6 files changed, 27 insertions, 7 deletions
diff --git a/data/templates/ids/fastnetmon.j2 b/data/templates/ids/fastnetmon.j2
index c482002fa..b9f77a257 100644
--- a/data/templates/ids/fastnetmon.j2
+++ b/data/templates/ids/fastnetmon.j2
@@ -1,21 +1,25 @@
 # enable this option if you want to send logs to local syslog facility
+logging:logging_level = debug
 logging:local_syslog_logging = on
 
 # list of all your networks in CIDR format
-networks_list_path = /etc/networks_list
+networks_list_path = /run/fastnetmon/networks_list
 
 # list networks in CIDR format which will be not monitored for attacks
-white_list_path = /etc/networks_whitelist
+white_list_path = /run/fastnetmon/excluded_networks_list
 
 # Enable/Disable any actions in case of attack
 enable_ban = on
+enable_ban_ipv6 = on
 
 ## How many packets will be collected from attack traffic
 ban_details_records_count = 500
 
 ## How long (in seconds) we should keep an IP in blocked state
 ## If you set 0 here it completely disables unban capability
-ban_time = 1900
+{% if ban_time is vyos_defined %}
+ban_time = {{ ban_time }}
+{% endif %}
 
 # Check if the attack is still active, before triggering an unban callback with this option
 # If the attack is still active, check each run of the unban watchdog
diff --git a/data/templates/ids/fastnetmon_excluded_networks_list.j2 b/data/templates/ids/fastnetmon_excluded_networks_list.j2
new file mode 100644
index 000000000..c88a1c527
--- /dev/null
+++ b/data/templates/ids/fastnetmon_excluded_networks_list.j2
@@ -0,0 +1,5 @@
+{% if excluded_network is vyos_defined %}
+{%     for net in excluded_network %}
+{{ net }}
+{%     endfor %}
+{% endif %}
diff --git a/data/templates/ids/fastnetmon_networks_list.j2 b/data/templates/ids/fastnetmon_networks_list.j2
index 1c81180be..5f1b3ba4d 100644
--- a/data/templates/ids/fastnetmon_networks_list.j2
+++ b/data/templates/ids/fastnetmon_networks_list.j2
@@ -1,6 +1,4 @@
-{% if network is vyos_defined(var_type=str) %}
-{{ network }}
-{% else %}
+{% if network is vyos_defined() %}
 {%     for net in network %}
 {{ net }}
 {%     endfor %}
diff --git a/data/templates/macsec/wpa_supplicant.conf.j2 b/data/templates/macsec/wpa_supplicant.conf.j2
index 0ac7cb860..d2529c50d 100644
--- a/data/templates/macsec/wpa_supplicant.conf.j2
+++ b/data/templates/macsec/wpa_supplicant.conf.j2
@@ -62,6 +62,12 @@ network={
     # mka_priority (Priority of MKA Actor) is in 0..255 range with 255 being
     # default priority
     mka_priority={{ security.mka.priority }}
+
+    # macsec_csindex: IEEE 802.1X/MACsec cipher suite
+    # 0 = GCM-AES-128
+    # 1 = GCM-AES-256
+{# security.cipher is a mandatory key #}
+    macsec_csindex={{ '1' if security.cipher is vyos_defined('gcm-aes-256') else '0' }}
 {% endif %}
 
 {% if security.replay_window is vyos_defined %}
@@ -83,5 +89,9 @@ network={
     # 1..2^32-1: number of packets that could be misordered
     macsec_replay_window={{ security.replay_window }}
 {% endif %}
+
+    # macsec_port: IEEE 802.1X/MACsec port - Port component of the SCI
+    # Range: 1-65534 (default: 1)
+    macsec_port=1
 }
 
diff --git a/data/templates/router-advert/radvd.conf.j2 b/data/templates/router-advert/radvd.conf.j2
index ed15b32f0..a464795ad 100644
--- a/data/templates/router-advert/radvd.conf.j2
+++ b/data/templates/router-advert/radvd.conf.j2
@@ -50,6 +50,8 @@ interface {{ iface }} {
         AdvValidLifetime {{ prefix_options.valid_lifetime }};
         AdvOnLink {{ 'off' if prefix_options.no_on_link_flag is vyos_defined else 'on' }};
         AdvPreferredLifetime {{ prefix_options.preferred_lifetime }};
+        DeprecatePrefix {{ 'on' if prefix_options.deprecate_prefix is vyos_defined else 'off' }};
+        DecrementLifetimes {{ 'on' if prefix_options.decrement_lifetime is vyos_defined else 'off' }};
     };
 {%             endfor %}
 {%         endif %}
diff --git a/data/templates/ssh/override.conf.j2 b/data/templates/ssh/override.conf.j2
index e4d6f51cb..4454ad1b8 100644
--- a/data/templates/ssh/override.conf.j2
+++ b/data/templates/ssh/override.conf.j2
@@ -5,8 +5,9 @@ After=vyos-router.service
 ConditionPathExists={{ config_file }}
 
 [Service]
+EnvironmentFile=
 ExecStart=
-ExecStart={{ vrf_command }}/usr/sbin/sshd -f {{ config_file }} -D $SSHD_OPTS
+ExecStart={{ vrf_command }}/usr/sbin/sshd -f {{ config_file }}
 Restart=always
 RestartPreventExitStatus=
 RestartSec=10