Merge remote-tracking branch 'origin/current' into feat/docs-llms-txt-current

# Conflicts: # docs/conf.py
author: Yuriy Andamasov <yuriy@vyos.io> 2026-05-06 23:24:45 +0300
committer: Yuriy Andamasov <yuriy@vyos.io> 2026-05-06 23:24:45 +0300
commit: 89f86b481456437f3e9f16895e7408fe460de3f3 (patch)
tree: f1bb09b203d56234c4518e6ab2d7fa5ca8610dec /docs/configexamples
parent: 6ce9145fa101e623c61f009c9cf5bb75a8a4a108 (diff)
parent: 7cf51e1c2901f6d1b01e9bff194f7188bc29e417 (diff)
download: vyos-documentation-89f86b481456437f3e9f16895e7408fe460de3f3.tar.gz
vyos-documentation-89f86b481456437f3e9f16895e7408fe460de3f3.zip
66 files changed, 8444 insertions, 7 deletions
diff --git a/docs/configexamples/ansible.md b/docs/configexamples/ansible.md
new file mode 100644
index 00000000..8bbd9306
--- /dev/null
+++ b/docs/configexamples/ansible.md
@@ -0,0 +1,212 @@
+---
+lastproofread: '2024-04-09'
+---
+
+(examples-ansible)=
+
+# Ansible example
+
+## Setting up Ansible on a server running the Debian operating system.
+
+In this example, we will set up a simple use of Ansible to configure
+multiple VyOS routers.
+We have four pre-configured routers with this configuration:
+
+Using the general schema for example:
+
+```{image} /_static/images/ansible.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+We have four pre-configured routers with this configuration:
+
+```none
+set interfaces ethernet eth0 address dhcp
+set service ssh
+commit
+save
+```
+
+- vyos7 - 192.0.2.105
+- vyos8 - 192.0.2.106
+- vyos9 - 192.0.2.107
+- vyos10 - 192.0.2.108
+
+## Install Ansible:
+
+```none
+# apt-get install ansible
+Do you want to continue? [Y/n] y
+```
+
+
+## Install Paramiko:
+
+```none
+#apt-get install -y python3-paramiko
+```
+
+
+## Check the version:
+
+```none
+# ansible --version
+ansible 2.10.8
+config file = None
+configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
+ansible python module location = /usr/lib/python3/dist-packages/ansible
+executable location = /usr/bin/ansible
+python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]
+```
+
+
+## Basic configuration of ansible.cfg:
+
+```none
+# nano /root/ansible.cfg
+[defaults]
+host_key_checking = no
+```
+
+
+## Add all the VyOS hosts:
+
+```none
+# nano /root/hosts
+[vyos_hosts]
+vyos7 ansible_ssh_host=192.0.2.105
+vyos8 ansible_ssh_host=192.0.2.106
+vyos9 ansible_ssh_host=192.0.2.107
+vyos10 ansible_ssh_host=192.0.2.108
+```
+
+
+## Add general variables:
+
+```none
+# mkdir /root/group_vars/
+# nano /root/group_vars/vyos_hosts
+ansible_python_interpreter: /usr/bin/python3
+ansible_network_os: vyos
+ansible_connection: network_cli
+ansible_user: vyos
+ansible_ssh_pass: vyos
+```
+
+
+## Add a simple playbook with the tasks for each router:
+
+```none
+# nano /root/main.yml
+
+---
+- hosts: vyos_hosts
+  gather_facts: 'no'
+  tasks:
+    - name: Configure general settings for the vyos hosts group
+      vyos_config:
+        lines:
+        - set system name-server 192.0.2.1
+        - set interfaces ethernet eth0 description '#WAN#'
+        - set interfaces ethernet eth1 description '#LAN#'
+        - set interfaces ethernet eth2 disable
+        - set interfaces ethernet eth3 disable
+        - set system host-name {{ inventory_hostname }}
+        save: true
+```
+
+
+## Start the playbook:
+
+```none
+ansible-playbook -i hosts main.yml
+PLAY [vyos_hosts] **************************************************************
+
+TASK [Configure general settings for the vyos hosts group] *********************
+ok: [vyos9]
+ok: [vyos10]
+ok: [vyos7]
+ok: [vyos8]
+
+PLAY RECAP *********************************************************************
+vyos10                     : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+vyos7                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+vyos8                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+vyos9                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+```
+
+
+## Check the result on the vyos10 router:
+
+```none
+vyos@vyos10:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface        IP Address                        S/L  Description
+---------        ----------                        ---  -----------
+eth0             192.0.2.108/24                    u/u  WAN
+eth1             -                                 u/u  LAN
+eth2             -                                 A/D
+eth3             -                                 A/D
+lo               127.0.0.1/8                       u/u
+                ::1/128
+
+vyos@vyos10:~$ sh configuration commands | grep 192.0.2.1
+set system name-server '192.0.2.1'
+```
+
+
+## The simple way without configuration of the hostname (one task for all routers):
+
+```none
+# nano /root/hosts_v2
+[vyos_hosts_group]
+vyos7 ansible_ssh_host=192.0.2.105
+vyos8 ansible_ssh_host=192.0.2.106
+vyos9 ansible_ssh_host=192.0.2.107
+vyos10 ansible_ssh_host=192.0.2.108
+[vyos_hosts_group:vars]
+ansible_python_interpreter=/usr/bin/python3
+ansible_user=vyos
+ansible_ssh_pass=vyos
+ansible_network_os=vyos
+ansible_connection=network_cli
+
+# nano /root/main_v2.yml
+---
+- hosts: vyos_hosts_group
+  connection: network_cli
+  gather_facts: 'no'
+  tasks:
+    - name: Configure remote vyos_hosts_group
+      vyos_config:
+        lines:
+        - set system name-server 192.0.2.1
+        - set interfaces ethernet eth0 description WAN
+        - set interfaces ethernet eth1 description LAN
+        - set interfaces ethernet eth2 disable
+        - set interfaces ethernet eth3 disable
+        save: true
+```
+
+```none
+# ansible-playbook -i hosts_v2 main_v2.yml
+
+PLAY [vyos_hosts_group] ********************************************************
+
+TASK [Configure remote vyos_hosts_group] ***************************************
+ok: [vyos8]
+ok: [vyos7]
+ok: [vyos9]
+ok: [vyos10]
+
+PLAY RECAP *********************************************************************
+vyos10                     : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+vyos7                      : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+vyos8                      : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+vyos9                      : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0
+```
+
+In the next chapter of the example, we'll use Ansible with jinja2
+templates and variables.
diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md
new file mode 100644
index 00000000..1633b349
--- /dev/null
+++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md
@@ -0,0 +1,89 @@
+# DHCP Relay through GRE-Bridge
+
+```{eval-rst}
+| Testdate: 2023-05-11
+| Version: 1.4-rolling-202305100734
+```
+
+This simple structure shows how to configure a DHCP Relay over a GRE Bridge
+interface.
+
+## Topology
+
+The topology has 3 VyOS routers and one client. Between the DHCP Server and
+the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large
+Network.
+
+```{image} _include/topology.webp
+:alt: Ansible Example topology image
+```
+
+
+## Configuration
+
+First, we configure the transport network and the Tunnel interface.
+
+Transport:
+
+```{literalinclude} _include/transport.conf
+:language: none
+```
+
+DHCP-Server
+
+```{literalinclude} _include/dhcp-server.conf
+:language: none
+:lines: 1-8
+```
+
+DHCP-Relay
+
+```{literalinclude} _include/dhcp-relay.conf
+:language: none
+:lines: 1-8
+```
+
+After this, we need the DHCP-Server and Relay configuration.
+To get a testable result, we just have one IP in the DHCP range.
+Expand it as you need it.
+
+DHCP-Server
+
+```{literalinclude} _include/dhcp-server.conf
+:language: none
+:lines: 9-13
+```
+
+DHCP-Relay
+
+```{literalinclude} _include/dhcp-relay.conf
+:language: none
+:lines: 9-10
+```
+
+
+## Test the result
+
+Ping the Client from the DHCP Server.
+
+```none
+vyos@dhcp-server:~$ ping 192.168.0.30 count 4
+PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data.
+64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms
+64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms
+64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms
+64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms
+
+--- 192.168.0.30 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3004ms
+rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms
+```
+
+And show all DHCP Leases
+
+```none
+vyos@dhcp-server:~$ show dhcp server leases
+IP Address    MAC address        State    Lease start          Lease expiration     Remaining    Pool        Hostname
+------------  -----------------  -------  -------------------  -------------------  -----------  ----------  ----------
+192.168.0.30  00:50:79:66:68:05  active   2023/05/11 13:08:50  2023/05/12 13:08:50  23:59:16     DHCPTun100  VPCS
+```
diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.png b/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.png
deleted file mode 100644
index 952b664b..00000000
--- a/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.png
+++ /dev/null
diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst b/docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst
index f2a98479..f2a98479 100644
--- a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst
+++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst
diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md
new file mode 100644
index 00000000..b74452e1
--- /dev/null
+++ b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md
@@ -0,0 +1,246 @@
+# L3VPN EVPN with VyOS
+
+```{eval-rst}
+| Testdate: 2023-05-11
+| Version: 1.4-rolling-202305100734
+```
+
+I spun up a new lab in EVE-NG, which represents this as the
+"Foo Bar - Service Provider Inc." that has 3 points of presence (PoP) in random
+datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two
+customers.
+
+I named the customers blue, red and green which is common practice in
+VRF (Virtual Routing and Forwarding) documentation scenarios.
+
+- PE1 is located in an industrial area that holds multiple office buildings.
+  All customers have a site in this area.
+- PE2 is located in a smaller area where by coincidence two customers
+  (blue and red) share an office building.
+- PE3 is located in a smaller area where by coincidence two customers
+  (blue and green) are located.
+
+## Management VRF
+
+A brief excursion into VRFs: This has been one of the longest-standing feature
+requests of VyOS (dating back to 2016) which can be described as
+"a VLAN for layer 2 is what a VRF is for layer 3".
+With VRFs, a router/system can hold multiple, isolated routing tables on the
+same system. If you wonder what's the difference between multiple tables that
+people used for policy-based routing since forever, it's that a VRF also
+isolates connected routes rather than just static and dynamically learned
+routes, so it allows NICs in different VRFs to use conflicting network
+ranges without issues.
+
+VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing)
+and VyOS 1.4 now enables full dynamic routing protocol support for
+OSPF, IS-IS, and BGP for individual VRFs.
+
+The lab I built is using a VRF (called **mgmt**) to provide out-of-band
+SSH access to the PE (Provider Edge) routers.
+
+```{literalinclude} _include/PE1.conf
+:language: none
+:lines: 1-6
+```
+
+
+## Topology
+
+We use the following network topology in this example:
+
+```{image} _include/topology.webp
+:alt: L3VPN EVPN with VyOS topology image
+```
+
+
+## Core network
+
+I chose to run OSPF as the IGP (Interior Gateway Protocol).
+All required BGP sessions are established via a dummy interfaces
+(similar to the loopback, but in Linux you can have only one loopback,
+while there can be many dummy interfaces) on the PE routers. In case of a link
+failure, traffic is diverted in the other direction in this triangle setup and
+BGP sessions will not go down. One could even enable
+BFD (Bidirectional Forwarding Detection) on the links for a faster
+failover and resilience in the network.
+
+Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from
+even the prior post about this subject. This is due to T1711, where it was
+finally decided to get rid of the redundant BGP ASN (Autonomous System Number)
+specification on the CLI and move it to a single leaf node
+(set protocols bgp local-as).
+
+It's important to note that all your existing configurations will be migrated
+automatically on image upgrade. Nothing to do on your side.
+
+PE1
+
+```{literalinclude} _include/PE1.conf
+:language: none
+:lines: 8-38
+```
+
+PE2
+
+```{literalinclude} _include/PE2.conf
+:language: none
+:lines: 8-38
+```
+
+PE3
+
+```{literalinclude} _include/PE3.conf
+:language: none
+:lines: 8-38
+```
+
+
+## Tenant networks (VRFs)
+
+Once all routers can be safely remotely managed and the core network is
+operational, we can now setup the tenant networks.
+
+Every tenant is assigned an individual VRF that would support overlapping
+address ranges for customers blue, red and green. In our example,
+we do not use overlapping ranges to make it easier when showing debug commands.
+
+Thus you can easily match it to one of the devices/networks below.
+
+Every router that provides access to a customer network needs to have the
+customer network (VRF + VNI) configured. To make our own lives easier,
+we utilize the same VRF table id (local routing table number) and
+VNI (Virtual Network Identifier) per tenant on all our routers.
+
+- blue uses local routing table id and VNI 2000
+- red uses local routing table id and VNI 3000
+- green uses local routing table id and VNI 4000
+
+PE1
+
+```{literalinclude} _include/PE1.conf
+:language: none
+:lines: 40-96
+```
+
+PE2
+
+```{literalinclude} _include/PE2.conf
+:language: none
+:lines: 40-89
+```
+
+PE3
+
+```{literalinclude} _include/PE3.conf
+:language: none
+:lines: 40-89
+```
+
+
+## Testing and debugging
+
+You managed to come this far, now we want to see the network and routing
+tables in action.
+
+Show routes for all VRFs
+
+```none
+vyos@PE1:~$ show ip route vrf all
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+VRF blue:
+C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13
+B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49
+B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49
+
+VRF default:
+O   172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09
+C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12
+O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46
+  *                       via 172.29.0.7, eth3, weight 1, 00:00:46
+O   172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09
+C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12
+C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14
+O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50
+O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45
+
+VRF green:
+C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13
+B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49
+
+VRF mgmt:
+S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45
+C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45
+
+VRF red:
+C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13
+B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49
+```
+
+Information about Ethernet Virtual Private Networks
+
+```none
+vyos@PE1:~$ show bgp l2vpn evpn
+BGP table version is 1, local router ID is 172.29.255.1
+Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
+Origin codes: i - IGP, e - EGP, ? - incomplete
+EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id]
+EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP]
+EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP]
+EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP]
+EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP]
+
+   Network          Next Hop            Metric LocPrf Weight Path
+Route Distinguisher: 10.1.1.1:5
+*> [5]:[0]:[24]:[10.1.1.0]
+                    172.29.255.1             0         32768 ?
+                    ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6
+Route Distinguisher: 10.1.2.1:4
+*>i[5]:[0]:[24]:[10.1.2.0]
+                    172.29.255.2             0    100      0 ?
+                    RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea
+Route Distinguisher: 10.1.3.1:4
+*>i[5]:[0]:[24]:[10.1.3.0]
+                    172.29.255.3             0    100      0 ?
+                    RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54
+Route Distinguisher: 10.2.1.1:6
+*> [5]:[0]:[24]:[10.2.1.0]
+                    172.29.255.1             0         32768 ?
+                    ET:8 RT:100:3000 Rmac:50:00:00:01:00:05
+Route Distinguisher: 10.2.2.1:5
+*>i[5]:[0]:[24]:[10.2.2.0]
+                    172.29.255.2             0    100      0 ?
+                    RT:100:3000 ET:8 Rmac:50:00:00:02:00:05
+Route Distinguisher: 10.3.1.1:7
+*> [5]:[0]:[24]:[10.3.1.0]
+                    172.29.255.1             0         32768 ?
+                    ET:8 RT:100:4000 Rmac:50:00:00:01:00:06
+Route Distinguisher: 10.3.3.1:6
+*>i[5]:[0]:[24]:[10.3.3.0]
+                    172.29.255.3             0    100      0 ?
+                    RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a
+
+Displayed 7 out of 7 total prefixes
+```
+
+If we need to retrieve information about a specific host/network inside
+the EVPN network we need to run
+
+```none
+vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10
+BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0]
+Paths: (1 available, best #1)
+  Not advertised to any peer
+  Route [5]:[0]:[24]:[10.3.1.0] VNI 4000
+  Local
+    172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1)
+      Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received)
+      Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06
+      Last update: Thu May 11 13:31:13 2023
+```
diff --git a/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.png b/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.png
deleted file mode 100644
index 18ecaabb..00000000
--- a/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.png
+++ /dev/null
diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst b/docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst
index 6092199b..6092199b 100644
--- a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst
+++ b/docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst
diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.log b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.log
index 6361d21c..a2f52ecd 100644
--- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.log
+++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.log
@@ -373,7 +373,7 @@ See the timeout setting options in the Network Debug and Troubleshooting Guide.
 2023-05-11 14:39:54,941 p=69617 u=rob n=ansible | [WARNING]: To ensure idempotency and correct diff the input configuration lines should be similar to how they appear if present in the running configuration on device including the indentation
 
 2023-05-11 14:39:54,943 p=69617 u=rob n=ansible | changed: [ovpn-server]
-2023-05-11 14:39:54,954 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : generate openvpn client conifg] *************************************************************************************************************************************************************************
+2023-05-11 14:39:54,954 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : generate openvpn client config] *************************************************************************************************************************************************************************
 2023-05-11 14:39:54,977 p=69617 u=rob n=ansible | skipping: [eveng]
 2023-05-11 14:39:54,985 p=69617 u=rob n=ansible | skipping: [vyos-oobm]
 2023-05-11 14:39:54,996 p=69617 u=rob n=ansible | skipping: [client]
@@ -503,7 +503,7 @@ deprecation_warnings=False in ansible.cfg.
 2023-05-11 14:47:17,013 p=69617 u=rob n=ansible | skipping: [ldap-server]
 2023-05-11 14:47:17,017 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: wait after stop] *********************************************************************************************************************************************************************
 2023-05-11 14:47:17,029 p=69617 u=rob n=ansible | Pausing for 5 seconds
-2023-05-11 14:47:17,030 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
+2023-05-11 14:47:17,030 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
 2023-05-11 14:47:22,045 p=69617 u=rob n=ansible | ok: [eveng]
 2023-05-11 14:47:22,057 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: start nodes id] **********************************************************************************************************************************************************************
 2023-05-11 14:47:22,092 p=69617 u=rob n=ansible | skipping: [eveng]
@@ -513,11 +513,11 @@ deprecation_warnings=False in ansible.cfg.
 2023-05-11 14:47:22,112 p=69617 u=rob n=ansible | skipping: [ldap-server]
 2023-05-11 14:47:22,116 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: wait after start] ********************************************************************************************************************************************************************
 2023-05-11 14:47:22,130 p=69617 u=rob n=ansible | Pausing for 5 seconds
-2023-05-11 14:47:22,130 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
+2023-05-11 14:47:22,130 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
 2023-05-11 14:47:27,153 p=69617 u=rob n=ansible | ok: [eveng]
 2023-05-11 14:47:27,161 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: wait, b/c the ping often failed without a short break] *******************************************************************************************************************************
 2023-05-11 14:47:27,181 p=69617 u=rob n=ansible | Pausing for 30 seconds
-2023-05-11 14:47:27,182 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
+2023-05-11 14:47:27,182 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
 2023-05-11 14:47:57,152 p=69617 u=rob n=ansible | ok: [eveng]
 2023-05-11 14:47:57,160 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: do ping test] ************************************************************************************************************************************************************************
 2023-05-11 14:47:57,198 p=69617 u=rob n=ansible | skipping: [eveng]
@@ -598,7 +598,7 @@ See the timeout setting options in the Network Debug and Troubleshooting Guide.
 2023-05-11 14:50:16,773 p=69617 u=rob n=ansible | skipping: [ldap-server]
 2023-05-11 14:50:16,777 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: wait after stop] *********************************************************************************************************************************************************************
 2023-05-11 14:50:16,791 p=69617 u=rob n=ansible | Pausing for 5 seconds
-2023-05-11 14:50:16,791 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
+2023-05-11 14:50:16,791 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
 2023-05-11 14:50:21,807 p=69617 u=rob n=ansible | ok: [eveng]
 2023-05-11 14:50:21,821 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: start nodes id] **********************************************************************************************************************************************************************
 2023-05-11 14:50:21,858 p=69617 u=rob n=ansible | skipping: [eveng]
@@ -608,11 +608,11 @@ See the timeout setting options in the Network Debug and Troubleshooting Guide.
 2023-05-11 14:50:21,878 p=69617 u=rob n=ansible | skipping: [ldap-server]
 2023-05-11 14:50:21,882 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: wait after start] ********************************************************************************************************************************************************************
 2023-05-11 14:50:21,896 p=69617 u=rob n=ansible | Pausing for 5 seconds
-2023-05-11 14:50:21,896 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
+2023-05-11 14:50:21,896 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
 2023-05-11 14:50:26,904 p=69617 u=rob n=ansible | ok: [eveng]
 2023-05-11 14:50:26,915 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: wait, b/c the ping often failed without a short break] *******************************************************************************************************************************
 2023-05-11 14:50:26,933 p=69617 u=rob n=ansible | Pausing for 30 seconds
-2023-05-11 14:50:26,934 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
+2023-05-11 14:50:26,934 p=69617 u=rob n=ansible | (ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
 2023-05-11 14:50:56,945 p=69617 u=rob n=ansible | ok: [eveng]
 2023-05-11 14:50:56,962 p=69617 u=rob n=ansible | TASK [eve-ng-lab-test : OpenVPN_with_LDAP: do ping test] ************************************************************************************************************************************************************************
 2023-05-11 14:50:56,998 p=69617 u=rob n=ansible | skipping: [eveng]
diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md
new file mode 100644
index 00000000..bd1ccfc4
--- /dev/null
+++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md
@@ -0,0 +1,238 @@
+(examples-openvpn-with-ldap)=
+
+# OpenVPN with LDAP
+
+```{eval-rst}
+| Testdate: 2023-05-11
+| Version: 1.4-rolling-202305100734
+```
+
+This LAB shows how to use OpenVPN with a Active Directory authentication method.
+
+Topology consists of:
+: - Windows Server 2019 with a running Active Directory
+  - VyOS as a OpenVPN Server
+  - VyOS as Client
+
+```{image} _include/topology.webp
+:alt: OpenVPN with LDAP topology image
+```
+
+
+## Active Directory on Windows server
+
+The lab assumes a full running Active Directory on the Windows Server.
+Here are some PowerShell commands to quickly add a Test Active Directory.
+
+```powershell
+# install the Active Directory Server role
+Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
+
+# install the Active Directory Server role
+Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -NoRebootCompletion:$true
+
+# create test user01 and binduser
+New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true
+New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true
+```
+
+
+## Configure VyOS as OpenVPN Server
+
+In this example OpenVPN will be setup with a client certificate and username / password authentication.
+
+First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed.
+Please look {ref}`here <configuration/pki/index:pki>` for more information.
+
+```{eval-rst}
+| Add the LDAP plugin configuration file `/config/auth/ldap-auth.config`
+```
+
+```{eval-rst}
+| Check all possible settings `here <https://github.com/threerings/openvpn-auth-ldap/blob/master/auth-ldap.conf>`_.
+```
+
+```{literalinclude} _include/ldap-auth.config
+:language: none
+```
+
+Now generate all required certificates on the ovpn-server:
+
+First the CA
+
+```none
+vyos@ovpn-server# run generate pki ca install OVPN-CA
+```
+
+after this create a signed server and a client certificate
+
+```none
+vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV
+vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT
+```
+
+and last the DH Key
+
+```none
+vyos@ovpn-server# run generate pki dh install DH
+```
+
+after all these steps the config look like this:
+
+```none
+set pki ca OVPN-CA certificate 'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/DNfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCqPg=='
+set pki ca OVPN-CA private key '<REDACTED>'
+set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzFaFw0zMzA1MDgxMjM4MzFaMFsxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxFDASBgNVBAMMC292cG4tc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApDWzTcB5LFM/tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DMn/Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/ItrfEadvgxrYR9gfhX79AkK0VHmZ/hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H//U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8nLnU0FnqpMMY14r7LZE/mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1ALqGrNUGFH4bEioTjDDx2GieOtp9rUwJMlkAyUEe0k/wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHpyzpwsA0WjA6sDTyWthgNYSxb1ikNGO8STCA=='
+set pki certificate SRV private key '<REDACTED>'
+set pki certificate CLIENT certificate 'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yUqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NEtYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pYb4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64='
+set pki certificate CLIENT private key '<REDACTED>'
+set pki dh DH parameters 'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWAKh2iwNRwyeXIEOtUDBkfcLGSNNfK0kQsos/J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg=='
+```
+
+Once all the required certificates and keys are installed, the remaining
+OpenVPN Server configuration can be carried out.
+
+```{literalinclude} _include/ovpn-server.conf
+:language: none
+```
+
+
+## Client configuration
+
+One advantage of having the client certificate stored is the ability to create the client configuration.
+
+```none
+vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA certificate CLIENT
+```
+
+save the output to a file and import it in nearly all openvpn clients.
+
+```none
+client
+nobind
+remote 198.51.100.254 1194
+remote-cert-tls server
+proto udp
+dev tun
+dev-type tun
+persist-key
+persist-tun
+verb 3
+
+# Encryption options
+
+keysize 256
+comp-lzo no
+
+<ca>
+-----BEGIN CERTIFICATE-----
+MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM
+CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y
+MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD
+VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5
+T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8
+gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z
+CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA
+sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU
+5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL
+c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG
+oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC
+8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1
+cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00
+uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O
+u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP
+BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF
+BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G
+CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy
+O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR
+IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo
+lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ
+7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH
+bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU
+rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld
+a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D
+NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I
+Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI
+V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq
+Pg==
+-----END CERTIFICATE-----
+
+</ca>
+
+<cert>
+-----BEGIN CERTIFICATE-----
+MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL
+BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM
+CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y
+MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD
+VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5
+T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7
+fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD
+pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP
+5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem
+TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y
+Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et
++/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY
+ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE
+euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE
+tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD
+Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG
+A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC
+MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n
+P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj
+6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp
+v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY
+b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560
+jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc
+xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz
+4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4
+MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO
+xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4
+BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W
+OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs
+24+4XwZYb8mbM31j7Nx8YvhR+64=
+-----END CERTIFICATE-----
+
+</cert>
+
+<key>
+-----BEGIN PRIVATE KEY-----
+...REDACTED...
+-----END PRIVATE KEY-----
+
+</key>
+```
+
+
+### Configure VyOS as client
+
+```none
+set interfaces openvpn vtun10 authentication username 'user01'
+set interfaces openvpn vtun10 authentication password '$ecret'
+set interfaces openvpn vtun10 encryption cipher 'aes256'
+set interfaces openvpn vtun10 hash 'sha512'
+set interfaces openvpn vtun10 mode 'client'
+set interfaces openvpn vtun10 persistent-tunnel
+set interfaces openvpn vtun10 protocol 'udp'
+set interfaces openvpn vtun10 remote-host '198.51.100.254'
+set interfaces openvpn vtun10 remote-port '1194'
+set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA'
+set interfaces openvpn vtun10 tls certificate 'CLIENT'
+```
+
+
+## Monitoring
+
+If the client is connected successfully you can check the status
+
+```none
+vyos@ovpn-server:~$ show openvpn server
+OpenVPN status on vtun10
+
+Client CN    Remote Host         Tunnel IP    Local Host           TX bytes    RX bytes    Connected Since
+-----------  ------------------  -----------  -------------------  ----------  ----------  -------------------
+client       198.51.100.1:55150  10.23.1.6    198.51.100.254:1194  4.7 KB      4.7 KB      2023-05-11 12:47:11
+```
diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.png b/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.png
deleted file mode 100644
index 382e44f6..00000000
--- a/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.png
+++ /dev/null
diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst
index acb880d1..acb880d1 100644
--- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst
+++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst
diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.md b/docs/configexamples/autotest/Wireguard/Wireguard.md
new file mode 100644
index 00000000..7bbf4c55
--- /dev/null
+++ b/docs/configexamples/autotest/Wireguard/Wireguard.md
@@ -0,0 +1,108 @@
+# Wireguard
+
+```{eval-rst}
+| Testdate: 2024-01-13
+| Version: 1.5-rolling-202401121239
+```
+
+This simple structure show how to connect two offices. One remote branch and the
+central office.
+
+## Topology
+
+The topology have a central and a branch VyOS router and one client, to
+test, in each site.
+
+```{image} _include/topology.webp
+:alt: Ansible Example topology image
+```
+
+
+## Configuration
+
+Set the local subnet on eth2 and the public ip address eth1 on each site.
+
+Central
+
+```{literalinclude} _include/central.conf
+:language: none
+:lines: 1-2
+```
+
+Branch
+
+```{literalinclude} _include/branch.conf
+:language: none
+:lines: 1-2
+```
+
+Next thing to do, is to create a wireguard keypair on each side.
+After this, the public key can be displayed, to save for later.
+
+```none
+vyos@central:~$ generate pki wireguard
+Private key: wHQS+ib3eMIp2DxRiAeXfFVaSCMMP1YHBaKfSR1xfV8=
+Public key: RCMy6BAER0uEcPvspUb3K38MHyHJpK5kiV5IOX943HI=
+```
+
+After you have each public key. The wireguard interfaces can be setup.
+
+Central
+
+```{literalinclude} _include/central.conf
+:language: none
+:lines: 4-12
+```
+
+Branch
+
+```{literalinclude} _include/branch.conf
+:language: none
+:lines: 4-12
+```
+
+To reach the network, a route must be set on each VyOS host.
+In this structure, a static interface route will fit the requirements.
+
+Central
+
+```{literalinclude} _include/central.conf
+:language: none
+:lines: 14
+```
+
+Branch
+
+```{literalinclude} _include/branch.conf
+:language: none
+:lines: 14
+```
+
+
+## Testing and debugging
+
+After all is done and commit, let's take a look if the Wireguard interface is
+up and running.
+
+```none
+vyos@central:~$ show interfaces wireguard
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface        IP Address                        S/L  Description
+---------        ----------                        ---  -----------
+wg01             192.168.0.1/24                    u/u  VPN-to-Branch
+```
+
+And ping the Branch PC from your central router to check the response.
+
+```none
+vyos@central:~$ ping 10.0.2.100 count 4
+PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data.
+64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.894 ms
+64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.869 ms
+64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.966 ms
+64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=0.998 ms
+
+--- 10.0.2.100 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3004ms
+rtt min/avg/max/mdev = 0.869/0.931/0.998/0.052 ms
+```
diff --git a/docs/configexamples/autotest/Wireguard/_include/topology.png b/docs/configexamples/autotest/Wireguard/_include/topology.png
deleted file mode 100644
index 43c0018e..00000000
--- a/docs/configexamples/autotest/Wireguard/_include/topology.png
+++ /dev/null
diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.rst b/docs/configexamples/autotest/Wireguard/rst-Wireguard.rst
index 7d7b216a..7d7b216a 100644
--- a/docs/configexamples/autotest/Wireguard/Wireguard.rst
+++ b/docs/configexamples/autotest/Wireguard/rst-Wireguard.rst
diff --git a/docs/configexamples/autotest/tunnelbroker/_include/topology.png b/docs/configexamples/autotest/tunnelbroker/_include/topology.png
deleted file mode 100644
index e70d55bc..00000000
--- a/docs/configexamples/autotest/tunnelbroker/_include/topology.png
+++ /dev/null
diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst
index e34cb779..e34cb779 100644
--- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst
+++ b/docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst
diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.md b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.md
new file mode 100644
index 00000000..6c59a491
--- /dev/null
+++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.md
@@ -0,0 +1,206 @@
+(examples-tunnelbroker-ipv6)=
+
+# Tunnelbroker.net (IPv6)
+
+```{eval-rst}
+| Testdate: 2024-01-13
+| Version: 1.5-rolling-202401121239
+```
+
+This guide walks through the setup of <https://www.tunnelbroker.net/> for an
+IPv6 Tunnel.
+
+## Prerequisites
+
+- A public, routable IPv4 address. This does not necessarily need to be static,
+  but you will need to update the tunnel endpoint when/if your IP address
+  changes, which can be done with a script and a scheduled task.
+- Account at <https://www.tunnelbroker.net/>
+- Requested a "Regular Tunnel". You want to choose a location that is closest
+  to your physical location for the best response time.
+
+### Topology
+
+The example topology has 2 VyOS routers. One as the WAN router and one as a
+client, to test a single LAN setup
+
+```{image} _include/topology.webp
+:alt: Tunnelbroker topology image
+```
+
+
+### Configuration
+
+First, we configure the `vyos-wan` interface to get a DHCP address.
+
+```{literalinclude} _include/vyos-wan.conf
+:language: none
+```
+
+Now we are able to setup the tunnel interface.
+
+```{literalinclude} _include/vyos-wan_tun0.conf
+:language: none
+:lines: 1-5
+```
+
+:::{note}
+The `source-address` is the Tunnelbroker client IPv4
+address or if there is NAT the current WAN interface address.
+
+If `source-address` is dynamic, the tunnel will cease working once
+the address changes. To avoid having to manually update
+`source-address` each time the dynamic IP changes, an address of
+'0.0.0.0' can be specified.
+:::
+
+Setup the IPv6 default route to the tunnel interface
+
+```{literalinclude} _include/vyos-wan_tun0.conf
+:language: none
+:lines: 7
+```
+
+Now you should be able to ping a public IPv6 Address
+
+```none
+vyos@vyos-wan:~$ ping 2001:470:20::2 count 4
+PING 2001:470:20::2(2001:470:20::2) 56 data bytes
+64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=33.8 ms
+64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=43.9 ms
+64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=43.4 ms
+64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=42.5 ms
+
+--- 2001:470:20::2 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 2999ms
+rtt min/avg/max/mdev = 33.802/40.920/43.924/4.139 ms
+```
+
+Assuming the pings are successful, you need to add some DNS servers.
+Some options:
+
+```{literalinclude} _include/vyos-wan_tun0.conf
+:language: none
+:lines: 13
+```
+
+You should now be able to ping something by IPv6 DNS name:
+
+```none
+vyos@vyos-wan:~$ ping tunnelbroker.net count 4
+PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes
+64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=48 time=285 ms
+64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=48 time=186 ms
+64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=48 time=178 ms
+64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=48 time=177 ms
+
+--- tunnelbroker.net ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3002ms
+rtt min/avg/max/mdev = 176.707/206.638/285.128/45.457 ms
+```
+
+
+### LAN Configuration
+
+At this point, your VyOS install should have full IPv6, but now your LAN devices
+need access.
+
+With Tunnelbroker.net, you have two options:
+
+- Routed /64. This is the default assignment. In IPv6-land, it's good for a
+  single "LAN", and is somewhat equivalent to a /24.
+- Routed /48. This is something you can request by clicking the "Assign /48"
+  link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k
+
+Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So
+if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore
+the assigned /64, and request the /48 and use that.
+
+## Single LAN Setup
+
+Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker
+Routed /64 prefix:
+
+```{literalinclude} _include/vyos-wan_tun0.conf
+:language: none
+:lines: 9-11
+```
+
+Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default,
+'valid-lifetime' and 'preferred-lifetime' are set to default values of
+30 days and 4 hours respectively.
+
+And the `client` to receive an IPv6 address with stateless autoconfig.
+
+```{literalinclude} _include/client.conf
+:language: none
+```
+
+This accomplishes a few things:
+- Sets your LAN interface's IP address
+- Enables router advertisements. This is an IPv6 alternative for DHCP (though
+  DHCPv6 can still be used). With RAs, Your devices will automatically find the
+  information they need for routing and DNS.
