'all', 'broadcast', 'default', 'delete', 'dev',
+                          'down', 'get', 'inet', 'link', 'mtu', 'type', 'up', 'vrf']
+
         table_ids = []
         vnis = []
         for name, vrf_config in vrf['name'].items():
diff --git a/src/etc/systemd/system/kea-ctrl-agent.service.d/override.conf b/src/etc/systemd/system/kea-ctrl-agent.service.d/override.conf
index 0f5bf801e..c74fafb42 100644
--- a/src/etc/systemd/system/kea-ctrl-agent.service.d/override.conf
+++ b/src/etc/systemd/system/kea-ctrl-agent.service.d/override.conf
@@ -1,6 +1,7 @@
 [Unit]
 After=
 After=vyos-router.service
+ConditionFileNotEmpty=
 
 [Service]
 ExecStart=
diff --git a/src/migration-scripts/flow-accounting/1-to-2 b/src/migration-scripts/flow-accounting/1-to-2
new file mode 100644
index 000000000..5ffb1eec8
--- /dev/null
+++ b/src/migration-scripts/flow-accounting/1-to-2
@@ -0,0 +1,63 @@
+# Copyright 2021-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# migrate 'system flow-accounting sflow' to 'system sflow'
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'flow-accounting']
+base_fa_sflow = base + ['sflow']
+base_sflow = ['system', 'sflow']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base_fa_sflow):
+        # Nothing to do
+        return
+
+    if not config.exists(base_sflow):
+
+        for iface in config.return_values(base + ['interface']):
+            config.set(base_sflow + ['interface'], value=iface, replace=False)
+
+        if config.exists(base + ['vrf']):
+            vrf = config.return_value(base + ['vrf'])
+            config.set(base_sflow + ['vrf'], value=vrf)
+
+        if config.exists(base + ['enable-egress']):
+            config.set(base_sflow + ['enable-egress'])
+
+        if config.exists(base_fa_sflow + ['agent-address']):
+            address = config.return_value(base_fa_sflow + ['agent-address'])
+            config.set(base_sflow + ['agent-address'], value=address)
+
+        if config.exists(base_fa_sflow + ['sampling-rate']):
+            sr = config.return_value(base_fa_sflow + ['sampling-rate'])
+            config.set(base_sflow + ['sampling-rate'], value=sr)
+
+        for server in config.list_nodes(base_fa_sflow + ['server']):
+            config.set(base_sflow + ['server'])
+            config.set_tag(base_sflow + ['server'])
+            config.set(base_sflow + ['server', server])
+            tmp = base_fa_sflow + ['server', server]
+            if config.exists(tmp + ['port']):
+                port = config.return_value(tmp + ['port'])
+                config.set(base_sflow + ['server', server, 'port'], value=port)
+
+    if config.exists(base + ['netflow']):
+        # delete only sflow from flow-accounting if netflow is set
+        config.delete(base_fa_sflow)
+    else:
+        # delete all flow-accounting config otherwise
+        config.delete(base)
diff --git a/src/migration-scripts/nhrp/0-to-1 b/src/migration-scripts/nhrp/0-to-1
new file mode 100644
index 000000000..badd88e04
--- /dev/null
+++ b/src/migration-scripts/nhrp/0-to-1
@@ -0,0 +1,129 @@
+# Copyright 2025 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Migration from Opennhrp to FRR NHRP
+import ipaddress
+
+from vyos.configtree import ConfigTree
+
+base = ['protocols', 'nhrp', 'tunnel']
+interface_base = ['interfaces', 'tunnel']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        return
+    networkid = 1
+    for tunnel_name in config.list_nodes(base):
+        ## Cisco Authentication migration
+        if config.exists(base + [tunnel_name,'cisco-authentication']):
+            auth = config.return_value(base + [tunnel_name,'cisco-authentication'])
+            config.delete(base + [tunnel_name,'cisco-authentication'])
+            config.set(base + [tunnel_name,'authentication'], value=auth)
+        ## Delete Dynamic-map to fqdn
+        if config.exists(base + [tunnel_name,'dynamic-map']):
+            config.delete(base + [tunnel_name,'dynamic-map'])
+        ## Holdtime migration
+        if config.exists(base + [tunnel_name,'holding-time']):
+            holdtime = config.return_value(base + [tunnel_name,'holding-time'])
+            config.delete(base + [tunnel_name,'holding-time'])
+            config.set(base + [tunnel_name,'holdtime'], value=holdtime)
+        ## Add network-id
+        config.set(base + [tunnel_name, 'network-id'], value=networkid)
+        networkid+=1
+        ## Map and nhs migration
+        nhs_tunnelip_list = []
+        nhs_nbmaip_list = []
+        is_nhs = False
+        if config.exists(base + [tunnel_name,'map']):
+            is_map = False
+            for tunnel_ip in config.list_nodes(base + [tunnel_name, 'map']):
+                tunnel_ip_path = base + [tunnel_name, 'map', tunnel_ip]
+                tunnel_ip = tunnel_ip.split('/')[0]
+                if config.exists(tunnel_ip_path + ['cisco']):
+                    config.delete(tunnel_ip_path + ['cisco'])
+                if config.exists(tunnel_ip_path + ['nbma-address']):
+                    nbma = config.return_value(tunnel_ip_path + ['nbma-address'])
+                    if config.exists (tunnel_ip_path + ['register']):
+                        config.delete(tunnel_ip_path + ['register'])
+                        config.delete(tunnel_ip_path + ['nbma-address'])
+                        config.set(base + [tunnel_name, 'nhs', 'tunnel-ip', tunnel_ip, 'nbma'], value=nbma)
+                        is_nhs = True
+                        if tunnel_ip not in nhs_tunnelip_list:
+                            nhs_tunnelip_list.append(tunnel_ip)
+                        if nbma not in nhs_nbmaip_list:
+                            nhs_nbmaip_list.append(nbma)
+                    else:
+                        config.delete(tunnel_ip_path + ['nbma-address'])
+                        config.set(base + [tunnel_name, 'map_test', 'tunnel-ip', tunnel_ip, 'nbma'], value=nbma)
+                        is_map = True
+            config.delete(base + [tunnel_name,'map'])
+
+            if is_nhs:
+                config.set_tag(base + [tunnel_name, 'nhs', 'tunnel-ip'])
+
+            if is_map:
+                config.copy(base + [tunnel_name, 'map_test'], base + [tunnel_name, 'map'])
+                config.delete(base + [tunnel_name, 'map_test'])
+                config.set_tag(base + [tunnel_name, 'map', 'tunnel-ip'])
+
+        #
+        # Change netmask to /32 on tunnel interface
+        # If nhs is alone, add static route tunnel network to nhs
+        #
+        if config.exists(interface_base + [tunnel_name, 'address']):
+            tunnel_ip_list = []
+            for tunnel_ip in config.return_values(
+                    interface_base + [tunnel_name, 'address']):
+                tunnel_ip_ch = tunnel_ip.split('/')[0]+'/32'
+                if tunnel_ip_ch not in tunnel_ip_list:
+                    tunnel_ip_list.append(tunnel_ip_ch)
+                    for nhs in nhs_tunnelip_list:
+                        config.set(['protocols', 'static', 'route', str(ipaddress.ip_network(tunnel_ip, strict=False)), 'next-hop', nhs, 'distance'], value='250')
+                    if nhs_tunnelip_list:
+                        if not config.is_tag(['protocols', 'static', 'route']):
+                            config.set_tag(['protocols', 'static', 'route'])
+                        if not config.is_tag(['protocols', 'static', 'route', str(ipaddress.ip_network(tunnel_ip, strict=False)), 'next-hop']):
+                            config.set_tag(['protocols', 'static', 'route', str(ipaddress.ip_network(tunnel_ip, strict=False)), 'next-hop'])
+
+            config.delete(interface_base + [tunnel_name, 'address'])
+            for tunnel_ip in tunnel_ip_list:
+                config.set(
+                    interface_base + [tunnel_name, 'address'], value=tunnel_ip, replace=False)
+
+        ## Map multicast migration
+        if config.exists(base + [tunnel_name, 'multicast']):
+            multicast_map = config.return_value(
+                base + [tunnel_name, 'multicast'])
+            if multicast_map == 'nhs':
+                config.delete(base + [tunnel_name, 'multicast'])
+                for nbma in nhs_nbmaip_list:
+                    config.set(base + [tunnel_name, 'multicast'], value=nbma,
+                               replace=False)
+
+        ## Delete non-cahching
+        if config.exists(base + [tunnel_name, 'non-caching']):
+            config.delete(base + [tunnel_name, 'non-caching'])
+        ## Delete shortcut-destination
+        if config.exists(base + [tunnel_name, 'shortcut-destination']):
+            if not config.exists(base + [tunnel_name, 'shortcut']):
+                config.set(base + [tunnel_name, 'shortcut'])
+            config.delete(base + [tunnel_name, 'shortcut-destination'])
+        ## Delete shortcut-target
+        if config.exists(base + [tunnel_name, 'shortcut-target']):
+            if not config.exists(base + [tunnel_name, 'shortcut']):
+                config.set(base + [tunnel_name, 'shortcut'])
+            config.delete(base + [tunnel_name, 'shortcut-target'])
+        ## Set registration-no-unique
+        config.set(base + [tunnel_name, 'registration-no-unique'])
\ No newline at end of file
diff --git a/src/migration-scripts/ntp/1-to-2 b/src/migration-scripts/ntp/1-to-2
index fd7b08221..d5f800922 100644
--- a/src/migration-scripts/ntp/1-to-2
+++ b/src/migration-scripts/ntp/1-to-2
@@ -1,4 +1,4 @@
-# Copyright 2023-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2023-2025 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -25,6 +25,11 @@ def migrate(config: ConfigTree) -> None:
         # Nothing to do
         return
 
