feat(swap): import .md files and webp transition from myst/current

Selective import from origin/myst/current (cf9c9b34):
- Add/update 255 .md files (full MyST conversion plus webp ref updates)
- Delete 175 PNG/JPG from docs/_static/images (webp twins already present)
- Delete 5 autotest topology.png (webp twins already present)

Preserved on swap (untouched):
- All .rst files (incremental swap pattern)
- conf.py, _ext/, _include/*.txt, .gitignore
- 115 canary md-*.md files
- 7 superpowers/specs/*.md design docs
- Logos vyos-logo.png / vyos-logo-icon.png (referenced by conf.py)

🤖 Generated by [robots](https://vyos.io)

1 files changed, 406 insertions, 0 deletions

diff --git a/docs/configexamples/ipsec-cisco-route-based.md b/docs/configexamples/ipsec-cisco-route-based.md
new file mode 100644
index 00000000..40a3985b
--- /dev/null
+++ b/docs/configexamples/ipsec-cisco-route-based.md
@@ -0,0 +1,406 @@
+---
+lastproofread: '2025-06-26'
+---
+
+(examples-ipsec-cisco-route-based)=
+
+# Route-based Site-to-Site VPN IPsec between VyOS and Cisco
+
+This document is to describe a basic setup using route-based
+site-to-site VPN IPsec. In this example we use VyOS 1.5 and
+Cisco IOS. Cisco initiates IPsec connection only if interesting
+traffic present. For stable work we recommend configuring an
+initiator role on VyOS side. OSPF is selected as routing protocol
+inside the tunnel.
+
+## Network Topology
+
+```{eval-rst}
+.. image:: /_static/images/cisco-vpn-ipsec.webp
+   :align: center
+   :alt: Network Topology Diagram
+```
+
+
+## Prerequirements
+
+**VyOS:**
+
+```{eval-rst}
++---------+----------------+
+| WAN IP  |  10.0.1.2/30   |
++---------+----------------+
+| LAN1 IP | 192.168.0.1/24 |
++---------+----------------+
+| LAN2 IP | 192.168.1.1/24 |
++---------+----------------+
+```
+
+**Cisco:**
+
+```{eval-rst}
++---------+-----------------+
+| WAN IP  | 10.0.2.2/30     |
++---------+-----------------+
+| LAN1 IP | 192.168.10.1/24 |
++---------+-----------------+
+| LAN2 IP | 192.168.11.1/24 |
++---------+-----------------+
+```
+
+**IKE parameters:**
+
+```{eval-rst}
++-------------------+---------+
+| Encryption        | AES-128 |
++-------------------+---------+
+| HASH              | SHA-1   |
++-------------------+---------+
+| Diff-Helman Group | 14      |
++-------------------+---------+
+| Life-Time         | 28800   |
++-------------------+---------+
+| IKE Version       | 1       |
++-------------------+---------+
+```
+
+**IPsec parameters:**
+
+```{eval-rst}
++------------+---------+
+| Encryption | AES-256 |
++------------+---------+
+| HASH       | SHA-256 |
++------------+---------+
+| Life-Time  | 3600    |
++------------+---------+
+| PFS        | disable |
++------------+---------+
+```
+
+**Hosts configuration**
+
+```{eval-rst}
++--------+--------------+
+| PC1 IP | 192.168.0.2  |
++--------+--------------+
+| PC2 IP | 192.168.1.2  |
++--------+--------------+
+| PC3 IP | 192.168.10.2 |
++--------+--------------+
+| PC4 IP | 192.168.11.2 |
++--------+--------------+
+```
+
+## Configuration
+
+:::{note}
+Pfs is disabled in Cisco by default.
+:::
+
+### VyOS
+
+```none
+set interfaces ethernet eth0 address '10.0.1.2/30'
+set interfaces ethernet eth1 address '192.168.0.1/24'
+set interfaces ethernet eth2 address '192.168.1.1/24'
+set interfaces vti vti1 address '10.100.100.1/30'
+set interfaces vti vti1 mtu '1438'
+set protocols ospf area 0 network '10.100.100.0/30'
+set protocols ospf area 0 network '192.168.0.0/24'
+set protocols ospf area 0 network '192.168.1.0/24'
+set protocols ospf interface eth1 passive
+set protocols ospf interface eth2 passive
+set protocols ospf interface vti1 network 'point-to-point'
+set protocols ospf parameters router-id '2.2.2.2'
+set protocols static route 0.0.0.0/0 next-hop 10.0.1.1
+set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2'
+set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2'
+set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA=='
+set vpn ipsec authentication psk AUTH-PSK secret-type 'base64'
+set vpn ipsec esp-group ESP-GROUP lifetime '3600'
+set vpn ipsec esp-group ESP-GROUP pfs 'disable'
+set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256'
+set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256'
+set vpn ipsec ike-group IKE-GROUP close-action 'start'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30'