+
+Now the Client is able to ping a public IPv6 address
+
+```none
+vyos@client:~$ ping 2001:470:20::2 count 4
+PING 2001:470:20::2(2001:470:20::2) 56 data bytes
+64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=32.1 ms
+64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=41.8 ms
+64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=41.7 ms
+64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=47.1 ms
+
+--- 2001:470:20::2 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3005ms
+rtt min/avg/max/mdev = 32.128/40.688/47.107/5.403 ms
+```
+
+
+## Multiple LAN/DMZ Setup
+
+That's how you can expand the example above.
+Use the `Routed /48` information. This allows you to assign a
+different /64 to every interface, LAN, or even device. Or you could break your
+network into smaller chunks like /56 or /60.
+
+The format of these addresses:
+- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker.
+- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN
+- `2001:470:xxxx:2::/64`: Another subnet
+- `2001:470:xxxx:ffff::/64`: The last usable /64 subnet.
+
+In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff
+(1-65535).
+
+So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc:
+
+```none
+set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64'
+set service router-advert interface eth1 name-server '2001:470:20::2'
+set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64
+
+set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64'
+set service router-advert interface eth2 name-server '2001:470:20::2'
+set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64
+
+set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64'
+set service router-advert interface eth3 name-server '2001:470:20::2'
+set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64
+```
+
+Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default,
+'valid-lifetime' and 'preferred-lifetime' are set to default values of
+30 days and 4 hours respectively.
+
+## Firewall
+
+Finally, don't forget the
+{ref}`Firewall <configuration/firewall/index:Firewall>`. The usage is
+identical, except instead of `set firewall ipv4 name NAME`, you would
+use `set firewall ipv6 name NAME`.
+
+Similarly, to attach the firewall, you would use
+`set firewall ipv6 name NAME rule N inbound-interface name eth0` or
+`set firewall zone LOCAL from WAN firewall ipv6-name`.
diff --git a/docs/configexamples/azure-vpn-bgp.md b/docs/configexamples/azure-vpn-bgp.md
new file mode 100644
index 00000000..83d77e53
--- /dev/null
+++ b/docs/configexamples/azure-vpn-bgp.md
@@ -0,0 +1,134 @@
+---
+lastproofread: '2021-06-28'
+---
+
+(examples-azure-vpn-bgp)=
+
+# Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
+
+This guide shows an example of a route-based IKEv2 site-to-site VPN to
+Azure using VTI and BGP for dynamic routing updates.
+
+For redundant / active-active configurations see
+{ref}`examples-azure-vpn-dual-bgp`
+
+## Prerequisites
+
+- A pair of Azure VNet Gateways deployed in active-passive
+  configuration with BGP enabled.
+- A local network gateway deployed in Azure representing
+  the Vyos device, matching the below Vyos settings except for
+  address space, which only requires the Vyos private IP, in
+  this example 10.10.0.5/32
+- A connection resource deployed in Azure linking the
+  Azure VNet gateway and the local network gateway representing
+  the Vyos device.
+
+## Example
+
+```{eval-rst}
++---------------------------------------+---------------------+
+| WAN Interface                         | eth0                |
++---------------------------------------+---------------------+
+| On-premises address space             | 10.10.0.0/16        |
++---------------------------------------+---------------------+
+| Azure address space                   |  10.0.0.0/16        |
++---------------------------------------+---------------------+
+| Vyos public IP                        | 198.51.100.3        |
++---------------------------------------+---------------------+
+| Vyos private IP                       | 10.10.0.5           |
++---------------------------------------+---------------------+
+| Azure VNet Gateway public IP          |  203.0.113.2        |
++---------------------------------------+---------------------+
+| Azure VNet Gateway BGP IP             |  10.0.0.4           |
++---------------------------------------+---------------------+
+| Pre-shared key                        | ch00s3-4-s3cur3-psk |
++---------------------------------------+---------------------+
+| Vyos ASN                              | 64499               |
++---------------------------------------+---------------------+
+| Azure ASN                             | 65540               |
++---------------------------------------+---------------------+
+```
+
+## Vyos configuration
+
+- Configure the IKE and ESP settings to match a subset
+  of those supported by Azure:
+
+```none
+set vpn ipsec esp-group AZURE lifetime '3600'
+set vpn ipsec esp-group AZURE mode 'tunnel'
+set vpn ipsec esp-group AZURE pfs 'dh-group2'
+set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
+set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
+
+set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
+set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
+set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
+set vpn ipsec ike-group AZURE ikev2-reauth
+set vpn ipsec ike-group AZURE key-exchange 'ikev2'
+set vpn ipsec ike-group AZURE lifetime '28800'
+set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
+set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
+set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
+```
+
+- Enable IPsec on eth0
+
+```none
+set vpn ipsec interface 'eth0'
+```
+
+- Configure a VTI with a dummy IP address
+
+```none
+set interfaces vti vti1 address '10.10.1.5/32'
+set interfaces vti vti1 description 'Azure Tunnel'
+```
+
+- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
+
+```none
+set interfaces vti vti1 ip adjust-mss 1350
+```
+
+- Configure the VPN tunnel
+
+```none
+set vpn ipsec authentication psk azure id '198.51.100.3'
+set vpn ipsec authentication psk azure id '203.0.113.2'
+set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk'
+set vpn ipsec site-to-site peer 203.0.113.2 authentication local-id '198.51.100.3'
+set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
+set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate'
+set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
+set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
+set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
+set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
+set vpn ipsec site-to-site peer 203.0.113.2 remote-address '203.0.113.2'
+set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
+set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
+```
+
+- **Important**: Add an interface route to reach Azure's BGP listener
+
+```none
+set protocols static route 10.0.0.4/32 interface vti1
+```
+
+- Configure your BGP settings
+
+```none
+set protocols bgp system-as 64499
+set protocols bgp neighbor 10.0.0.4 remote-as '65540'
+set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
+set protocols bgp neighbor 10.0.0.4 timers holdtime '30'
+set protocols bgp neighbor 10.0.0.4 timers keepalive '10'
+```
+
+- **Important**: Disable connected check
+
+```none
+set protocols bgp neighbor 10.0.0.4 disable-connected-check
+```
diff --git a/docs/configexamples/azure-vpn-dual-bgp.md b/docs/configexamples/azure-vpn-dual-bgp.md
new file mode 100644
index 00000000..967debd4
--- /dev/null
+++ b/docs/configexamples/azure-vpn-dual-bgp.md
@@ -0,0 +1,160 @@
+---
+lastproofread: '2021-06-28'
+---
+
+(examples-azure-vpn-dual-bgp)=
+
+# Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
+
+This guide shows an example of a redundant (active-active) route-based IKEv2
+site-to-site VPN to Azure using VTI
+and BGP for dynamic routing updates.
+
+## Prerequisites
+
+- A pair of Azure VNet Gateways deployed in active-active
+  configuration with BGP enabled.
+- A local network gateway deployed in Azure representing
+  the Vyos device, matching the below Vyos settings except for
+  address space, which only requires the Vyos private IP, in
+  this example 10.10.0.5/32
+- A connection resource deployed in Azure linking the
+  Azure VNet gateway and the local network gateway representing
+  the Vyos device.
+
+## Example
+
+```{eval-rst}
++---------------------------------------+---------------------+
+| WAN Interface                         | eth0                |
++---------------------------------------+---------------------+
+| On-premises address space             | 10.10.0.0/16        |
++---------------------------------------+---------------------+
+| Azure address space                   |  10.0.0.0/16        |
++---------------------------------------+---------------------+
+| Vyos public IP                        | 198.51.100.3        |
++---------------------------------------+---------------------+
+| Vyos private IP                       | 10.10.0.5           |
++---------------------------------------+---------------------+
+| Azure VNet Gateway 1 public IP        |  203.0.113.2        |
++---------------------------------------+---------------------+
+| Azure VNet Gateway 2 public IP        |  203.0.113.3        |
++---------------------------------------+---------------------+
+| Azure VNet Gateway BGP IP             |  10.0.0.4,10.0.0.5  |
++---------------------------------------+---------------------+
+| Pre-shared key                        | ch00s3-4-s3cur3-psk |
++---------------------------------------+---------------------+
+| Vyos ASN                              | 64499               |
++---------------------------------------+---------------------+
+| Azure ASN                             | 65540               |
++---------------------------------------+---------------------+
+```
+
+## Vyos configuration
+
+- Configure the IKE and ESP settings to match a subset
+  of those supported by Azure:
+
+```none
+set vpn ipsec esp-group AZURE lifetime '3600'
+set vpn ipsec esp-group AZURE mode 'tunnel'
+set vpn ipsec esp-group AZURE pfs 'dh-group2'
+set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
+set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'
+
+set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
+set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
+set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
+set vpn ipsec ike-group AZURE ikev2-reauth
+set vpn ipsec ike-group AZURE key-exchange 'ikev2'
+set vpn ipsec ike-group AZURE lifetime '28800'
+set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
+set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
+set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
+```
+
+- Enable IPsec on eth0
+
+```none
+set vpn ipsec interface 'eth0'
+```
+
+- Configure two VTIs with a dummy IP address each
+
+```none
+set interfaces vti vti1 address '10.10.1.5/32'
+set interfaces vti vti1 description 'Azure Primary Tunnel'
+
+set interfaces vti vti2 address '10.10.1.6/32'
+set interfaces vti vti2 description 'Azure Secondary Tunnel'
+```
+
+- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
+
+```none
+set interfaces vti vti1 ip adjust-mss 1350
+set interfaces vti vti2 ip adjust-mss 1350
+```
+
+- Configure the VPN tunnels
+
+```none
+set vpn ipsec authentication psk azure id '198.51.100.3'
+set vpn ipsec authentication psk azure id '203.0.113.2'
+set vpn ipsec authentication psk azure id '203.0.113.3'
+set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk'
+
+set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3'
+set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2'
+set vpn ipsec site-to-site peer azure-primary connection-type 'initiate'
+set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL'
+set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE'
+set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit'
+set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5'
+set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2'
+set vpn ipsec site-to-site peer azure-primary vti bind 'vti1'
+set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE'
+
+set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3'
+set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3'
+set vpn ipsec site-to-site peer azure-secondary connection-type 'initiate'
+set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL'
+set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE'
+set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit'
+set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5'
+set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3'
+set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2'
+set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE'
+```
+
+- **Important**: Add an interface route to reach both Azure's BGP listeners
+
+```none
+set protocols static route 10.0.0.4/32 interface vti1
+set protocols static route 10.0.0.5/32 interface vti2
+```
+
+- Configure your BGP settings
+
+```none
+set protocols bgp system-as 64499
+set protocols bgp neighbor 10.0.0.4 remote-as '65540'
+set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
+set protocols bgp neighbor 10.0.0.4 timers holdtime '30'
+set protocols bgp neighbor 10.0.0.4 timers keepalive '10'
+
+set protocols bgp neighbor 10.0.0.5 remote-as '65540'
+set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound'
+set protocols bgp neighbor 10.0.0.5 timers holdtime '30'
+set protocols bgp neighbor 10.0.0.5 timers keepalive '10'
+```
+
+- **Important**: Disable connected check, otherwise the routes learned
+  from Azure will not be imported into the routing table.
+
+```none
+set protocols bgp neighbor 10.0.0.4 disable-connected-check
+set protocols bgp neighbor 10.0.0.5 disable-connected-check
+```
diff --git a/docs/configexamples/bgp-ipv6-unnumbered.md b/docs/configexamples/bgp-ipv6-unnumbered.md
new file mode 100644
index 00000000..4fa29834
--- /dev/null
+++ b/docs/configexamples/bgp-ipv6-unnumbered.md
@@ -0,0 +1,174 @@
+---
+lastproofread: '2021-06-28'
+---
+
+(examples-bgp-ipv6-unnumbered)=
+
+# BGP IPv6 unnumbered with extended nexthop
+
+General information can be found in the {ref}`routing-bgp` chapter.
+
+## Configuration
+
+- Router A:
+
+```none
+set protocols bgp system-as 64496
+set protocols bgp address-family ipv4-unicast redistribute connected
+set protocols bgp address-family ipv6-unicast redistribute connected
+set protocols bgp neighbor eth1 interface v6only
+set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
+set protocols bgp neighbor eth2 interface v6only
+set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
+set protocols bgp parameters bestpath as-path multipath-relax
+set protocols bgp parameters bestpath compare-routerid
+set protocols bgp parameters default no-ipv4-unicast
+set protocols bgp parameters router-id '192.168.0.1'
+set protocols bgp peer-group fabric address-family ipv4-unicast
+set protocols bgp peer-group fabric address-family ipv6-unicast
+set protocols bgp peer-group fabric capability extended-nexthop
+set protocols bgp peer-group fabric remote-as 'external'
+```
+
+- Router B:
+
+```none
+set protocols bgp system-as 64499
+set protocols bgp address-family ipv4-unicast redistribute connected
+set protocols bgp address-family ipv6-unicast redistribute connected
+set protocols bgp neighbor eth1 interface v6only
+set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
+set protocols bgp neighbor eth2 interface v6only
+set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
+set protocols bgp parameters bestpath as-path multipath-relax
+set protocols bgp parameters bestpath compare-routerid
+set protocols bgp parameters default no-ipv4-unicast
+set protocols bgp parameters router-id '192.168.0.2'
+set protocols bgp peer-group fabric address-family ipv4-unicast
+set protocols bgp peer-group fabric address-family ipv6-unicast
+set protocols bgp peer-group fabric capability extended-nexthop
+set protocols bgp peer-group fabric remote-as 'external'
+```
+
+
+## Results
+
+- Router A:
+
+```none
+vyos@vyos:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface        IP Address                        S/L  Description
+---------        ----------                        ---  -----------
+eth0             198.51.100.34/24                  u/u
+eth1             -                                 u/u
+eth2             -                                 u/u
+lo               127.0.0.1/8                       u/u
+                 192.168.0.1/32
+                 ::1/128
+```
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+       F - PBR, f - OpenFabric,
+       > - selected route, * - FIB route
+
+S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53
+C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53
+C>* 192.168.0.1/32 is directly connected, lo, 03:21:56
+B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07
+  *                       via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07
+```
+
+```none
+vyos@vyos:~$ ping 192.168.0.2
+PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
+64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms
+64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms
+64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms
+64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms
+64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms
+
+--- 192.168.0.2 ping statistics ---
+5 packets transmitted, 5 received, 0% packet loss, time 4086ms
+rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms
+```
+
+```none
+vyos@vyos:~$ show ip bgp summary
+
+IPv4 Unicast Summary:
+BGP router identifier 192.168.0.1, local AS number 64496 vrf-id 0
+BGP table version 4
+RIB entries 5, using 800 bytes of memory
+Peers 2, using 41 KiB of memory
+Peer groups 1, using 64 bytes of memory
+
+Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
+eth1            4      64499      13      13        0    0    0 00:05:33            2
+eth2            4      64499      13      14        0    0    0 00:05:29            2
+
+Total number of neighbors 2
+```
+
+- Router B:
+
+```none
+vyos@vyos:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface        IP Address                        S/L  Description
+---------        ----------                        ---  -----------
+eth0             198.51.100.33/24                  u/u
+eth1             -                                 u/u
+eth2             -                                 u/u
+lo               127.0.0.1/8                       u/u
+                 192.168.0.2/32
+                 ::1/128
+```
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+       F - PBR, f - OpenFabric,
+       > - selected route, * - FIB route
+
+S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08
+C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09
+B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18
+  *                       via fe80::a00:27ff:fe93:e142, eth2, 00:06:18
+C>* 192.168.0.2/32 is directly connected, lo, 00:44:11
+```
+
+```none
+vyos@vyos:~$ ping 192.168.0.1
+PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
+64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms
+64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms
+64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms
+64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms
+
+--- 192.168.0.1 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3051ms
+rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms
+```
+
+```none
+vyos@vyos:~$ show ip bgp summary
+IPv4 Unicast Summary:
+BGP router identifier 192.168.0.2, local AS number 64499 vrf-id 0
+BGP table version 4
+RIB entries 5, using 800 bytes of memory
+Peers 2, using 41 KiB of memory
+Peer groups 1, using 64 bytes of memory
+
+Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
+eth1            4      64496      14      14        0    0    0 00:06:40            2
+eth2            4      64496      14      14        0    0    0 00:06:37            2
+
+Total number of neighbors 2
+```
diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.md b/docs/configexamples/dmvpn-dualhub-dualcloud.md
new file mode 100644
index 00000000..20c1a064
--- /dev/null
+++ b/docs/configexamples/dmvpn-dualhub-dualcloud.md
@@ -0,0 +1,552 @@
+---
+lastproofread: '2024-02-21'
+---
+
+(examples-dmvpn-dualhub-dualcloud)=
+
+# DMVPN Dual HUB Dual Cloud
+
+This document is to describe a basic setup to build DMVPN network with two Hubs and two clouds using DMVPN Phase3.
+OSPF is used as routing protocol inside DMVPN.
+
+In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1)
+as a Spoke.
+
+## Network Topology
+
+```{image} /_static/images/dual-hub-DMVPN.webp
+:align: center
+:alt: DMVPN Network Topology
+:width: 80%
+```
+
+
+## Configurations
+
+### Underlay configuration
+
+Networks 192.168.X.0/24 are used as LANs for every spoke.
+
+HUB-1
+
+```none
+set interfaces ethernet eth0 address '10.0.0.2/30'
+set protocols static route 0.0.0.0/0 next-hop 10.0.0.1
+```
+
+HUB-2
+
+```none
+set interfaces ethernet eth0 address '10.0.1.2/30'
+set protocols static route 0.0.0.0/0 next-hop 10.0.1.1
+```
+
+Spoke-1
+
+```none
+interface GigabitEthernet0/0
+ ip address 10.0.11.2 255.255.255.252
+ duplex auto
+ speed auto
+ media-type rj45
+!
+interface GigabitEthernet0/1
+ ip address 192.168.11.1 255.255.255.0
+ ip ospf 1 area 0
+ duplex auto
+ speed auto
+ media-type rj45
+!
+ip route 0.0.0.0 0.0.0.0 10.0.11.1
+```
+
+Spoke-2
+
+```none
+set interfaces ethernet eth0 address '10.0.12.2/30'
+set interfaces ethernet eth1 address '192.168.12.1/24'
+set protocols static route 0.0.0.0/0 next-hop 10.0.12.1
+```
+
+Spoke-3
+
+```none
+set interfaces ethernet eth0 address '10.0.13.2/30'
+set interfaces ethernet eth1 address '192.168.13.1/24'
+set protocols static route 0.0.0.0/0 next-hop 10.0.13.1
+```
+
+
+### NHRP configuration
+
+The next step is to configure the NHRP protocol. In a Dual cloud network, every HUB has to be configured with one GRE
+multipoint tunnel interface and every spoke has to be configured with two tunnel interfaces, one tunnel to each hub.
+In this example tunnel networks are 10.100.100.0/24 for the first cloud and 10.100.101.0/24 for the second cloud.
+But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32.
+
+HUB-1
+
+```none
+set interfaces tunnel tun100 address '10.100.100.1/32'
+set interfaces tunnel tun100 enable-multicast
+set interfaces tunnel tun100 encapsulation 'gre'
+set interfaces tunnel tun100 ip adjust-mss '1360'
+set interfaces tunnel tun100 mtu '1436'
+set interfaces tunnel tun100 parameters ip key '42'
+set interfaces tunnel tun100 source-interface 'eth0'
+set protocols nhrp tunnel tun100 authentication 'vyos'
+set protocols nhrp tunnel tun100 holdtime '300'
+set protocols nhrp tunnel tun100 multicast 'dynamic'
+set protocols nhrp tunnel tun100 network-id '1'
+set protocols nhrp tunnel tun100 redirect
+set protocols nhrp tunnel tun100 registration-no-unique
+```
+
+HUB-2
+
+```none
+set interfaces tunnel tun101 address '10.100.101.1/32'
+set interfaces tunnel tun101 enable-multicast
+set interfaces tunnel tun101 encapsulation 'gre'
+set interfaces tunnel tun101 ip adjust-mss '1360'
+set interfaces tunnel tun101 mtu '1436'
+set interfaces tunnel tun101 parameters ip key '43'
+set interfaces tunnel tun101 source-interface 'eth0'
+set protocols nhrp tunnel tun101 authentication 'vyos'
+set protocols nhrp tunnel tun101 holdtime '300'
+set protocols nhrp tunnel tun101 multicast 'dynamic'
+set protocols nhrp tunnel tun101 network-id '2'
+set protocols nhrp tunnel tun101 redirect
+set protocols nhrp tunnel tun101 registration-no-unique
+```
+
+Spoke-1
+
+```none
+interface Tunnel100
+ ip address 10.100.100.11 255.255.255.0
+ no ip redirects
+ ip mtu 1436
+ ip nhrp authentication vyos
+ ip nhrp map multicast 10.0.0.2
+ ip nhrp network-id 1
+ ip nhrp holdtime 300
+ ip nhrp nhs 10.100.100.1 nbma 10.0.0.2
+ ip nhrp shortcut
+ ip tcp adjust-mss 1360
+ tunnel source GigabitEthernet0/0
+ tunnel mode gre multipoint
+ tunnel key 42
+!
+interface Tunnel101
+ ip address 10.100.101.11 255.255.255.0
+ no ip redirects
+ ip mtu 1436
+ ip nhrp authentication vyos
+ ip nhrp map multicast 10.0.1.2
+ ip nhrp network-id 2
+ ip nhrp holdtime 300
+ ip nhrp nhs 10.100.101.1 nbma 10.0.1.2
+ ip nhrp shortcut
+ ip tcp adjust-mss 1360
+ tunnel source GigabitEthernet0/0
+ tunnel mode gre multipoint
+ tunnel key 43
+```
+
+Spoke-2
+
+```none
+set interfaces tunnel tun100 address '10.100.100.12/32'
+set interfaces tunnel tun100 enable-multicast
+set interfaces tunnel tun100 encapsulation 'gre'
+set interfaces tunnel tun100 ip adjust-mss '1360'
+set interfaces tunnel tun100 mtu '1436'
+set interfaces tunnel tun100 parameters ip key '42'
+set interfaces tunnel tun100 source-interface 'eth0'
+set interfaces tunnel tun101 address '10.100.101.12/32'
+set interfaces tunnel tun101 enable-multicast
+set interfaces tunnel tun101 encapsulation 'gre'
+set interfaces tunnel tun101 ip adjust-mss '1360'
+set interfaces tunnel tun101 mtu '1436'
+set interfaces tunnel tun101 parameters ip key '43'
+set interfaces tunnel tun101 source-interface 'eth0'
+set protocols nhrp tunnel tun100 authentication 'vyos'
+set protocols nhrp tunnel tun100 holdtime '300'
+set protocols nhrp tunnel tun100 multicast '10.0.0.2'
+set protocols nhrp tunnel tun100 network-id '1'
+set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2'
+set protocols nhrp tunnel tun100 registration-no-unique
+set protocols nhrp tunnel tun100 shortcut
+set protocols nhrp tunnel tun101 authentication 'vyos'
+set protocols nhrp tunnel tun101 holdtime '300'
+set protocols nhrp tunnel tun101 multicast '10.0.1.2'
+set protocols nhrp tunnel tun101 network-id '2'
+set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2'
+set protocols nhrp tunnel tun101 registration-no-unique
+set protocols nhrp tunnel tun101 shortcut
+```
+
+Spoke-3
+
+```none
+set protocols nhrp tunnel tun100 authentication 'vyos'
+set protocols nhrp tunnel tun100 holdtime '300'
+set protocols nhrp tunnel tun100 multicast '10.0.0.2'
+set protocols nhrp tunnel tun100 network-id '1'
+set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2'
+set protocols nhrp tunnel tun100 registration-no-unique
+set protocols nhrp tunnel tun100 shortcut
+set protocols nhrp tunnel tun101 authentication 'vyos'
+set protocols nhrp tunnel tun101 holdtime '300'
+set protocols nhrp tunnel tun101 multicast '10.0.1.2'
+set protocols nhrp tunnel tun101 network-id '2'
+set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2'
+set protocols nhrp tunnel tun101 registration-no-unique
+set protocols nhrp tunnel tun101 shortcut
+```
+
+
+### Overlay configuration
+
+The last step is to configure the routing protocol. In this scenario, OSPF was chosen as the dynamic routing protocol.
+But you can use iBGP or eBGP. To form fast convergence it is possible to use BFD protocol.
+
+HUB-1
+
+```none
+set protocols ospf interface tun100 area '0'
+set protocols ospf interface tun100 network 'point-to-multipoint'
+set protocols ospf interface tun100 passive disable
+set protocols ospf passive-interface 'default'
+```
+
+HUB-2
+
+```none
+set protocols ospf interface tun101 area '0'
+set protocols ospf interface tun101 network 'point-to-multipoint'
+set protocols ospf interface tun101 passive disable
+set protocols ospf passive-interface 'default'
+```
+
+Spoke-1
+
+```none
+interface Tunnel100
+ ip ospf network point-to-multipoint
+ ip ospf dead-interval 40
+ ip ospf hello-interval 10
+ ip ospf 1 area 0
+!
+interface Tunnel101
+ ip ospf network point-to-multipoint
+ ip ospf dead-interval 40
+ ip ospf hello-interval 10
+ ip ospf 1 area 0
+!
+router ospf 1
+ passive-interface default
+ no passive-interface Tunnel100
+ no passive-interface Tunnel101
+```
+
+Spoke-2
+
+```none
+set protocols ospf interface eth1 area '0'
+set protocols ospf interface tun100 area '0'
+set protocols ospf interface tun100 network 'point-to-multipoint'
+set protocols ospf interface tun100 passive disable
+set protocols ospf interface tun101 area '0'
+set protocols ospf interface tun101 network 'point-to-multipoint'
+set protocols ospf interface tun101 passive disable
+set protocols ospf passive-interface 'default'
+```
+
+Spoke-3
+
+```none
+set protocols ospf interface eth1 area '0'
+set protocols ospf interface tun100 area '0'
+set protocols ospf interface tun100 network 'point-to-multipoint'
+set protocols ospf interface tun100 passive disable
+set protocols ospf interface tun101 area '0'
+set protocols ospf interface tun101 network 'point-to-multipoint'
+set protocols ospf interface tun101 passive disable
+set protocols ospf passive-interface 'default'
+```
+
+
+### Security configuration
+
+Tunnels can be encrypted by IPSEC for security.
+
+HUB-1
+
+```{eval-rst}
+ .. code-block:: none
+
+    set vpn ipsec esp-group ESP-HUB lifetime '1800'
+    set vpn ipsec esp-group ESP-HUB mode 'transport'
+    set vpn ipsec esp-group ESP-HUB pfs 'disable'
+    set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+    set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+    set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+    set vpn ipsec ike-group IKE-HUB lifetime '3600'
+    set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+    set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+    set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+    set vpn ipsec interface 'eth0'
+    set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+    set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
+    set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
+    set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+    set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+```
+
+HUB-2
+
+```{eval-rst}
+ .. code-block:: none
+
+    set vpn ipsec esp-group ESP-HUB lifetime '1800'
+    set vpn ipsec esp-group ESP-HUB mode 'transport'
+    set vpn ipsec esp-group ESP-HUB pfs 'disable'
+    set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+    set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+    set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+    set vpn ipsec ike-group IKE-HUB lifetime '3600'
+    set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+    set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+    set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+    set vpn ipsec interface 'eth0'
+    set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+    set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
+    set vpn ipsec profile NHRPVPN bind tunnel 'tun101'
+    set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+    set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+```
+
+VyOS Spokes have the same configuration
+
+```{eval-rst}
+ .. code-block:: none
+
+    set vpn ipsec esp-group ESP-HUB lifetime '1800'
+    set vpn ipsec esp-group ESP-HUB mode 'transport'
+    set vpn ipsec esp-group ESP-HUB pfs 'disable'
+    set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+    set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+    set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+    set vpn ipsec ike-group IKE-HUB lifetime '3600'
+    set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+    set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+    set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+    set vpn ipsec interface 'eth0'
+    set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+    set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
+    set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
+    set vpn ipsec profile NHRPVPN bind tunnel 'tun101'
+    set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+    set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+```
+
+SPOKE-1
+
+```{eval-rst}
+ .. code-block:: none
+
+    crypto isakmp policy 1
+     encr aes 256
+     authentication pre-share
+     group 2
+     lifetime 3600
+    crypto isakmp key secret address 0.0.0.0
+    !
+    !
+    crypto ipsec transform-set ESP_TRANSFORMSET esp-aes 256 esp-sha-hmac
+     mode transport
+    !
+    !
+    crypto ipsec profile gre_protection
+     set security-association lifetime seconds 1800
+     set transform-set ESP_TRANSFORMSET
+    !
+    interface Tunnel100
+     tunnel protection ipsec profile gre_protection shared
+    !
+    interface Tunnel101
+     tunnel protection ipsec profile gre_protection shared
+```
+
+
+## Monitoring
+
+All spokes created IPSec tunnels to Hubs, are registered on Hubs using NHRP protocol and formed adjacency in OSPF.
+
+```none
+vyos@HUB-1:~$ show vpn ipsec sa
+Connection                  State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
+--------------------------  -------  --------  --------------  ----------------  ----------------  -----------  ------------------------
+dmvpn-NHRPVPN-tun100-child  up       6m1s      4K/5K           51/56             10.0.13.2         10.0.13.2    AES_CBC_256/HMAC_SHA1_96
+dmvpn-NHRPVPN-tun100-child  up       6m36s     4K/6K           56/65             10.0.12.2         10.0.12.2    AES_CBC_256/HMAC_SHA1_96
+dmvpn-NHRPVPN-tun100-child  up       8m49s     6K/6K           73/77             10.0.11.2         10.0.11.2    AES_CBC_256/HMAC_SHA1_96
+
+vyos@HUB-1:~$ show ip nhrp cache
+Iface    Type     Protocol                 NBMA                     Claimed NBMA             Flags  Identity
+tun100   dynamic  10.100.100.12            10.0.12.2                10.0.12.2                 T     10.0.12.2
+tun100   dynamic  10.100.100.13            10.0.13.2                10.0.13.2                 T     10.0.13.2
+tun100   dynamic  10.100.100.11            10.0.11.2                10.0.11.2                 T     10.0.11.2
+tun100   local    10.100.100.1             10.0.0.2                 10.0.0.2                        -
+
+vyos@HUB-1:~$ show ip ospf neighbor
+
+Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXmtL RqstL DBsmL
+192.168.11.1      1 Full/DROther    17m01s            36.201s 10.100.100.11   tun100:10.100.100.1                  0     0     0
+192.168.12.1      1 Full/DROther    9m42s             37.443s 10.100.100.12   tun100:10.100.100.1                  0     0     0
+192.168.13.1      1 Full/DROther    9m15s             35.053s 10.100.100.13   tun100:10.100.100.1                  0     0     0
+```
+
+First, we see that LANs are accessible through hubs using OSPF routes.
+
+```none
+SPOKE-1#show ip route
+Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
+       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
+       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
+       E1 - OSPF external type 1, E2 - OSPF external type 2
+       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
+       ia - IS-IS inter area, * - candidate default, U - per-user static route
+       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+       a - application route
+       + - replicated route, % - next hop override, p - overrides from PfR
+
+Gateway of last resort is 10.0.11.1 to network 0.0.0.0
+.....
+      192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks
+C        192.168.11.0/24 is directly connected, GigabitEthernet0/1
+L        192.168.11.1/32 is directly connected, GigabitEthernet0/1
+O     192.168.12.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101
+                      [110/1002] via 10.100.100.1, 00:16:13, Tunnel100
+O     192.168.13.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101
+                      [110/1002] via 10.100.100.1, 00:15:45, Tunnel100
+
+
+vyos@SPOKE-2:~$ show ip route
+Codes: K - kernel route, C - connected, L - local, S - static,
+       R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric, t - Table-Direct,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+......
+O>* 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36
+  *                         via 10.100.101.1, tun101 onlink, weight 1, 00:12:36
+O   192.168.12.0/24 [110/1] is directly connected, eth1, weight 1, 01:24:40
+C>* 192.168.12.0/24 is directly connected, eth1, weight 1, 01:24:43
+L>* 192.168.12.1/32 is directly connected, eth1, weight 1, 01:24:43
+O>* 192.168.13.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36
+  *                         via 10.100.101.1, tun101 onlink, weight 1, 00:12:36
+```
+
+After initiating traffic between SPOKES sites, Phase 3 of DMVPN will work.
+For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1
+
+```none
+PC-SPOKE-2 : 192.168.12.2 255.255.255.0 gateway 192.168.12.1
+
+PC-SPOKE-2> trace 192.168.11.2
+trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop
+ 1   192.168.12.1   0.558 ms  0.378 ms  0.561 ms
+ 2   10.100.101.1   1.768 ms  1.158 ms  1.744 ms
+ 3   10.100.101.11   7.196 ms  4.971 ms  4.793 ms
+ 4   *192.168.11.2   7.747 ms (ICMP type:3, code:3, Destination port unreachable)
+
+PC-SPOKE-2> trace 192.168.11.2
+trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop
+ 1   192.168.12.1   0.562 ms  0.396 ms  0.364 ms
+ 2   10.100.100.11   4.401 ms  4.399 ms  4.174 ms
+ 3   *192.168.11.2   3.241 ms (ICMP type:3, code:3, Destination port unreachable)
+```
+
+First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2.
+Now routing tables are changed. LAN networks 192.168.12.0/24 and 192.168.11.0/24 available directly via SPOKES.
+
+```none
+vyos@SPOKE-2:~$ show ip route
+Codes: K - kernel route, C - connected, L - local, S - static,
+       R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric, t - Table-Direct,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+N>* 192.168.11.0/24 [10/0] via 10.100.100.11, tun100 onlink, weight 1, 00:00:14
+O   192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:00:54
+                            via 10.100.101.1, tun101 onlink, weight 1, 00:00:54
+
+
+SPOKE-1# show ip route next-hop-override
+Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
+       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
+       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
+       E1 - OSPF external type 1, E2 - OSPF external type 2
+       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
+       ia - IS-IS inter area, * - candidate default, U - per-user static route
+       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+       a - application route
+       + - replicated route, % - next hop override, p - overrides from PfR
+
+Gateway of last resort is 10.0.11.1 to network 0.0.0.0
+
+O   % 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:24:09, Tunnel101
+                      [110/1002] via 10.100.100.1, 00:25:46, Tunnel100
+                      [NHO][110/1] via 10.100.100.12, 00:00:03, Tunnel100
+```
+
+NHRP shows shortcuts on Spokes
+
+```none
+vyos@SPOKE-2:~$ show ip nhrp shortcut
+Type     Prefix                   Via                      Identity
+dynamic  192.168.11.0/24          10.100.100.11            10.0.11.2
+
+SPOKE-1# show ip nhrp shortcut
+10.100.100.12/32 via 10.100.100.12
+   Tunnel100 created 00:09:59, expire 00:02:21
+   Type: dynamic, Flags: router nhop rib nho
+   NBMA address: 10.0.12.2
+192.168.12.0/24 via 10.100.100.12
+   Tunnel100 created 00:02:38, expire 00:02:21
+   Type: dynamic, Flags: router rib nho
+   NBMA address: 10.0.12.2
+```
+
+A new Spoke to Spoke IPSec tunnel is created
+
+```none
+SPOKE-1#show crypto isakmp sa
+IPv4 Crypto ISAKMP SA
+dst             src             state          conn-id status
+10.0.0.2        10.0.11.2       QM_IDLE           1002 ACTIVE
+10.0.12.2       10.0.11.2       QM_IDLE           1004 ACTIVE
+10.0.1.2        10.0.11.2       QM_IDLE           1003 ACTIVE
+
+vyos@SPOKE-2:~$ show vpn ipsec sa
+Connection                  State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
+--------------------------  -------  --------  --------------  ----------------  ----------------  -----------  ------------------------
+dmvpn-NHRPVPN-tun100-child  up       7m26s     4K/4K           57/53             10.0.0.2          10.0.0.2     AES_CBC_256/HMAC_SHA1_96
+dmvpn-NHRPVPN-tun100-child  up       11m48s    316B/1K         3/15              10.0.11.2         10.0.11.2    AES_CBC_256/HMAC_SHA1_96
+dmvpn-NHRPVPN-tun101-child  up       5m58s     5K/4K           62/51             10.0.1.2          10.0.1.2     AES_CBC_256/HMAC_SHA1_96
+```
+
+
+## Summary
+
+If one of the Hubs loses connectivity to the Internet, the other Hub will be available and take the main role.