+    # T6911: do not migrate NTP configuration if mandatory server is missing
+    if not config.exists(base_path + ['server']):
+        config.delete(base_path)
+        return
+
     # config.copy does not recursively create a path, so create ['service'] if
     # it doesn't yet exist, such as for config.boot.default
     if not config.exists(['service']):
diff --git a/src/op_mode/dhcp.py b/src/op_mode/dhcp.py
index 918836a80..636d083e4 100755
--- a/src/op_mode/dhcp.py
+++ b/src/op_mode/dhcp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright (C) 2022-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -19,7 +19,6 @@ import sys
 import typing
 
 from datetime import datetime
-from datetime import timezone
 from glob import glob
 from ipaddress import ip_address
 from tabulate import tabulate
@@ -30,137 +29,78 @@ from vyos.base import Warning
 from vyos.configquery import ConfigTreeQuery
 
 from vyos.kea import kea_get_active_config
+from vyos.kea import kea_get_dhcp_pools
 from vyos.kea import kea_get_leases
-from vyos.kea import kea_get_pool_from_subnet_id
+from vyos.kea import kea_get_server_leases
+from vyos.kea import kea_get_static_mappings
 from vyos.kea import kea_delete_lease
-from vyos.utils.process import is_systemd_service_running
 from vyos.utils.process import call
+from vyos.utils.process import is_systemd_service_running
 
-time_string = "%a %b %d %H:%M:%S %Z %Y"
+time_string = '%a %b %d %H:%M:%S %Z %Y'
 
 config = ConfigTreeQuery()
-lease_valid_states = ['all', 'active', 'free', 'expired', 'released', 'abandoned', 'reset', 'backup']
-sort_valid_inet = ['end', 'mac', 'hostname', 'ip', 'pool', 'remaining', 'start', 'state']
-sort_valid_inet6 = ['end', 'duid', 'ip', 'last_communication', 'pool', 'remaining', 'state', 'type']
+lease_valid_states = [
+    'all',
+    'active',
+    'free',
+    'expired',
+    'released',
+    'abandoned',
+    'reset',
+    'backup',
+]
+sort_valid_inet = [
+    'end',
+    'mac',
+    'hostname',
+    'ip',
+    'pool',
+    'remaining',
+    'start',
+    'state',
+]
+sort_valid_inet6 = [
+    'end',
+    'duid',
+    'ip',
+    'last_communication',
+    'pool',
+    'remaining',
+    'state',
+    'type',
+]
 mapping_sort_valid = ['mac', 'ip', 'pool', 'duid']
 
+stale_warn_msg = 'DHCP server is configured but not started. Data may be stale.'
+
 ArgFamily = typing.Literal['inet', 'inet6']
-ArgState = typing.Literal['all', 'active', 'free', 'expired', 'released', 'abandoned', 'reset', 'backup']
+ArgState = typing.Literal[
+    'all', 'active', 'free', 'expired', 'released', 'abandoned', 'reset', 'backup'
+]
 ArgOrigin = typing.Literal['local', 'remote']
 