+set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1'
+set vpn ipsec ike-group IKE-GROUP lifetime '28800'
+set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14'
+set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128'
+set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1'
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2'
+set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2'
+set vpn ipsec site-to-site peer CISCO connection-type 'initiate'
+set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2'
+set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2'
+set vpn ipsec site-to-site peer CISCO vti bind 'vti1'
+```
+
+
+### Cisco
+
+```none
+crypto isakmp policy 10
+ encr aes
+ authentication pre-share
+ group 14
+ lifetime 28800
+crypto isakmp key test address 10.0.1.2
+!
+!
+crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac
+ mode transport
+!
+crypto ipsec profile IPsec-profile
+ set transform-set TS
+!
+!
+!
+!
+!
+!
+!
+interface Loopback0
+ ip address 1.1.1.1 255.255.255.255
+!
+interface Tunnel10
+ ip address 10.100.100.2 255.255.255.252
+ ip ospf network point-to-point
+ tunnel source GigabitEthernet0/0
+ tunnel mode ipsec ipv4
+ tunnel destination 10.0.1.2
+ tunnel protection ipsec profile IPsec-profile
+!
+interface GigabitEthernet0/0
+ ip address 10.0.2.2 255.255.255.252
+ duplex auto
+ speed auto
+ media-type rj45
+!
+interface GigabitEthernet0/1
+ ip address 192.168.10.1 255.255.255.0
+ duplex auto
+ speed auto
+ media-type rj45
+!
+interface GigabitEthernet0/2
+ ip address 192.168.11.1 255.255.255.0
+ duplex auto
+ speed auto
+ media-type rj45
+!
+router ospf 1
+ router-id 1.1.1.1
+ passive-interface GigabitEthernet0/1
+ passive-interface GigabitEthernet0/2
+ network 10.100.100.0 0.0.0.3 area 0
+ network 192.168.10.0 0.0.0.255 area 0
+ network 192.168.11.0 0.0.0.255 area 0
+!
+ip route 0.0.0.0 0.0.0.0 10.0.2.1
+```
+
+
+## Monitoring
+
+### Monitoring on VyOS side
+
+IKE SAs:
+
+```none
+vyos@vyos:~$ show vpn ike sa
+Peer ID / IP                            Local ID / IP
+------------                            -------------
+10.0.2.2 10.0.2.2                       10.0.1.2 10.0.1.2
+
+    State  IKEVer  Encrypt      Hash          D-H Group      NAT-T  A-Time  L-Time
+    -----  ------  -------      ----          ---------      -----  ------  ------
+    up     IKEv1   AES_CBC_128  HMAC_SHA1_96  MODP_2048      no     8175    18439
+```
+
+IPsec SAs:
+
+```none
+vyos@vyos:~$ show vpn ipsec sa
+Connection    State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
+------------  -------  --------  --------------  ----------------  ----------------  -----------  -----------------------------
+CISCO-vti     up       34m59s    17K/14K         224/213           10.0.2.2          10.0.2.2     AES_CBC_256/HMAC_SHA2_256_128
+```
+
+OSPF Neighbor Status:
+
+```none
+vyos@vyos:~$ show ip ospf neighbor
+
+Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXmtL RqstL DBsmL
+1.1.1.1           1 Full/-          1h29m37s          39.317s 10.100.100.2    vti1:10.100.100.1                    0     0     0
+```
+
+Routing Table:
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, L - local, S - static,
+       R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric, t - Table-Direct,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54
+C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59
+L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59
+O   10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50
+C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50
+L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50
+O   192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54
+C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59
+L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59
+O   192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54
+C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59
+L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59
+O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34
+O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34
+```
+
+
+### Monitoring on Cisco side
+
+IKE SAs:
+
+```none
+Cisco#show crypto isakmp sa
+IPv4 Crypto ISAKMP SA
+dst             src             state          conn-id status