+This is a simple example where only one internet connection is used. But in the real world, there can be two
+connections to the Internet. In this case, there is a recommendation to build each tunnel via each Internet connection,
+choose the main cloud, and manipulate traffic via a routing protocol. It allows the creation failover on link-level
+connections too.
diff --git a/docs/configexamples/firewall.md b/docs/configexamples/firewall.md
new file mode 100644
index 00000000..5d170511
--- /dev/null
+++ b/docs/configexamples/firewall.md
@@ -0,0 +1,16 @@
+---
+lastproofread: '2024-09-11'
+---
+
+# Firewall Examples
+
+This section contains examples of firewall configurations for various
+deployments.
+
+```{toctree}
+:maxdepth: 2
+
+fwall-and-vrf
+fwall-and-bridge
+zone-policy
+```
diff --git a/docs/configexamples/fwall-and-bridge.md b/docs/configexamples/fwall-and-bridge.md
new file mode 100644
index 00000000..5eb7a7fd
--- /dev/null
+++ b/docs/configexamples/fwall-and-bridge.md
@@ -0,0 +1,490 @@
+---
+lastproofread: '2024-09-11'
+---
+
+# Bridge and firewall example
+
+## Scenario and requirements
+
+This example shows how to configure a VyOS router with bridge interfaces and
+firewall rules.
+
+Three non VLAN-aware bridges are going to be configured, and each one has its
+own requirements.
+
+- Bridge br0:
+  : - Isolated layer 2 bridge.
+    - Accept only IPv6 communication within the bridge.
+- Bridge br1:
+  : - Drop all DHCP discover packets.
+    - Accept all ARP packets.
+    - Within the bridge, accept only new IPv4 connections from host 10.1.1.102
+    - Drop all other IPv4 connections.
+    - Drop all IPv6 connections.
+    - Accept access to router itself.
+    - Allow connections to internet
+    - Drop connections to other LANs.
+- Bridge br2:
+  : - Accept all DHCP discover packets.
+    - Accept only DHCP offers from valid server and|or trusted bridge port.
+    - Accept all ARP packets.
+    - Accept all IPv4 connections.
+    - Drop all IPv6 connections.
+    - Deny access to the router.
+    - Allow connections to internet.
+    - Allow connections to bridge br1.
+
+## Configuration
+
+### Bridges and interfaces configuration
+
+First, we need to configure the interfaces and bridges:
+
+```none
+# Bridge br0
+set interfaces bridge br0 description 'Isolated L2 bridge'
+set interfaces bridge br0 member interface eth1
+set interfaces bridge br0 member interface eth2
+set interfaces ethernet eth1 description 'br0'
+set interfaces ethernet eth2 description 'br0'
+
+# Bridge br1:
+set interfaces bridge br1 address '10.1.1.1/24'
+set interfaces bridge br1 description 'L3 bridge br1'
+set interfaces bridge br1 member interface eth3
+set interfaces bridge br1 member interface eth4
+set interfaces ethernet eth3 description 'br1'
+set interfaces ethernet eth4 description 'br1'
+
+# Bridge br2:
+set interfaces bridge br2 address '10.2.2.1/24'
+set interfaces bridge br2 description 'L3 bridge br2'
+set interfaces bridge br2 member interface eth5
+set interfaces bridge br2 member interface eth6
+set interfaces bridge br2 member interface eth7
+set interfaces ethernet eth5 description 'br2 - Host'
+set interfaces ethernet eth6 description 'br2 - Trusted DHCP Server'
+set interfaces ethernet eth7 description 'br2'
+```
+
+
+### Bridge firewall configuration
+
+In this section, we are going to configure the firewall rules that will be used
+in bridge firewall, and will control the traffic within each bridge.
+
+We are going to use custom firewall rulesets, one for each bridge that will
+be used in `prerouting`, and one for each bridge that will be used in the
+`forward` chain.
+
+Also, we are going to use firewall interface groups in order to simplify the
+firewall configuration.
+
+So first, let's create the required firewall interface groups:
+
+```none
+# Bridge br0 interface-group:
+set firewall group interface-group br0-ifaces interface 'br0'
+set firewall group interface-group br0-ifaces interface 'eth1'
+set firewall group interface-group br0-ifaces interface 'eth2'
+
+# Bridge br1 interface-group:
+set firewall group interface-group br1-ifaces interface 'br1'
+set firewall group interface-group br1-ifaces interface 'eth3'
+set firewall group interface-group br1-ifaces interface 'eth4'
+
+# Bridge br2 interface-group:
+set firewall group interface-group br2-ifaces interface 'br2'
+set firewall group interface-group br2-ifaces interface 'eth5'
+set firewall group interface-group br2-ifaces interface 'eth6'
+set firewall group interface-group br2-ifaces interface 'eth7'
+```
+
+As said before, we are going to create custom firewall rulesets for each
+bridge, that will be used in the `prerouting` chain, in order to drop as much
+unwanted traffic as early as possible. So, custom rulesets used in
+`prerouting` chain are going to be `br0-pre`, `br1-pre`, and `br2-pre`:
+
+```none
+# Prerouting - Catch all traffic for br0
+set firewall bridge prerouting filter rule 10 action 'jump'
+set firewall bridge prerouting filter rule 10 description 'br0 traffic'
+set firewall bridge prerouting filter rule 10 inbound-interface group 'br0-ifaces'
+set firewall bridge prerouting filter rule 10 jump-target 'br0-pre'
+
+# Prerouting - Catch all traffic for br1
+set firewall bridge prerouting filter rule 20 action 'jump'
+set firewall bridge prerouting filter rule 20 description 'br1 traffic'
+set firewall bridge prerouting filter rule 20 inbound-interface group 'br1-ifaces'
+set firewall bridge prerouting filter rule 20 jump-target 'br1-pre'
+
+# Prerouting - Catch all traffic for br2
+set firewall bridge prerouting filter rule 30 action 'jump'
+set firewall bridge prerouting filter rule 30 description 'br2 traffic'
+set firewall bridge prerouting filter rule 30 inbound-interface group 'br2-ifaces'
+set firewall bridge prerouting filter rule 30 jump-target 'br2-pre'
+```
+
+And then create the custom rulesets:
+
+```none
+### br0 - br0-pre
+  # Requirements: accept only IPv6 communication within the bridge
+set firewall bridge name br0-pre rule 10 description 'Accept IPv6 traffic'
+set firewall bridge name br0-pre rule 10 action 'accept'
+set firewall bridge name br0-pre rule 10 ethernet-type 'ipv6'
+  # And drop everything else
+set firewall bridge name br0-pre default-action 'drop'
+
+### br1 - br1-pre
+  # Requirements: drop all DHCP discover packets
+set firewall bridge name br1-pre rule 10 description 'Drop DHCP discover'
+set firewall bridge name br1-pre rule 10 action 'drop'
+set firewall bridge name br1-pre rule 10 protocol 'udp'
+set firewall bridge name br1-pre rule 10 source port '68'
+set firewall bridge name br1-pre rule 10 destination port '67'
+set firewall bridge name br1-pre rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
+set firewall bridge name br1-pre rule 10 log
+  # Requirement: drop all IPv6 connections
+set firewall bridge name br1-pre rule 20 description 'Drop IPv6 traffic'
+set firewall bridge name br1-pre rule 20 action 'drop'
+set firewall bridge name br1-pre rule 20 ethernet-type 'ipv6'
+  # Accept everything else so it can be parsed later
+set firewall bridge name br1-pre default-action 'accept'
+
+### br2 - br2-pre
+  # Requirements: drop all IPv6 connections
+set firewall bridge name br2-pre rule 10 description 'Drop IPv6 traffic'
+set firewall bridge name br2-pre rule 10 action 'drop'
+set firewall bridge name br2-pre rule 10 ethernet-type 'ipv6'
+  # Accept everything else so it can be parsed later
+set firewall bridge name br2-pre default-action 'accept'
+```
+
+Now, in the `forward` chain, we are going to define state policies, and
+custom rulesets for each bridge that would be used in the `forward` chain.
+These rulesets are `br0-fwd`, `br1-fwd`, and `br2-fwd`:
+
+```none
+# Forward - State policies if not defined globally
+set firewall bridge forward filter rule 5 action 'accept'
+set firewall bridge forward filter rule 5 state 'established'
+set firewall bridge forward filter rule 5 state 'related'
+set firewall bridge forward filter rule 10 action 'drop'
+set firewall bridge forward filter rule 10 state 'invalid'
+
+# Forward - Catch all traffic for br0
+set firewall bridge forward filter rule 110 description 'br0 traffic'
+set firewall bridge forward filter rule 110 action 'jump'
+set firewall bridge forward filter rule 110 inbound-interface group 'br0-ifaces'
+set firewall bridge forward filter rule 110 jump-target 'br0-fwd'
+
+# Forward - Catch all traffic for br1
+set firewall bridge forward filter rule 120 description 'br1 traffic'
+set firewall bridge forward filter rule 120 action 'jump'
+set firewall bridge forward filter rule 120 inbound-interface group 'br1-ifaces'
+set firewall bridge forward filter rule 120 jump-target 'br1-fwd'
+
+# Forward - Catch all traffic for br2
+set firewall bridge forward filter rule 130 description 'br2 traffic'
+set firewall bridge forward filter rule 130 action 'jump'
+set firewall bridge forward filter rule 130 inbound-interface group 'br2-ifaces'
+set firewall bridge forward filter rule 130 jump-target 'br2-fwd'
+
+# Forward - Default action drop:
+set firewall bridge forward filter default-action 'drop'
+```
+
+And the content of the custom rulesets:
+
+```none
+### br0 - br0-fwd
+  # Accept everything that wasn't dropped in prerouting
+set firewall bridge name br0-fwd default-action 'accept'
+
+### br1 - br1-fwd
+  # Requirement: Accept all ARP packets
+set firewall bridge name br1-fwd rule 10 description 'Accept ARP'
+set firewall bridge name br1-fwd rule 10 action 'accept'
+set firewall bridge name br1-fwd rule 10 ethernet-type 'arp'
+  # Requirement: Accept only new IPv4 connections from host 10.1.1.102
+set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host'
+set firewall bridge name br1-fwd rule 20 action 'accept'
+set firewall bridge name br1-fwd rule 20 source address '10.1.1.102'
+set firewall bridge name br1-fwd rule 20 state 'new'
+  # Drop everything else within the bridge:
+set firewall bridge name br1-fwd default-action 'drop'
+
+### br2 - br2-fwd
+  # Requirement: Accept all DHCP discover packets
+set firewall bridge name br2-fwd rule 10 description 'Accept DHCP discover'
+set firewall bridge name br2-fwd rule 10 action 'accept'
+set firewall bridge name br2-fwd rule 10 protocol 'udp'
+set firewall bridge name br2-fwd rule 10 source port '68'
+set firewall bridge name br2-fwd rule 10 destination port '67'
+set firewall bridge name br2-fwd rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
+  # Requirement: Accept only DHCP offers from valid server on port eth6
+set firewall bridge name br2-fwd rule 20 description 'Accept DHCP offers from trusted interface'
+set firewall bridge name br2-fwd rule 20 action 'accept'
+set firewall bridge name br2-fwd rule 20 protocol 'udp'
+set firewall bridge name br2-fwd rule 20 source port '67'
+set firewall bridge name br2-fwd rule 20 destination port '68'
+set firewall bridge name br2-fwd rule 20 inbound-interface name 'eth6'
+set firewall bridge name br2-fwd rule 22 description 'Drop all other DHCP offers'
+set firewall bridge name br2-fwd rule 22 action 'drop'
+set firewall bridge name br2-fwd rule 22 protocol 'udp'
+set firewall bridge name br2-fwd rule 22 source port '67'
+set firewall bridge name br2-fwd rule 22 destination port '68'
+set firewall bridge name br2-fwd rule 22 log
+
+  # Accept all ARP packets
+set firewall bridge name br2-fwd rule 30 description 'Accept ARP'
+set firewall bridge name br2-fwd rule 30 action 'accept'
+set firewall bridge name br2-fwd rule 30 ethernet-type 'arp'
+  # Accept all IPv4 connections
+set firewall bridge name br2-fwd rule 40 description 'Accept ipv4'
+set firewall bridge name br2-fwd rule 40 action 'accept'
+set firewall bridge name br2-fwd rule 40 ethernet-type 'ipv4'
+  # Drop everything else
+set firewall bridge name br2-fwd default-action 'drop'
+```
+
+
+### IP firewall configuration
+
+Since some of the requirements listed above exceed the capabilities of the
+bridge firewall, we need to use the IP firewall to implement them.
+For bridge br1 and br2, we need to control the traffic that is going to the
+router itself, to other local networks, and to the Internet.
+
+As a reminder, here's a link to the {doc}`firewall documentation
+</configuration/firewall/index>`, where you can find more information about
+the packet flow for traffic that comes from bridge layer and should be analyzed
+by the IP firewall.
+
+Access to the router itself is controlled by the base chain `input`, and
+rules to accomplish all the requirements are:
+
+```none
+# First of all, if not using global state policies, we need to define them:
+set firewall ipv4 input filter rule 10 state 'established'
+set firewall ipv4 input filter rule 10 state 'related'
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 20 state 'invalid'
+set firewall ipv4 input filter rule 20 action 'drop'
+
+# Input - br1 - Accept access to router itself
+set firewall ipv4 input filter rule 110 description "Accept access from br1"
+set firewall ipv4 input filter rule 110 action 'accept'
+set firewall ipv4 input filter rule 110 inbound-interface group 'br1-ifaces'
+
+# Input - br2 - Deny access to the router
+set firewall ipv4 input filter rule 120 description "Deny access from br2"
+set firewall ipv4 input filter rule 120 action 'drop'
+set firewall ipv4 input filter rule 120 inbound-interface group 'br2-ifaces'
+```
+
+And for traffic that is going to other local networks, and to he Internet, we
+need to use the base chain `forward`. As in the bridge firewall, we are
+going to use custom rulesets for each bridge, that would be used in the
+`forward` chain. Those rulesets are `ip-br1-fwd` and `ip-br2-fwd`:
+
+```none
+# First of all, if not using global state policies, we need to define them:
+set firewall ipv4 forward filter rule 5 action 'accept'
+set firewall ipv4 forward filter rule 5 state 'established'
+set firewall ipv4 forward filter rule 5 state 'related'
+set firewall ipv4 forward filter rule 10 action 'drop'
+set firewall ipv4 forward filter rule 10 state 'invalid'
+
+# Forward - Catch all traffic for br1
+set firewall ipv4 forward filter rule 110 description 'br1 traffic'
+set firewall ipv4 forward filter rule 110 action 'jump'
+set firewall ipv4 forward filter rule 110 inbound-interface group 'br1-ifaces'
+set firewall ipv4 forward filter rule 110 jump-target 'ip-br1-fwd'
+
+# Forward - Catch all traffic for br2
+set firewall ipv4 forward filter rule 120 description 'br2 traffic'
+set firewall ipv4 forward filter rule 120 action 'jump'
+set firewall ipv4 forward filter rule 120 inbound-interface group 'br2-ifaces'
+set firewall ipv4 forward filter rule 120 jump-target 'ip-br2-fwd'
+
+# Forward - Default action drop:
+set firewall ipv4 forward filter default-action 'drop'
+```
+
+And the content of the custom rulesets:
+
+```none
+### br1 - ip-br1-fwd
+  # Requirement: Allow connections to internet
+set firewall ipv4 name ip-br1-fwd rule 10 description 'br1 - allow internet access'
+set firewall ipv4 name ip-br1-fwd rule 10 action 'accept'
+set firewall ipv4 name ip-br1-fwd rule 10 outbound-interface name 'eth0'
+  # Requirement: Drop all other connections
+set firewall ipv4 name ip-br1-fwd default-action 'drop'
+
+### br2 - ip-br2-fwd
+  # Requirement: Allow connections to internet
+set firewall ipv4 name ip-br2-fwd rule 10 description 'br2 - allow internet access'
+set firewall ipv4 name ip-br2-fwd rule 10 action 'accept'
+set firewall ipv4 name ip-br2-fwd rule 10 outbound-interface name 'eth0'
+  # Requirement: Allow connections to br1
+set firewall ipv4 name ip-br2-fwd rule 20 description 'br2 - allow access to br1'
+set firewall ipv4 name ip-br2-fwd rule 20 action 'accept'
+set firewall ipv4 name ip-br2-fwd rule 20 outbound-interface group 'br1-ifaces'
+  # Requirement: Drop all other connections
+set firewall ipv4 name ip-br2-fwd default-action 'drop'
+```
+
+
+## Validation
+
+While testing the configuration, we can check logs in order to ensure that
+we are accepting and/or blocking the correct traffic.
+
+For example, while a host tries to get an IP address from a DHCP server in
+br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from
+untrusted servers are dropped:
+
+```none
+vyos@bridge:~$ show log firewall bridge
+Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302
+Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
+Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
+```
+
+And with operational mode commands, we can check rules matchers, actions, and
+counters.
+
+Bridge firewall ruleset:
+
+```none
+vyos@bri:~$ show firewall bridge
+Rulesets bridge Information
+
+---------------------------------
+bridge Firewall "forward filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  -----------------------------------------
+5        accept    all                19     1916  ct state { established, related }  accept
+10       drop      all                 0        0  ct state invalid
+110      jump      all                 2      208  iifname @I_br0-ifaces  jump NAME_br0-fwd
+120      jump      all                10      670  iifname @I_br1-ifaces  jump NAME_br1-fwd
+130      jump      all                12     3086  iifname @I_br2-ifaces  jump NAME_br2-fwd
+default  drop      all                 0        0
+
+---------------------------------
+bridge Firewall "name br0-fwd"
+
+Rule     Action    Protocol      Packets    Bytes
+-------  --------  ----------  ---------  -------
+default  accept    all                 2      208
+
+---------------------------------
+bridge Firewall "name br0-pre"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------
+10       accept    all                18     1872  ether type ip6  accept
+default  drop      all                 9     1476
+
+---------------------------------
+bridge Firewall "name br1-fwd"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------------------------
+10       accept    all                 5      250  ether type arp  accept
+20       accept    all                 3      252  ct state new ip saddr 10.1.1.102  accept
+default  drop      all                 2      168
+
+---------------------------------
+bridge Firewall "name br1-pre"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------------------------------------------------------------------------
+10       drop      udp                 3     1176  ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67  prefix "[bri-NAM-br1-pre-10-D]"
+20       drop      all                 0        0  ether type ip6
+default  accept    all                58     4430
+
+---------------------------------
+bridge Firewall "name br2-fwd"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ---------------------------------------------------------------
+10       accept    udp                 4     1312  ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67  accept
+20       accept    udp                 2      656  udp sport 67 udp dport 68 iifname "eth6"  accept
+22       drop      udp                 1      322  udp sport 67 udp dport 68  prefix "[bri-NAM-br2-fwd-22-D]"
+30       accept    all                 2       92  ether type arp  accept
+40       accept    all                 3      704  ether type ip  accept
+default  drop      all                 0        0
+
+---------------------------------
+bridge Firewall "name br2-pre"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  --------------
+10       drop      all                 7      728  ether type ip6
+default  accept    all                77     7548
+
+---------------------------------
+bridge Firewall "prerouting filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------------------------
+10       jump      all                27     3348  iifname @I_br0-ifaces  jump NAME_br0-pre
+20       jump      all                61     5606  iifname @I_br1-ifaces  jump NAME_br1-pre
+30       jump      all                84     8276  iifname @I_br2-ifaces  jump NAME_br2-pre
+default  drop      all                 0        0
+
+vyos@bridge:~$
+```
+
+IPv4 firewall ruleset:
+
+```none
+vyos@bridge:~$ show firewall ipv4
+Rulesets ipv4 Information
+
+---------------------------------
+ipv4 Firewall "forward filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  -------------------------------------------
+5        accept    all                76     6384  ct state { established, related }  accept
+10       drop      all                 0        0  ct state invalid
+110      jump      all                13     1092  iifname @I_br1-ifaces  jump NAME_ip-br1-fwd
+120      jump      all                 3      252  iifname @I_br2-ifaces  jump NAME_ip-br2-fwd
+default  drop      all                 0        0
+
+---------------------------------
+ipv4 Firewall "input filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  -----------------------------------------
+10       accept    all                 0        0  ct state { established, related }  accept
+20       drop      all                 0        0  ct state invalid
+110      accept    all                10      720  iifname @I_br1-ifaces  accept
+120      drop      all                26     2672  iifname @I_br2-ifaces
+default  accept    all              3037   991621
+
+---------------------------------
+ipv4 Firewall "name ip-br1-fwd"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------
+10       accept    all                 5      420  oifname "eth0"  accept
+default  drop      all                 8      672
+
+---------------------------------
+ipv4 Firewall "name ip-br2-fwd"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  -----------------------------
+10       accept    all                 1       84  oifname "eth0"  accept
+20       accept    all                 2      168  oifname @I_br1-ifaces  accept
+default  drop      all                 0        0
+
+vyos@bridge:~$
+```
diff --git a/docs/configexamples/fwall-and-vrf.md b/docs/configexamples/fwall-and-vrf.md
new file mode 100644
index 00000000..da9949db
--- /dev/null
+++ b/docs/configexamples/fwall-and-vrf.md
@@ -0,0 +1,121 @@
+# VRF and firewall example
+
+## Scenario and requirements
+
+This example shows how to configure a VyOS router with VRFs and firewall rules.
+
+Diagram used in this example:
+
+```{image} /_static/images/firewall-and-vrf-blueprints.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+As exposed in the diagram, there are four VRFs. These VRFs are `MGMT`,
+`WAN`, `LAN` and `PROD`, and their requirements are:
+
+```{eval-rst}
+* VRF MGMT:
+   * Allow connections to LAN and PROD.
+   * Deny connections to internet(WAN).
+   * Allow connections to the router.
+* VRF LAN:
+   * Allow connections to PROD.
+   * Allow connections to internet(WAN).
+* VRF PROD:
+   * Only accepts connections.
+* VRF WAN:
+   * Allow connection to PROD.
+```
+
+## Configuration
+
+First, we need to configure the interfaces and VRFs:
+
+```none
+set interfaces ethernet eth1 address '10.100.100.1/24'
+set interfaces ethernet eth1 vrf 'MGMT'
+set interfaces ethernet eth2 vif 150 address '10.150.150.1/24'
+set interfaces ethernet eth2 vif 150 vrf 'LAN'
+set interfaces ethernet eth2 vif 160 address '10.160.160.1/24'
+set interfaces ethernet eth2 vif 160 vrf 'LAN'
+set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24'
+set interfaces ethernet eth2 vif 3500 vrf 'PROD'
+set interfaces loopback lo
+set interfaces pppoe pppoe0 authentication password 'p4ssw0rd'
+set interfaces pppoe pppoe0 authentication username 'vyos'
+set interfaces pppoe pppoe0 source-interface 'eth0'
+set interfaces pppoe pppoe0 vrf 'WAN'
+set vrf bind-to-all
+set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN'
+set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT'
+set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD'
+set vrf name LAN table '103'
+set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN'
+set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN'
+set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD'
+set vrf name MGMT table '102'
+set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN'
+set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT'
+set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN'
+set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN'
+set vrf name PROD table '104'
+set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN'
+set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN'
+set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD'
+set vrf name WAN table '101'
+```
+
+And before firewall rules are shown, we need to pay attention how to configure
+and match interfaces and VRFs. In case where an interface is assigned to a
+non-default VRF, if we want to use inbound-interface or outbound-interface in
+firewall rules, we need to:
+
+- For **inbound-interface**: use the interface name with the VRF name, like
+  `MGMT` or `LAN`.
+- For **outbound-interface**: use the interface name, like `eth0`, `vtun0`,
+  `eth2*` or similar.
+
+Next, we need to configure the firewall rules. First we will define all rules
+for transit traffic between VRFs.
+
+```none
+set firewall ipv4 forward filter default-action 'drop'
+set firewall ipv4 forward filter default-log
+set firewall ipv4 forward filter rule 10 action 'accept'
+set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD'
+set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT'
+set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*'
+set firewall ipv4 forward filter rule 99 action 'drop'
+set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt'
+set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1'
+set firewall ipv4 forward filter rule 120 action 'accept'
+set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD'
+set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN'
+set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500'
+set firewall ipv4 forward filter rule 130 action 'accept'
+set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet'
+set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN'
+set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0'
+```
+
+Also, we are adding global state policies, in order to allow established and
+related traffic, in order not to drop valid responses:
+
+```none
+set firewall global-options state-policy established action 'accept'
+set firewall global-options state-policy invalid action 'drop'
+set firewall global-options state-policy related action 'accept'
+```
+
+And finally, we need to allow input connections to the router itself only from
+vrf MGMT:
+
+```none
+set firewall ipv4 input filter default-action 'drop'
+set firewall ipv4 input filter default-log
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 10 description 'MGMT - Allow input'
+set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT'
+```
diff --git a/docs/configexamples/ha.md b/docs/configexamples/ha.md
new file mode 100644
index 00000000..c3fd4f84
--- /dev/null
+++ b/docs/configexamples/ha.md
@@ -0,0 +1,556 @@
+---
+lastproofread: '2021-06-28'
+---
+
+(example-high-availability)=
+
+# High Availability Walkthrough
+
+This document walks you through a complete HA setup of two VyOS machines. This
+design is based on a VM as the primary router and a physical machine as a
+backup, using VRRP, BGP, OSPF, and conntrack sharing.
+
+This document aims to walk you through setting everything up, so
+at a point where you can reboot any machine and not lose more than a few
+seconds worth of connectivity.
+
+## Design
+
+This is based on a real-life production design. One of the complex issues
+is ensuring you have redundant data INTO your network. We do this with a pair
+of Cisco Nexus switches and using Virtual PortChannels that are spanned across
+them. As a bonus, this also allows for complete switch failure without
+an outage. How you achieve this yourself is left as an exercise to the reader.
+But our setup is documented here.
+
+### Walkthrough suggestion
+
+The `commit` command is implied after every section. If you make an error,
+`commit` will warn you and you can fix it before getting too far into things.
+Please ensure you commit early and commit often.
+
+If you are following through this document, it is strongly suggested you
+complete the entire document, ONLY doing the virtual router1 steps, and then
+come back and walk through it AGAIN on the backup hardware router.
+
+This ensures you don't go too fast or miss a step. However, it will make your
+life easier to configure the fixed IP address and default route now on the
+hardware router.
+
+### Example Network
+
+In this document, we have been allocated 203.0.113.0/24 by our upstream
+provider, which we are publishing on VLAN100.
+
+They want us to establish a BGP session to their routers on 192.0.2.11 and
+192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and
+we are AS 65551.
+
+Our routers are going to have a floating IP address of 203.0.113.1, and use
+.2 and .3 as their fixed IPs.
+
+We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201.
+
+When traffic is originated from the 10.200.201.0/24 network, it will be
+masqueraded to 203.0.113.1
+
+For connection between sites, we are running a WireGuard link to two REMOTE
+routers and using OSPF over those links to distribute routes. That remote
+site is expected to send traffic from anything in 10.201.0.0/16
+
+### VLANs
+
+These are the vlans we will be using:
+
+- 50: Upstream, using the 192.0.2.0/24 network allocated by them.
+- 100: 'Public' network, using our 203.0.113.0/24 network.
+- 201: 'Internal' network, using 10.200.201.0/24
+
+### Hardware
+
+- switch1 (Nexus 10gb Switch)
+- switch2 (Nexus 10gb Switch)
+- compute1 (VMware ESXi 6.5)
+- compute2 (VMware ESXi 6.5)
+- compute3 (VMware ESXi 6.5)
+- router2 (Random 1RU machine with 4 NICs)
+
+Note that router1 is a VM that runs on one of the compute nodes.
+
+### Network Cabling
+
+- From Datacenter - This connects into port 1 on both switches, and is tagged
+  as VLAN 50
+- Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch
+- Hardware Router - Port 8 of each switch
+- compute1 - Port 9 of each switch
+- compute2 - Port 10 of each switch
+- compute3 - Port 11 of each switch
+
+This is ignoring the extra Out-of-band management networking, which should be
+on totally different switches, and a different feed into the rack, and is out
+of scope of this.
+
+:::{note}
+Our implementation uses VMware's Distributed Port Groups, which allows
+VMware to use LACP. This is a part of the ENTERPRISE licence, and is not
+available on a free licence. If you are implementing this and do not have
+access to DPGs, you should not use VMware, and use some other virtualization
+platform instead.
+:::
+
+## Basic Setup (via console)
+
+Create your router1 VM. So it can withstand a VM Host failing or a
+network link failing. Using VMware, this is achieved by enabling vSphere DRS,
+vSphere Availability, and creating a Distributed Port Group that uses LACP.
+
+Many other Hypervisors do this, and I'm hoping that this document will be
+expanded to document how to do this for others.
+
+Create an 'All VLANs' network group, that passes all trunked traffic through
+to the VM. Attach this network group to router1 as eth0.
+
+:::{note}
+VMware: You must DISABLE SECURITY on this Port group. Make sure that
+`Promiscuous Mode`, `MAC address changes` and `Forged transmits` are
+enabled. All of these will be done as part of failover.
+:::
+
+### Bonding on Hardware Router
+
+Create a LACP bond on the hardware router. We are assuming that eth0 and eth1
+are connected to port 8 on both switches, and that those ports are configured
+as a Port-Channel.
+
+```none
+set interfaces bonding bond0 description 'Switch Port-Channel'
+set interfaces bonding bond0 hash-policy 'layer2'
+set interfaces bonding bond0 member interface 'eth0'
+set interfaces bonding bond0 member interface 'eth1'
+set interfaces bonding bond0 mode '802.3ad'
+```
+
+
+### Assign external IP addresses
+
+VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this
+is talking directly to upstream. Create our IP address on vlan50.
+
+For the hardware router, replace `eth0` with `bond0`. As (almost) every
+command is identical, this will not be specified unless different things need
+to be performed on different hosts.
+
+```none
+set interfaces ethernet eth0 vif 50 address '192.0.2.21/24'
+```
+
+In this case, the hardware router has a different IP, so it would be
+
+```none
+set interfaces ethernet bond0 vif 50 address '192.0.2.22/24'
+```
+
+
+### Add (temporary) default route
+
+It is assumed that the routers provided by upstream are capable of acting as a
+default router, add that as a static route.
+
+```none
+set protocols static route 0.0.0.0/0 next-hop 192.0.2.11
+commit
+save
+```
+
+
+### Enable SSH
+
+Enable SSH so you can now SSH into the routers, rather than using the console.
+
+```none
+set service ssh
+commit
+save
+```
+
+At this point, you should be able to SSH into both of them, and will no longer
+need access to the console (unless you break something!)
+
+## VRRP Configuration
+
+We are setting up VRRP so that it does NOT fail back when a machine returns into
+service, and it prioritizes router1 over router2.
+
+### Internal Network
+
+This has a floating IP address of 10.200.201.1/24, using virtual router ID 201.
+The difference between them is the interface name, hello-source-address, and
+peer-address.
+
+**router1**
+
+```none
+set interfaces ethernet eth0 vif 201 address 10.200.201.2/24
+set high-availability vrrp group int hello-source-address '10.200.201.2'
+set high-availability vrrp group int interface 'eth0.201'
+set high-availability vrrp group int peer-address '10.200.201.3'
+set high-availability vrrp group int no-preempt
+set high-availability vrrp group int priority '200'
+set high-availability vrrp group int address '10.200.201.1/24'
+set high-availability vrrp group int vrid '201'
+```
+
+**router2**
+
+```none
+set interfaces ethernet bond0 vif 201 address 10.200.201.3/24
+set high-availability vrrp group int hello-source-address '10.200.201.3'
+set high-availability vrrp group int interface 'bond0.201'
+set high-availability vrrp group int peer-address '10.200.201.2'
+set high-availability vrrp group int no-preempt
+set high-availability vrrp group int priority '100'
+set high-availability vrrp group int address '10.200.201.1/24'
+set high-availability vrrp group int vrid '201'
+```
+
+
+### Public Network
+
+This has a floating IP address of 203.0.113.1/24, using virtual router ID 113.
+The virtual router ID is just a random number between 1 and 254, and can be set
+to whatever you want. Best practices suggest you try to keep them unique
+enterprise-wide.
+
+**router1**
+
+```none
+set interfaces ethernet eth0 vif 100 address 203.0.113.2/24
+set high-availability vrrp group public hello-source-address '203.0.113.2'
+set high-availability vrrp group public interface 'eth0.100'
+set high-availability vrrp group public peer-address '203.0.113.3'
+set high-availability vrrp group public no-preempt
+set high-availability vrrp group public priority '200'
+set high-availability vrrp group public address '203.0.113.1/24'
+set high-availability vrrp group public vrid '113'
+```
+
+**router2**
+
+```none
+set interfaces ethernet bond0 vif 100 address 203.0.113.3/24
+set high-availability vrrp group public hello-source-address '203.0.113.3'
+set high-availability vrrp group public interface 'bond0.100'
+set high-availability vrrp group public peer-address '203.0.113.2'
+set high-availability vrrp group public no-preempt
+set high-availability vrrp group public priority '100'
+set high-availability vrrp group public address '203.0.113.1/24'
+set high-availability vrrp group public vrid '113'
+```
+
+
+### Create VRRP sync-group
+
+The sync group is used to replicate connection tracking. It needs to be assigned
+to a random VRRP group, and we are creating a sync group called `sync` using
+the vrrp group `int`.
+
+```none
+set high-availability vrrp sync-group sync member 'int'
+```
+
+
+### Testing
+
+At this point, you should be able to see both IP addresses when you run
+`show interfaces`, and `show vrrp` should show both interfaces in MASTER
+state (and SLAVE state on router2).