-def _utc_to_local(utc_dt):
-    return datetime.fromtimestamp((datetime.fromtimestamp(utc_dt) - datetime(1970, 1, 1)).total_seconds())
-
 
-def _format_hex_string(in_str):
-    out_str = ""
-    # if input is divisible by 2, add : every 2 chars
-    if len(in_str) > 0 and len(in_str) % 2 == 0:
-        out_str = ':'.join(a+b for a,b in zip(in_str[::2], in_str[1::2]))
-    else:
-        out_str = in_str
-
-    return out_str
-
-
-def _find_list_of_dict_index(lst, key='ip', value=''):
-    """
-    Find the index entry of list of dict matching the dict value
-    Exampe:
-        % lst = [{'ip': '192.0.2.1'}, {'ip': '192.0.2.2'}]
-        % _find_list_of_dict_index(lst, key='ip', value='192.0.2.2')
-        % 1
-    """
-    idx = next((index for (index, d) in enumerate(lst) if d[key] == value), None)
-    return idx
+def _utc_to_local(utc_dt):
+    return datetime.fromtimestamp(
+        (datetime.fromtimestamp(utc_dt) - datetime(1970, 1, 1)).total_seconds()
+    )
 
 
-def _get_raw_server_leases(family='inet', pool=None, sorted=None, state=[], origin=None) -> list:
-    """
-    Get DHCP server leases
-    :return list
-    """
+def _get_raw_server_leases(
+    config, family='inet', pool=None, sorted=None, state=[], origin=None
+) -> list:
     inet_suffix = '6' if family == 'inet6' else '4'
-    try:
-        leases = kea_get_leases(inet_suffix)
-    except Exception:
-        raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server lease information')
+    pools = [pool] if pool else kea_get_dhcp_pools(config, inet_suffix)
 
-    if pool is None:
-        pool = _get_dhcp_pools(family=family)
-    else:
-        pool = [pool]
-
-    try:
-        active_config = kea_get_active_config(inet_suffix)
-    except Exception:
-        raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
-
-    data = []
-    for lease in leases:
-        lifetime = lease['valid-lft']
-        expiry = (lease['cltt'] + lifetime)
-
-        lease['start_timestamp'] = datetime.fromtimestamp(expiry - lifetime, timezone.utc)
-        lease['expire_timestamp'] = datetime.fromtimestamp(expiry, timezone.utc) if expiry else None
-
-        data_lease = {}
-        data_lease['ip'] = lease['ip-address']
-        lease_state_long = {0: 'active', 1: 'rejected', 2: 'expired'}
-        data_lease['state'] = lease_state_long[lease['state']]
-        data_lease['pool'] = kea_get_pool_from_subnet_id(active_config, inet_suffix, lease['subnet-id']) if active_config else '-'
-        data_lease['end'] = lease['expire_timestamp'].timestamp() if lease['expire_timestamp'] else None
-        data_lease['origin'] = 'local' # TODO: Determine remote in HA
-        data_lease['mac'] = lease.get('hw-address', '')
-        data_lease['hostname'] = lease.get('hostname', '')
-        # remove trailing dot to ensure consistency for `vyos-hostsd-client`
-        if len(data_lease['hostname']) > 0 and data_lease['hostname'][-1] == '.':
-            data_lease['hostname'] = data_lease['hostname'][:-1]
-
-        if family == 'inet':
-            data_lease['start'] = lease['start_timestamp'].timestamp()
-
-        if family == 'inet6':
-            data_lease['last_communication'] = lease['start_timestamp'].timestamp()
-            data_lease['duid'] = _format_hex_string(lease['duid'])
-            data_lease['type'] = lease['type']
-
-            if lease['type'] == 'IA_PD':
-                prefix_len = lease['prefix-len']
-                data_lease['ip'] += f'/{prefix_len}'
-
-        data_lease['remaining'] = '-'
-
-        if lease['valid-lft'] > 0:
-            data_lease['remaining'] = lease['expire_timestamp'] - datetime.now(timezone.utc)
-
-            if data_lease['remaining'].days >= 0:
-                # substraction gives us a timedelta object which can't be formatted with strftime
-                # so we use str(), split gets rid of the microseconds
-                data_lease['remaining'] = str(data_lease['remaining']).split('.')[0]
-
-        # Do not add old leases
-        if data_lease['remaining'] != '' and data_lease['pool'] in pool and data_lease['state'] != 'free':
-            if not state or state == 'all' or data_lease['state'] in state:
-                data.append(data_lease)
-
-        # deduplicate
-        checked = []
-        for entry in data:
-            addr = entry.get('ip')
-            if addr not in checked:
-                checked.append(addr)
-            else:
-                idx = _find_list_of_dict_index(data, key='ip', value=addr)
-                if idx is not None:
-                    data.pop(idx)
+    mappings = kea_get_server_leases(config, inet_suffix, pools, state, origin)
 
     if sorted:
         if sorted == 'ip':
-            data.sort(key = lambda x:ip_address(x['ip']))
+            mappings.sort(key=lambda x: ip_address(x['ip']))
         else:
-            data.sort(key = lambda x:x[sorted])
-    return data
+            mappings.sort(key=lambda x: x[sorted])
+    return mappings
 
 
 def _get_formatted_server_leases(raw_data, family='inet'):
@@ -171,17 +111,28 @@ def _get_formatted_server_leases(raw_data, family='inet'):
             hw_addr = lease.get('mac')
             state = lease.get('state')
             start = lease.get('start')
-            start =  _utc_to_local(start).strftime('%Y/%m/%d %H:%M:%S')
+            start = _utc_to_local(start).strftime('%Y/%m/%d %H:%M:%S')
             end = lease.get('end')
-            end =  _utc_to_local(end).strftime('%Y/%m/%d %H:%M:%S') if end else '-'
+            end = _utc_to_local(end).strftime('%Y/%m/%d %H:%M:%S') if end else '-'
             remain = lease.get('remaining')
             pool = lease.get('pool')
             hostname = lease.get('hostname')
             origin = lease.get('origin')
-            data_entries.append([ipaddr, hw_addr, state, start, end, remain, pool, hostname, origin])
-
-        headers = ['IP Address', 'MAC address', 'State', 'Lease start', 'Lease expiration', 'Remaining', 'Pool',
-                   'Hostname', 'Origin']
+            data_entries.append(
+                [ipaddr, hw_addr, state, start, end, remain, pool, hostname, origin]
+            )
+
+        headers = [
+            'IP Address',
+            'MAC address',
+            'State',
+            'Lease start',
+            'Lease expiration',
+            'Remaining',
+            'Pool',
+            'Hostname',
+            'Origin',
+        ]
 