+10.0.1.2        10.0.2.2        QM_IDLE           1002 ACTIVE
+
+IPv6 Crypto ISAKMP SA
+```
+
+IPsec SAs:
+
+```none
+Cisco#show crypto ipsec sa
+
+interface: Tunnel10
+    Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2
+
+   protected vrf: (none)
+   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
+   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
+   current_peer 10.0.1.2 port 500
+     PERMIT, flags={origin_is_acl,}
+    #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295
+    #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238
+    #pkts compressed: 0, #pkts decompressed: 0
+    #pkts not compressed: 0, #pkts compr. failed: 0
+    #pkts not decompressed: 0, #pkts decompress failed: 0
+    #send errors 0, #recv errors 0
+
+     local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2
+     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
+     current outbound spi: 0xC3E9B307(3286872839)
+     PFS (Y/N): N, DH group: none
+
+     inbound esp sas:
+      spi: 0x2740C328(658555688)
+        transform: esp-256-aes esp-sha256-hmac ,
+        in use settings ={Tunnel, }
+        conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0
+        sa timing: remaining key lifetime (k/sec): (4173824/1401)
+        IV size: 16 bytes
+        replay detection support: Y
+        Status: ACTIVE(ACTIVE)
+
+     inbound ah sas:
+
+     inbound pcp sas:
+
+     outbound esp sas:
+      spi: 0xC3E9B307(3286872839)
+        transform: esp-256-aes esp-sha256-hmac ,
+        in use settings ={Tunnel, }
+        conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0
+        sa timing: remaining key lifetime (k/sec): (4173819/1401)
+        IV size: 16 bytes
+        replay detection support: Y
+        Status: ACTIVE(ACTIVE)
+
+     outbound ah sas:
+
+     outbound pcp sas:
+```
+
+OSPF Neighbor Status:
+
+```none
+Cisco# show ip ospf neighbor
+
+Neighbor ID     Pri   State           Dead Time   Address         Interface
+2.2.2.2           0   FULL/  -        00:00:35    10.100.100.1    Tunnel10
+```
+
+Routing Table:
+
+```none
+Cisco#show ip route
+Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
+       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
+       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
+       E1 - OSPF external type 1, E2 - OSPF external type 2
+       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
+       ia - IS-IS inter area, * - candidate default, U - per-user static route
+       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+       a - application route
+       + - replicated route, % - next hop override, p - overrides from PfR
+
+Gateway of last resort is 10.0.2.1 to network 0.0.0.0
+
+S*    0.0.0.0/0 [1/0] via 10.0.2.1
+      1.0.0.0/32 is subnetted, 1 subnets
+C        1.1.1.1 is directly connected, Loopback0
+      10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
+C        10.0.2.0/30 is directly connected, GigabitEthernet0/0
+L        10.0.2.2/32 is directly connected, GigabitEthernet0/0
+C        10.100.100.0/30 is directly connected, Tunnel10
+L        10.100.100.2/32 is directly connected, Tunnel10
+O     192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10
+O     192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10
+      192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
+C        192.168.10.0/24 is directly connected, GigabitEthernet0/1
+L        192.168.10.1/32 is directly connected, GigabitEthernet0/1
+      192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks
+C        192.168.11.0/24 is directly connected, GigabitEthernet0/2
+L        192.168.11.1/32 is directly connected, GigabitEthernet0/2
+```
+
+
+### Checking Connectivity
+
+ICMP packets from PC1 to PC3.
+
+```none
+PC1> ping 192.168.10.2
+
+84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms
+84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms
+84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms
+84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms
+84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms
+```
+
+ICMP packets from PC2 to PC4.
+
+```none
+PC2> ping 192.168.11.2
+
+84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms
+84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms
+84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms
+```