+
+```none
+vyos@router1:~$ show vrrp
+Name      Interface      VRID  State    Last Transition
+--------  -----------  ------  -------  -----------------
+int       eth0.201        201  MASTER   100s
+public    eth0.100        113  MASTER   200s
+vyos@router1:~$
+```
+
+You should be able to ping to and from all the IPs you have allocated.
+
+## NAT and conntrack-sync
+
+Masquerade Traffic originating from 10.200.201.0/24 that is heading out the
+public interface.
+
+:::{note}
+We explicitly exclude the primary upstream network so that BGP or
+OSPF traffic doesn't accidentally get NAT'ed.
+:::
+
+```none
+set nat source rule 10 destination address '!192.0.2.0/24'
+set nat source rule 10 outbound-interface name 'eth0.50'
+set nat source rule 10 source address '10.200.201.0/24'
+set nat source rule 10 translation address '203.0.113.1'
+```
+
+
+### Configure conntrack-sync and enable helpers
+
+Conntrack helper modules are enabled by default, but they tend to cause more
+problems than they're worth in complex networks. You can disable all of them
+at one go.
+
+```none
+delete system conntrack modules
+```
+
+Now enable replication between nodes. Replace eth0.201 with bond0.201 on the
+hardware router.
+
+```none
+set service conntrack-sync accept-protocol 'tcp,udp,icmp'
+set service conntrack-sync event-listen-queue-size '8'
+set service conntrack-sync failover-mechanism vrrp sync-group 'sync'
+set service conntrack-sync interface eth0.201
+set service conntrack-sync mcast-group '224.0.0.50'
+set service conntrack-sync sync-queue-size '8'
+```
+
+(ha-contracktesting)=
+
+### Testing
+
+The simplest way to test is to look at the connection tracking stats on the
+standby hardware router with the command `show conntrack-sync statistics`.
+The numbers should be very close to the numbers on the primary router.
+
+When you have both routers up, you should be able to establish a connection
+from a NAT'ed machine out to the internet, reboot the active machine, and that
+connection should be preserved, and will not drop out.
+
+## OSPF Over WireGuard
+
+Wireguard doesn't have the concept of an up or down link, due to its design.
+This complicates AND simplifies using it for network transport, as for reliable
+state detection you need to use SOMETHING to detect when the link is down.
+
+If you use a routing protocol itself, you solve two problems at once. This is
+only a basic example, and is provided as a starting point.
+
+### Configure Wireguard
+
+There is plenty of instructions and documentation on setting up Wireguard. The
+only important thing you need to remember is to only use one WireGuard
+interface per OSPF connection.
+
+We use small /30's from 10.254.60/24 for the point-to-point links.
+
+**router1**
+
+Replace the 203.0.113.3 with whatever the other router's IP address is.
+
+```none
+set interfaces wireguard wg01 address '10.254.60.1/30'
+set interfaces wireguard wg01 description 'router1-to-offsite1'
+set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0'
+set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001'
+set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15'
+set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o='
+set interfaces wireguard wg01 port '50001'
+set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e'
+set protocols ospf interface wg01 cost '11'
+set protocols ospf interface wg01 dead-interval '5'
+set protocols ospf interface wg01 hello-interval '1'
+set protocols ospf interface wg01 network 'point-to-point'
+set protocols ospf interface wg01 priority '1'
+set protocols ospf interface wg01 retransmit-interval '5'
+set protocols ospf interface wg01 transmit-delay '1'
+```
+
+**offsite1**
+
+This is connecting back to the STATIC IP of router1, not the floating.
+
+```none
+set interfaces wireguard wg01 address '10.254.60.2/30'
+set interfaces wireguard wg01 description 'offsite1-to-router1'
+set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0'
+set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001'
+set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15'
+set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q='
+set interfaces wireguard wg01 port '50001'
+set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e'
+set protocols ospf interface wg01 cost '11'
+set protocols ospf interface wg01 dead-interval '5'
+set protocols ospf interface wg01 hello-interval '1'
+set protocols ospf interface wg01 network 'point-to-point'
+set protocols ospf interface wg01 priority '1'
+set protocols ospf interface wg01 retransmit-interval '5'
+set protocols ospf interface wg01 transmit-delay '1'
+```
+
+
+### Test WireGuard
+
+Make sure you can ping 10.254.60.1 and .2 from both routers.
+
+### Create Export Filter
+
+We only want to export the networks we know. Always do a whitelist on your route
+filters, both importing and exporting. A good rule of thumb is
+**'If you are not the default router for a network, don't advertise
+it'**. This means we explicitly do not want to advertise the 192.0.2.0/24
+network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE
+the default route for). This filter is applied to `redistribute connected`.
+If we WERE to advertise it, the remote machines would see 192.0.2.21 available
+via their default route, establish the connection, and then OSPF would say
+'192.0.2.0/24 is available via this tunnel', at which point the tunnel would
+break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via
+default again. This is called 'flapping'.
+
+```none
+set policy access-list 150 description 'Outbound OSPF Redistribution'
+set policy access-list 150 rule 10 action 'permit'
+set policy access-list 150 rule 10 destination any
+set policy access-list 150 rule 10 source inverse-mask '0.0.0.255'
+set policy access-list 150 rule 10 source network '10.200.201.0'
+set policy access-list 150 rule 20 action 'permit'
+set policy access-list 150 rule 20 destination any
+set policy access-list 150 rule 20 source inverse-mask '0.0.0.255'
+set policy access-list 150 rule 20 source network '203.0.113.0'
+set policy access-list 150 rule 100 action 'deny'
+set policy access-list 150 rule 100 destination any
+set policy access-list 150 rule 100 source any
+```
+
+
+### Create Import Filter
+
+We only want to import networks we know. Our OSPF peer should only be
+advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE
+MATCH. You deny in access-list 100 to accept the route.
+
+```none
+set policy access-list 100 description 'Inbound OSPF Routes from Peers'
+set policy access-list 100 rule 10 action 'deny'
+set policy access-list 100 rule 10 destination any
+set policy access-list 100 rule 10 source inverse-mask '0.0.255.255'
+set policy access-list 100 rule 10 source network '10.201.0.0'
+set policy access-list 100 rule 100 action 'permit'
+set policy access-list 100 rule 100 destination any
+set policy access-list 100 rule 100 source any
+set policy route-map PUBOSPF rule 100 action 'deny'
+set policy route-map PUBOSPF rule 100 match ip address access-list '100'
+set policy route-map PUBOSPF rule 500 action 'permit'
+```
+
+
+### Enable OSPF
+
+Every router **must** have a unique router-id.
+The 'reference-bandwidth' is used because when OSPF was originally designed,
+the idea of a link faster than 1gbit was unheard of, and it does not scale
+correctly.
+
+```none
+set protocols ospf area 0.0.0.0 authentication 'md5'
+set protocols ospf area 0.0.0.0 network '10.254.60.0/24'
+set protocols ospf auto-cost reference-bandwidth '10000'
+set protocols ospf log-adjacency-changes
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.254.60.2'
+set system ip protocol ospf route-map PUBOSPF
+```
+
+
+### Test OSPF
+
+When you have enabled OSPF on both routers, you should be able to see each
+other with the command `show ip ospf neighbour`. The state must be 'Full'
+or '2-Way'. If it is not, then there is a network connectivity issue between the
+hosts. This is often caused by NAT or MTU issues. You should not see any new
+routes (unless this is the second pass) in the output of `show ip route`
+
+## Advertise connected routes
+
+As a reminder, only advertise routes that you are the default router for. This
+is why we are NOT announcing the 192.0.2.0/24 network, because if that was
+announced into OSPF, the other routers would try to connect to that network
+over a tunnel that connects to that network!
+
+```none
+set protocols ospf access-list 150 export 'connected'
+set protocols ospf redistribute connected
+```
+
+You should now be able to see the advertised network on the other host.
+
+### Duplicate configuration
+
+At this point, you now need to create the X link between all four routers.
+Use a different /30 for each link.
+
+### Priorities
+
+Set the cost on the secondary links to be 200. This means that they will not
+be used unless the primary links are down.
+
+```none
+set protocols ospf interface wg01 cost '10'
+set protocols ospf interface wg01 cost '200'
+```
+
+This will be visible in 'show ip route'.
+
+## BGP
+
+BGP is an extremely complex network protocol. An example is provided here.
+
+:::{note}
+Router id's must be unique.
+:::
+
+**router1**
+
+The `redistribute ospf` command is there purely as an example of how this can
+be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as
+it is not 203.0.113.0/24.
+
+```none
+set policy prefix-list BGPOUT description 'BGP Export List'
+set policy prefix-list BGPOUT rule 10 action 'deny'
+set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks'
+set policy prefix-list BGPOUT rule 10 ge '25'
+set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0'
+set policy prefix-list BGPOUT rule 100 action 'permit'
+set policy prefix-list BGPOUT rule 100 description 'Our network'
+set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24'
+set policy prefix-list BGPOUT rule 10000 action 'deny'
+set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0'
+
+set policy route-map BGPOUT description 'BGP Export Filter'
+set policy route-map BGPOUT rule 10 action 'permit'
+set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT'
+set policy route-map BGPOUT rule 10000 action 'deny'
+set policy route-map BGPPREPENDOUT description 'BGP Export Filter'
+set policy route-map BGPPREPENDOUT rule 10 action 'permit'
+set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551'
+set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT'
+set policy route-map BGPPREPENDOUT rule 10000 action 'deny'
+
+set protocols bgp system-as 65551
+set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
+set protocols bgp address-family ipv4-unicast redistribute connected metric '50'
+set protocols bgp address-family ipv4-unicast redistribute ospf metric '50'
+set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT'
+set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound
+set protocols bgp neighbor 192.0.2.11 remote-as '65550'
+set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21'
+set protocols bgp parameters router-id '192.0.2.21'
+```
+
+**router2**
+
+This is identical, but you use the BGPPREPENDOUT route-map to advertise the
+route with a longer path.
diff --git a/docs/configexamples/index.md b/docs/configexamples/index.md
new file mode 100644
index 00000000..e5a81305
--- /dev/null
+++ b/docs/configexamples/index.md
@@ -0,0 +1,60 @@
+(examples)=
+
+# Configuration Blueprints
+
+This chapter contains various configuration examples:
+
+```{toctree}
+:maxdepth: 2
+
+firewall
+bgp-ipv6-unnumbered
+ospf-unnumbered
+azure-vpn-bgp
+azure-vpn-dual-bgp
+ha
+wan-load-balancing
+pppoe-ipv6-basic
+l3vpn-hub-and-spoke
+lac-lns
+inter-vrf-routing-vrf-lite
+dmvpn-dualhub-dualcloud
+qos
+segment-routing-isis
+nmp
+ansible
+ipsec-cisco-policy-based
+ipsec-cisco-route-based
+ipsec-pa-route-based
+policy-based-ipsec-and-firewall
+site-2-site-cisco
+```
+
+
+## Configuration Blueprints (autotest)
+
+The next pages contain fully automated configuration examples.
+
+Each lab will build and test from an external script.
+The page content is generated, so changes will not take effect.
+
+A host `vyos-oobm` will be used as an SSH proxy. This host is just
+necessary for the lab tests.
+
+The process will do the following steps:
+1. create the lab on a eve-ng server
+2. configure each host in the lab
+3. do some defined tests
+4. optional do an upgrade to a higher version and do step 3 again.
+5. generate the documentation and include files
+6. shutdown and destroy the lab, if there is no error
+
+```{toctree}
+:maxdepth: 1
+
+autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE
+autotest/tunnelbroker/tunnelbroker
+autotest/L3VPN_EVPN/L3VPN_EVPN
+autotest/Wireguard/Wireguard
+autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP
+```
diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.md b/docs/configexamples/inter-vrf-routing-vrf-lite.md
new file mode 100644
index 00000000..2ac36904
--- /dev/null
+++ b/docs/configexamples/inter-vrf-routing-vrf-lite.md
@@ -0,0 +1,797 @@
+# Inter-VRF Routing over VRF Lite
+
+**Virtual Routing and Forwarding** is a technology that allow multiple instance
+of a routing table to exist within a single device. One of the key aspect of
+**VRFs** is that do not share the same routes or interfaces, therefore packets
+are forwarded between interfaces that belong to the same VRF only.
+
+Any information related to a VRF is not exchanged between devices -or in the
+same device- by default, this is a technique called **VRF-Lite**.
+
+Keep networks isolated is -in general- a good principle, but there are cases
+where you might need that some network can access other in a different VRF.
+
+The scope of this document is to cover such cases in a dynamic way without the
+use of MPLS-LDP.
+
+General information about L3VPNs can be found in the {ref}`configuration/vrf/index:L3VPN VRFs` chapter.
+
+## Overview
+
+Let’s say we have a requirement to have multiple networks.
+
+- LAN 1
+- LAN 2
+- Management
+- Internet
+
+Both LANs have to be able to route between each other, both will have managed
+devices through a dedicated management network and both will need Internet
+access yet the LAN2 will need access to some set of outside networks, not all.
+The management network will need access to both LANs but cannot have access
+to/from the outside.
+
+This scenario could be a nightmare applying regular routing and might need
+filtering in multiple interfaces.
+
+A simple solution could be using different routing tables, or VRFs
+for all the networks so we can keep the routing restrictions.
+But for us to route between the different VRFs we would need a cable or a
+logical connection between each other:
+
+- One cable/logical connection between LAN1 and LAN2
+- One cable/logical connection between LAN1 and Internet
+- One cable/logical connection between LAN2 and Internet
+- One cable/logical connection between LAN1 and Management
+- One cable/logical connection between LAN2 and Management
+
+As we can see this is unpractical.
+
+To address this scenario we will use to our advantage an extension of the BGP
+routing protocol that will help us in the “Export” between VRFs without the
+need for MPLS.
+
+MP-BGP or MultiProtocol BGP introduces two main concepts to solve this
+limitation:
+\- Route Distinguisher (RD): Is used to distinguish between different VRFs
+–called VPNs- inside the BGP Process. The RD is appended to each IPv4 Network
+that is advertised into BGP for that VPN making it a unique VPNv4 route.
+\- Route Target (RT): This is an extended BGP community append to the VPNv4 route
+in the Import/Export process. When a route passes from the VRF routing table
+into the BGP process it will add the configured export extended community(ies)
+for that VPN. When that route needs to go from BGP into the VRF routing table
+will only pass if that given VPN import policy matches any of the appended
+community(ies) into that prefix.
+
+## Topology
+
+```{image} /_static/images/inter-vrf-routing-vrf-lite.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 70%
+```
+
+
+### IP Schema
+
+```{eval-rst}
++----------+------------+----------------+------------------+
+| Device-A |  Device-B  |  IPv4 Network  |   IPv6 Network   |
++----------+------------+----------------+------------------+
+|   Core   |    LAN1    |  10.1.1.0/30   |  2001:db8::/127  |
++----------+------------+----------------+------------------+
+|   Core   |    LAN2    | 172.16.2.0/30  |  2001:db8::2/127 |
++----------+------------+----------------+------------------+
+|   Core   | Management | 192.168.3.0/30 |  2001:db8::4/127 |
++----------+------------+----------------+------------------+
+|   Core   |     ISP    |  10.2.2.0/30   |  2001:db8::6/127 |
++----------+------------+----------------+------------------+
+```
+
+### RD & RT Schema
+
+```{eval-rst}
++------------+-----------+-----------+
+|    VRF     |     RD    |     RT    |
++------------+-----------+-----------+
+|    LAN1    |  64496:1  |  64496:1  |
++------------+-----------+-----------+
+|    LAN2    |  64496:2  |  64496:2  |
++------------+-----------+-----------+
+| Management | 64496:50  | 64496:50  |
++------------+-----------+-----------+
+|  Internet  | 64496:100 | 64496:100 |
++------------+-----------+-----------+
+```
+
+## Configurations
+
+:::{note}
+We use a static route configuration in between the Core and each
+LAN and Management router, and BGP between the Core router and the ISP router
+but any dynamic routing protocol can be used.
+:::
+
+### Remote Networks
+
+The following template configuration can be used in each remote router based
+in our topology.
+
+```none
+# Interface Configuration
+set interface eth eth<N> address <IP ADDRESS/CIDR>
+
+# Static default route back to Core
+set protocols static route 0.0.0.0/0 next-hop <CORE IP ADDRESS>
+```
+
+
+### Core Router
+
+#### Step 1: VRF and Configurations to remote networks
+
+- Configuration
+
+Set the VRF name and Table ID, set interface address and bind it to the VRF.
+Last add the static route to the remote network.
+
+```none
+# VRF name and table ID (MANDATORY)
+set vrf name <VRF> table <ID>
+
+# Interface Configuration
+set interface eth eth<N> address <IP ADDRESS/CIDR>
+
+# Assign interface to VRF
+set interface eth eth<N> vrf <VRF>
+
+# Static route to remote Network
+set vrf name <VRF> protocols static route <NETWORK/CIDR> next-hop <REMOTE IP ADDRESS>
+```
+
+- Verification
+
+Checking the routing table of the VRF should reveal both static and connected
+entries active. A PING test between the Core and remote router is a way to
+validate connectivity within the VRF.
+
+```none
+# show ip route vrf <VRF>
+# show ipv6 route vrf <VRF>
+
+vyos@Core:~$ show ip route vrf LAN1
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+VRF LAN1:
+S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41
+C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44
+
+vyos@Core:~$ show ipv6 route vrf LAN1
+Codes: K - kernel route, C - connected, S - static, R - RIPng,
+       O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table,
+       v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+VRF LAN1:
+C>* 2001:db8::/127 is directly connected, eth0, 00:18:43
+S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03
+C>* fe80::/64 is directly connected, eth0, 00:18:43
+
+# ping <DESTINATION> vrf <VRF>
+
+vyos@Core:~$ ping 10.1.1.2 vrf LAN1
+PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.
+64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms
+64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms
+^C
+--- 10.1.1.2 ping statistics ---
+2 packets transmitted, 2 received, 0% packet loss, time 1002ms
+rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms
+vyos@Core:~$ ping 10.0.0.1 vrf LAN1
+PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
+64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms
+64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms
+^C
+--- 10.0.0.1 ping statistics ---
+2 packets transmitted, 2 received, 0% packet loss, time 1002ms
+rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms
+
+vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1
+PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes
+64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms
+64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms
+64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms
+^C
+--- 2001:db8:0:1::1 ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2004ms
+rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms
+```
+
+
+#### Step 2: BGP Configuration for VRF-Lite
+
+- Configuration
+
+Setting BGP global local-as as well inside the VRF. Redistribute static
+routes to inject configured networks into the BGP process but still inside
+the VRF.
+
+```none
+# set BGP global local-as
+set protocols bgp system-as <ASN>
+
+# set BGP VRF local-as and redistribution
+set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> redistribute static
+```
+
+- Verification
+
+Check the BGP VRF table and verify if the static routes are injected showing
+the correct next-hop information.
+
+```none
+# show ip bgp vrf <VRF>
+# show bgp vrf <VRF> ipv6
+
+vyos@Core:~$ show ip bgp vrf LAN1
+BGP table version is 3, local router ID is 10.1.1.1, vrf id 8
+Default local pref 100, local AS 64496
+Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
+               i internal, r RIB-failure, S Stale, R Removed
+Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
+Origin codes:  i - IGP, e - EGP, ? - incomplete
+RPKI validation codes: V valid, I invalid, N Not found
+
+   Network          Next Hop            Metric LocPrf Weight Path
+*> 10.0.0.0/24      10.1.1.2                 0         32768 ?
+
+vyos@Core# run show bgp vrf LAN1 ipv6
+BGP table version is 13, local router ID is 10.1.1.1, vrf id 8
+Default local pref 100, local AS 64496
+Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
+               i internal, r RIB-failure, S Stale, R Removed
+Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
+Origin codes:  i - IGP, e - EGP, ? - incomplete
+RPKI validation codes: V valid, I invalid, N Not found
+
+   Network          Next Hop            Metric LocPrf Weight Path
+*> 2001:db8:0:1::/64
+                    2001:db8::1              0         32768 ?
+```
+
+
+#### Step 3: VPN Configuration
+
+- Configuration
+
+Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT),
+then we enable the export/import VPN.
+
+```none
+# set Route-distinguisher
+set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> rd vpn export '<RD>'
+
+# set route-target for import/export
+# Note: RT are a list that can be more than one community between apostrophe
+#       and separated by blank space. Ex: '<RT:1> <RT:2> <RT:3>'
+set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> route-target vpn export '<RT:Export>'
+set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> route-target vpn import '<RT:Import>'
+
+# Enable VPN export/import under this VRF
+set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> export vpn
+set vrf name <VRF> protocols bgp address-family <AF IPv4/IPv6> import vpn
+```
+
+A key point to understand is that if we need two VRFs to communicate between
+each other EXPORT rt from VRF1 has to be in the IMPORT rt list from VRF2. But
+this is only in ONE direction, to complete the communication the EXPORT rt from
+VRF2 has to be in the IMPORT rt list from VRF1.
+
+There are some cases where this is not needed -for example, in some
+DDoS appliance- but most inter-vrf routing designs use the above configurations.
+
+- Verification
+
+After configured all the VRFs involved in this topology we take a deeper look
+at both BGP and Routing table for the VRF LAN1
+
+```none
+# show ip bgp vrf <VRF>
+# show bgp vrf <VRF> ipv6
+
+vyos@Core# run show ip bgp vrf LAN1
+BGP table version is 53, local router ID is 10.1.1.1, vrf id 8
+Default local pref 100, local AS 64496
+Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
+               i internal, r RIB-failure, S Stale, R Removed
+Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
+Origin codes:  i - IGP, e - EGP, ? - incomplete
+RPKI validation codes: V valid, I invalid, N Not found
+
+   Network          Next Hop            Metric LocPrf Weight Path
+*> 0.0.0.0/0        10.2.2.2@7<                            0 64497 i
+*> 10.0.0.0/24      10.1.1.2                 0         32768 ?
+*> 10.2.2.0/30      10.2.2.2@7<              0             0 64497 ?
+*> 192.0.2.0/24     10.2.2.2@7<              0             0 64497 ?
+*> 192.168.0.0/24   192.168.3.2@11<          0         32768 ?
+*> 198.51.100.0/24  10.2.2.2@7<              0             0 64497 ?
+*> 203.0.113.0/24   10.2.2.2@7<              0             0 64497 ?
+
+vyos@Core# run show bgp vrf LAN1 ipv6
+BGP table version is 13, local router ID is 10.1.1.1, vrf id 8
+Default local pref 100, local AS 64496
+Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
+               i internal, r RIB-failure, S Stale, R Removed
+Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
+Origin codes:  i - IGP, e - EGP, ? - incomplete
+RPKI validation codes: V valid, I invalid, N Not found
+
+Network          Next Hop            Metric LocPrf Weight Path
+*> ::/0             fe80::5200:ff:fe02:3@7<
+                                                           0 64497 i
+*> 2001:db8::6/127  fe80::5200:ff:fe02:3@7<
+                                             0             0 64497 ?
+*> 2001:db8:0:1::/64
+                    2001:db8::1              0         32768 ?
+*> 2001:db8:0:3::/64
+                    2001:db8::5@11<          0         32768 ?
+*> 2001:db8:1::/48  fe80::5200:ff:fe02:3@7<
+                                             0             0 64497 ?
+*> 2001:db8:2::/48  fe80::5200:ff:fe02:3@7<
+                                             0             0 64497 ?
+*> 2001:db8:3::/48  fe80::5200:ff:fe02:3@7<
+                                             0             0 64497 ?
+
+# show ip route vrf <VRF>
+# show ipv6 route vrf <VRF>
+
+vyos@Core:~$ show ip route vrf LAN1
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+VRF LAN1:
+B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38
+S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57
+C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59
+B   10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38
+B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38
+B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38
+B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38
+B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38
+
+vyos@Core# run show ipv6 route vrf LAN1
+Codes: K - kernel route, C - connected, S - static, R - RIPng,
+       O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table,
+       v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+VRF LAN1:
+B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50
+C>* 2001:db8::/127 is directly connected, eth0, 05:33:43
+B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50
+S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03
+B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50
+B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50
+B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50
+B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50
+C>* fe80::/64 is directly connected, eth0, 05:33:43
+```
+
+As we can see in the BGP table any imported route has been injected with a "@"
+followed by the VPN id; In the routing table of the VRF, if the route was
+installed, we can see -between round brackets- the exported VRF table.
+
+#### Step 4: End to End verification
+
+Now we perform some end-to-end testing
+- From Management to LAN1/LAN2
+
+```none
+vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1
+PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data.
+64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms
+64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms
+64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms
+^C
+--- 10.0.0.1 ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2005ms
+rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms
+vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1
+PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data.
+64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms
+64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms
+^C
+--- 172.16.0.1 ping statistics ---
+2 packets transmitted, 2 received, 0% packet loss, time 1001ms
+rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms
+vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1
+PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes
+64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms
+64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms
+64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms
+^C
+--- 2001:db8:0:1::1 ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2003ms
+rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms
+vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1
+PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes
+64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms
+64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms
+64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms
+64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms
+^C
+--- 2001:db8:0:2::1 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3005ms
+rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms
+```
+
+- From Management to Outside (fails as intended)
+
+```none
+vyos@Management:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58
+C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05
+C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03
+vyos@Management:~$ ping 192.0.2.1
+PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data.
+From 192.168.3.1 icmp_seq=1 Destination Net Unreachable
+From 192.168.3.1 icmp_seq=2 Destination Net Unreachable
+^C
+--- 192.0.2.1 ping statistics ---
+2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms
+
+vyos@Management:~$ ping 195.51.100.1
+PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data.
+From 192.168.3.1 icmp_seq=1 Destination Net Unreachable
+From 192.168.3.1 icmp_seq=2 Destination Net Unreachable
+From 192.168.3.1 icmp_seq=3 Destination Net Unreachable
+^C
+--- 195.51.100.1 ping statistics ---
+3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms
+
+vyos@Management:~$ ping 2001:db8:1::1
+PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes
+From 2001:db8::4 icmp_seq=1 Destination unreachable: No route
+From 2001:db8::4 icmp_seq=2 Destination unreachable: No route
+^C
+--- 2001:db8:1::1 ping statistics ---
+2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms
+
+vyos@Management:~$ ping 2001:db8:2::1
+PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes
+From 2001:db8::4 icmp_seq=1 Destination unreachable: No route
+From 2001:db8::4 icmp_seq=2 Destination unreachable: No route
+^C
+--- 2001:db8:2::1 ping statistics ---
+2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms
+```
+
+- LAN1 to Outside
+
+```none
+vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1
+PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data.
+64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms
+64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms
+64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms
+^C
+--- 192.0.2.1 ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2004ms
+rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms
+vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1
+PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data.
+64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms
+64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms
+^C
+--- 198.51.100.1 ping statistics ---
+2 packets transmitted, 2 received, 0% packet loss, time 1002ms
+rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms
+vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1
+PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data.
+64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms
+64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms
+^C
+--- 203.0.113.1 ping statistics ---
+2 packets transmitted, 2 received, 0% packet loss, time 1003ms
+rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms
+vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1
+PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes
+64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms
+64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms
+64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms
+^C
+--- 2001:db8:1::1 ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2004ms
+rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms
+vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1
+PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes
+64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms
+64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms
+64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms
+^C
+--- 2001:db8:2::1 ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2003ms
+rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms
+```
+
+:::{note}
+we are using "source-address" option cause we are not redistributing
+connected interfaces into BGP on the Core router hence there is no comeback
+route and ping will fail.
+:::
+
+- LAN1 to LAN2
+
+```none
+vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1
+PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data.
+64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms
+64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms
+^C
+--- 172.16.0.1 ping statistics ---
+2 packets transmitted, 2 received, 0% packet loss, time 1002ms
+rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms
+vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1
+PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes
+64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms
+64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms
+64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms
+^C
+--- 2001:db8:0:2::1 ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2003ms
+rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms
+```
+
+
+## Conclusions
+
+Inter-VRF routing is a well-known solution to address complex routing scenarios
+that enable -in a dynamic way- to leak routes between VRFs. Is recommended to
+take special consideration while designing route-targets and its application as
+it can minimize future interventions while creating a new VRF will automatically
+take the desired effect in its propagation.
+
+## Appendix-A
+
+### Full configuration from all devices
+
+- Core
+
+```none
+set interfaces ethernet eth0 address '10.1.1.1/30'
+set interfaces ethernet eth0 address '2001:db8::/127'
+set interfaces ethernet eth0 vrf 'LAN1'
+set interfaces ethernet eth1 address '172.16.2.1/30'
+set interfaces ethernet eth1 address '2001:db8::2/127'
+set interfaces ethernet eth1 vrf 'LAN2'
+set interfaces ethernet eth2 address '192.168.3.1/30'
+set interfaces ethernet eth2 address '2001:db8::4/127'
+set interfaces ethernet eth2 vrf 'Management'
+set interfaces ethernet eth3 address '10.2.2.1/30'
+set interfaces ethernet eth3 address '2001:db8::6/127'
+set interfaces ethernet eth3 vrf 'Internet'
+set protocols bgp address-family ipv4-unicast
+set protocols bgp system-as '64496'
+set vrf name Internet protocols bgp address-family ipv4-unicast export vpn
+set vrf name Internet protocols bgp address-family ipv4-unicast import vpn
+set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Internet protocols bgp address-family ipv6-unicast export vpn
+set vrf name Internet protocols bgp address-family ipv6-unicast import vpn
+set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast
+set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497'
+set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast
+set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497'
+set vrf name Internet table '104'
+set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn
+set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn
+set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static
+set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2'
+set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn
+set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn
+set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static
+set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2'
+set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2
+set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1
+set vrf name LAN1 table '101'
+set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn
+set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn
+set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static
+set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn
+set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn
+set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static
+set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1'
+set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2
+set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3
+set vrf name LAN2 table '102'
+set vrf name Management protocols bgp address-family ipv4-unicast export vpn
+set vrf name Management protocols bgp address-family ipv4-unicast import vpn
+set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv4-unicast redistribute static
+set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Management protocols bgp address-family ipv6-unicast export vpn
+set vrf name Management protocols bgp address-family ipv6-unicast import vpn
+set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv6-unicast redistribute static
+set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2
+set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5
+set vrf name Management table '103'
+```
+
+- LAN1
+
+```none
+set interfaces dummy dum0 address '10.0.0.1/24'
+set interfaces dummy dum0 address '2001:db8:0:1::1/64'
+set interfaces ethernet eth0 address '10.1.1.2/30'
+set interfaces ethernet eth0 address '2001:db8::1/127'
+set protocols static route 0.0.0.0/0 next-hop 10.1.1.1
+set protocols static route6 ::/0 next-hop 2001:db8::1
+```
+
+- LAN2
+
+```none
+set interfaces dummy dum0 address '172.16.0.1/24'
+set interfaces dummy dum0 address '2001:db8:0:2::1/64'
+set interfaces ethernet eth0 hw-id '50:00:00:03:00:00'
+set interfaces ethernet eth1 address '172.16.2.2/30'
+set interfaces ethernet eth1 address '2001:db8::3/127'
+set protocols static route 0.0.0.0/0 next-hop 172.16.2.1
+set protocols static route6 ::/0 next-hop 2001:db8::2
+```
+
+- Management
+
+```none
+set interfaces dummy dum0 address '192.168.0.1/24'
+set interfaces dummy dum0 address '2001:db8:0:3::1/64'
+set interfaces ethernet eth2 address '192.168.3.2/30'
+set interfaces ethernet eth2 address '2001:db8::5/127'
+set protocols static route 0.0.0.0/0 next-hop 192.168.3.1
+set protocols static route6 ::/0 next-hop 2001:db8::4
+```
+
+- ISP
+
+```none
+set interfaces dummy dum0 address '192.0.2.1/24'
+set interfaces dummy dum0 address '2001:db8:1::1/48'
+set interfaces dummy dum1 address '198.51.100.1/24'
+set interfaces dummy dum1 address '2001:db8:2::1/48'
+set interfaces dummy dum2 address '203.0.113.1/24'
+set interfaces dummy dum2 address '2001:db8:3::1/48'
+set interfaces ethernet eth3 address '10.2.2.2/30'
+set interfaces ethernet eth3 address '2001:db8::7/127'
+set protocols bgp address-family ipv4-unicast redistribute connected
+set protocols bgp address-family ipv6-unicast redistribute connected
+set protocols bgp system-as '64497'
+set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate
+set protocols bgp neighbor 10.2.2.1 remote-as '64496'
+set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate
+set protocols bgp neighbor 2001:db8::6 remote-as '64496'
+set protocols static route 0.0.0.0/0 next-hop 10.2.2.1
+set protocols static route6 ::/0 next-hop 2001:db8::6
+```
+
+
+## Appendix-B
+
+### Route-Filtering
+
+When importing routes using MP-BGP it is possible to filter a subset of them
+before are injected in the BGP table. One of the most common case is to use a
+route-map with an prefix-list.
+- Configuration
+
+We create a prefix-list first and add all the routes we need to.
+
+```none
+# set both ipv4 and ipv6 policies
+
+set policy prefix-list LAN2-Internet rule 1 action 'permit'
+set policy prefix-list LAN2-Internet rule 1 le '24'
+set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16'
+set policy prefix-list LAN2-Internet rule 2 action 'permit'
+set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24'
+set policy prefix-list LAN2-Internet rule 3 action 'permit'
+set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24'
+set policy prefix-list LAN2-Internet rule 4 action 'permit'
+set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24'
+
+set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit'
+set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48'
+set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit'
+set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48'
+set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit'
+set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64'
+set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit'
+set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64'
+```
+
+Then add a route-map and reference to above prefix. Consider that the actions
+taken inside the prefix will MATCH the routes that will be affected by the
+actions inside the rules of the route-map.
+
+```none
+set policy route-map LAN2-Internet rule 1 action 'permit'
+set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet'
+
+set policy route-map LAN2-Internet-v6 rule 1 action 'permit'
+set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-Internet-v6'
+```
+
+We are using a "white list" approach by allowing only what is necessary. In case
+that need to implement a "black list" approach then you will need to change the
+action in the route-map for a deny BUT you need to add a rule that permits the
+rest due to the implicit deny in the route-map.
+
+Then we need to attach the policy to the BGP process. This needs to be under
+the import statement in the vrf we need to filter.
+
+```none
+set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6'
+```
+
+- Verification
+
+```none
+# show ip route vrf LAN2
+
+B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28
+S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32
+C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39
+B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24
+B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Management), weight 1, 00:45:27
+B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24
+
+# show ipv6 route vrf LAN2
+
+C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26
+B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17
+S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21
+B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:46:16
+B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13
+B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13
+C>* fe80::/64 is directly connected, eth1, 00:46:27
+```
+
+As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able
+to select which routes are effectively imported and installed.
diff --git a/docs/configexamples/ipsec-cisco-policy-based.md b/docs/configexamples/ipsec-cisco-policy-based.md
new file mode 100644
index 00000000..7a31601d
--- /dev/null
+++ b/docs/configexamples/ipsec-cisco-policy-based.md
@@ -0,0 +1,363 @@
+---
+lastproofread: '2025-06-26'
+---
+
+(examples-ipsec-cisco-policy-based)=
+
+# Policy-based Site-to-Site VPN IPsec between VyOS and Cisco
+
+This document is to describe a basic setup using policy-based
+site-to-site VPN IPsec. In this example we use VyOS 1.5 and
+Cisco IOS. Cisco initiates IPsec connection only if interesting
+traffic present. For stable work we recommend configuring an
+initiator role on VyOS side.