     if family == 'inet6':
         for lease in raw_data:
@@ -189,29 +140,33 @@ def _get_formatted_server_leases(raw_data, family='inet'):
             hw_addr = lease.get('mac')
             state = lease.get('state')
             start = lease.get('last_communication')
-            start =  _utc_to_local(start).strftime('%Y/%m/%d %H:%M:%S')
+            start = _utc_to_local(start).strftime('%Y/%m/%d %H:%M:%S')
             end = lease.get('end')
-            end =  _utc_to_local(end).strftime('%Y/%m/%d %H:%M:%S')
+            end = _utc_to_local(end).strftime('%Y/%m/%d %H:%M:%S')
             remain = lease.get('remaining')
             lease_type = lease.get('type')
             pool = lease.get('pool')
             hostname = lease.get('hostname')
             host_identifier = lease.get('duid')
-            data_entries.append([ipaddr, hw_addr, state, start, end, remain, pool, hostname, lease_type, host_identifier])
-
-        headers = ['IPv6 address', 'MAC address', 'State', 'Last communication', 'Lease expiration', 'Remaining', 'Pool',
-                   'Hostname', 'Type', 'DUID']
+            data_entries.append(
+                [ipaddr, state, start, end, remain, lease_type, pool, host_identifier]
+            )
+
+        headers = [
+            'IPv6 address',
+            'State',
+            'Last communication',
+            'Lease expiration',
+            'Remaining',
+            'Type',
+            'Pool',
+            'DUID',
+        ]
 
     output = tabulate(data_entries, headers, numalign='left')
     return output
 
 
-def _get_dhcp_pools(family='inet') -> list:
-    v = 'v6' if family == 'inet6' else ''
-    pools = config.list_nodes(f'service dhcp{v}-server shared-network-name')
-    return pools
-
-
 def _get_pool_size(pool, family='inet'):
     v = 'v6' if family == 'inet6' else ''
     base = f'service dhcp{v}-server shared-network-name {pool}'
@@ -231,26 +186,27 @@ def _get_pool_size(pool, family='inet'):
     return size
 
 
-def _get_raw_pool_statistics(family='inet', pool=None):
-    if pool is None:
-        pool = _get_dhcp_pools(family=family)
-    else:
-        pool = [pool]
+def _get_raw_server_pool_statistics(config, family='inet', pool=None):
+    inet_suffix = '6' if family == 'inet6' else '4'
+    pools = [pool] if pool else kea_get_dhcp_pools(config, inet_suffix)
 
-    v = 'v6' if family == 'inet6' else ''
     stats = []
-    for p in pool:
-        subnet = config.list_nodes(f'service dhcp{v}-server shared-network-name {p} subnet')
+    for p in pools:
         size = _get_pool_size(family=family, pool=p)
-        leases = len(_get_raw_server_leases(family=family, pool=p))
+        leases = len(_get_raw_server_leases(config, family=family, pool=p))
         use_percentage = round(leases / size * 100) if size != 0 else 0
-        pool_stats = {'pool': p, 'size': size, 'leases': leases,
-                      'available': (size - leases), 'use_percentage': use_percentage, 'subnet': subnet}
+        pool_stats = {
+            'pool': p,
+            'size': size,
+            'leases': leases,
+            'available': (size - leases),
+            'use_percentage': use_percentage,
+        }
         stats.append(pool_stats)
     return stats
 
 
-def _get_formatted_pool_statistics(pool_data, family='inet'):
+def _get_formatted_server_pool_statistics(pool_data, family='inet'):
     data_entries = []
     for entry in pool_data:
         pool = entry.get('pool')
@@ -261,67 +217,54 @@ def _get_formatted_pool_statistics(pool_data, family='inet'):
         use_percentage = f'{use_percentage}%'
         data_entries.append([pool, size, leases, available, use_percentage])
 
-    headers = ['Pool', 'Size','Leases', 'Available', 'Usage']
+    headers = ['Pool', 'Size', 'Leases', 'Available', 'Usage']
     output = tabulate(data_entries, headers, numalign='left')
     return output
 
-def _get_raw_server_static_mappings(family='inet', pool=None, sorted=None):
-    if pool is None:
-        pool = _get_dhcp_pools(family=family)
-    else:
-        pool = [pool]
 
-    v = 'v6' if family == 'inet6' else ''
-    mappings = []
-    for p in pool:
-        pool_config = config.get_config_dict(['service', f'dhcp{v}-server', 'shared-network-name', p],
-                                             get_first_key=True)
-        if 'subnet' in pool_config:
-            for subnet, subnet_config in pool_config['subnet'].items():
-                if 'static-mapping' in subnet_config:
-                    for name, mapping_config in subnet_config['static-mapping'].items():
-                        mapping = {'pool': p, 'subnet': subnet, 'name': name}
-                        mapping.update(mapping_config)
-                        mappings.append(mapping)
+def _get_raw_server_static_mappings(config, family='inet', pool=None, sorted=None):
+    inet_suffix = '6' if family == 'inet6' else '4'
+    pools = [pool] if pool else kea_get_dhcp_pools(config, inet_suffix)
+
+    mappings = kea_get_static_mappings(config, inet_suffix, pools)
 
     if sorted:
         if sorted == 'ip':
-            if family == 'inet6':
-                mappings.sort(key = lambda x:ip_address(x['ipv6-address']))
-            else:
-                mappings.sort(key = lambda x:ip_address(x['ip-address']))
+            mappings.sort(key=lambda x: ip_address(x['ip']))
         else:
-            mappings.sort(key = lambda x:x[sorted])
+            mappings.sort(key=lambda x: x[sorted])
     return mappings
 
+
 def _get_formatted_server_static_mappings(raw_data, family='inet'):
     data_entries = []
-    if family == 'inet':
-        for entry in raw_data:
-            pool = entry.get('pool')
-            subnet = entry.get('subnet')
-            name = entry.get('name')
-            ip_addr = entry.get('ip-address', 'N/A')
-            mac_addr = entry.get('mac', 'N/A')
-            duid = entry.get('duid', 'N/A')
-            description = entry.get('description', 'N/A')
-            data_entries.append([pool, subnet, name, ip_addr, mac_addr, duid, description])
-    elif family == 'inet6':
-        for entry in raw_data:
-            pool = entry.get('pool')
-            subnet = entry.get('subnet')
-            name = entry.get('name')
-            ip_addr = entry.get('ipv6-address', 'N/A')
-            mac_addr = entry.get('mac', 'N/A')
-            duid = entry.get('duid', 'N/A')
-            description = entry.get('description', 'N/A')
-            data_entries.append([pool, subnet, name, ip_addr, mac_addr, duid, description])
-
-    headers = ['Pool', 'Subnet', 'Name', 'IP Address', 'MAC Address', 'DUID', 'Description']
+
+    for entry in raw_data:
+        pool = entry.get('pool')
+        subnet = entry.get('subnet')
+        hostname = entry.get('hostname')
+        ip_addr = entry.get('ip', 'N/A')
+        mac_addr = entry.get('mac', 'N/A')
+        duid = entry.get('duid', 'N/A')
+        description = entry.get('description', 'N/A')
+        data_entries.append(
+            [pool, subnet, hostname, ip_addr, mac_addr, duid, description]
+        )
+
+    headers = [
+        'Pool',
+        'Subnet',
+        'Hostname',
+        'IP Address',
+        'MAC Address',
+        'DUID',
+        'Description',
+    ]
     output = tabulate(data_entries, headers, numalign='left')
     return output
 
-def _verify(func):
+
+def _verify_server(func):
     """Decorator checks if DHCP(v6) config exists"""
     from functools import wraps
 
@@ -335,8 +278,10 @@ def _verify(func):
         if not config.exists(f'service dhcp{v}-server'):
             raise vyos.opmode.UnconfiguredSubsystem(unconf_message)
         return func(*args, **kwargs)
+
     return _wrapper
 
+
 def _verify_client(func):
     """Decorator checks if interface is configured as DHCP client"""
     from functools import wraps
@@ -355,67 +300,124 @@ def _verify_client(func):
         if not config.exists(f'interfaces {interface_path} address dhcp{v}'):
             raise vyos.opmode.UnconfiguredObject(unconf_message)
         return func(*args, **kwargs)
+
     return _wrapper
 
-@_verify
-def show_pool_statistics(raw: bool, family: ArgFamily, pool: typing.Optional[str]):
-    pool_data = _get_raw_pool_statistics(family=family, pool=pool)
+
+@_verify_server
+def show_server_pool_statistics(
+    raw: bool, family: ArgFamily, pool: typing.Optional[str]
+):
+    v = 'v6' if family == 'inet6' else ''
+    inet_suffix = '6' if family == 'inet6' else '4'
+
+    if not is_systemd_service_running(f'kea-dhcp{inet_suffix}-server.service'):
+        Warning(stale_warn_msg)
+
+    try:
+        active_config = kea_get_active_config(inet_suffix)
+    except Exception:
+        raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
+
+    active_pools = kea_get_dhcp_pools(active_config, inet_suffix)
+
+    if pool and active_pools and pool not in active_pools:
+        raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
+
+    pool_data = _get_raw_server_pool_statistics(active_config, family=family, pool=pool)
     if raw:
         return pool_data
     else:
-        return _get_formatted_pool_statistics(pool_data, family=family)
+        return _get_formatted_server_pool_statistics(pool_data, family=family)
+
+
+@_verify_server
+def show_server_leases(
+    raw: bool,
+    family: ArgFamily,
+    pool: typing.Optional[str],
+    sorted: typing.Optional[str],
+    state: typing.Optional[ArgState],
+    origin: typing.Optional[ArgOrigin],
+):
+    v = 'v6' if family == 'inet6' else ''
+    inet_suffix = '6' if family == 'inet6' else '4'
 
+    if not is_systemd_service_running(f'kea-dhcp{inet_suffix}-server.service'):
+        Warning(stale_warn_msg)
 
-@_verify
-def show_server_leases(raw: bool, family: ArgFamily, pool: typing.Optional[str],
-                       sorted: typing.Optional[str], state: typing.Optional[ArgState],
-                       origin: typing.Optional[ArgOrigin] ):
-    # if dhcp server is down, inactive leases may still be shown as active, so warn the user.
-    v = '6' if family == 'inet6' else '4'
-    if not is_systemd_service_running(f'kea-dhcp{v}-server.service'):
-        Warning('DHCP server is configured but not started. Data may be stale.')
+    try:
+        active_config = kea_get_active_config(inet_suffix)
+    except Exception:
+        raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
 
-    v = 'v6' if family == 'inet6' else ''
-    if pool and pool not in _get_dhcp_pools(family=family):
-        raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
+    active_pools = kea_get_dhcp_pools(active_config, inet_suffix)
 
-    if state and state not in lease_valid_states:
-        raise vyos.opmode.IncorrectValue(f'DHCP{v} state "{state}" is invalid!')
+    if pool and active_pools and pool not in active_pools:
+        raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
 
     sort_valid = sort_valid_inet6 if family == 'inet6' else sort_valid_inet
     if sorted and sorted not in sort_valid:
         raise vyos.opmode.IncorrectValue(f'DHCP{v} sort "{sorted}" is invalid!')
 
-    lease_data = _get_raw_server_leases(family=family, pool=pool, sorted=sorted, state=state, origin=origin)
+    if state and state not in lease_valid_states:
+        raise vyos.opmode.IncorrectValue(f'DHCP{v} state "{state}" is invalid!')
+
+    lease_data = _get_raw_server_leases(
+        config=active_config,
+        family=family,
+        pool=pool,
+        sorted=sorted,
+        state=state,
+        origin=origin,
+    )
     if raw:
         return lease_data
     else:
         return _get_formatted_server_leases(lease_data, family=family)
 
-@_verify
-def show_server_static_mappings(raw: bool, family: ArgFamily, pool: typing.Optional[str],
-                                sorted: typing.Optional[str]):
+
+@_verify_server
+def show_server_static_mappings(
+    raw: bool,
+    family: ArgFamily,
+    pool: typing.Optional[str],
+    sorted: typing.Optional[str],
+):
     v = 'v6' if family == 'inet6' else ''
-    if pool and pool not in _get_dhcp_pools(family=family):
+    inet_suffix = '6' if family == 'inet6' else '4'
+
+    if not is_systemd_service_running(f'kea-dhcp{inet_suffix}-server.service'):
+        Warning(stale_warn_msg)
+
+    try:
+        active_config = kea_get_active_config(inet_suffix)
+    except Exception:
+        raise vyos.opmode.DataUnavailable('Cannot fetch DHCP server configuration')
+
+    active_pools = kea_get_dhcp_pools(active_config, inet_suffix)
+
+    if pool and active_pools and pool not in active_pools:
         raise vyos.opmode.IncorrectValue(f'DHCP{v} pool "{pool}" does not exist!')
 
     if sorted and sorted not in mapping_sort_valid:
         raise vyos.opmode.IncorrectValue(f'DHCP{v} sort "{sorted}" is invalid!')
 