+
+## Network Topology
+
+```{image} /_static/images/cisco-vpn-ipsec.webp
+:align: center
+:alt: Network Topology Diagram
+```
+
+
+## Prerequirements
+
+**VyOS:**
+
+```{eval-rst}
++---------+----------------+
+| WAN IP  |  10.0.1.2/30   |
++---------+----------------+
+| LAN1 IP | 192.168.0.1/24 |
++---------+----------------+
+| LAN2 IP | 192.168.1.1/24 |
++---------+----------------+
+```
+
+**Cisco:**
+
+```{eval-rst}
++---------+-----------------+
+| WAN IP  | 10.0.2.2/30     |
++---------+-----------------+
+| LAN1 IP | 192.168.10.1/24 |
++---------+-----------------+
+| LAN2 IP | 192.168.11.1/24 |
++---------+-----------------+
+```
+
+**IKE parameters:**
+
+```{eval-rst}
++-------------------+---------+
+| Encryption        | AES-256 |
++-------------------+---------+
+| HASH              | SHA-1   |
++-------------------+---------+
+| Diff-Helman Group | 14      |
++-------------------+---------+
+| Life-Time         | 28800   |
++-------------------+---------+
+| IKE Version       | 2       |
++-------------------+---------+
+```
+
+**IPsec parameters:**
+
+```{eval-rst}
++------------+---------+
+| Encryption | AES-256 |
++------------+---------+
+| HASH       | SHA-256 |
++------------+---------+
+| Life-Time  | 3600    |
++------------+---------+
+| PFS        | disable |
++------------+---------+
+```
+
+```{eval-rst}
+**Traffic Selectors**
+ 192.168.0.0/24 <==> 192.168.10.0/24
+
+ 192.168.1.0/24 <==> 192.168.11.0/24
+```
+
+**Hosts configuration**
+
+```{eval-rst}
++--------+--------------+
+| PC1 IP | 192.168.0.2  |
++--------+--------------+
+| PC2 IP | 192.168.1.2  |
++--------+--------------+
+| PC3 IP | 192.168.10.2 |
++--------+--------------+
+| PC4 IP | 192.168.11.2 |
++--------+--------------+
+```
+
+## Configuration
+
+:::{note}
+Pfs is disabled in Cisco by default.
+:::
+
+### VyOS
+
+```none
+set interfaces ethernet eth0 address '10.0.1.2/30'
+set interfaces ethernet eth1 address '192.168.0.1/24'
+set interfaces ethernet eth2 address '192.168.1.1/24'
+set protocols static route 0.0.0.0/0 next-hop 10.0.1.1
+set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2'
+set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2'
+set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA=='
+set vpn ipsec authentication psk AUTH-PSK secret-type 'base64'
+set vpn ipsec esp-group ESP-GROUP lifetime '3600'
+set vpn ipsec esp-group ESP-GROUP pfs 'disable'
+set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256'
+set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256'
+set vpn ipsec ike-group IKE-GROUP close-action 'start'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10'
+set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
+set vpn ipsec ike-group IKE-GROUP lifetime '28800'
+set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14'
+set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes256'
+set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1'
+set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2'
+set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2'
+set vpn ipsec site-to-site peer CISCO connection-type 'initiate'
+set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2'
+set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2'
+set vpn ipsec site-to-site peer CISCO tunnel 1 local prefix '192.168.0.0/24'
+set vpn ipsec site-to-site peer CISCO tunnel 1 remote prefix '192.168.10.0/24'
+set vpn ipsec site-to-site peer CISCO tunnel 2 local prefix '192.168.1.0/24'
+set vpn ipsec site-to-site peer CISCO tunnel 2 remote prefix '192.168.11.0/24'
+```
+
+
+### Cisco
+
+```none
+crypto ikev2 proposal aes-cbc-256-proposal
+ encryption aes-cbc-256
+ integrity sha1
+ group 14
+!
+crypto ikev2 policy policy1
+ match address local 10.0.2.2
+ proposal aes-cbc-256-proposal
+!
+crypto ikev2 keyring keys
+ peer VyOS
+  address 10.0.1.2
+  pre-shared-key local test
+  pre-shared-key remote test
+!
+crypto ikev2 profile IKEv2-profile
+ match identity remote address 10.0.1.2 255.255.255.255
+ authentication remote pre-share
+ authentication local pre-share
+ keyring local keys
+ lifetime 28800
+!
+crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac
+ mode tunnel
+!
+crypto map IPSEC-map 10 ipsec-isakmp
+ set peer 10.0.1.2
+ set security-association lifetime seconds 3600
+ set transform-set TS
+ set ikev2-profile IKEv2-profile
+ match address cryptoacl
+!
+interface GigabitEthernet0/0
+ ip address 10.0.2.2 255.255.255.252
+ crypto map IPSEC-map
+!
+interface GigabitEthernet0/1
+ ip address 192.168.10.1 255.255.255.0
+!
+interface GigabitEthernet0/2
+ ip address 192.168.11.1 255.255.255.0
+!
+ip route 0.0.0.0 0.0.0.0 10.0.2.1
+!
+ip access-list extended cryptoacl
+ permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255
+ permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255
+```
+
+
+## Monitoring
+
+### Monitoring on VyOS side
+
+IKE SAs:
+
+```none
+vyos@vyos:~$ show vpn ike sa
+Peer ID / IP                            Local ID / IP
+------------                            -------------
+10.0.2.2 10.0.2.2                       10.0.1.2 10.0.1.2
+
+    State  IKEVer  Encrypt      Hash          D-H Group      NAT-T  A-Time  L-Time
+    -----  ------  -------      ----          ---------      -----  ------  ------
+    up     IKEv2   AES_CBC_256  HMAC_SHA1_96  MODP_2048      no     304     26528
+```
+
+IPsec SAs:
+
+```none
+vyos@vyos:~$ show vpn ipsec sa
+Connection      State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
+--------------  -------  --------  --------------  ----------------  ----------------  -----------  -----------------------------
+CISCO-tunnel-1  up       6m6s      0B/0B           0/0               10.0.2.2          10.0.2.2     AES_CBC_256/HMAC_SHA2_256_128
+CISCO-tunnel-2  up       6m6s      0B/0B           0/0               10.0.2.2          10.0.2.2     AES_CBC_256/HMAC_SHA2_256_128
+```
+
+
+### Monitoring on Cisco side
+
+IKE SAs:
+
+```none
+Cisco#show crypto ikev2 sa
+ IPv4 Crypto IKEv2  SA
+
+Tunnel-id Local                 Remote                fvrf/ivrf            Status
+1         10.0.2.2/4500         10.0.1.2/4500         none/none            READY
+      Encr: AES-CBC, keysize: 256, PRF: SHA1, Hash: SHA96, DH Grp:14, Auth sign: PSK, Auth verify: PSK
+      Life/Active Time: 28800/471 sec
+
+ IPv6 Crypto IKEv2  SA
+```
+
+IPsec SAs:
+
+```none
+ Cisco#show crypto ipsec sa
+
+interface: GigabitEthernet0/0
+    Crypto map tag: IPSEC-map, local addr 10.0.2.2
+
+   protected vrf: (none)
+   local  ident (addr/mask/prot/port): (192.168.11.0/255.255.255.0/0/0)
+   remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
+   current_peer 10.0.1.2 port 4500
+     PERMIT, flags={origin_is_acl,}
+    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
+    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
+    #pkts compressed: 0, #pkts decompressed: 0
+    #pkts not compressed: 0, #pkts compr. failed: 0
+    #pkts not decompressed: 0, #pkts decompress failed: 0
+    #send errors 0, #recv errors 0
+
+     local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2
+     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
+     current outbound spi: 0xC81F83DA(3357508570)
+     PFS (Y/N): N, DH group: none
+
+     inbound esp sas:
+      spi: 0x8C63C51E(2355348766)
+        transform: esp-256-aes esp-sha256-hmac ,
+        in use settings ={Tunnel, }
+        conn id: 23, flow_id: SW:23, sibling_flags 80000040, crypto map: IPSEC-map
+        sa timing: remaining key lifetime (k/sec): (4231729/3585)
+        IV size: 16 bytes
+        replay detection support: Y
+        Status: ACTIVE(ACTIVE)
+
+     inbound ah sas:
+
+     inbound pcp sas:
+
+     outbound esp sas:
+      spi: 0xC81F83DA(3357508570)
+        transform: esp-256-aes esp-sha256-hmac ,
+        in use settings ={Tunnel, }
+        conn id: 24, flow_id: SW:24, sibling_flags 80000040, crypto map: IPSEC-map
+        sa timing: remaining key lifetime (k/sec): (4231729/3585)
+        IV size: 16 bytes
+        replay detection support: Y
+        Status: ACTIVE(ACTIVE)
+
+     outbound ah sas:
+
+     outbound pcp sas:
+
+   protected vrf: (none)
+   local  ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
+   remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
+   current_peer 10.0.1.2 port 4500
+     PERMIT, flags={origin_is_acl,}
+    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
+    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
+    #pkts compressed: 0, #pkts decompressed: 0
+    #pkts not compressed: 0, #pkts compr. failed: 0
+    #pkts not decompressed: 0, #pkts decompress failed: 0
+    #send errors 0, #recv errors 0
+
+     local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2
+     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
+     current outbound spi: 0xC40C7A20(3289152032)
+     PFS (Y/N): N, DH group: none
+
+     inbound esp sas:
+      spi: 0x2948B6CB(692631243)
+        transform: esp-256-aes esp-sha256-hmac ,
+        in use settings ={Tunnel, }
+        conn id: 21, flow_id: SW:21, sibling_flags 80000040, crypto map: IPSEC-map
+        sa timing: remaining key lifetime (k/sec): (4194891/3581)
+        IV size: 16 bytes
+        replay detection support: Y
+        Status: ACTIVE(ACTIVE)
+
+     inbound ah sas:
+
+     inbound pcp sas:
+
+     outbound esp sas:
+      spi: 0xC40C7A20(3289152032)
+        transform: esp-256-aes esp-sha256-hmac ,
+        in use settings ={Tunnel, }
+        conn id: 22, flow_id: SW:22, sibling_flags 80000040, crypto map: IPSEC-map
+        sa timing: remaining key lifetime (k/sec): (4194891/3581)
+        IV size: 16 bytes
+        replay detection support: Y
+        Status: ACTIVE(ACTIVE)
+
+     outbound ah sas:
+
+     outbound pcp sas:
+```
+
+
+### Checking Connectivity
+
+ICMP packets from PC1 to PC3.
+
+```none
+PC1> ping 192.168.10.2
+
+84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms
+84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms
+84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms
+84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms
+84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms
+```
+
+ICMP packets from PC2 to PC4.
+
+```none
+PC2> ping 192.168.11.2
+
+84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms
+84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms
+84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms
+```
diff --git a/docs/configexamples/ipsec-cisco-route-based.md b/docs/configexamples/ipsec-cisco-route-based.md
new file mode 100644
index 00000000..40a3985b
--- /dev/null
+++ b/docs/configexamples/ipsec-cisco-route-based.md
@@ -0,0 +1,406 @@
+---
+lastproofread: '2025-06-26'
+---
+
+(examples-ipsec-cisco-route-based)=
+
+# Route-based Site-to-Site VPN IPsec between VyOS and Cisco
+
+This document is to describe a basic setup using route-based
+site-to-site VPN IPsec. In this example we use VyOS 1.5 and
+Cisco IOS. Cisco initiates IPsec connection only if interesting
+traffic present. For stable work we recommend configuring an
+initiator role on VyOS side. OSPF is selected as routing protocol
+inside the tunnel.
+
+## Network Topology
+
+```{eval-rst}
+.. image:: /_static/images/cisco-vpn-ipsec.webp
+   :align: center
+   :alt: Network Topology Diagram
+```
+
+
+## Prerequirements
+
+**VyOS:**
+
+```{eval-rst}
++---------+----------------+
+| WAN IP  |  10.0.1.2/30   |
++---------+----------------+
+| LAN1 IP | 192.168.0.1/24 |
++---------+----------------+
+| LAN2 IP | 192.168.1.1/24 |
++---------+----------------+
+```
+
+**Cisco:**
+
+```{eval-rst}
++---------+-----------------+
+| WAN IP  | 10.0.2.2/30     |
++---------+-----------------+
+| LAN1 IP | 192.168.10.1/24 |
++---------+-----------------+
+| LAN2 IP | 192.168.11.1/24 |
++---------+-----------------+
+```
+
+**IKE parameters:**
+
+```{eval-rst}
++-------------------+---------+
+| Encryption        | AES-128 |
++-------------------+---------+
+| HASH              | SHA-1   |
++-------------------+---------+
+| Diff-Helman Group | 14      |
++-------------------+---------+
+| Life-Time         | 28800   |
++-------------------+---------+
+| IKE Version       | 1       |
++-------------------+---------+
+```
+
+**IPsec parameters:**
+
+```{eval-rst}
++------------+---------+
+| Encryption | AES-256 |
++------------+---------+
+| HASH       | SHA-256 |
++------------+---------+
+| Life-Time  | 3600    |
++------------+---------+
+| PFS        | disable |
++------------+---------+
+```
+
+**Hosts configuration**
+
+```{eval-rst}
++--------+--------------+
+| PC1 IP | 192.168.0.2  |
++--------+--------------+
+| PC2 IP | 192.168.1.2  |
++--------+--------------+
+| PC3 IP | 192.168.10.2 |
++--------+--------------+
+| PC4 IP | 192.168.11.2 |
++--------+--------------+
+```
+
+## Configuration
+
+:::{note}
+Pfs is disabled in Cisco by default.
+:::
+
+### VyOS
+
+```none
+set interfaces ethernet eth0 address '10.0.1.2/30'
+set interfaces ethernet eth1 address '192.168.0.1/24'
+set interfaces ethernet eth2 address '192.168.1.1/24'
+set interfaces vti vti1 address '10.100.100.1/30'
+set interfaces vti vti1 mtu '1438'
+set protocols ospf area 0 network '10.100.100.0/30'
+set protocols ospf area 0 network '192.168.0.0/24'
+set protocols ospf area 0 network '192.168.1.0/24'
+set protocols ospf interface eth1 passive
+set protocols ospf interface eth2 passive
+set protocols ospf interface vti1 network 'point-to-point'
+set protocols ospf parameters router-id '2.2.2.2'
+set protocols static route 0.0.0.0/0 next-hop 10.0.1.1
+set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2'
+set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2'
+set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA=='
+set vpn ipsec authentication psk AUTH-PSK secret-type 'base64'
+set vpn ipsec esp-group ESP-GROUP lifetime '3600'
+set vpn ipsec esp-group ESP-GROUP pfs 'disable'
+set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256'
+set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256'
+set vpn ipsec ike-group IKE-GROUP close-action 'start'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30'
+set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1'
+set vpn ipsec ike-group IKE-GROUP lifetime '28800'
+set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14'
+set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128'
+set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1'
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2'
+set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2'
+set vpn ipsec site-to-site peer CISCO connection-type 'initiate'
+set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2'
+set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2'
+set vpn ipsec site-to-site peer CISCO vti bind 'vti1'
+```
+
+
+### Cisco
+
+```none
+crypto isakmp policy 10
+ encr aes
+ authentication pre-share
+ group 14
+ lifetime 28800
+crypto isakmp key test address 10.0.1.2
+!
+!
+crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac
+ mode transport
+!
+crypto ipsec profile IPsec-profile
+ set transform-set TS
+!
+!
+!
+!
+!
+!
+!
+interface Loopback0
+ ip address 1.1.1.1 255.255.255.255
+!
+interface Tunnel10
+ ip address 10.100.100.2 255.255.255.252
+ ip ospf network point-to-point
+ tunnel source GigabitEthernet0/0
+ tunnel mode ipsec ipv4
+ tunnel destination 10.0.1.2
+ tunnel protection ipsec profile IPsec-profile
+!
+interface GigabitEthernet0/0
+ ip address 10.0.2.2 255.255.255.252
+ duplex auto
+ speed auto
+ media-type rj45
+!
+interface GigabitEthernet0/1
+ ip address 192.168.10.1 255.255.255.0
+ duplex auto
+ speed auto
+ media-type rj45
+!
+interface GigabitEthernet0/2
+ ip address 192.168.11.1 255.255.255.0
+ duplex auto
+ speed auto
+ media-type rj45
+!
+router ospf 1
+ router-id 1.1.1.1
+ passive-interface GigabitEthernet0/1
+ passive-interface GigabitEthernet0/2
+ network 10.100.100.0 0.0.0.3 area 0
+ network 192.168.10.0 0.0.0.255 area 0
+ network 192.168.11.0 0.0.0.255 area 0
+!
+ip route 0.0.0.0 0.0.0.0 10.0.2.1
+```
+
+
+## Monitoring
+
+### Monitoring on VyOS side
+
+IKE SAs:
+
+```none
+vyos@vyos:~$ show vpn ike sa
+Peer ID / IP                            Local ID / IP
+------------                            -------------
+10.0.2.2 10.0.2.2                       10.0.1.2 10.0.1.2
+
+    State  IKEVer  Encrypt      Hash          D-H Group      NAT-T  A-Time  L-Time
+    -----  ------  -------      ----          ---------      -----  ------  ------
+    up     IKEv1   AES_CBC_128  HMAC_SHA1_96  MODP_2048      no     8175    18439
+```
+
+IPsec SAs:
+
+```none
+vyos@vyos:~$ show vpn ipsec sa
+Connection    State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
+------------  -------  --------  --------------  ----------------  ----------------  -----------  -----------------------------
+CISCO-vti     up       34m59s    17K/14K         224/213           10.0.2.2          10.0.2.2     AES_CBC_256/HMAC_SHA2_256_128
+```
+
+OSPF Neighbor Status:
+
+```none
+vyos@vyos:~$ show ip ospf neighbor
+
+Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXmtL RqstL DBsmL
+1.1.1.1           1 Full/-          1h29m37s          39.317s 10.100.100.2    vti1:10.100.100.1                    0     0     0
+```
+
+Routing Table:
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, L - local, S - static,
+       R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric, t - Table-Direct,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54
+C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59
+L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59
+O   10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50
+C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50
+L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50
+O   192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54
+C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59
+L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59
+O   192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54
+C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59
+L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59
+O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34
+O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34
+```
+
+
+### Monitoring on Cisco side
+
+IKE SAs:
+
+```none
+Cisco#show crypto isakmp sa
+IPv4 Crypto ISAKMP SA
+dst             src             state          conn-id status
+10.0.1.2        10.0.2.2        QM_IDLE           1002 ACTIVE
+
+IPv6 Crypto ISAKMP SA
+```
+
+IPsec SAs:
+
+```none
+Cisco#show crypto ipsec sa
+
+interface: Tunnel10
+    Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2
+
+   protected vrf: (none)
+   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
+   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
+   current_peer 10.0.1.2 port 500
+     PERMIT, flags={origin_is_acl,}
+    #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295
+    #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238
+    #pkts compressed: 0, #pkts decompressed: 0
+    #pkts not compressed: 0, #pkts compr. failed: 0
+    #pkts not decompressed: 0, #pkts decompress failed: 0
+    #send errors 0, #recv errors 0
+
+     local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2
+     plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
+     current outbound spi: 0xC3E9B307(3286872839)
+     PFS (Y/N): N, DH group: none
+
+     inbound esp sas:
+      spi: 0x2740C328(658555688)
+        transform: esp-256-aes esp-sha256-hmac ,
+        in use settings ={Tunnel, }
+        conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0
+        sa timing: remaining key lifetime (k/sec): (4173824/1401)
+        IV size: 16 bytes
+        replay detection support: Y
+        Status: ACTIVE(ACTIVE)
+
+     inbound ah sas:
+
+     inbound pcp sas:
+
+     outbound esp sas:
+      spi: 0xC3E9B307(3286872839)
+        transform: esp-256-aes esp-sha256-hmac ,
+        in use settings ={Tunnel, }
+        conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0
+        sa timing: remaining key lifetime (k/sec): (4173819/1401)
+        IV size: 16 bytes
+        replay detection support: Y
+        Status: ACTIVE(ACTIVE)
+
+     outbound ah sas:
+
+     outbound pcp sas:
+```
+
+OSPF Neighbor Status:
+
+```none
+Cisco# show ip ospf neighbor
+
+Neighbor ID     Pri   State           Dead Time   Address         Interface
+2.2.2.2           0   FULL/  -        00:00:35    10.100.100.1    Tunnel10
+```
+
+Routing Table:
+
+```none
+Cisco#show ip route
+Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
+       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
+       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
+       E1 - OSPF external type 1, E2 - OSPF external type 2
+       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
+       ia - IS-IS inter area, * - candidate default, U - per-user static route
+       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+       a - application route
+       + - replicated route, % - next hop override, p - overrides from PfR
+
+Gateway of last resort is 10.0.2.1 to network 0.0.0.0
+
+S*    0.0.0.0/0 [1/0] via 10.0.2.1
+      1.0.0.0/32 is subnetted, 1 subnets
+C        1.1.1.1 is directly connected, Loopback0
+      10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
+C        10.0.2.0/30 is directly connected, GigabitEthernet0/0
+L        10.0.2.2/32 is directly connected, GigabitEthernet0/0
+C        10.100.100.0/30 is directly connected, Tunnel10
+L        10.100.100.2/32 is directly connected, Tunnel10
+O     192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10
+O     192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10
+      192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
+C        192.168.10.0/24 is directly connected, GigabitEthernet0/1
+L        192.168.10.1/32 is directly connected, GigabitEthernet0/1
+      192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks
+C        192.168.11.0/24 is directly connected, GigabitEthernet0/2
+L        192.168.11.1/32 is directly connected, GigabitEthernet0/2
+```
+
+
+### Checking Connectivity
+
+ICMP packets from PC1 to PC3.
+
+```none
+PC1> ping 192.168.10.2
+
+84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms
+84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms
+84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms
+84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms
+84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms
+```
+
+ICMP packets from PC2 to PC4.
+
+```none
+PC2> ping 192.168.11.2
+
+84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms
+84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms
+84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms
+```
diff --git a/docs/configexamples/ipsec-pa-route-based.md b/docs/configexamples/ipsec-pa-route-based.md
new file mode 100644
index 00000000..c4a9e06c
--- /dev/null
+++ b/docs/configexamples/ipsec-pa-route-based.md
@@ -0,0 +1,412 @@
+---
+lastproofread: '2025-06-26'
+---
+
+(examples-ipsec-pa-route-based)=
+
+# Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto
+
+This document is to describe a basic setup using route-based
+site-to-site VPN IPsec. In this example we use VyOS 1.5 and
+PA 11.0.0. OSPF is selected as routing protocol inside the
+tunnel.
+
+Since this example focuses on IPsec configuration it does not
+include firewall configuration.
+
+## Network Topology
+
+```{image} /_static/images/ipsec-vyos-pa.webp
+:align: center
+:alt: Network Topology Diagram
+```
+
+
+## Prerequirements
+
+**VyOS:**
+
+```{eval-rst}
++---------+----------------+
+| WAN IP  |  10.0.1.2/30   |
++---------+----------------+
+| LAN1 IP | 192.168.0.1/24 |
++---------+----------------+
+| LAN2 IP | 192.168.1.1/24 |
++---------+----------------+
+```
+
+**Palo Alto:**
+
+```{eval-rst}
++---------+-----------------+
+| WAN IP  | 10.0.2.2/30     |
++---------+-----------------+
+| LAN1 IP | 192.168.10.1/24 |
++---------+-----------------+
+| LAN2 IP | 192.168.11.1/24 |
++---------+-----------------+
+```
+
+**IKE parameters:**
+
+```{eval-rst}
++-------------------+---------+
+| Encryption        | AES-128 |
++-------------------+---------+
+| HASH              | SHA-1   |
++-------------------+---------+
+| Diff-Helman Group | 14      |
++-------------------+---------+
+| Life-Time         | 28800   |
++-------------------+---------+
+| IKE Version       | 1       |
++-------------------+---------+
+```
+
+**IPsec parameters:**
+
+```{eval-rst}
++------------+---------+
+| Encryption | AES-256 |
++------------+---------+
+| HASH       | SHA-256 |
++------------+---------+
+| Life-Time  | 3600    |
++------------+---------+
+| PFS        | disable |
++------------+---------+
+```
+
+**Hosts configuration**
+
+```{eval-rst}
++--------+--------------+
+| PC1 IP | 192.168.0.2  |
++--------+--------------+
+| PC2 IP | 192.168.1.2  |
++--------+--------------+
+| PC3 IP | 192.168.10.2 |
++--------+--------------+
+| PC4 IP | 192.168.11.2 |
++--------+--------------+
+```
+
+## Configuration
+
+### VyOS
+
+```none
+set interfaces ethernet eth0 address '10.0.1.2/30'
+set interfaces ethernet eth1 address '192.168.0.1/24'
+set interfaces ethernet eth2 address '192.168.1.1/24'
+set interfaces vti vti1 address '10.100.100.1/30'
+set interfaces vti vti1 mtu '1438'
+set protocols ospf area 0 network '10.100.100.0/30'
+set protocols ospf area 0 network '192.168.0.0/24'
+set protocols ospf area 0 network '192.168.1.0/24'
+set protocols ospf interface eth1 passive
+set protocols ospf interface eth2 passive
+set protocols ospf interface vti1 network 'point-to-point'
+set protocols ospf parameters router-id '2.2.2.2'
+set protocols static route 0.0.0.0/0 next-hop 10.0.1.1
+set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2'
+set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2'
+set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA=='
+set vpn ipsec authentication psk AUTH-PSK secret-type 'base64'
+set vpn ipsec esp-group ESP-GROUP lifetime '3600'
+set vpn ipsec esp-group ESP-GROUP pfs 'disable'
+set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256'
+set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256'
+set vpn ipsec ike-group IKE-GROUP close-action 'start'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10'
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30'
+set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1'
+set vpn ipsec ike-group IKE-GROUP lifetime '28800'
+set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14'
+set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128'
+set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1'
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec site-to-site peer PA authentication local-id '10.0.1.2'
+set vpn ipsec site-to-site peer PA authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer PA authentication remote-id '10.0.2.2'
+set vpn ipsec site-to-site peer PA connection-type 'initiate'
+set vpn ipsec site-to-site peer PA default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer PA ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer PA local-address '10.0.1.2'
+set vpn ipsec site-to-site peer PA remote-address '10.0.2.2'
+set vpn ipsec site-to-site peer PA vti bind 'vti1'
+```
+
+
+### Palo Alto
+
+```{eval-rst}
+GUI Configuration:
+ Network -> Network Profiles -> IKE Crypto
+
+ .. image:: /_static/images/PA-IKE-group.webp
+   :align: center
+
+ Network -> Network Profiles -> IKE Gateways
+
+ .. image:: /_static/images/PA-IKE-GW-1.webp
+   :align: center
+
+ .. image:: /_static/images/PA-IKE-GW-2.webp
+   :align: center
+
+ Network -> Network Profiles -> IPSec Crypto
+
+ .. image:: /_static/images/PA-ESP-group.webp
+   :align: center
+
+ Network -> Interfaces
+
+ .. image:: /_static/images/PA-tunnel-1.webp
+   :align: center
+
+ .. image:: /_static/images/PA-tunnel-2.webp
+   :align: center
+
+ .. image:: /_static/images/PA-tunnel-3.webp
+   :align: center
+
+ Network -> IPSec Tunnels
+
+ .. image:: /_static/images/PA-IPsec-tunnel.webp
+   :align: center
+```
+CLI configuration with OSPF:
+```none
+set network interface ethernet ethernet1/1 layer3 ip 10.0.2.2/30
+set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow
+set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24
+set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow
+set network interface ethernet ethernet1/3 layer3 ip 192.168.11.1/24
+set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow
+set network interface tunnel units tunnel.1 ip 10.100.100.2/30
+set network interface tunnel units tunnel.1 interface-management-profile Allow
+set network interface tunnel units tunnel.1 mtu 1438
+set network profiles interface-management-profile Allow ping yes
+set network ike crypto-profiles ike-crypto-profiles IKE-GROUP hash sha1
+set network ike crypto-profiles ike-crypto-profiles IKE-GROUP dh-group group14
+set network ike crypto-profiles ike-crypto-profiles IKE-GROUP encryption aes-128-cbc
+set network ike crypto-profiles ike-crypto-profiles IKE-GROUP lifetime seconds 28800
+set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp authentication sha256
+set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp encryption aes-256-cbc
+set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP lifetime seconds 3600
+set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP dh-group no-pfs
+set network ike gateway VyOS authentication pre-shared-key key test
+set network ike gateway VyOS protocol ikev1 dpd enable yes
+set network ike gateway VyOS protocol ikev1 exchange-mode main
+set network ike gateway VyOS protocol ikev1 ike-crypto-profile IKE-GROUP
+set network ike gateway VyOS protocol ikev2 dpd enable yes
+set network ike gateway VyOS protocol version ikev1
+set network ike gateway VyOS protocol-common nat-traversal enable yes
+set network ike gateway VyOS protocol-common fragmentation enable no
+set network ike gateway VyOS protocol-common passive-mode yes
+set network ike gateway VyOS local-address interface ethernet1/1
+set network ike gateway VyOS peer-address ip 10.0.1.2
+set network ike gateway VyOS local-id id 10.0.2.2
+set network ike gateway VyOS local-id type ipaddr
+set network ike gateway VyOS peer-id id 10.0.1.2
+set network ike gateway VyOS peer-id type ipaddr
+set network tunnel ipsec VyOS-tunnel auto-key ike-gateway VyOS
+set network tunnel ipsec VyOS-tunnel auto-key ipsec-crypto-profile ESP-GROUP
+set network tunnel ipsec VyOS-tunnel tunnel-monitor enable no
+set network tunnel ipsec VyOS-tunnel tunnel-interface tunnel.1
+set network tunnel ipsec VyOS-tunnel anti-replay no
+set network virtual-router default protocol ospf enable yes
+set network virtual-router default protocol ospf area 0.0.0.0 type normal
+set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 enable yes
+set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 passive no
+set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 link-type p2p
+set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 enable yes
+set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 passive yes
+set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 link-type broadcast
+set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 enable yes
+set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 passive yes
+set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 link-type broadcast
+set network virtual-router default protocol ospf router-id 1.1.1.1
+set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ]
+```
+
+## Monitoring
+### Monitoring on VyOS side
+
+IKE SAs:
+
+```none
+vyos@vyos:~$ show vpn ike sa
+Peer ID / IP                            Local ID / IP
+------------                            -------------
+10.0.2.2 10.0.2.2                       10.0.1.2 10.0.1.2
+
+    State  IKEVer  Encrypt      Hash          D-H Group      NAT-T  A-Time  L-Time
+    -----  ------  -------      ----          ---------      -----  ------  ------
+    up     IKEv1   AES_CBC_128  HMAC_SHA1_96  MODP_2048      no     1372    25802
+```
+
+IPsec SAs:
+
+```none
+vyos@vyos:~$ show vpn ipsec sa
+Connection    State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
+------------  -------  --------  --------------  ----------------  ----------------  -----------  -----------------------------
+PA-vti        up       23m27s    9K/10K          149/151           10.0.2.2          10.0.2.2     AES_CBC_256/HMAC_SHA2_256_128
+```
+
+OSPF Neighbor Status:
+
+```none
+vyos@vyos:~$ show ip ospf neighbor
+
+Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXmtL RqstL DBsmL
+1.1.1.1           1 Full/-          23m56s            37.948s 10.100.100.2    vti1:10.100.100.1                    0     0     0
+```
+
+Routing Table:
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, L - local, S - static,
+       R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric, t - Table-Direct,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:27:30
+C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:27:34
+L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:27:34
+O   10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:24:34
+C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:24:34
+L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:24:34
+O   192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:27:29
+C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:27:34
+L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:27:34
+O   192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:27:29
+C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:27:34
+L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:27:34
+O>* 192.168.10.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19
+O>* 192.168.11.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19
+```
+
+### Monitoring on Palo Alto side
+
+IKE SAs:
+
+```none
+admin@PA-VM> show vpn ike-sa
+
+IKEv1 phase-1 SAs
+GwID/client IP  Peer-Address           Gateway Name                                                    Role Mode Algorithm             Established     Expiration      V  ST Xt Phase2
+--------------  ------------           ------------                                                    ---- ---- ---------             -----------     ----------      -  -- -- ------
+1               10.0.1.2               VyOS                                                            Resp Main PSK/DH14/A128/SHA1    Jul.31 01:35:00 Jul.31 09:35:00 v1 13 1  1
+
+Show IKEv1 IKE SA: Total 1 gateways found. 1 ike sa found.
+
+
+IKEv1 phase-2 SAs
+Gateway Name                                                    TnID     Tunnel                 GwID/IP          Role Algorithm          SPI(in)  SPI(out) MsgID    ST Xt
+------------                                                    ----     ------                 -------          ---- ---------          -------  -------- -----    -- --
+VyOS                                                            1        VyOS-tunnel            1                Resp ESP/    /tunl/SHA2 8827A3D9 C204F4FA BD202829 9  1
+
+Show IKEv1 phase2 SA: Total 1 gateways found. 1 ike sa found.
+
+
+There is no IKEv2 SA found.
+```
+
+IPsec SAs:
+
+```none
+admin@PA-VM> show vpn ipsec-sa
+
+GwID/client IP  TnID   Peer-Address           Tunnel(Gateway)                                                                                                                  Algorithm          SPI(in)  SPI(out) life(Sec/KB)             remain-time(Sec)
+--------------  ----   ------------           ---------------                                                                                                                  ---------          -------  -------- ------------             ----------------
+1               1      10.0.1.2               VyOS-tunnel(VyOS)                                                                                                                ESP/A256/SHA256    8827A3D9 C204F4FA 3600/Unlimited           2733
+
+Show IPSec SA: Total 1 tunnels found. 1 ipsec sa found.