-    static_mappings = _get_raw_server_static_mappings(family=family, pool=pool, sorted=sorted)
+    static_mappings = _get_raw_server_static_mappings(
+        config=active_config, family=family, pool=pool, sorted=sorted
+    )
     if raw:
         return static_mappings
     else:
         return _get_formatted_server_static_mappings(static_mappings, family=family)
 
+
 def _lease_valid(inet, address):
     leases = kea_get_leases(inet)
-    for lease in leases:
-        if address == lease['ip-address']:
-            return True
-    return False
+    return any(lease['ip-address'] == address for lease in leases)
+
 
-@_verify
+@_verify_server
 def clear_dhcp_server_lease(family: ArgFamily, address: str):
     v = 'v6' if family == 'inet6' else ''
     inet = '6' if family == 'inet6' else '4'
@@ -430,6 +432,7 @@ def clear_dhcp_server_lease(family: ArgFamily, address: str):
 
     print(f'Lease "{address}" has been cleared')
 
+
 def _get_raw_client_leases(family='inet', interface=None):
     from time import mktime
     from datetime import datetime
@@ -458,21 +461,28 @@ def _get_raw_client_leases(family='inet', interface=None):
                     # format this makes less sense for an API and also the expiry
                     # timestamp is provided in UNIX time. Convert string (e.g. Sun Jul
                     # 30 18:13:44 CEST 2023) to UNIX time (1690733624)
-                    tmp.update({'last_update' : int(mktime(datetime.strptime(line, time_string).timetuple()))})
+                    tmp.update(
+                        {
+                            'last_update': int(
+                                mktime(datetime.strptime(line, time_string).timetuple())
+                            )
+                        }
+                    )
                     continue
 
                 k, v = line.split('=')
-                tmp.update({k : v.replace("'", "")})
+                tmp.update({k: v.replace("'", '')})
 
         if 'interface' in tmp:
             vrf = get_interface_vrf(tmp['interface'])
             if vrf:
-                tmp.update({'vrf' : vrf})
+                tmp.update({'vrf': vrf})
 
         lease_data.append(tmp)
 
     return lease_data
 
+
 def _get_formatted_client_leases(lease_data, family):
     from time import localtime
     from time import strftime
@@ -483,30 +493,34 @@ def _get_formatted_client_leases(lease_data, family):
     for lease in lease_data:
         if not lease.get('new_ip_address'):
             continue
-        data_entries.append(["Interface", lease['interface']])
+        data_entries.append(['Interface', lease['interface']])
         if 'new_ip_address' in lease:
-            tmp = '[Active]' if is_intf_addr_assigned(lease['interface'], lease['new_ip_address']) else '[Inactive]'
-            data_entries.append(["IP address", lease['new_ip_address'], tmp])
+            tmp = (
+                '[Active]'
+                if is_intf_addr_assigned(lease['interface'], lease['new_ip_address'])
+                else '[Inactive]'
+            )
+            data_entries.append(['IP address', lease['new_ip_address'], tmp])
         if 'new_subnet_mask' in lease:
-            data_entries.append(["Subnet Mask", lease['new_subnet_mask']])
+            data_entries.append(['Subnet Mask', lease['new_subnet_mask']])
         if 'new_domain_name' in lease:
-            data_entries.append(["Domain Name", lease['new_domain_name']])
+            data_entries.append(['Domain Name', lease['new_domain_name']])
         if 'new_routers' in lease:
-            data_entries.append(["Router", lease['new_routers']])
+            data_entries.append(['Router', lease['new_routers']])
         if 'new_domain_name_servers' in lease:
-            data_entries.append(["Name Server", lease['new_domain_name_servers']])
+            data_entries.append(['Name Server', lease['new_domain_name_servers']])
         if 'new_dhcp_server_identifier' in lease:
-            data_entries.append(["DHCP Server", lease['new_dhcp_server_identifier']])
+            data_entries.append(['DHCP Server', lease['new_dhcp_server_identifier']])
         if 'new_dhcp_lease_time' in lease:
-            data_entries.append(["DHCP Server", lease['new_dhcp_lease_time']])
+            data_entries.append(['DHCP Server', lease['new_dhcp_lease_time']])
         if 'vrf' in lease:
-            data_entries.append(["VRF", lease['vrf']])
+            data_entries.append(['VRF', lease['vrf']])
         if 'last_update' in lease:
             tmp = strftime(time_string, localtime(int(lease['last_update'])))
-            data_entries.append(["Last Update", tmp])
+            data_entries.append(['Last Update', tmp])
         if 'new_expiry' in lease:
             tmp = strftime(time_string, localtime(int(lease['new_expiry'])))
-            data_entries.append(["Expiry", tmp])
+            data_entries.append(['Expiry', tmp])
 
         # Add empty marker
         data_entries.append([''])
@@ -515,6 +529,7 @@ def _get_formatted_client_leases(lease_data, family):
 
     return output
 
+
 def show_client_leases(raw: bool, family: ArgFamily, interface: typing.Optional[str]):
     lease_data = _get_raw_client_leases(family=family, interface=interface)
     if raw:
@@ -522,6 +537,7 @@ def show_client_leases(raw: bool, family: ArgFamily, interface: typing.Optional[
     else:
         return _get_formatted_client_leases(lease_data, family=family)
 
+
 @_verify_client
 def renew_client_lease(raw: bool, family: ArgFamily, interface: str):
     if not raw:
@@ -532,6 +548,7 @@ def renew_client_lease(raw: bool, family: ArgFamily, interface: str):
     else:
         call(f'systemctl restart dhclient@{interface}.service')
 
+
 @_verify_client
 def release_client_lease(raw: bool, family: ArgFamily, interface: str):
     if not raw:
@@ -542,6 +559,7 @@ def release_client_lease(raw: bool, family: ArgFamily, interface: str):
     else:
         call(f'systemctl stop dhclient@{interface}.service')
 
+
 if __name__ == '__main__':
     try:
         res = vyos.opmode.run(sys.modules[__name__])
diff --git a/src/op_mode/ipsec.py b/src/op_mode/ipsec.py
index 02ba126b4..1ab50b105 100755
--- a/src/op_mode/ipsec.py
+++ b/src/op_mode/ipsec.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022-2024 VyOS maintainers and contributors
+# Copyright (C) 2022-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -700,15 +700,6 @@ def reset_profile_dst(profile: str, tunnel: str, nbma_dst: str):
                     ]
                 )
             )
-            # initiate IKE SAs
-            for ike in sa_nbma_list:
-                if ike_sa_name in ike:
-                    vyos.ipsec.vici_initiate(
-                        ike_sa_name,
-                        'dmvpn',
-                        ike[ike_sa_name]['local-host'],
-                        ike[ike_sa_name]['remote-host'],
-                    )
             print(
                 f'Profile {profile} tunnel {tunnel} remote-host {nbma_dst} reset result: success'
             )
@@ -732,18 +723,6 @@ def reset_profile_all(profile: str, tunnel: str):
                 )
             # terminate IKE SAs
             vyos.ipsec.terminate_vici_by_name(ike_sa_name, None)
-            # initiate IKE SAs
-            for ike in sa_list:
-                if ike_sa_name in ike:
-                    vyos.ipsec.vici_initiate(
-                        ike_sa_name,
-                        'dmvpn',
-                        ike[ike_sa_name]['local-host'],
-                        ike[ike_sa_name]['remote-host'],
-                    )
-                print(
-                    f'Profile {profile} tunnel {tunnel} remote-host {ike[ike_sa_name]["remote-host"]} reset result: success'
-                )
             print(f'Profile {profile} tunnel {tunnel} reset result: success')
         except vyos.ipsec.ViciInitiateError as err:
             raise vyos.opmode.UnconfiguredSubsystem(err)
diff --git a/src/op_mode/nhrp.py b/src/op_mode/nhrp.py
deleted file mode 100755
index e66f33079..000000000
--- a/src/op_mode/nhrp.py
+++ /dev/null
@@ -1,101 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2023 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import sys
-import tabulate
-import vyos.opmode
-
-from vyos.utils.process import cmd
-from vyos.utils.process import process_named_running
-from vyos.utils.dict import colon_separated_to_dict
-
-
-def _get_formatted_output(output_dict: dict) -> str:
-    """
-    Create formatted table for CLI output
-    :param output_dict: dictionary for API
-    :type output_dict: dict
-    :return: tabulate string
-    :rtype: str
-    """
-    print(f"Status: {output_dict['Status']}")
-    output: str = tabulate.tabulate(output_dict['routes'], headers='keys',
-                                    numalign="left")
-    return output
-
-
-def _get_formatted_dict(output_string: str) -> dict:
-    """
-    Format string returned from CMD to API list
-    :param output_string: String received by CMD
-    :type output_string: str
-    :return: dictionary for API
-    :rtype: dict
-    """
-    formatted_dict: dict = {
-        'Status': '',
-        'routes': []
-    }
-    output_list: list = output_string.split('\n\n')
-    for list_a in output_list:
-        output_dict = colon_separated_to_dict(list_a, True)
-        if 'Status' in output_dict:
-            formatted_dict['Status'] = output_dict['Status']
-        else:
-            formatted_dict['routes'].append(output_dict)
-    return formatted_dict
-
-
-def show_interface(raw: bool):
-    """
-    Command 'show nhrp interface'
-    :param raw: if API
-    :type raw: bool
-    """
-    if not process_named_running('opennhrp'):
-        raise vyos.opmode.UnconfiguredSubsystem('OpenNHRP is not running.')
-    interface_string: str = cmd('sudo opennhrpctl interface show')
-    interface_dict: dict = _get_formatted_dict(interface_string)
-    if raw:
-        return interface_dict
-    else:
-        return _get_formatted_output(interface_dict)
-
-
-def show_tunnel(raw: bool):
-    """
-    Command 'show nhrp tunnel'
-    :param raw: if API
-    :type raw: bool
-    """
-    if not process_named_running('opennhrp'):
-        raise vyos.opmode.UnconfiguredSubsystem('OpenNHRP is not running.')
-    tunnel_string: str = cmd('sudo opennhrpctl show')
-    tunnel_dict: list = _get_formatted_dict(tunnel_string)
-    if raw:
-        return tunnel_dict
-    else:
-        return _get_formatted_output(tunnel_dict)
-
-
-if __name__ == '__main__':
-    try:
-        res = vyos.opmode.run(sys.modules[__name__])
-        if res:
-            print(res)
-    except (ValueError, vyos.opmode.Error) as e:
-        print(e)
-        sys.exit(1)
diff --git a/src/op_mode/vtysh_wrapper.sh b/src/op_mode/vtysh_wrapper.sh
index 25d09ce77..bc472f7bb 100755
--- a/src/op_mode/vtysh_wrapper.sh
+++ b/src/op_mode/vtysh_wrapper.sh
@@ -2,5 +2,5 @@
 declare -a tmp
 # FRR uses ospf6 where we use ospfv3, and we use reset over clear for BGP,
 # thus alter the commands
-tmp=$(echo $@ | sed -e "s/ospfv3/ospf6/" | sed -e "s/^reset bgp/clear bgp/" | sed -e "s/^reset ip bgp/clear ip bgp/")
+tmp=$(echo $@ | sed -e "s/ospfv3/ospf6/" | sed -e "s/^reset bgp/clear bgp/" | sed -e "s/^reset ip bgp/clear ip bgp/"| sed -e "s/^reset ip nhrp/clear ip nhrp/")
 vtysh -c "$tmp"
diff --git a/src/tests/test_configd_inspect.py b/src/tests/test_configd_inspect.py
index ccd631893..a0470221d 100644
--- a/src/tests/test_configd_inspect.py
+++ b/src/tests/test_configd_inspect.py
@@ -1,4 +1,4 @@
-# Copyright (C) 2020-2024 VyOS maintainers and contributors
+# Copyright (C) 2020-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -12,93 +12,151 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import os
-import re
+import ast
 import json
 
-import warnings
-import importlib.util
-from inspect import signature
-from inspect import getsource
-from functools import wraps
 from unittest import TestCase
 
 INC_FILE = 'data/configd-include.json'
 CONF_DIR = 'src/conf_mode'
 