+```
+
+OSPF Neighbor Status:
+
+```none
+admin@PA-VM> show routing protocol ospf neighbor
+
+  Options: 0x80:reserved, O:Opaq-LSA capability, DC:demand circuits, EA:Ext-Attr LSA capability,
+           N/P:NSSA option, MC:multicase, E:AS external LSA capability, T:TOS capability
+  ==========
+  virtual router:                default
+  neighbor address:              10.100.100.1
+  local address binding:         0.0.0.0
+  type:                          dynamic
+  status:                        full
+  neighbor router ID:            2.2.2.2
+  area id:                       0.0.0.0
+  neighbor priority:             1
+  lifetime remain:               32
+  messages pending:              0
+  LSA request pending:           0
+  options:                       0x02: E
+  hello suppressed:              no
+  restart helper status:         not helping
+  restart helper time remaining: 0
+  restart helper exit reason:    none
+```
+
+Routing Table:
+
+```none
+admin@PA-VM> show routing route
+
+flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,
+       Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast
+
+
+VIRTUAL ROUTER: default (id 1)
+  ==========
+destination                                 nexthop                                 metric flags      age   interface          next-AS
+0.0.0.0/0                                   10.0.2.1                                10     A S              ethernet1/1
+10.0.2.0/30                                 10.0.2.2                                0      A C              ethernet1/1
+10.0.2.2/32                                 0.0.0.0                                 0      A H
+10.100.100.0/30                             0.0.0.0                                 10       Oi       1273  tunnel.1
+10.100.100.0/30                             10.100.100.2                            0      A C              tunnel.1
+10.100.100.2/32                             0.0.0.0                                 0      A H
+192.168.0.0/24                              10.100.100.1                            11     A Oi       1253  tunnel.1
+192.168.1.0/24                              10.100.100.1                            11     A Oi       1253  tunnel.1
+192.168.10.0/24                             0.0.0.0                                 10       Oi       1273  ethernet1/2
+192.168.10.0/24                             192.168.10.1                            0      A C              ethernet1/2
+192.168.10.1/32                             0.0.0.0                                 0      A H
+192.168.11.0/24                             0.0.0.0                                 10       Oi       1273  ethernet1/3
+192.168.11.0/24                             192.168.11.1                            0      A C              ethernet1/3
+192.168.11.1/32                             0.0.0.0                                 0      A H
+total routes shown: 14
+```
+
+### Checking Connectivity
+
+ICMP packets from PC1 to PC3.
+
+```none
+PC1> ping 192.168.10.2
+
+84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms
+84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms
+84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms
+84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms
+84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms
+```
+
+ICMP packets from PC2 to PC4.
+
+```none
+PC2> ping 192.168.11.2
+
+84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms
+84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms
+84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms
+```
diff --git a/docs/configexamples/l3vpn-hub-and-spoke.md b/docs/configexamples/l3vpn-hub-and-spoke.md
new file mode 100644
index 00000000..3c719926
--- /dev/null
+++ b/docs/configexamples/l3vpn-hub-and-spoke.md
@@ -0,0 +1,1091 @@
+# L3VPN for Hub-and-Spoke connectivity with VyOS
+
+IP/MPLS technology is widely used by various service providers and large
+enterprises in order to achieve better network scalability, manageability
+and flexibility. It also provides the possibility to deliver different
+services for the customers in a seamless manner.
+Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered
+through OSI layer 3 networking technologies. Often the border gateway
+protocol (BGP) is used to send and receive VPN-related data that is
+responsible for the control plane. L3VPN utilizes virtual routing and
+forwarding (VRF) techniques to receive and deliver user data as well as
+separate data planes of the end-users. It is built using a combination of
+IP- and MPLS-based information. Generally, L3VPNs are used to send data
+on back-end VPN infrastructures, such as for VPN connections between data
+centres, HQs and branches.
+
+An L3VPN consists of multiple access links, multiple VPN routing and
+forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs.
+An L3VPN can be configured to connect two or more customer sites.
+In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have
+unique Route Distinguishers (RDs). In order to use the hub site as a
+transit point for connectivity in such an environment, the spoke sites
+export their routes to the hub. Spokes can talk to hubs, but never have
+direct paths to other spokes. All traffic between spokes is controlled
+and delivered over the hub site.
+
+To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple
+requirements in order to properly implement the solution.
+We'll use the following nodes in our LAB environment:
+
+- 2 x Route reflectors (VyOS-RRx)
+- 4 x Provider routers (VyOS-Px)
+- 3 x Provider Edge (VyOs-PEx)
+- 3 x Customer Edge (VyOS-CEx)
+
+The following software was used in the creation of this document:
+
+- Operating system: VyOS
+- Version: 1.4-rolling-202110310317
+- Image name: vyos-1.4-rolling-202110310317-amd64.iso
+
+**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317)
+– The configurations below are specifically for VyOS 1.4.x.
+
+General information can be found in the
+{ref}`configuration/vrf/index:L3VPN VRFs` chapter.
+
+## Topology
+
+```{image} /_static/images/L3VPN_hub_and_spoke.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+
+## How does it work?
+
+As we know the main assumption of L3VPN “Hub and Spoke” is, that the
+traffic between spokes have to pass via hub, in our scenario VyOS-PE2
+is the Hub PE
+and the VyOS-CE1-HUB is the central customer office device that is responsible
+for controlling access between all spokes and announcing its network prefixes
+(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its
+own Route-Distinguisher(RD) and route-target import/export lists.
+Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to
+the nodes across network where PEs Spokes import the route-target 60535:1030
+(this is export route-target of vrf BLUE_HUB) and export its own route-target
+60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the
+Customer edge nodes can only learn the network prefixes of the HUB site
+[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes
+[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32].
+Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network
+routes exchange and minimize iBGP peerings between devices.
+
+L3VPN configuration parameters table:
+
+```{eval-rst}
++----------+-------+------------+-----------------+-------------+-------------+
+|   Node   |  Role |     VRF    |        RD       |  RT import  |  RT export  |
++----------+-------+------------+-----------------+-------------+-------------+
+| VyOS-PE2 | Hub   | BLUE_HUB   | 10.80.80.1:1011 | 65035:1011  | 65035:1030  |
+|          |       |            |                 | 65035:1030  |             |
++----------+-------+------------+-----------------+-------------+-------------+
+| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030  | 65035:1011  |
++----------+-------+------------+-----------------+-------------+-------------+
+| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030  | 65035:1011  |
++----------+-------+------------+-----------------+-------------+-------------+
+```
+
+## Configuration
+
+### Step-1: Configuring IGP and enabling MPLS LDP
+
+At the first step we need to configure the IP/MPLS backbone network using OSPF
+as IGP protocol and LDP as label-switching protocol for the base connectivity
+between **P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R**
+(eflector) nodes:
+- VyOS-P1:
+
+```none
+# interfaces
+set interfaces dummy dum10 address '10.0.0.3/32'
+set interfaces ethernet eth0 address '172.16.30.1/24'
+set interfaces ethernet eth1 address '172.16.40.1/24'
+set interfaces ethernet eth2 address '172.16.90.1/24'
+set interfaces ethernet eth3 address '172.16.10.1/24'
+set interfaces ethernet eth5 address '172.16.100.1/24'
+
+# protocols ospf+ldp
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set protocols mpls interface 'eth5'
+set protocols mpls interface 'eth0'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp interface 'eth3'
+set protocols mpls ldp interface 'eth5'
+set protocols mpls ldp router-id '10.0.0.3'
+set protocols ospf area 0 network '0.0.0.0/0'
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.3'
+```
+
+- VyOS-P2:
+
+```none
+# interfaces
+set interfaces dummy dum10 address '10.0.0.4/32'
+set interfaces ethernet eth0 address '172.16.30.2/24'
+set interfaces ethernet eth1 address '172.16.20.1/24'
+set interfaces ethernet eth2 address '172.16.120.1/24'
+set interfaces ethernet eth3 address '172.16.60.1/24'
+
+# protocols ospf+ldp
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set protocols mpls interface 'eth0'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp interface 'eth3'
+set protocols mpls ldp router-id '10.0.0.4'
+set protocols ospf area 0 network '0.0.0.0/0'
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.4'
+```
+
+- VyOS-P3:
+
+```none
+# interfaces
+set interfaces dummy dum10 address '10.0.0.5/32'
+set interfaces ethernet eth0 address '172.16.110.1/24'
+set interfaces ethernet eth1 address '172.16.40.2/24'
+set interfaces ethernet eth2 address '172.16.50.1/24'
+set interfaces ethernet eth3 address '172.16.70.1/24'
+
+# protocols ospf + ldp
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set protocols mpls interface 'eth0'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp interface 'eth3'
+set protocols mpls ldp router-id '10.0.0.5'
+set protocols ospf area 0 network '0.0.0.0/0'
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.5'
+```
+
+- VyOS-P4:
+
+```none
+# interfaces
+set interfaces dummy dum10 address '10.0.0.6/32'
+set interfaces ethernet eth0 address '172.16.80.2/24'
+set interfaces ethernet eth1 address '172.16.130.1/24'
+set interfaces ethernet eth2 address '172.16.50.2/24'
+set interfaces ethernet eth3 address '172.16.60.2/24'
+set interfaces ethernet eth5 address '172.16.140.1/24'
+
+
+# protocols ospf + ldp
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set protocols mpls interface 'eth0'
+set protocols mpls interface 'eth5'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp interface 'eth3'
+set protocols mpls ldp interface 'eth5'
+set protocols mpls ldp router-id '10.0.0.6'
+set protocols ospf area 0 network '0.0.0.0/0'
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.6'
+```
+
+- VyOS-PE1:
+
+```none
+# interfaces
+set interfaces dummy dum10 address '10.0.0.7/32'
+set interfaces ethernet eth0 address '172.16.90.2/24'
+
+# protocols  ospf + ldp
+set protocols mpls interface 'eth0'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp router-id '10.0.0.7'
+set protocols ospf area 0 network '0.0.0.0/0'
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.7'
+```
+
+- VyOS-PE2:
+
+```none
+# interfaces
+set interfaces dummy dum10 address '10.0.0.8/32'
+set interfaces ethernet eth0 address '172.16.110.2/24'
+set interfaces ethernet eth1 address '172.16.100.2/24'
+set interfaces ethernet eth2 address '172.16.80.1/24'
+
+# protocols  ospf + ldp
+set protocols mpls interface 'eth0'
+set protocols mpls interface 'eth1'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp router-id '10.0.0.8'
+set protocols ospf area 0 network '0.0.0.0/0'
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.8'
+```
+
+- VyOS-PE3:
+
+```none
+# interfaces
+set interfaces dummy dum10 address '10.0.0.10/32'
+set interfaces ethernet eth0 address '172.16.140.2/24'
+
+# protocols ospf + ldp
+set protocols mpls interface 'eth0'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp router-id '10.0.0.10'
+set protocols ospf area 0 network '0.0.0.0/0'
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.10'
+```
+
+- VyOS-RR1:
+
+```none
+# interfaces
+set interfaces ethernet eth1 address '172.16.20.2/24'
+set interfaces ethernet eth2 address '172.16.10.2/24'
+set interfaces dummy dum10 address '10.0.0.1/32'
+
+# protocols ospf + ldp
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp router-id '10.0.0.1'
+set protocols ospf area 0 network '0.0.0.0/0'
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.1'
+```
+
+- VyOS-RR2:
+
+```none
+# interfaces
+set interfaces ethernet eth0 address '172.16.80.1/24'
+set interfaces ethernet eth1 address '172.16.70.2/24'
+set interfaces dummy dum10 address '10.0.0.2/32'
+
+# protocols ospf + ldp
+set protocols mpls interface 'eth0'
+set protocols mpls interface 'eth1'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp router-id '10.0.0.2'
+set protocols ospf area 0 network '0.0.0.0/0'
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.2'
+```
+
+
+### Step-2: Configuring iBGP for L3VPN control-plane
+
+At this step we are going to enable iBGP protocol on MPLS nodes and
+Route Reflectors (two routers for redundancy) that will deliver IPv4
+VPN (L3VPN) routes between them:
+- VyOS-RR1:
+
+```none
+set protocols bgp system-as '65001'
+set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4'
+set protocols bgp parameters cluster-id '10.0.0.1'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id '10.0.0.1'
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+```
+
+- VyOS-RR2:
+
+```none
+set protocols bgp system-as '65001'
+set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4'
+set protocols bgp parameters cluster-id '10.0.0.1'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id '10.0.0.2'
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+```
+
+- VyOS-PE1:
+
+```none
+set protocols bgp system-as '65001'
+set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id '10.0.0.7'
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+```
+
+- VyOS-PE2:
+
+```none
+set protocols bgp system-as '65001'
+set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id '10.0.0.8'
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+```
+
+- VyOS-PE3:
+
+```none
+set protocols bgp system-as '65001'
+set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id '10.0.0.10'
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+```
+
+
+### Step-3: Configuring L3VPN VRFs on PE nodes
+
+This section provides configuration steps for setting up VRFs on our
+PE nodes including CE facing interfaces, BGP, rd and route-target
+import/export based on the pre-defined parameters.
+- VyOS-PE1:
+
+```none
+# VRF settings
+set vrf name BLUE_SPOKE table '200'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030'
+set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override
+set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035'
+
+# interfaces
+set interfaces ethernet eth3 address '10.50.50.1/24'
+set interfaces ethernet eth3 vrf 'BLUE_SPOKE'
+```
+
+- VyOS-PE2:
+
+```none
+# VRF settings
+set vrf name BLUE_HUB table '400'
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto'
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011'
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030'
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030'
+set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override
+set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035'
+
+# interfaces
+set interfaces ethernet eth3 address '10.80.80.1/24'
+set interfaces ethernet eth3 vrf 'BLUE_HUB'
+```
+
+- VyOS-PE3:
+
+```none
+# VRF settings
+set vrf name BLUE_SPOKE table '200'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030'
+set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override
+set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035'
+
+# interfaces
+set interfaces ethernet eth3 address '10.60.60.1/24'
+set interfaces ethernet eth3 vrf 'BLUE_SPOKE'
+```
+
+
+### Step-4: Configuring CE nodes
+
+Dynamic routing used between CE and PE nodes and eBGP peering
+established for the route exchanging between them. All routes
+received by PEs are then exported to L3VPN and delivered from
+Spoke sites to Hub and vise-versa based on previously
+configured L3VPN parameters.
+- VyOS-CE1-SPOKE:
+
+```none
+# interfaces
+set interfaces dummy dum20 address '10.0.0.80/32'
+set interfaces ethernet eth0 address '10.50.50.2/24'
+
+# BGP for peering with PE
+set protocols bgp system-as 65035
+set protocols bgp address-family ipv4-unicast network 10.0.0.80/32
+set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2'
+set protocols bgp neighbor 10.50.50.1 remote-as '65001'
+set protocols bgp neighbor 10.50.50.1 update-source 'eth0'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id '10.50.50.2'
+```
+
+- VyOS-CE1-HUB:
+
+```none
+# interfaces
+set interfaces dummy dum20 address '10.0.0.100/32'
+set interfaces ethernet eth0 address '10.80.80.2/24'
+
+# BGP for peering with PE
+set protocols bgp system-as 65035
+set protocols bgp address-family ipv4-unicast network 10.0.0.100/32
+set protocols bgp address-family ipv4-unicast redistribute connected
+set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2'
+set protocols bgp neighbor 10.80.80.1 remote-as '65001'
+set protocols bgp neighbor 10.80.80.1 update-source 'eth0'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id '10.80.80.2'
+```
+
+- VyOS-CE2-SPOKE:
+
+```none
+# interfaces
+set interfaces dummy dum20 address '10.0.0.90/32'
+set interfaces ethernet eth0 address '10.60.60.2/24'
+
+# BGP for peering with PE
+set protocols bgp system-as 65035
+set protocols bgp address-family ipv4-unicast network 10.0.0.90/32
+set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2'
+set protocols bgp neighbor 10.60.60.1 remote-as '65001'
+set protocols bgp neighbor 10.60.60.1 update-source 'eth0'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id '10.60.60.2'
+```
+
+
+### Step-5: Verification
+
+This section describes verification commands for MPLS/BGP/LDP
+protocols and L3VPN related routes as well as diagnosis and
+reachability checks between CE nodes.
+
+Let’s check IPv4 routing and MPLS information on provider nodes
+(same procedure for all P nodes):
+- “show ip ospf neighbor” for checking ospf relationship
+
+```none
+vyos@VyOS-P1:~$  show ip ospf neighbor
+
+Neighbor ID  Pri State           Dead Time Address       Interface            RXmtL RqstL DBsmL
+10.0.0.4         1 Full/Backup       34.718s   172.16.30.2   eth0:172.16.30.1       0      0       0
+10.0.0.5         1 Full/Backup       35.132s   172.16.40.2   eth1:172.16.40.1       0      0       0
+10.0.0.7         1 Full/Backup       34.764s   172.16.90.2   eth2:172.16.90.1       0      0       0
+10.0.0.1         1 Full/Backup       35.642s   172.16.10.2   eth3:172.16.10.1       0      0       0
+10.0.0.8         1 Full/Backup       35.484s   172.16.100.2  eth5:172.16.100.1      0      0     0
+```
+
+- “show mpls ldp neighbor “ for checking ldp neighbors
+
+```none
+vyos@VyOS-P1:~$ show mpls ldp neighbor
+AF   ID              State          Remote Address   Uptime
+ipv4 10.0.0.1        OPERATIONAL 10.0.0.1        07w5d06h
+ipv4 10.0.0.4        OPERATIONAL 10.0.0.4        09w3d00h
+ipv4 10.0.0.5        OPERATIONAL 10.0.0.5        09w2d23h
+ipv4 10.0.0.7        OPERATIONAL 10.0.0.7        03w0d01h
+ipv4 10.0.0.8        OPERATIONAL 10.0.0.8        01w3d02h
+```
+
+- “show mpls ldp binding” for checking mpls label assignment
+
+```none
+vyos@VyOS-P1:~$ show mpls ldp discovery
+AF   Destination         Nexthop         Local    Label Remote Label  In Use
+ipv4 10.0.0.1/32         10.0.0.1        23                imp-null      yes
+ipv4 10.0.0.1/32         10.0.0.4        23                20                no
+ipv4 10.0.0.1/32         10.0.0.5        23                17                no
+ipv4 10.0.0.1/32         10.0.0.7        23                16                no
+ipv4 10.0.0.1/32         10.0.0.8        23                16                no
+ipv4 10.0.0.2/32         10.0.0.1        20                16                no
+ipv4 10.0.0.2/32         10.0.0.4        20                22                no
+ipv4 10.0.0.2/32         10.0.0.5        20                24            yes
+ipv4 10.0.0.2/32         10.0.0.7        20                17                no
+ipv4 10.0.0.2/32         10.0.0.8        20                17                no
+ipv4 10.0.0.3/32         10.0.0.1        imp-null          17                no
+ipv4 10.0.0.3/32         10.0.0.4        imp-null          16                no
+ipv4 10.0.0.3/32         10.0.0.5        imp-null          18                no
+ipv4 10.0.0.3/32         10.0.0.7        imp-null          18                no
+ipv4 10.0.0.3/32         10.0.0.8        imp-null          18                no
+ipv4 10.0.0.4/32         10.0.0.1        16                18                no
+ipv4 10.0.0.4/32         10.0.0.4        16                imp-null      yes
+ipv4 10.0.0.4/32         10.0.0.5        16                19                no
+ipv4 10.0.0.4/32         10.0.0.7        16                19                no
+ipv4 10.0.0.4/32         10.0.0.8        16                19                no
+ipv4 10.0.0.5/32         10.0.0.1        21                19                no
+ipv4 10.0.0.5/32         10.0.0.4        21                17                no
+ipv4 10.0.0.5/32         10.0.0.5        21                imp-null      yes
+ipv4 10.0.0.5/32         10.0.0.7        21                20                no
+ipv4 10.0.0.5/32         10.0.0.8        21                20                no
+ipv4 10.0.0.6/32         10.0.0.1        17                20                no
+ipv4 10.0.0.6/32         10.0.0.4        17                23            yes
+ipv4 10.0.0.6/32         10.0.0.5        17                21            yes
+ipv4 10.0.0.6/32         10.0.0.7        17                21                no
+ipv4 10.0.0.6/32         10.0.0.8        17                21                no
+ipv4 10.0.0.7/32         10.0.0.1        22                21                no
+ipv4 10.0.0.7/32         10.0.0.4        22                18                no
+ipv4 10.0.0.7/32         10.0.0.5        22                20                no
+ipv4 10.0.0.7/32         10.0.0.7        22                imp-null      yes
+ipv4 10.0.0.7/32         10.0.0.8        22                22                no
+ipv4 10.0.0.8/32         10.0.0.1        24                22                no
+ipv4 10.0.0.8/32         10.0.0.4        24                19                no
+ipv4 10.0.0.8/32         10.0.0.5        24                16                no
+ipv4 10.0.0.8/32         10.0.0.7        24                22                no
+ipv4 10.0.0.8/32         10.0.0.8        24                imp-null      yes
+ipv4 10.0.0.9/32         10.0.0.1        18                23                no
+ipv4 10.0.0.9/32         10.0.0.4        18                21            yes
+ipv4 10.0.0.9/32         10.0.0.5        18                22                no
+ipv4 10.0.0.9/32         10.0.0.7        18                23                no
+ipv4 10.0.0.9/32         10.0.0.8        18                23                no
+ipv4 10.0.0.10/32    10.0.0.1        19                24                no
+ipv4 10.0.0.10/32    10.0.0.4        19                24            yes
+ipv4 10.0.0.10/32    10.0.0.5        19                23            yes
+ipv4 10.0.0.10/32    10.0.0.7        19                24                no
+ipv4 10.0.0.10/32    10.0.0.8        19                24                no
+```
+
+Now we’re checking iBGP status and routes from route-reflector
+nodes to other devices:
+- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors:
+
+```none
+vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary
+BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0
+BGP table version 0
+RIB entries 9, using 1728 bytes of memory
+Peers 4, using 85 KiB of memory
+Peer groups 1, using 64 bytes of memory
+
+Neighbor     V       AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt
+10.0.0.7         4   65001   7719    7733              0    0    0   5d07h56m            2       10
+10.0.0.8         4   65001   7715    7724              0    0    0   5d08h28m            4       10
+10.0.0.9         4   65001   7713    7724              0    0    0   5d08h28m            2       10
+10.0.0.10    4   65001   7713    7724              0    0    0   5d08h28m            2       10
+
+Total number of neighbors 4
+```
+
+- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information:
+
+```none
+vyos@VyOS-RR1:~$ show bgp ipv4 vpn
+BGP table version is 2, local router ID is 10.0.0.1, vrf id 0
+Default local pref 100, local AS 65001
+Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
+             i internal, r RIB-failure, S Stale, R Removed
+Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
+Origin codes:  i - IGP, e - EGP, ? - incomplete
+
+   Network       Next Hop            Metric LocPrf Weight Path
+Route Distinguisher: 10.50.50.1:1011
+*>i10.50.50.0/24 10.0.0.7                0   100     0 i
+ UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0
+*>i80.80.80.80/32   10.0.0.7                 0   100     0 65035 i
+ UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0
+Route Distinguisher: 10.60.60.1:1011
+*>i10.60.60.0/24 10.0.0.10           0   100     0 i
+ UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0
+*>i90.90.90.90/32   10.0.0.10            0   100     0 65035 i
+ UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0
+Route Distinguisher: 10.80.80.1:1011
+*>i10.80.80.0/24 10.0.0.8                0   100     0 i
+ UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0
+*>i100.100.100.100/32
+                 10.0.0.8                0   100     0 65035 i
+ UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0
+Route Distinguisher: 172.16.80.1:2011
+*>i10.110.110.0/24  10.0.0.8                 0   100     0 65050 i
+ UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0
+*>i172.16.80.0/24   10.0.0.8                 0   100     0 i
+ UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0
+Route Distinguisher: 172.16.100.1:2011
+*>i10.210.210.0/24  10.0.0.9                 0   100     0 65050 i
+ UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0
+*>i172.16.100.0/24  10.0.0.9                 0   100     0 i
+ UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0
+```
+
+- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected
+  for specific VPNv4 destination
+
+```none
+vyos@VyOS-RR1:~$ show bgp  ipv4 vpn 10.0.0.100/32
+BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32
+not allocated
+Paths: (1 available, best #1)
+  Advertised to non peer-group peers:
+  10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10
+  65035, (Received from a RR-client)
+ 10.0.0.8 from 10.0.0.8 (10.0.0.8)
+     Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received)
+     Extended Community: RT:65035:1030
+     Remote label: 80
+     Last update: Tue Oct 19 13:45:32 202
+```
+
+Also we can verify how PE devices receives VPNv4 networks from the RRs
+and installing them to the specific customer VRFs:
+- “show bgp ipv4 vpn summary” for checking iBGP neighbors against
+  route-reflector devices:
+
+```none
+vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary
+BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0
+BGP table version 0
+RIB entries 9, using 1728 bytes of memory
+Peers 2, using 43 KiB of memory
+Peer groups 1, using 64 bytes of memory
+
+Neighbor     V       AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt
+10.0.0.1         4   65001   8812    8794           0       0       0   01:18:42         8       2
+10.0.0.2         4   65001   8800    8792           0       0       0   6d02h27m         8       2
+```
+
+- “show bgp vrf all” for checking all the prefix learning on BGP
+  : within VRFs:
+
+```none
+vyos@VyOS-PE1:~$ show  bgp vrf all
+
+Instance default:
+No BGP prefixes displayed, 0 exist
+
+Instance BLUE_SPOKE:
+BGP table version is 8, local router ID is 10.50.50.1, vrf id 6
+Default local pref 100, local AS 65001
+Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
+             i internal, r RIB-failure, S Stale, R Removed
+Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
+Origin codes:  i - IGP, e - EGP, ? - incomplete
+
+   Network       Next Hop            Metric LocPrf Weight Path
+*  10.50.50.0/24 0.0.0.0                 0       32768 ?
+*>               0.0.0.0                 0       32768 i
+*> 10.80.80.0/24 10.0.0.8@0<             0   100     0 i
+*                10.0.0.8@0<             0   100     0 i
+*> 10.0.0.80/32   10.50.50.2             0           0 65035 i
+*> 10.0.0.100/32
+                 10.0.0.8@0<             0   100     0 65035 ?
+*                10.0.0.8@0<             0   100     0 65035 ?
+```
+
+- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor
+  : information between PE and CE:
+
+```none
+vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary
+
+IPv4 Unicast Summary:
+BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6
+BGP table version 8
+RIB entries 7, using 1344 bytes of memory
+Peers 1, using 21 KiB of memory
+
+Neighbor     V       AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt
+10.50.50.2   4   65035   9019    9023              0 0      0   6d06h12m         1       4
+
+Total number of neighbors 1
+```
+
+- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE.
+  : Using this command we are also able to check the transport and
+    customer label (inner/outer) for Hub network prefix (10.0.0.100/32):
+
+```none
+vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE
+
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+     O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+     T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+     F - PBR, f - OpenFabric,
+     > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+
+VRF BLUE_SPOKE:
+K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h
+C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h
+B>  10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00
+  *                      via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00
+B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m
+B>  10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00
+  *                              via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00
+```
+
+- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the
+  : specific VPNv4 destination including extended community and
+    remotelabel information. This procedure is the same on all Spoke nodes:
+
+```none
+vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32
+BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32
+not allocated
+Paths: (2 available, best #1)
+  Not advertised to any peer
+  65035
+ 10.0.0.8 from 10.0.0.1 (10.0.0.8)
+     Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP)
+     Extended Community: RT:65035:1030
+     Originator: 10.0.0.8, Cluster list: 10.0.0.1
+     Remote label: 80
+     Last update: Tue Oct 19 13:45:26 2021
+  65035
+ 10.0.0.8 from 10.0.0.2 (10.0.0.8)
+     Origin incomplete, metric 0, localpref 100, valid, internal
+     Extended Community: RT:65035:1030
+     Originator: 10.0.0.8, Cluster list: 10.0.0.1
+     Remote label: 80
+     Last update: Wed Oct 13 12:39:34 202
+```
+
+Now, let’s check routing information on out Hub PE:
+- “show bgp ipv4 vpn summary” for checking iBGP neighbors again
+  : VyOS-RR1/RR2
+
+```none
+vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary
+BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0
+BGP table version 0
+RIB entries 9, using 1728 bytes of memory
+Peers 2, using 43 KiB of memory
+Peer groups 1, using 64 bytes of memory
+
+Neighbor     V       AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt
+10.0.0.1         4   65001   15982   15949       0   0   0 05:41:28          6       4
+10.0.0.2         4   65001   9060    9054        0   0   0 6d06h47m          6       4
+
+Total number of neighbors
+```
+
+- “show bgp vrf all” for checking all the prefixes learning on BGP
+
+```none
+vyos@VyOS-PE2:~$ show bgp vrf all
+
+Instance default:
+No BGP prefixes displayed, 0 exist
+
+Instance BLUE_HUB:
+BGP table version is 50, local router ID is 10.80.80.1, vrf id 8
+Default local pref 100, local AS 65001
+Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
+             i internal, r RIB-failure, S Stale, R Removed
+Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
+Origin codes:  i - IGP, e - EGP, ? - incomplete
+
+   Network       Next Hop            Metric LocPrf Weight Path
+*> 10.50.50.0/24 10.0.0.7@0<             0   100     0 i
+*                10.0.0.7@0<             0   100     0 i
+*> 10.60.60.0/24 10.0.0.10@0<        0   100     0 i
+*                10.0.0.10@0<        0   100     0 i
+*  10.80.80.0/24 10.80.80.2              0           0 65035 ?
+*                0.0.0.0                 0       32768 i
+*>               0.0.0.0                 0       32768 ?
+*> 10.110.110.0/24  172.16.80.2@9<           0           0 65050 i
+*> 10.210.210.0/24  10.0.0.9@0<              0   100     0 65050 i
+*                10.0.0.9@0<             0   100     0 65050 i
+*> 10.0.0.80/32   10.0.0.7@0<            0   100     0 65035 i
+*                10.0.0.7@0<             0   100     0 65035 i
+*> 10.0.0.90/32   10.0.0.10@0<           0   100     0 65035 i
+*                10.0.0.10@0<        0   100     0 65035 i
+*> 10.0.0.100/32
+                 10.80.80.2              0           0 65035 ?
+*> 172.16.80.0/24   0.0.0.0@9<               0       32768 ?
+                 0.0.0.0@9<              0       32768 i
+*> 172.16.100.0/24  10.0.0.9@0<              0   100     0 i
+*                10.0.0.9@0<             0   100     0 i
+```
+
+- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor
+  : CE Hub device
+
+```none
+vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary
+
+IPv4 Unicast Summary:
+BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8
+BGP table version 50
+RIB entries 19, using 3648 bytes of memory
+Peers 1, using 21 KiB of memory
+
+Neighbor     V       AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt
+10.80.80.2   4   65035   15954   15972          0    0      0   01w4d01h         2       10
+```
+
+- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE.
+  : With this command we are able to check the transport and
+    customer label (inner/outer) for network spokes prefixes
+    10.0.0.80/32 - 10.0.0.90/32
+
+```none
+vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB
+
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+     O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+     T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+     F - PBR, f - OpenFabric,
+     > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+
+VRF BLUE_HUB:
+K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h
+B>  10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15
+  *                      via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15
+B>  10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15
+  *                      via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15
+C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h
+B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h
+B>  10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15
+  *                          via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15
+  *                          via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15
+B>  10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15
+  *                          via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15
+B>  10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15
+  *                          via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15
+B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h
+B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h
+B>  172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15
+  *                          via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15
+  *                          via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15
+```
+
+- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path,
+  : extended community and remote label of specific destination
+
+```none
+vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32
+BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32
+not allocated
+Paths: (2 available, best #1)
+  Not advertised to any peer
+  65035
+ 10.0.0.7 from 10.0.0.1 (10.0.0.7)
+     Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP)
+     Extended Community: RT:65035:1011
+     Originator: 10.0.0.7, Cluster list: 10.0.0.1
+     Remote label: 144
+     Last update: Tue Oct 19 13:45:30 2021
+  65035
+ 10.0.0.7 from 10.0.0.2 (10.0.0.7)
+     Origin IGP, metric 0, localpref 100, valid, internal
+     Extended Community: RT:65035:1011
+     Originator: 10.0.0.7, Cluster list: 10.0.0.1
+     Remote label: 144
+     Last update: Wed Oct 13 12:39:37 2021
+
+vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32
+BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32
+not allocated
+Paths: (2 available, best #1)
+  Not advertised to any peer
+  65035
+ 10.0.0.10 from 10.0.0.1 (10.0.0.10)
+     Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP)
+     Extended Community: RT:65035:1011
+     Originator: 10.0.0.10, Cluster list: 10.0.0.1
+     Remote label: 144
+     Last update: Tue Oct 19 13:45:30 2021
+  65035
+ 10.0.0.10 from 10.0.0.2 (10.0.0.10)
+     Origin IGP, metric 0, localpref 100, valid, internal
+     Extended Community: RT:65035:1011
+     Originator: 10.0.0.10, Cluster list: 10.0.0.1
+     Remote label: 144
+     Last update: Wed Oct 13 12:45:44 2021
+```
+
+Finally, let’s check the reachability between CEs:
+- VyOS-CE1-SPOKE -----> VyOS-CE-HUB
+
+```none
+# check rib
+vyos@VyOS-CE1-SPOKE:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+     O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+     T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+     F - PBR, f - OpenFabric,
+     > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+
+B   10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m
+C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h
+B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m
+C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h
+B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m
+
+# check icmp
+vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80
+PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data.
+64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms
+64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms
+64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms
+64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms
+^C
+--- 10.0.0.100 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 8ms
+rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms
+
+# check network path
+vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100
+traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets
+ 1  10.50.50.1 (10.50.50.1)  1.041 ms  1.252 ms  1.835 ms
+ 2  * * *
+ 3  10.0.0.100 (10.0.0.100)  9.225 ms  9.159 ms  9.121 m
+```
+
+- VyOS-CE-HUB -------> VyOS-CE1-SPOKE
+- VyOS-CE-HUB -------> VyOS-CE2-SPOKE
+
+```none
+# check rib
+vyos@VyOS-CE-HUB:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+     O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+     T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+     F - PBR, f - OpenFabric,
+     > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+
+B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m
+B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m
+C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h
+B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h
+B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m
+B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m
+B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m
+C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h
+B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h
+B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m
+
+# check icmp
+vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4
+PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data.
+64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms
+64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms
+64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms
+64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms
+
+--- 10.0.0.80 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 9ms
+rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms
+
+vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4
+PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data.
+64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms
+64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms
+64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms
+^C
+--- 10.0.0.90 ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 6ms
+rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms
+
+# check network path
+vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80
+traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets
+ 1  10.80.80.1 (10.80.80.1)  1.563 ms  1.341 ms  1.075 ms
+ 2  * * *
+ 3  10.0.0.80 (10.0.0.80)  8.125 ms  8.019 ms  7.781 ms
+
+vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90
+traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets
+ 1  10.80.80.1 (10.80.80.1)  1.305 ms  1.137 ms  1.097 ms
+ 2  * * *
+ 3  * * *
+ 4  10.0.0.90 (10.0.0.90)  9.358 ms  9.325 ms  9.292 ms
+```
+
+- VyOS-CE2-SPOKE -------> VyOS-CE-HUB
+
+```none
+# check rib
+vyos@rt-ce2-SPOKE:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+     O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+     T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+     F - PBR, f - OpenFabric,
+     > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+
+B   10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h
+C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h
+B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m
+C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h
+B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m
+
+# check icmp
+vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4
+PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data.
+64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms
+64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms
+64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms
+64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms
+
+--- 10.0.0.100 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 9ms
+rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms
+
+# check network path
+vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100
+traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets
+ 1  10.60.60.1 (10.60.60.1)  1.343 ms  1.190 ms  1.152 ms
+ 2  * * *
+ 3  * * *
+ 4  10.0.0.100 (10.0.0.100)  7.504 ms  7.480 ms  7.488 ms
+```
+
+**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll
+see `* * *` for the transit routers of the mpls backbone.
diff --git a/docs/configexamples/lac-lns.md b/docs/configexamples/lac-lns.md
new file mode 100644
index 00000000..51a96f8b
--- /dev/null
+++ b/docs/configexamples/lac-lns.md
@@ -0,0 +1,181 @@
+---
+lastproofread: '2024-02-21'
+---
+
+(examples-lac-lns)=
+
+# PPPoE over L2TP
+
+This document is to describe a basic setup using PPPoE over L2TP.
+LAC and LNS are components of the broadband topology.
+LAC - L2TP access concentrator
+LNS - L2TP Network Server
+LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and
+forward them to LNS. LNS is the termination point that comes from PPP packets
+from the remote client.
+
+In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC.
+All users with domain **vyos.io** will be tunneled to LNS via L2TP.
+
+## Network Topology
+
+```{image} /_static/images/lac-lns-diagram.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 60%
+```
+
+
+## Configurations
+
+### LAC
+
+```none
+aaa new-model
+!
+aaa authentication ppp default local
+!
+vpdn enable
+vpdn aaa attribute nas-ip-address vpdn-nas
+!
+vpdn-group LAC
+ request-dialin
+  protocol l2tp
+  domain vyos.io
+ initiate-to ip 192.168.139.100
+ source-ip 192.168.139.101
+ local name LAC
+ l2tp tunnel password 0 test123
+!
+bba-group pppoe MAIN-BBA
+ virtual-template 1
+!
+interface GigabitEthernet0/0
+ description To LNS
+ ip address 192.168.139.101 255.255.255.0
+ duplex auto
+ speed auto
+ media-type rj45
+!
+interface GigabitEthernet0/1
+ description To PPPoE clients
+ no ip address
+ duplex auto
+ speed auto
+ media-type rj45
+ pppoe enable group MAIN-BBA
+!
+interface Virtual-Template1
+ description pppoe MAIN-BBA
+ no ip address
+ no peer default ip address
+ ppp mtu adaptive
+ ppp authentication chap
+!
+```
+
+
+### LNS
+
+% stop_vyoslinter
+
+```none
+set interfaces ethernet eth0 address '192.168.139.100/24'
+set nat source rule 100 outbound-interface name 'eth0'
+set nat source rule 100 source address '10.0.0.0/24'
+set nat source rule 100 translation address 'masquerade'
+set protocols static route 0.0.0.0/0 next-hop 192.168.139.2
+set vpn l2tp remote-access authentication mode 'radius'
+set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest'
+set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100'
+set vpn l2tp remote-access default-pool 'TEST-POOL'
+set vpn l2tp remote-access gateway-address '10.0.0.1'
+set vpn l2tp remote-access lns host-name 'LAC'
+set vpn l2tp remote-access lns shared-secret 'test123'
+set vpn l2tp remote-access name-server '8.8.8.8'
+set vpn l2tp remote-access ppp-options disable-ccp
+```
+
+% start_vyoslinter
+
+:::{note}
+This setup requires the Compression Control Protocol (CCP)
+being disabled, the command `set vpn l2tp remote-access ppp-options disable-ccp`
+accomplishes that.
+:::
+
+### Client
+
+In this lab we use Windows PPPoE client.
+
+```{image} /_static/images/lac-lns-winclient.webp
+:align: center
+:alt: Window PPPoE Client Configuration
+:width: 100%
+```
+
+
+### Monitoring
+
+Monitoring on LNS side
+
+```none
+vyos@vyos:~$ show l2tp-server sessions
+ ifname |   username   |    ip    | ip6 | ip6-dp |   calling-sid   | rate-limit | state  |  uptime  | rx-bytes  | tx-bytes
+--------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+----------
+ l2tp0  | test@vyos.io | 10.0.0.2 |     |        | 192.168.139.101 |            | active | 00:00:35 | 188.4 KiB | 9.3 MiB
+```
+
+Monitoring on LAC side
+
+```none
+Router#show pppoe session
+     1 session  in FORWARDED (FWDED) State
+     1 session  total
+Uniq ID  PPPoE  RemMAC          Port                    VT  VA         State
+           SID  LocMAC                                      VA-st      Type
+      1      1  000c.290b.20a6  Gi0/1                    1  N/A        FWDED
+                0c58.88ac.0001
+
+Router#show l2tp
+L2TP Tunnel and Session Information Total tunnels 1 sessions 1
+
+LocTunID   RemTunID   Remote Name   State  Remote Address  Sessn L2TP Class/
+                                                           Count VPDN Group
+23238      2640       LAC           est    192.168.139.100 1     LAC
+
+LocID      RemID      TunID      Username, Intf/      State  Last Chg Uniq ID
+                                 Vcid, Circuit
+25641      25822      23238      test@vyos.io, Gi0/1  est    00:05:36 1
+```
+
+Monitoring on RADIUS Server side
+
+```none
+root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221
+Wed Feb 21 13:37:17 2024
+        User-Name = "test@vyos.io"
+        NAS-Port = 0
+        NAS-Port-Id = "l2tp0"
+        NAS-Port-Type = Virtual
+        Service-Type = Framed-User
+        Framed-Protocol = PPP
+        Calling-Station-Id = "192.168.139.101"
+        Called-Station-Id = "192.168.139.100"
+        Acct-Status-Type = Start
+        Acct-Authentic = RADIUS
+        Acct-Session-Id = "45c731e169d9a4f1"
+        Acct-Session-Time = 0
+        Acct-Input-Octets = 0
+        Acct-Output-Octets = 0
+        Acct-Input-Packets = 0
+        Acct-Output-Packets = 0
+        Acct-Input-Gigawords = 0
+        Acct-Output-Gigawords = 0
+        Framed-IP-Address = 10.0.0.2
+        NAS-IP-Address = 192.168.139.100
+        Event-Timestamp = "Feb 21 2024 13:37:17 UTC"
+        Tmp-String-9 = "ai:"
+        Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318"
+        Timestamp = 1708522637
+```
diff --git a/docs/configexamples/nmp.md b/docs/configexamples/nmp.md
new file mode 100644
index 00000000..63231a09
--- /dev/null
+++ b/docs/configexamples/nmp.md
@@ -0,0 +1,76 @@
+---
+lastproofread: '2023-03-26'
+---
+
+(examples-nmp)=
+
+# NMP example
+
+Consider how to quickly set up NMP and VyOS for monitoring.
+NMP is multi-vendor network monitoring from 'SolarWinds' built to
+scale and expand with the needs of your network.
+
+## Configuration 'VyOS'
+
+First prepare our VyOS router for connection to NMP. We have to set
+up the SNMP protocol and connectivity between the router and NMP.
+
+% stop_vyoslinter
+
+```none
+set interfaces ethernet eth0 address 'dhcp'
+set system name-server '8.8.8.8'
+set service snmp community router authorization 'test'
+set service snmp community router network '0.0.0.0/0'
+```
+
+% start_vyoslinter
+
+
+## Configuration 'NMP'
+
+Next, you should just follow the pictures:
+
+```{image} /_static/images/nmp1.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp2.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp3.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp4.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp5.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp6.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp7.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+In the end, you'll get a powerful instrument for monitoring the VyOS systems.
diff --git a/docs/configexamples/ospf-unnumbered.md b/docs/configexamples/ospf-unnumbered.md
new file mode 100644
index 00000000..9174d1b4
--- /dev/null
+++ b/docs/configexamples/ospf-unnumbered.md
@@ -0,0 +1,118 @@
+---
+lastproofread: '2021-06-29'
+---
+
+(examples-ospf-unnumbered)=
+
+# OSPF unnumbered with ECMP
+
+General information can be found in the {ref}`routing-ospf` chapter.
+
+## Configuration
+
+- Router A:
+
+```none
+set interfaces ethernet eth0 address '10.0.0.1/24'
+set interfaces ethernet eth1 address '192.168.0.1/32'
+set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+set interfaces ethernet eth1 ip ospf network 'point-to-point'
+set interfaces ethernet eth2 address '192.168.0.1/32'
+set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+set interfaces ethernet eth2 ip ospf network 'point-to-point'
+set interfaces loopback lo address '192.168.0.1/32'
+set protocols ospf area 0.0.0.0 authentication 'md5'
+set protocols ospf area 0.0.0.0 network '192.168.0.1/32'
+set protocols ospf parameters router-id '192.168.0.1'
+set protocols ospf redistribute connected
+```
+
+- Router B:
+
+```none
+set interfaces ethernet eth0 address '10.0.0.2/24'
+set interfaces ethernet eth1 address '192.168.0.2/32'
+set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+set interfaces ethernet eth1 ip ospf network 'point-to-point'
+set interfaces ethernet eth2 address '192.168.0.2/32'
+set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+set interfaces ethernet eth2 ip ospf network 'point-to-point'
+set interfaces loopback lo address '192.168.0.2/32'
+set protocols ospf area 0.0.0.0 authentication 'md5'
+set protocols ospf area 0.0.0.0 network '192.168.0.2/32'
+set protocols ospf parameters router-id '192.168.0.2'
+set protocols ospf redistribute connected
+```
+
+
+## Results
+
+- Router A:
+
+```none
+vyos@vyos:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface        IP Address                        S/L  Description
+---------        ----------                        ---  -----------
+eth0             10.0.0.1/24                       u/u
+eth1             192.168.0.1/32                    u/u
+eth2             192.168.0.1/32                    u/u
+lo               127.0.0.1/8                       u/u
+                 192.168.0.1/32
+                 ::1/128
+```
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+       F - PBR, f - OpenFabric,
+       > - selected route, * - FIB route, q - queued route, r - rejected route
+
+S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
+O   10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21
+                            via 192.168.0.2, eth2 onlink, 00:13:21
+C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
+O   192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53
+C * 192.168.0.1/32 is directly connected, eth2, 00:56:31
+C * 192.168.0.1/32 is directly connected, eth1, 00:56:31
+C>* 192.168.0.1/32 is directly connected, lo, 00:57:36
+O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03
+  *                        via 192.168.0.2, eth2 onlink, 00:29:03
+```
+
+- Router B:
+
+```none
+vyos@vyos:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface        IP Address                        S/L  Description
+---------        ----------                        ---  -----------
+eth0             10.0.0.2/24                       u/u
+eth1             192.168.0.2/32                    u/u
+eth2             192.168.0.2/32                    u/u
+lo               127.0.0.1/8                       u/u
+                 192.168.0.2/32
+                 ::1/128
+```
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+       F - PBR, f - OpenFabric,
+       > - selected route, * - FIB route, q - queued route, r - rejected route
+
+S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
+O   10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21
+                            via 192.168.0.1, eth2 onlink, 00:13:21
+C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
+O   192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53
+C * 192.168.0.2/32 is directly connected, eth2, 00:56:31
+C * 192.168.0.2/32 is directly connected, eth1, 00:56:31
+C>* 192.168.0.2/32 is directly connected, lo, 00:57:36
+O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03
+  *                        via 192.168.0.1, eth2 onlink, 00:29:03
+```
diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.md b/docs/configexamples/policy-based-ipsec-and-firewall.md
new file mode 100644
index 00000000..86bc9318
--- /dev/null
+++ b/docs/configexamples/policy-based-ipsec-and-firewall.md
@@ -0,0 +1,269 @@
+(examples-policy-based-ipsec-and-firewall)=
+
+# Policy-Based Site-to-Site VPN and Firewall Configuration
+
+This guide shows an example policy-based IKEv2 site-to-site VPN between two
+VyOS routers, and firewall configuration.
+
+For simplicity, configuration and tests are done only using IPv4, and firewall
+configuration is done only on one router.
+
+## Network Topology and requirements
+
+This configuration example and the requirements consists of:
+
+- Two VyOS routers with public IP address.
+
+- 2 private subnets on each site.
+
+- Local subnets should be able to reach internet using source NAT.
+
+- Communication between private subnets should be done through IPSec tunnel
+  without NAT.
+
+- Configuration of basic firewall in one site, in order to:
+
+  > - Protect the router on 'WAN' interface, allowing only IPSec connections
+  >   and SSH access from trusted IPs.
+  > - Allow access to the router only from trusted networks.
+  > - Allow DNS requests only only for local networks.
+  > - Allow ICMP on all interfaces.
+  > - Allow all new connections from local subnets.
+  > - Allow connections from LANs to LANs through the tunnel.
+
+```{image} /_static/images/policy-based-ipsec-and-firewall.webp
+```
+
+
+## Configuration
+
+Interface and routing configuration:
+
+```none
+# LEFT router:
+set interfaces ethernet eth0 address '198.51.100.14/30'
+set interfaces ethernet eth1 vif 111 address '10.1.11.1/24'
+set interfaces ethernet eth2 vif 112 address '10.1.12.1/24'
+set protocols static route 0.0.0.0/0 next-hop 198.51.100.13
+
+# RIGHT router:
+set interfaces ethernet eth0 address '192.0.2.130/30'
+set interfaces ethernet eth1 vif 221 address '10.2.21.1/24'
+set interfaces ethernet eth2 vif 222 address '10.2.22.1/24'
+```
+
+IPSec configuration:
+
+```none
+# LEFT router:
+set vpn ipsec authentication psk RIGHT id '198.51.100.14'
+set vpn ipsec authentication psk RIGHT id '192.0.2.130'
+set vpn ipsec authentication psk RIGHT secret 'p4ssw0rd'
+set vpn ipsec esp-group ESP-GROUP mode 'tunnel'
+set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
+set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'
+set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
+set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
+set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
+set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
+set vpn ipsec interface 'eth0'
+set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer RIGHT connection-type 'initiate'
+set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14'
+set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130'
+set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24'
+
+# RIGHT router:
+set vpn ipsec authentication psk LEFT id '192.0.2.130'
+set vpn ipsec authentication psk LEFT id '198.51.100.14'
+set vpn ipsec authentication psk LEFT secret 'p4ssw0rd'
+set vpn ipsec esp-group ESP-GROUP mode 'tunnel'
+set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
+set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'
+set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
+set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
+set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
+set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
+set vpn ipsec interface 'eth0'
+set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer LEFT connection-type 'none'
+set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130'
+set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14'
+set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24'
+```
+
+Firewall Configuration:
+
+```none
+# Firewall Groups:
+set firewall group network-group LOCAL-NETS network '10.1.11.0/24'
+set firewall group network-group LOCAL-NETS network '10.1.12.0/24'
+set firewall group network-group REMOTE-NETS network '10.2.21.0/24'
+set firewall group network-group REMOTE-NETS network '10.2.22.0/24'
+set firewall group network-group TRUSTED network '198.51.100.125/32'
+set firewall group network-group TRUSTED network '203.0.113.0/24'
+set firewall group network-group TRUSTED network '10.1.11.0/24'
+set firewall group network-group TRUSTED network '192.168.70.0/24'
+
+# Forward traffic: default drop and only allow what is needed
+set firewall ipv4 forward filter default-action 'drop'
+
+# Forward traffic: global state policies
+set firewall ipv4 forward filter rule 1 action 'accept'
+set firewall ipv4 forward filter rule 1 state established 'enable'
+set firewall ipv4 forward filter rule 1 state related 'enable'
+set firewall ipv4 forward filter rule 2 action 'drop'
+set firewall ipv4 forward filter rule 2 state invalid 'enable'
+
+# Forward traffic: Accept all connections from local networks
+set firewall ipv4 forward filter rule 10 action 'accept'
+set firewall ipv4 forward filter rule 10 source group network-group 'LOCAL-NETS'
+
+# Forward traffic: accept connections from remote LANs to local LANs
+set firewall ipv4 forward filter rule 20 action 'accept'
+set firewall ipv4 forward filter rule 20 destination group network-group 'LOCAL-NETS'
+set firewall ipv4 forward filter rule 20 source group network-group 'REMOTE-NETS'
+
+# Input traffic: default drop and only allow what is needed
+set firewall ipv4 input filter default-action 'drop'
+
+# Input traffic: global state policies
+set firewall ipv4 input filter rule 1 action 'accept'
+set firewall ipv4 input filter rule 1 state established 'enable'
+set firewall ipv4 input filter rule 1 state related 'enable'
+set firewall ipv4 input filter rule 2 action 'drop'
+set firewall ipv4 input filter rule 2 state invalid 'enable'
+
+# Input traffic: add rules needed for ipsec connection
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 10 destination port '500,4500'
+set firewall ipv4 input filter rule 10 inbound-interface name 'eth0'
+set firewall ipv4 input filter rule 10 protocol 'udp'
+set firewall ipv4 input filter rule 15 action 'accept'
+set firewall ipv4 input filter rule 15 inbound-interface name 'eth0'
+set firewall ipv4 input filter rule 15 protocol 'esp'
+
+# Input traffic: accept ssh connection from trusted ips
+set firewall ipv4 input filter rule 20 action 'accept'
+set firewall ipv4 input filter rule 20 destination port '22'
+set firewall ipv4 input filter rule 20 protocol 'tcp'
+set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED'
+
+# Input traffic: accept dns requests only from local networks.
+set firewall ipv4 input filter rule 25 action 'accept'
+set firewall ipv4 input filter rule 25 destination port '53'
+set firewall ipv4 input filter rule 25 protocol 'udp'
+set firewall ipv4 input filter rule 25 source group network-group 'LOCAL-NETS'
+
+# Input traffic: allow icmp
+set firewall ipv4 input filter rule 30 action 'accept'
+set firewall ipv4 input filter rule 30 protocol 'icmp'
+```
+
+And NAT Configuration:
+
+```none
+set nat source rule 10 destination group network-group 'REMOTE-NETS'
+set nat source rule 10 exclude
+set nat source rule 10 outbound-interface name 'eth0'
+set nat source rule 10 source group network-group 'LOCAL-NETS'
+set nat source rule 20 outbound-interface name 'eth0'
+set nat source rule 20 source group network-group 'LOCAL-NETS'
+set nat source rule 20 translation address 'masquerade'
+```
+
+## Checking through op-mode commands
+
+After some testing, we can check IPSec status, and counter on every tunnel:
+
+```none
+vyos@LEFT:~$ show vpn ipsec sa
+Connection      State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID    Proposal
+--------------  -------  --------  --------------  ----------------  ----------------  -----------  ---------------------------------------
+RIGHT-tunnel-0  up       36m24s    840B/840B       10/10             192.0.2.130       192.0.2.130  AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
+RIGHT-tunnel-1  up       36m33s    588B/588B       7/7               192.0.2.130       192.0.2.130  AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
+RIGHT-tunnel-2  up       35m50s    1K/1K           15/15             192.0.2.130       192.0.2.130  AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
+RIGHT-tunnel-3  up       36m54s    2K/2K           32/32             192.0.2.130       192.0.2.130  AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
+vyos@LEFT:~$ 
+```
+
+Also, we can check firewall counters:
+
+```none
+vyos@LEFT:~$ show firewall
+Rulesets Information
+
+---------------------------------
+IPv4 Firewall "forward filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ------------------------------------------------------
+1        accept    all               681    96545  ct state { established, related }  accept
+2        drop      all                 0        0  ct state invalid
+10       accept    all               360    27205  ip saddr @N_LOCAL-NETS  accept
+20       accept    all                 8      648  ip daddr @N_LOCAL-NETS ip saddr @N_REMOTE-NETS  accept
+default  drop      all
+
+---------------------------------
+IPv4 Firewall "input filter"
+
+Rule     Action    Protocol      Packets    Bytes  Conditions
+-------  --------  ----------  ---------  -------  ----------------------------------------------
+1        accept    all               901   123709  ct state { established, related }  accept
+2        drop      all                 0        0  ct state invalid
+10       accept    udp                 0        0  udp dport { 500, 4500 } iifname "eth0"  accept
+15       accept    esp                 0        0  meta l4proto esp iifname "eth0"  accept
+20       accept    tcp                 1       60  tcp dport 22 ip saddr @N_TRUSTED  accept
+25       accept    udp                 0        0  udp dport 53 ip saddr @N_LOCAL-NETS  accept
+30       accept    icmp                0        0  meta l4proto icmp  accept
+default  drop      all
+
+vyos@LEFT:~$ 
+vyos@LEFT:~$ show firewall statistics 
+Rulesets Statistics
+
+---------------------------------
+IPv4 Firewall "forward filter"
+
+Rule     Packets    Bytes    Action    Source       Destination    Inbound-Interface    Outbound-interface
+-------  ---------  -------  --------  -----------  -------------  -------------------  --------------------
+1        681        96545    accept    any          any            any                  any
+2        0          0        drop      any          any            any                  any
+10       360        27205    accept    LOCAL-NETS   any            any                  any
+20       8          648      accept    REMOTE-NETS  LOCAL-NETS     any                  any
+default  N/A        N/A      drop      any          any            any                  any
+
+---------------------------------
+IPv4 Firewall "input filter"
+
+Rule     Packets    Bytes    Action    Source      Destination    Inbound-Interface    Outbound-interface
+-------  ---------  -------  --------  ----------  -------------  -------------------  --------------------
+1        905        124213   accept    any         any            any                  any
+2        0          0        drop      any         any            any                  any
+10       0          0        accept    any         any            eth0                 any
+15       0          0        accept    any         any            eth0                 any
+20       1          60       accept    TRUSTED     any            any                  any
+25       0          0        accept    LOCAL-NETS  any            any                  any
+30       0          0        accept    any         any            any                  any
+default  N/A        N/A      drop      any         any            any                  any
+
+vyos@LEFT:~$ 
+```
diff --git a/docs/configexamples/pppoe-ipv6-basic.md b/docs/configexamples/pppoe-ipv6-basic.md
new file mode 100644
index 00000000..76984f4b
--- /dev/null
+++ b/docs/configexamples/pppoe-ipv6-basic.md
@@ -0,0 +1,114 @@
+---
+lastproofread: '2021-06-29'
+---
+
+(examples-pppoe-ipv6-basic)=
+
+# PPPoE IPv6 Basic Setup for Home Network
+
+This document is to describe a basic setup using PPPoE with DHCPv6-PD +
+SLAAC to construct a typical home network. The user can follow the steps
+described here to quickly setup a working network and use this as a starting
+point to further configure or fine-tune other settings.
+
+To achieve this, your ISP is required to support DHCPv6-PD. If you're not sure,
+please contact your ISP for more information.
+
+## Network Topology
+
+```{image} /_static/images/pppoe-ipv6-pd-diagram.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 60%
+```
+
+
+## Configurations
+
+### PPPoE Setup
+
+```none
+set interfaces pppoe pppoe0 authentication password <YOUR PASSWORD>
+set interfaces pppoe pppoe0 authentication username <YOUR USERNAME>
+set interfaces pppoe pppoe0 service-name <YOUR SERVICENAME>
+set interfaces pppoe pppoe0 source-interface 'eth0'
+```
+
+- Fill `password` and `user` with the credential provided by your ISP.
+- `service-name` can be an arbitrary string.
+
+### DHCPv6-PD Setup
+
+During address configuration, in addition to assigning an address to the WAN
+interface, ISP also provides a prefix to allow the router to configure addresses
+of LAN interface and other nodes connecting to LAN, which is called prefix
+delegation (PD).
+
+```none
+set interfaces pppoe pppoe0 ipv6 address autoconf
+set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100'
+```
+
+- Here we use the prefix to configure the address of eth1 (LAN) to form
+  `<prefix>::64`, where `64` is hexadecimal of address 100.
+
+<!-- list break -->
+
+- For home network users, most of time ISP only provides /64 prefix, hence
+  there is no need to set SLA ID and prefix length. See {ref}`pppoe-interface`
+  for more information.
+
+### Router Advertisement
+
+We need to enable router advertisement for LAN network so that PC can receive
+the prefix and use SLAAC to configure the address automatically.
+
+```none
+set service router-advert interface eth1 link-mtu '1492'
+set service router-advert interface eth1 name-server <NAME SERVER>
+set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800'
+```
+
+- Set MTU in advertisement to 1492 because of PPPoE header overhead.
+- Set DNS server address in the advertisement so that clients can obtain it by
+  using RDNSS option. Most operating systems (Windows, Linux, Mac) should
+  already support it.
+- Here we set the prefix to `::/64` to indicate advertising any /64 prefix
+  the LAN interface is assigned.
+- Since some ISPs disconnects continuous connection for every 2~3 days, we set
+  `valid-lifetime` to 2 days to allow PC for phasing out old address.
+
+### Basic Firewall
+
+To have basic protection while keeping IPv6 network functional, we need to:
+- Allow all established and related traffic for router and LAN
+- Allow all icmpv6 packets for router and LAN
+- Allow DHCPv6 packets for router
+
+```none
+set firewall ipv6 name WAN_IN default-action 'drop'
+set firewall ipv6 name WAN_IN rule 10 action 'accept'
+set firewall ipv6 name WAN_IN rule 10 state established 'enable'
+set firewall ipv6 name WAN_IN rule 10 state related 'enable'
+set firewall ipv6 name WAN_IN rule 20 action 'accept'
+set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6'
+set firewall ipv6 name WAN_LOCAL default-action 'drop'
+set firewall ipv6 name WAN_LOCAL rule 10 action 'accept'
+set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable'
+set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable'
+set firewall ipv6 name WAN_LOCAL rule 20 action 'accept'
+set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6'
+set firewall ipv6 name WAN_LOCAL rule 30 action 'accept'
+set firewall ipv6 name WAN_LOCAL rule 30 destination port '546'
+set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp'
+set firewall ipv6 name WAN_LOCAL rule 30 source port '547'
+set firewall ipv6 forward filter rule 10 action jump
+set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN'
+set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0'
+set firewall ipv6 input filter rule 10 action jump
+set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL'
+set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0'
+```
+
+Note to allow the router to receive DHCPv6 response from ISP. We need to allow
+packets with source port 547 (server) and destination port 546 (client).
diff --git a/docs/configexamples/qos.md b/docs/configexamples/qos.md
new file mode 100644
index 00000000..e8335584
--- /dev/null
+++ b/docs/configexamples/qos.md
@@ -0,0 +1,201 @@
+---
+lastproofread: '2023-02-18'
+---
+
+(examples-qos)=
+
+# QoS example
+
+## Configuration 'dcsp' and shaper using QoS
+
+In this case, we'll try to make a simple lab using QoS and the
+general ability of the VyOS system.
+We recommend you to go through the main article about
+[QoS](https://docs.vyos.io/en/latest/configuration/trafficpolicy/index.html)
+first.
+
+Using the general schema for example:
+
+```{image} /_static/images/qos1.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+We have four hosts on the local network 172.17.1.0/24. All hosts are
+labeled CS0 by default. We need to replace labels on all hosts except
+vpc8.
+We will replace the labels on the nearest router “VyOS3” using the IP
+addresses of the sources.
+
+- 172.17.1.2 CS0 -> CS4
+- 172.17.1.3 CS0 -> CS5
+- 172.17.1.4 CS0 -> CS6
+- 172.17.1.40 CS0 by default
+
+Next, we will replace only all CS4 labels on the “VyOS2” router.
+
+- CS4 -> CS5
+
+In the end, we will configure the traffic shaper using QoS mechanisms
+on the “VYOS2” router.
+
+## Configuration:
+
+Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll
+use in this case only static routes.
+On the VyOS3 router, we need to change the 'dscp' labels for the
+VPCs. To do this, we use this configuration.
+
+```none
+set interfaces ethernet eth0 address '10.1.1.100/24'
+set interfaces ethernet eth1 address '172.17.1.1/24'
+set protocols static route 0.0.0.0/0 next-hop 10.1.1.1
+set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32'
+set qos policy shaper vyos3 class 10 set-dscp 'CS4'
+set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32'
+set qos policy shaper vyos3 class 20 set-dscp 'CS5'
+set qos policy shaper vyos3 class 30 match ADDRESS30 ip source address '172.17.1.4/32'
+set qos policy shaper vyos3 class 30 set-dscp 'CS6'
+set qos policy shaper vyos3 default bandwidth '10%'
+set qos policy shaper vyos3 default ceiling '100%'
+set qos policy shaper vyos3 default priority '7'
+set qos policy shaper vyos3 default queue-type 'fair-queue'
+set qos interface eth0 egress 'vyos3'
+```
+
+Main rules:
+
+- ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32
+- ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32
+- ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32
+
+Check the result
+
+```{image} /_static/images/qos2.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+Before the interface eth0 on router VyOS3
+
+```{image} /_static/images/qos3.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+After the interface eth0 on router VyOS3
+
+```{image} /_static/images/qos4.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+On the router, VyOS4 set all traffic as CS4. We have to configure the
+default class and class for changing all labels from CS0 to CS4
+
+```none
+set interfaces ethernet eth0 address '10.2.1.100/24'
+set protocols static route 0.0.0.0/0 next-hop 10.2.1.1
+set qos policy shaper vyos4 class 10 bandwidth '100%'
+set qos policy shaper vyos4 class 10 burst '15k'
+set qos policy shaper vyos4 class 10 match ALL ether protocol 'all'
+set qos policy shaper vyos4 class 10 queue-type 'fair-queue'
+set qos policy shaper vyos4 class 10 set-dscp 'CS4'
+set qos policy shaper vyos4 default bandwidth '10%'
+set qos policy shaper vyos4 default burst '15k'
+set qos policy shaper vyos4 default ceiling '100%'
+set qos policy shaper vyos4 default priority '7'
+set qos policy shaper vyos4 default queue-type 'fair-queue'
+    set qos interface eth0 egress 'vyos4'
+```
+
+Next on the router VyOS2 we will change labels on all incoming
+traffic only from CS4-> CS6
+
+```{image} /_static/images/qos5.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```none
+set interfaces ethernet eth0 address '10.1.1.1/24'
+set interfaces ethernet eth1 address '10.2.1.1/24'
+set interfaces ethernet eth2 address '10.9.9.1/24'
+set protocols static route 172.17.1.0/24 next-hop 10.1.1.100
+set qos policy shaper vyos2 class 10 bandwidth '100%'
+set qos policy shaper vyos2 class 10 burst '15k'
+set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4'
+set qos policy shaper vyos2 class 10 queue-type 'fair-queue'
+set qos policy shaper vyos2 class 10 set-dscp 'CS5'
+set qos policy shaper vyos2 default bandwidth '100%'
+set qos policy shaper vyos2 default burst '15k'
+set qos policy shaper vyos2 default ceiling '100%'
+set qos policy shaper vyos2 default priority '7'
+set qos policy shaper vyos2 default queue-type 'fair-queue'
+    set qos interface eth2 egress 'vyos2'
+```
+
+```{image} /_static/images/qos6.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+- 172.17.1.2/24 CS0
+
+```{image} /_static/images/qos7.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+- 172.17.1.2/24 CS0 - > CS4
+
+```{image} /_static/images/qos8.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+- 172.17.1.2/24 CS4 - > CS5
+
+```{image} /_static/images/qos9.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+In the end, on the router “VyOS2” we will set outgoing bandwidth
+limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for
+IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work
+with the help of the “iPerf” utility.
+
+Set up bandwidth limits on the eth2 interface of the router “VyOS2”.
+
+```none
+vyos@vyos2# show qos policy shaper vyos2 class 20
+bandwidth 5mbit
+description "for VyOS3 eth0"
+match VyOS3 {
+    ip {
+        source {
+            address 10.1.1.100/32
+        }
+    }
+}
+```
+
+Check the result.