-f_list = ['get_config', 'verify', 'generate', 'apply']
-
-def import_script(s):
-    path = os.path.join(CONF_DIR, s)
-    name = os.path.splitext(s)[0].replace('-', '_')
-    spec = importlib.util.spec_from_file_location(name, path)
-    module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(module)
-    return module
-
-# importing conf_mode scripts imports jinja2 with deprecation warning
-def ignore_deprecation_warning(f):
-    @wraps(f)
-    def decorated_function(*args, **kwargs):
-        with warnings.catch_warnings():
-            warnings.simplefilter("ignore")
-            f(*args, **kwargs)
-    return decorated_function
+funcs = ['get_config', 'verify', 'generate', 'apply']
+
+
+class FunctionSig(ast.NodeVisitor):
+    def __init__(self):
+        self.func_sig_len = dict.fromkeys(funcs, None)
+        self.get_config_default_values = []
+
+    def visit_FunctionDef(self, node):
+        func_name = node.name
+        if func_name in funcs:
+            self.func_sig_len[func_name] = len(node.args.args)
+
+        if func_name == 'get_config':
+            for default in node.args.defaults:
+                if isinstance(default, ast.Constant):
+                    self.get_config_default_values.append(default.value)
+
+        self.generic_visit(node)
+
+    def get_sig_lengths(self):
+        return self.func_sig_len
+
+    def get_config_default(self):
+        return self.get_config_default_values[0]
+
+
+class LegacyCall(ast.NodeVisitor):
+    def __init__(self):
+        self.legacy_func_count = 0
+
+    def visit_Constant(self, node):
+        value = node.value
+        if isinstance(value, str):
+            if 'my_set' in value or 'my_delete' in value:
+                self.legacy_func_count += 1
+
+        self.generic_visit(node)
+
+    def get_legacy_func_count(self):
+        return self.legacy_func_count
+
+
+class ConfigInstance(ast.NodeVisitor):
+    def __init__(self):
+        self.count = 0
+
+    def visit_Call(self, node):
+        if isinstance(node.func, ast.Name):
+            name = node.func.id
+            if name == 'Config':
+                self.count += 1
+        self.generic_visit(node)
+
+    def get_count(self):
+        return self.count
+
+
+class FunctionConfigInstance(ast.NodeVisitor):
+    def __init__(self):
+        self.func_config_instance = dict.fromkeys(funcs, 0)
+
+    def visit_FunctionDef(self, node):
+        func_name = node.name
+        if func_name in funcs:
+            config_instance = ConfigInstance()
+            config_instance.visit(node)
+            self.func_config_instance[func_name] = config_instance.get_count()
+        self.generic_visit(node)
+
+    def get_func_config_instance(self):
+        return self.func_config_instance
+
 
 class TestConfigdInspect(TestCase):
     def setUp(self):
+        self.ast_list = []
+
         with open(INC_FILE) as f:
             self.inc_list = json.load(f)
 
-    @ignore_deprecation_warning
-    def test_signatures(self):
         for s in self.inc_list:
-            m = import_script(s)
-            for i in f_list:
-                f = getattr(m, i, None)
-                self.assertIsNotNone(f, f"'{s}': missing function '{i}'")
-                sig = signature(f)
-                par = sig.parameters
-                l = len(par)
-                self.assertEqual(l, 1,
-                        f"'{s}': '{i}' incorrect signature")
-                if i == 'get_config':
-                    for p in par.values():
-                        self.assertTrue(p.default is None,
-                                f"'{s}': '{i}' incorrect signature")
-
-    @ignore_deprecation_warning
-    def test_function_instance(self):
-        for s in self.inc_list:
-            m = import_script(s)
-            for i in f_list:
-                f = getattr(m, i, None)
-                if not f:
-                    continue
-                str_f = getsource(f)
-                # Regex not XXXConfig() T3108
-                n = len(re.findall(r'[^a-zA-Z]Config\(\)', str_f))
-                if i == 'get_config':
-                    self.assertEqual(n, 1,
-                            f"'{s}': '{i}' no instance of Config")
-                if i != 'get_config':
-                    self.assertEqual(n, 0,
-                            f"'{s}': '{i}' instance of Config")
-
-    @ignore_deprecation_warning
-    def test_file_instance(self):
-        for s in self.inc_list:
-            m = import_script(s)
-            str_m = getsource(m)
-            # Regex not XXXConfig T3108
-            n = len(re.findall(r'[^a-zA-Z]Config\(\)', str_m))
-            self.assertEqual(n, 1,
-                    f"'{s}' more than one instance of Config")
-
-    @ignore_deprecation_warning
+            s_path = f'{CONF_DIR}/{s}'
+            with open(s_path) as f:
+                s_str = f.read()
+            s_tree = ast.parse(s_str)
+            self.ast_list.append((s, s_tree))
+
+    def test_signatures(self):
+        for s, t in self.ast_list:
+            visitor = FunctionSig()
+            visitor.visit(t)
+            sig_lens = visitor.get_sig_lengths()
+
+            for f in funcs:
+                self.assertIsNotNone(sig_lens[f], f"'{s}': '{f}' missing")
+                self.assertEqual(sig_lens[f], 1, f"'{s}': '{f}' incorrect signature")
+
+            self.assertEqual(
+                visitor.get_config_default(),
+                None,
+                f"'{s}': 'get_config' incorrect signature",
+            )
+
+    def test_file_config_instance(self):
+        for s, t in self.ast_list:
+            visitor = ConfigInstance()
+            visitor.visit(t)
+            count = visitor.get_count()
+
+            self.assertEqual(count, 1, f"'{s}' more than one instance of Config")
+
+    def test_function_config_instance(self):
+        for s, t in self.ast_list:
+            visitor = FunctionConfigInstance()
+            visitor.visit(t)
+            func_config_instance = visitor.get_func_config_instance()
+
+            for f in funcs:
+                if f == 'get_config':
+                    self.assertTrue(
+                        func_config_instance[f] > 0,
+                        f"'{s}': '{f}' no instance of Config",
+                    )
+                    self.assertTrue(
+                        func_config_instance[f] < 2,
+                        f"'{s}': '{f}' more than one instance of Config",
+                    )
+                else:
+                    self.assertEqual(
+                        func_config_instance[f], 0, f"'{s}': '{f}' instance of Config"
+                    )
+
     def test_config_modification(self):
-        for s in self.inc_list:
-            m = import_script(s)
-            str_m = getsource(m)
-            n = str_m.count('my_set')
-            self.assertEqual(n, 0, f"'{s}' modifies config")
+        for s, t in self.ast_list:
+            visitor = LegacyCall()
+            visitor.visit(t)
+            legacy_func_count = visitor.get_legacy_func_count()
+
+            self.assertEqual(legacy_func_count, 0, f"'{s}' modifies config")