+
+```{image} /_static/images/qos10.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+As we see shaper is working and the traffic will not work over 5 Mbit/s.
diff --git a/docs/configexamples/ansible.rst b/docs/configexamples/rst-ansible.rst
index ee865076..ee865076 100644
--- a/docs/configexamples/ansible.rst
+++ b/docs/configexamples/rst-ansible.rst
diff --git a/docs/configexamples/azure-vpn-bgp.rst b/docs/configexamples/rst-azure-vpn-bgp.rst
index 597a4d15..597a4d15 100644
--- a/docs/configexamples/azure-vpn-bgp.rst
+++ b/docs/configexamples/rst-azure-vpn-bgp.rst
diff --git a/docs/configexamples/azure-vpn-dual-bgp.rst b/docs/configexamples/rst-azure-vpn-dual-bgp.rst
index 04a6a631..04a6a631 100644
--- a/docs/configexamples/azure-vpn-dual-bgp.rst
+++ b/docs/configexamples/rst-azure-vpn-dual-bgp.rst
diff --git a/docs/configexamples/bgp-ipv6-unnumbered.rst b/docs/configexamples/rst-bgp-ipv6-unnumbered.rst
index f7a530d8..f7a530d8 100644
--- a/docs/configexamples/bgp-ipv6-unnumbered.rst
+++ b/docs/configexamples/rst-bgp-ipv6-unnumbered.rst
diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.rst b/docs/configexamples/rst-dmvpn-dualhub-dualcloud.rst
index a3a4e619..a3a4e619 100644
--- a/docs/configexamples/dmvpn-dualhub-dualcloud.rst
+++ b/docs/configexamples/rst-dmvpn-dualhub-dualcloud.rst
diff --git a/docs/configexamples/firewall.rst b/docs/configexamples/rst-firewall.rst
index 6968eb04..6968eb04 100644
--- a/docs/configexamples/firewall.rst
+++ b/docs/configexamples/rst-firewall.rst
diff --git a/docs/configexamples/fwall-and-bridge.rst b/docs/configexamples/rst-fwall-and-bridge.rst
index 134dd6c0..134dd6c0 100644
--- a/docs/configexamples/fwall-and-bridge.rst
+++ b/docs/configexamples/rst-fwall-and-bridge.rst
diff --git a/docs/configexamples/fwall-and-vrf.rst b/docs/configexamples/rst-fwall-and-vrf.rst
index bd97e1ad..bd97e1ad 100644
--- a/docs/configexamples/fwall-and-vrf.rst
+++ b/docs/configexamples/rst-fwall-and-vrf.rst
diff --git a/docs/configexamples/ha.rst b/docs/configexamples/rst-ha.rst
index 2f7bd4a4..2f7bd4a4 100644
--- a/docs/configexamples/ha.rst
+++ b/docs/configexamples/rst-ha.rst
diff --git a/docs/configexamples/index.rst b/docs/configexamples/rst-index.rst
index b5985d7f..b5985d7f 100644
--- a/docs/configexamples/index.rst
+++ b/docs/configexamples/rst-index.rst
diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst
index 1f02da8e..1f02da8e 100644
--- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst
+++ b/docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst
diff --git a/docs/configexamples/ipsec-cisco-policy-based.rst b/docs/configexamples/rst-ipsec-cisco-policy-based.rst
index 257d98a1..257d98a1 100644
--- a/docs/configexamples/ipsec-cisco-policy-based.rst
+++ b/docs/configexamples/rst-ipsec-cisco-policy-based.rst
diff --git a/docs/configexamples/ipsec-cisco-route-based.rst b/docs/configexamples/rst-ipsec-cisco-route-based.rst
index 553c5e2a..553c5e2a 100644
--- a/docs/configexamples/ipsec-cisco-route-based.rst
+++ b/docs/configexamples/rst-ipsec-cisco-route-based.rst
diff --git a/docs/configexamples/ipsec-pa-route-based.rst b/docs/configexamples/rst-ipsec-pa-route-based.rst
index 96349d98..96349d98 100644
--- a/docs/configexamples/ipsec-pa-route-based.rst
+++ b/docs/configexamples/rst-ipsec-pa-route-based.rst
diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/rst-l3vpn-hub-and-spoke.rst
index 90a036d8..90a036d8 100644
--- a/docs/configexamples/l3vpn-hub-and-spoke.rst
+++ b/docs/configexamples/rst-l3vpn-hub-and-spoke.rst
diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/rst-lac-lns.rst
index 5f344d54..5f344d54 100644
--- a/docs/configexamples/lac-lns.rst
+++ b/docs/configexamples/rst-lac-lns.rst
diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/rst-nmp.rst
index 8945a9f4..8945a9f4 100644
--- a/docs/configexamples/nmp.rst
+++ b/docs/configexamples/rst-nmp.rst
diff --git a/docs/configexamples/ospf-unnumbered.rst b/docs/configexamples/rst-ospf-unnumbered.rst
index 6a5a1bb4..6a5a1bb4 100644
--- a/docs/configexamples/ospf-unnumbered.rst
+++ b/docs/configexamples/rst-ospf-unnumbered.rst
diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.rst b/docs/configexamples/rst-policy-based-ipsec-and-firewall.rst
index dcf59af9..dcf59af9 100644
--- a/docs/configexamples/policy-based-ipsec-and-firewall.rst
+++ b/docs/configexamples/rst-policy-based-ipsec-and-firewall.rst
diff --git a/docs/configexamples/pppoe-ipv6-basic.rst b/docs/configexamples/rst-pppoe-ipv6-basic.rst
index cc14451c..cc14451c 100644
--- a/docs/configexamples/pppoe-ipv6-basic.rst
+++ b/docs/configexamples/rst-pppoe-ipv6-basic.rst
diff --git a/docs/configexamples/qos.rst b/docs/configexamples/rst-qos.rst
index 96448dd4..96448dd4 100644
--- a/docs/configexamples/qos.rst
+++ b/docs/configexamples/rst-qos.rst
diff --git a/docs/configexamples/segment-routing-isis.rst b/docs/configexamples/rst-segment-routing-isis.rst
index 86cbec26..86cbec26 100644
--- a/docs/configexamples/segment-routing-isis.rst
+++ b/docs/configexamples/rst-segment-routing-isis.rst
diff --git a/docs/configexamples/site-2-site-cisco.rst b/docs/configexamples/rst-site-2-site-cisco.rst
index e8322002..e8322002 100644
--- a/docs/configexamples/site-2-site-cisco.rst
+++ b/docs/configexamples/rst-site-2-site-cisco.rst
diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/rst-wan-load-balancing.rst
index d03d4ed9..d03d4ed9 100644
--- a/docs/configexamples/wan-load-balancing.rst
+++ b/docs/configexamples/rst-wan-load-balancing.rst
diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/rst-zone-policy.rst
index 7ea33b95..7ea33b95 100644
--- a/docs/configexamples/zone-policy.rst
+++ b/docs/configexamples/rst-zone-policy.rst
diff --git a/docs/configexamples/segment-routing-isis.md b/docs/configexamples/segment-routing-isis.md
new file mode 100644
index 00000000..41ba2389
--- /dev/null
+++ b/docs/configexamples/segment-routing-isis.md
@@ -0,0 +1,277 @@
+---
+lastproofread: '2023-04-10'
+---
+
+(examples-segment-routing-isis)=
+
+# Segment-routing IS-IS example
+
+When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this
+blue print as an initial setup to get MPLS ISIS-SR working between those two
+devices.The lab was build using {abbr}`EVE-NG (Emulated Virtual
+Environment NG)`.
+
+:::{figure} /_static/images/vyos-sr-isis.webp
+:alt: ISIS-SR network
+
+ISIS-SR example network
+:::
+
+The below configuration is used as example where we keep focus on
+VyOS-P1/VyOS-P2/XRv-P3 which we share the settings.
+
+## Configuration
+
+- VyOS-P1:
+
+```none
+set interfaces dummy dum0 address '192.0.2.1/32'
+set interfaces ethernet eth1 address '192.0.2.5/30'
+set interfaces ethernet eth1 mtu '8000'
+set interfaces ethernet eth3 address '192.0.2.21/30'
+set interfaces ethernet eth3 mtu '8000'
+set protocols isis interface dum0 passive
+set protocols isis interface eth1 network point-to-point
+set protocols isis interface eth3 network point-to-point
+set protocols isis level 'level-2'
+set protocols isis log-adjacency-changes
+set protocols isis metric-style 'wide'
+set protocols isis net '49.0000.0000.0000.0001.00'
+set protocols isis segment-routing maximum-label-depth '8'
+set protocols isis segment-routing prefix 192.0.2.1/32 index value '1'
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth3'
+set system host-name 'P1-VyOS'
+```
+
+- XRv-P3:
+
+```none
+hostname P3-VyOS
+interface Loopback0
+ ipv4 address 192.0.2.3 255.255.255.255
+!
+interface GigabitEthernet0/0/0/1
+ mtu 8014
+ ipv4 address 192.0.2.6 255.255.255.252
+!
+interface GigabitEthernet0/0/0/2
+ mtu 8014
+ ipv4 address 192.0.2.18 255.255.255.252
+!
+router isis VyOS
+ is-type level-2-only
+ net 49.0000.0000.0000.0003.00
+ log adjacency changes
+ address-family ipv4 unicast
+  metric-style wide
+  segment-routing mpls
+ !
+ interface Loopback0
+  passive
+  address-family ipv4 unicast
+   prefix-sid index 3
+  !
+ !
+ interface GigabitEthernet0/0/0/1
+  point-to-point
+  address-family ipv4 unicast
+  !
+ !
+ interface GigabitEthernet0/0/0/2
+  point-to-point
+  address-family ipv4 unicast
+  !
+ !
+!
+```
+
+- VyOS-P2:
+
+```none
+set interfaces dummy dum0 address '192.0.2.2/32'
+set interfaces ethernet eth2 address '192.0.2.17/30'
+set interfaces ethernet eth2 mtu '8000'
+set interfaces ethernet eth3 address '192.0.2.26/30'
+set interfaces ethernet eth3 mtu '8000'
+set protocols isis interface dum0 passive
+set protocols isis interface eth2 network point-to-point
+set protocols isis interface eth3 network point-to-point
+set protocols isis level 'level-2'
+set protocols isis log-adjacency-changes
+set protocols isis metric-style 'wide'
+set protocols isis net '49.0000.0000.0000.0002.00'
+set protocols isis segment-routing maximum-label-depth '8'
+set protocols isis segment-routing prefix 192.0.2.2/32 index value '2'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set system host-name 'P2-VyOS'
+```
+
+This gives us MPLS segment routing enabled and labels forwarding :
+
+```none
+vyos@P1-VyOS:~$ show mpls table
+Inbound Label  Type        Nexthop               Outbound Label
+-----------------------------------------------------------------
+15000          SR (IS-IS)  192.0.2.6             implicit-null
+15001          SR (IS-IS)  192.0.2.22            implicit-null
+15002          SR (IS-IS)  fe80::5200:ff:fe04:3  implicit-null
+16002          SR (IS-IS)  192.0.2.6             16002
+16003          SR (IS-IS)  192.0.2.6             implicit-null
+16011          SR (IS-IS)  192.0.2.22            implicit-null
+
+vyos@P2-VyOS:~$ show mpls table
+Inbound Label  Type        Nexthop     Outbound Label
+-------------------------------------------------------
+15000          SR (IS-IS)  192.0.2.18  implicit-null
+16001          SR (IS-IS)  192.0.2.18  16001
+16003          SR (IS-IS)  192.0.2.18  implicit-null
+16011          SR (IS-IS)  192.0.2.18  16011
+
+RP/0/0/CPU0:P3-VyOS#show mpls forwarding
+Tue Mar 28 17:47:18.928 UTC
+Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
+Label  Label       or ID              Interface                    Switched
+------ ----------- ------------------ ------------ --------------- ------------
+16001  Pop         SR Pfx (idx 1)     Gi0/0/0/1    192.0.2.5       0
+16002  Pop         SR Pfx (idx 2)     Gi0/0/0/2    192.0.2.17      0
+16011  16011       SR Pfx (idx 11)    Gi0/0/0/1    192.0.2.5       0
+24000  Pop         SR Adj (idx 1)     Gi0/0/0/1    192.0.2.5       0
+24001  Pop         SR Adj (idx 3)     Gi0/0/0/1    192.0.2.5       0
+24002  Pop         SR Adj (idx 1)     Gi0/0/0/2    192.0.2.17      0
+24003  Pop         SR Adj (idx 3)     Gi0/0/0/2    192.0.2.17      0
+```
+
+VyOS is able to check MSD per devices:
+
+```none
+vyos@P1-VyOS:~$ show isis segment-routing node
+Area VyOS:
+IS-IS L1 SR-Nodes:
+
+IS-IS L2 SR-Nodes:
+
+System ID       SRGB           SRLB            Algorithm  MSD
+---------------------------------------------------------------
+0000.0000.0001  16000 - 23999  15000 - 15999   SPF        8
+0000.0000.0002  16000 - 23999  15000 - 15999   SPF        8
+0000.0000.0003  16000 - 23999  0 - 4294967295  SPF        10
+0000.0000.0011  16000 - 23999  15000 - 15999   SPF        8
+
+vyos@P2-VyOS:~$ show isis segment-routing node
+Area VyOS:
+ IS-IS L1 SR-Nodes:
+
+ IS-IS L2 SR-Nodes:
+
+ System ID       SRGB           SRLB            Algorithm  MSD
+ ---------------------------------------------------------------
+ 0000.0000.0001  16000 - 23999  15000 - 15999   SPF        8
+ 0000.0000.0002  16000 - 23999  15000 - 15999   SPF        8
+ 0000.0000.0003  16000 - 23999  0 - 4294967295  SPF        10
+ 0000.0000.0011  16000 - 23999  15000 - 15999   SPF        8
+```
+
+Here is the routing tables showing the MPLS segment routing label operations:
+
+```none
+vyos@P1-VyOS:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m
+I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m
+I   192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m
+I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m
+I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m
+I   192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m
+I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m
+
+
+vyos@P2-VyOS:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m
+I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m
+I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m
+I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m
+I   192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m
+I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m
+
+RP/0/0/CPU0:P3-VyOS#show route isis
+Tue Mar 28 18:19:16.417 UTC
+
+i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1
+i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2
+i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1
+i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1
+i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2
+```
+
+Information about prefix-sid and label-operation from VyOS
+
+```none
+vyos@P1-VyOS:~$ show isis route prefix-sid
+Area VyOS:
+IS-IS L2 IPv4 routing table:
+
+ Prefix         Metric  Interface  Nexthop    SID  Label Op.
+ ----------------------------------------------------------------------
+ 192.0.2.1/32   0       -          -          -    -
+ 192.0.2.2/32   30      eth1       192.0.2.6  2    Swap(16002, 16002)
+ 192.0.2.3/32   10      eth1       192.0.2.6  3    Pop(16003)
+ 192.0.2.4/30   20      eth1       192.0.2.6  -    -
+ 192.0.2.16/30  20      eth1       192.0.2.6  -    -
+ 192.0.2.20/30  0       -          -          -    -
+ 192.0.2.24/30  30      eth1       192.0.2.6  -    -
+
+ vyos@P2-VyOS:~$ show isis route prefix-sid
+ Area VyOS:
+ IS-IS L2 IPv4 routing table:
+
+  Prefix         Metric  Interface  Nexthop     SID  Label Op.
+  -----------------------------------------------------------------------
+  192.0.2.1/32   30      eth2       192.0.2.18  1    Swap(16001, 16001)
+  192.0.2.2/32   0       -          -           -    -
+  192.0.2.3/32   10      eth2       192.0.2.18  3    Pop(16003)
+  192.0.2.4/30   20      eth2       192.0.2.18  -    -
+  192.0.2.16/30  20      eth2       192.0.2.18  -    -
+  192.0.2.20/30  30      eth2       192.0.2.18  -    -
+  192.0.2.24/30  0       -          -           -    -
+```
+
+Ping between VyOS-P1 / VyOS-P2 to confirm reachability:
+
+```none
+vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1
+PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data.
+64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms
+64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms
+64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms
+64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms
+^C
+--- 192.0.2.2 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3004ms
+rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms
+
+vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2
+PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data.
+64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms
+64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms
+64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms
+64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms
+^C
+--- 192.0.2.1 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3005ms
+rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms
+```
diff --git a/docs/configexamples/site-2-site-cisco.md b/docs/configexamples/site-2-site-cisco.md
new file mode 100644
index 00000000..d8ca2c18
--- /dev/null
+++ b/docs/configexamples/site-2-site-cisco.md
@@ -0,0 +1,170 @@
+(examples-site-2-site-cisco)=
+
+# Site-to-Site IPSec VPN to Cisco using FlexVPN
+
+This guide shows a sample configuration for FlexVPN site-to-site Internet
+Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel.
+
+FlexVPN is a newer "solution" for deployment of VPNs and it utilizes IKEv2 as
+the key exchange protocol. The result is a flexible and scalable VPN solution
+that can be easily adapted to fit various network needs. It can also support a
+variety of encryption methods, including AES and 3DES.
+
+The lab was built using EVE-NG.
+
+## Configuration
+
+### VyOS
+
+- GRE:
+
+```none
+set interfaces tunnel tun1 encapsulation 'gre'
+set interfaces tunnel tun1 ip adjust-mss '1336'
+set interfaces tunnel tun1 mtu '1376'
+set interfaces tunnel tun1 remote '10.1.1.6'
+set interfaces tunnel tun1 source-address '198.51.100.1'
+```
+
+- IPsec:
+
+```none
+set vpn ipsec authentication psk vyos_cisco_l id 'vyos.net'
+set vpn ipsec authentication psk vyos_cisco_l id 'cisco.hub.net'
+set vpn ipsec authentication psk vyos_cisco_l secret 'secret'
+set vpn ipsec esp-group e1 lifetime '3600'
+set vpn ipsec esp-group e1 mode 'tunnel'
+set vpn ipsec esp-group e1 pfs 'disable'
+set vpn ipsec esp-group e1 proposal 1 encryption 'aes128'
+set vpn ipsec esp-group e1 proposal 1 hash 'sha256'
+set vpn ipsec ike-group i1 key-exchange 'ikev2'
+set vpn ipsec ike-group i1 lifetime '28800'
+set vpn ipsec ike-group i1 proposal 1 dh-group '5'
+set vpn ipsec ike-group i1 proposal 1 encryption 'aes256'
+set vpn ipsec ike-group i1 proposal 1 hash 'sha256'
+set vpn ipsec interface 'eth2'
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec options flexvpn
+set vpn ipsec options interface 'tun1'
+set vpn ipsec options virtual-ip
+set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net'
+set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net'
+set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
+set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
+set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
+set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1'
+set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
+set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'
+```
+
+
+### Cisco
+
+```none
+aaa new-model
+!
+!
+aaa authorization network default local
+!
+crypto ikev2 name-mangler GET_DOMAIN
+ fqdn all
+ email all
+!
+!
+crypto ikev2 authorization policy vyos
+ pool mypool
+ aaa attribute list mylist
+ route set interface
+ route accept any tag 100 distance 5
+!
+crypto ikev2 keyring mykeys
+ peer peer1
+  identity fqdn vyos.net
+  pre-shared-key local secret
+  pre-shared-key remote secret
+crypto ikev2 profile my_profile
+ match identity remote fqdn vyos.net
+ identity local fqdn cisco.hub.net
+ authentication remote pre-share
+ authentication local pre-share
+ keyring local mykeys
+ dpd 10 3 periodic
+ aaa authorization group psk list local name-mangler GET_DOMAIN
+ aaa authorization user psk cached
+ virtual-template 1
+!
+!
+!
+crypto ipsec transform-set TSET esp-aes esp-sha256-hmac
+ mode tunnel
+!
+!
+crypto ipsec profile my-ipsec-profile
+ set transform-set TSET
+ set ikev2-profile my_profile
+!
+interface Virtual-Template1 type tunnel
+ no ip address
+ ip mtu 1376
+ ip nhrp network-id 1
+ ip nhrp shortcut virtual-template 1
+ ip tcp adjust-mss 1336
+ tunnel path-mtu-discovery
+ tunnel protection ipsec profile my-ipsec-profile
+ !
+ ip local pool my_pool 172.16.122.1 172.16.122.254
+```
+
+Since the tunnel is a point-to-point GRE tunnel, it behaves like any other
+point-to-point interface (for example: serial, dialer), and it is possible to
+run any Interior Gateway Protocol (IGP)/Exterior Gateway Protocol (EGP) over
+the link in order to exchange routing information
+
+## Verification
+
+```none
+vyos@vyos$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface        IP Address                        S/L  Description
+---------        ----------                        ---  -----------
+eth0             -                                 u/u
+eth1             -                                 u/u
+eth2             198.51.100.1/24                       u/u
+eth3             172.16.1.2/24                     u/u
+lo               127.0.0.1/8                       u/u
+                 ::1/128
+tun1             172.16.122.2/32                   u/u
+
+vyos@vyos:~$ show vpn ipsec sa
+Connection          State    Uptime    Bytes In/Out    Packets In/Out    Remote address    Remote ID              Proposal
+------------------  -------  --------  --------------  ----------------  ----------------  ---------------------  -----------------------------
+cisco_hub-tunnel-1  up       44m17s    35K/31K         382/367           10.1.1.6          cisco.hub.net  AES_CBC_128/HMAC_SHA2_256_128
+
+
+Hub#sh crypto ikev2 sa detailed
+ IPv4 Crypto IKEv2  SA
+
+Tunnel-id Local                 Remote                fvrf/ivrf            Status
+5         10.1.1.6/4500         198.51.100.1/4500         none/none               READY
+      Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK
+      Life/Active Time: 86400/2694 sec
+      CE id: 0, Session-id: 2
+      Status Description: Negotiation done
+      Local spi: C94EE2DC92A60C47       Remote spi: 9AF0EF151BECF14C
+      Local id: cisco.hub.net
+      Remote id: vyos.net
+      Local req msg id:  269            Remote req msg id:  0
+      Local next msg id: 269            Remote next msg id: 0
+      Local req queued:  269            Remote req queued:  0
+      Local window:      5              Remote window:      1
+      DPD configured for 10 seconds, retry 3
+      Fragmentation not configured.
+      Extended Authentication not configured.
+      NAT-T is not detected
+      Cisco Trust Security SGT is disabled
+      Assigned host addr: 172.16.122.2
+```
diff --git a/docs/configexamples/wan-load-balancing.md b/docs/configexamples/wan-load-balancing.md
new file mode 100644
index 00000000..b9357523
--- /dev/null
+++ b/docs/configexamples/wan-load-balancing.md
@@ -0,0 +1,183 @@
+---
+lastproofread: '2021-06-29'
+---
+
+(wan-load-balancing)=
+
+
+# WAN Load Balancer examples
+
+% stop_vyoslinter
+
+## Example 1: Distributing load evenly
+
+The setup used in this example is shown in the following diagram:
+
+```{image} /_static/images/Wan_load_balancing1.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+
+### Overview
+
+> - All traffic coming in through eth2 is balanced between eth0 and eth1
+>   on the router.
+> - Pings will be sent to four targets for health testing (33.44.55.66,
+>   44.55.66.77, 55.66.77.88 and 66.77.88.99).
+> - All outgoing packets are assigned the source address of the assigned
+>   interface (SNAT).
+> - eth0 is set to be removed from the load balancer's interface pool
+>   after 5 ping failures, eth1 will be removed after 4 ping failures.
+
+### Create static routes to ping targets
+
+Create static routes through the two ISPs towards the ping targets and
+commit the changes:
+
+```none
+set protocols static route 33.44.55.66/32 next-hop 11.22.33.1
+set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 
+set protocols static route 55.66.77.88/32 next-hop 22.33.44.1
+set protocols static route 66.77.88.99/32 next-hop 22.33.44.1
+```
+
+
+### Configure the load balancer
+
+Configure the WAN load balancer with the parameters described above:
+
+```none
+set load-balancing wan interface-health eth0 failure-count 5
+set load-balancing wan interface-health eth0 nexthop 11.22.33.1
+set load-balancing wan interface-health eth0 test 10 type ping
+set load-balancing wan interface-health eth0 test 10 target 33.44.55.66
+set load-balancing wan interface-health eth0 test 20 type ping
+set load-balancing wan interface-health eth0 test 20 target 44.55.66.77
+set load-balancing wan interface-health eth1 failure-count 4
+set load-balancing wan interface-health eth1 nexthop 22.33.44.1
+set load-balancing wan interface-health eth1 test 10 type ping
+set load-balancing wan interface-health eth1 test 10 target 55.66.77.88
+set load-balancing wan interface-health eth1 test 20 type ping
+set load-balancing wan interface-health eth1 test 20 target 66.77.88.99
+set load-balancing wan rule 10 inbound-interface eth2
+set load-balancing wan rule 10 interface eth0
+set load-balancing wan rule 10 interface eth1
+```
+
+
+## Example 2: Failover based on interface weights
+
+This example uses the failover mode.
+(wan-example2-overview)=
+
+### Overview
+
+In this example, eth0 is the primary interface and eth1 is the secondary
+interface. To provide simple failover functionality. If eth0 fails, eth1
+takes over.
+
+### Create interface weight based configuration
+
+The configuration steps are the same as in the previous example, except
+rule 10. So we keep the configuration, remove rule 10 and add a new rule
+for the failover mode:
+
+```none
+delete load-balancing wan rule 10
+set load-balancing wan rule 10 failover
+set load-balancing wan rule 10 inbound-interface eth2
+set load-balancing wan rule 10 interface eth0 weight 10
+set load-balancing wan rule 10 interface eth1 weight 1
+```
+
+
+## Example 3: Failover based on rule order
+
+The previous example used the failover command to send traffic through
+eth1 if eth0 fails. In this example, failover functionality is provided
+by rule order.
+(wan-example3-overview)=
+
+### Overview
+
+Two rules will be created, the first rule directs traffic coming in
+from eth2 to eth0 and the second rule directs the traffic to eth1. If
+eth0 fails the first rule is bypassed and the second rule matches,
+directing traffic to eth1.
+
+### Create rule order based configuration
+
+We keep the configuration from the previous example, delete rule 10
+and create the two new rules as described:
+
+```none
+delete load-balancing wan rule 10
+set load-balancing wan rule 10 inbound-interface eth2
+set load-balancing wan rule 10 interface eth0
+set load-balancing wan rule 20 inbound-interface eth2
+set load-balancing wan rule 20 interface eth1
+```
+
+
+## Example 4: Failover based on rule order - priority traffic
+
+A rule order for prioritizing traffic is useful in scenarios where the
+secondary link has a lower speed and should only carry high priority
+traffic. It is assumed for this example that eth1 is connected to a
+slower connection than eth0 and should prioritize VoIP traffic.
+(wan-example4-overview)=
+
+### Overview
+
+A rule order for prioritizing traffic is useful in scenarios where the
+secondary link has a lower speed and should only carry high priority
+traffic. It is assumed for this example that eth1 is connected to a
+slower connection than eth0 and should prioritize VoIP traffic.
+
+### Create rule order based configuration with low speed secondary link
+
+We keep the configuration from the previous example, delete rule 20 and
+create a new rule as described:
+
+```none
+delete load-balancing wan rule 20
+set load-balancing wan rule 20 inbound-interface eth2
+set load-balancing wan rule 20 interface eth1
+set load-balancing wan rule 20 destination port sip
+set load-balancing wan rule 20 protocol tcp
+set protocols static route 0.0.0.0/0 next-hop 11.22.33.1
+```
+
+
+## Example 5: Exclude traffic from load balancing
+
+In this example two LAN interfaces exist in different subnets instead
+of one like in the previous examples:
+
+```{image} /_static/images/Wan_load_balancing_exclude1.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+
+### Adding a rule for the second interface
+
+Based on the previous example, another rule for traffic from the second
+interface eth3 can be added to the load balancer. However, traffic meant
+to flow between the LAN subnets will be sent to eth0 and eth1 as well.
+To prevent this, another rule is required. This rule excludes traffic
+between the local subnets from the load balancer. It also excludes
+locally-sources packets (required for web caching with load balancing).
+eth+ is used as an alias that refers to all ethernet interfaces:
+
+```none
+set load-balancing wan rule 5 exclude
+set load-balancing wan rule 5 inbound-interface eth+
+set load-balancing wan rule 5 destination address 10.0.0.0/8
+```
+
+% start_vyoslinter
+
diff --git a/docs/configexamples/zone-policy.md b/docs/configexamples/zone-policy.md
new file mode 100644
index 00000000..2cd773a9
--- /dev/null
+++ b/docs/configexamples/zone-policy.md
@@ -0,0 +1,417 @@
+---
+lastproofread: '2024-06-14'
+---
+
+(examples-zone-policy)=
+
+# Zone-Policy example
+
+:::{note}
+In {vytask}`T2199` the syntax of the zone configuration was changed.
+The zone configuration moved from `zone-policy zone <name>` to `firewall
+zone <name>`.
+:::
+
+## Native IPv4 and IPv6
+
+We have three networks.
+
+```none
+WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64
+LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64
+DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64
+```
+
+**This specific example is for a router on a stick, but is very easily
+adapted for however many NICs you have**:
+
+- Internet - 192.168.200.100 - TCP/80
+- Internet - 192.168.200.100 - TCP/443
+- Internet - 192.168.200.100 - TCP/25
+- Internet - 192.168.200.100 - TCP/53
+- VyOS acts as DHCP, DNS forwarder, NAT, router and firewall.
+- 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web
+  and mail (SMTP/IMAP) server.
+- 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It
+  can SSH to VyOS.
+- LAN and DMZ hosts have basic outbound access: Web, FTP, SSH.
+- LAN can access DMZ resources.
+- DMZ cannot access LAN resources.
+- Inbound WAN connect to DMZ host.
+
+```{image} /_static/images/zone-policy-diagram.webp
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+The VyOS interface is assigned the .1/:1 address of their respective
+networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30.
+
+It will look something like this:
+
+```none
+interfaces {
+    ethernet eth0 {
+        duplex auto
+        hw-id 00:53:ed:6e:2a:92
+        smp_affinity auto
+        speed auto
+        vif 10 {
+            address 172.16.10.1/24
+            address 2001:db8:0:9999::1/64
+        }
+        vif 20 {
+            address 192.168.100.1/24
+            address 2001:db8:0:AAAA::1/64
+        }
+        vif 30 {
+            address 192.168.200.1/24
+            address 2001:db8:0:BBBB::1/64
+        }
+    }
+    loopback lo {
+    }
+}
+```
+
+
+## Zones Basics
+
+Each interface is assigned to a zone. The interface can be physical or
+virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly
+the same.
+
+Traffic flows from zone A to zone B. That flow is what I refer to as a
+zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations.
+
+Ruleset are created per zone-pair-direction.
+
+I name rule sets to indicate which zone-pair-direction they represent.
+eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN.
+
+In VyOS, you have to have unique Ruleset names. In the event of overlap,
+I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This
+allows for each auto-completion and uniqueness.
+
+In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is
+the firewall itself.
+
+If your computer is on the LAN and you need to SSH into your VyOS box,
+you would need a rule to allow it in the LAN-Local ruleset. If you want
+to access a webpage from your VyOS box, you need a rule to allow it in
+the Local-LAN ruleset.
+
+In rules, it is good to keep them named consistently. As the number of
+rules you have grows, the more consistency you have, the easier your
+life will be.
+
+```none
+Rule 1 - State Established, Related
+Rule 2 - State Invalid
+Rule 100 - ICMP
+Rule 200 - Web
+Rule 300 - FTP
+Rule 400 - NTP
+Rule 500 - SMTP
+Rule 600 - DNS
+Rule 700 - DHCP
+Rule 800 - SSH
+Rule 900 - IMAPS
+```
+
+The first two rules are to deal with the idiosyncrasies of VyOS and
+iptables.
+
+Zones and Rulesets both have a default action statement. When using
+Zone-Policies, the default action is set by the zone-policy statement
+and is represented by rule 10000.
+
+It is good practice to log both accepted and denied traffic. It can save
+you significant headaches when trying to troubleshoot a connectivity
+issue.
+
+To add logging to the default rule, do:
+
+```none
+set firewall name <ruleSet> default-log
+```
+
+By default, iptables does not allow traffic for established sessions to
+return, so you must explicitly allow this. I do this by adding two rules
+to every ruleset. 1 allows established and related state packets through
+and rule 2 drops and logs invalid state packets. We place the
+established/related rule at the top because the vast majority of traffic
+on a network is established and the invalid rule to prevent invalid
+state packets from mistakenly being matched against other rules. Having
+the most matched rule listed first reduces CPU load in high volume
+environments. Note: I have filed a bug to have this added as a default
+action as well.
+
+''It is important to note, that you do not want to add logging to the
+established state rule as you will be logging both the inbound and
+outbound packets for each session instead of just the initiation of the
+session. Your logs will be massive in a very short period of time.''
+
+In VyOS you must have the interfaces created before you can apply it to
+the zone and the rulesets must be created prior to applying it to a
+zone-policy.
+
+I create/configure the interfaces first. Build out the rulesets for each
+zone-pair-direction which includes at least the three state rules. Then
+I setup the zone-policies.
+
+Zones do not allow for a default action of accept; either drop or
+reject. It is important to remember this because if you apply an
+interface to a zone and commit, any active connections will be dropped.
+Specifically, if you are SSH’d into VyOS and add local or the interface
+you are connecting through to a zone and do not have rulesets in place
+to allow SSH and established sessions, you will not be able to connect.
+
+The following are the rules that were created for this example (may not
+be complete), both in IPv4 and IPv6. If there is no IP specified, then
+the source/destination address is not explicit.
+
+```none
+WAN - DMZ:192.168.200.200 - tcp/80
+WAN - DMZ:192.168.200.200 - tcp/443
+WAN - DMZ:192.168.200.200 - tcp/25
+WAN - DMZ:192.168.200.200 - tcp/53
+WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80
+WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443
+WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25
+WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53
+
+DMZ - Local - tcp/53
+DMZ - Local - tcp/123
+DMZ - Local - tcp/67,68
+
+LAN - Local - tcp/53
+LAN - Local - tcp/123
+LAN - Local - tcp/67,68
+LAN:192.168.100.10 - Local - tcp/22
+LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22
+
+LAN - WAN - tcp/80
+LAN - WAN - tcp/443
+LAN - WAN - tcp/22
+LAN - WAN - tcp/20,21
+
+DMZ - WAN - tcp/80
+DMZ - WAN - tcp/443
+DMZ - WAN - tcp/22
+DMZ - WAN - tcp/20,21
+DMZ - WAN - tcp/53
+DMZ - WAN - udp/53
+
+Local - WAN - tcp/80
+Local - WAN - tcp/443
+Local - WAN - tcp/20,21
+
+Local - DMZ - tcp/25
+Local - DMZ - tcp/67,68
+Local - DMZ - tcp/53
+Local - DMZ - udp/53
+
+Local - LAN - tcp/67,68
+
+LAN - DMZ - tcp/80
+LAN - DMZ - tcp/443
+LAN - DMZ - tcp/993
+LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22
+LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22
+```
+
+Since we have 4 zones, we need to setup the following rulesets.
+
+```none
+Lan-wan
+Lan-local
+Lan-dmz
+Wan-lan
+Wan-local
+Wan-dmz
+Local-lan
+Local-wan
+Local-dmz
+Dmz-lan
+Dmz-wan
+Dmz-local
+```
+
+Even if the two zones will never communicate, it is a good idea to
+create the zone-pair-direction rulesets and set default-log. This
+will allow you to log attempts to access the networks. Without it, you
+will never see the connection attempts.
+
+This is an example of the three base rules.
+
+```none
+name wan-lan {
+  default-action drop
+  default-log
+  rule 1 {
+    action accept
+    state {
+      established enable
+      related enable
+    }
+  }
+  rule 2 {
+    action drop
+    log enable
+    state {
+      invalid enable
+    }
+  }
+}
+```
+
+Here is an example of an IPv6 DMZ-WAN ruleset.
+
+```none
+ipv6-name dmz-wan-6 {
+  default-action drop
+  default-log
+  rule 1 {
+    action accept
+    state {
+      established enable
+      related enable
+    }
+  }
+  rule 2 {
+    action drop
+    log enable
+    state {
+      invalid enable
+    }
+  }
+  rule 100 {
+    action accept
+    log enable
+    protocol ipv6-icmp
+  }
+  rule 200 {
+    action accept
+    destination {
+      port 80,443
+    }
+    log enable
+    protocol tcp
+  }
+  rule 300 {
+    action accept
+    destination {
+      port 20,21
+    }
+    log enable
+    protocol tcp
+  }
+  rule 500 {
+    action accept
+    destination {
+      port 25
+    }
+    log enable
+    protocol tcp
+    source {
+      address 2001:db8:0:BBBB::200
+    }
+  }
+  rule 600 {
+    action accept
+    destination {
+      port 53
+    }
+    log enable
+    protocol tcp_udp
+    source {
+      address 2001:db8:0:BBBB::200
+    }
+  }
+  rule 800 {
+    action accept
+    destination {
+    port 22
+    }
+    log enable
+    protocol tcp
+  }
+}
+```
+
+Once you have all of your rulesets built, then you need to create your
+zone-policy.
+
+Start by setting the interface and default action for each zone.
+
+```none
+set firewall zone dmz default-action drop
+set firewall zone dmz interface eth0.30
+```
+
+In this case, we are setting the v6 ruleset that represents traffic
+sourced from the LAN, destined for the DMZ. Because the zone-policy
+firewall syntax is a little awkward, I keep it straight by thinking of
+it backwards.
+
+```none
+set firewall zone dmz from lan firewall ipv6-name lan-dmz-6
+```
+
+DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out
+a bunch at one time.
+
+In the end, you will end up with something like this config. I took out
+everything but the Firewall, Interfaces, and zone-policy sections. It is
+long enough as is.
+
+## IPv6 Tunnel
+
+If you are using a IPv6 tunnel from HE.net or someone else, the basis is
+the same except you have two WAN interfaces. One for v4 and one for v6.
+
+You would have 5 zones instead of just 4 and you would configure your v6
+ruleset between your tunnel interface and your LAN/DMZ zones instead of
+to the WAN.
+
+LAN, WAN, DMZ, local and TUN (tunnel)
+
+v6 pairs would be:
+
+```none
+lan-tun
+lan-local
+lan-dmz
+tun-lan
+tun-local
+tun-dmz
+local-lan
+local-tun
+local-dmz
+dmz-lan
+dmz-tun
+dmz-local
+```
+
+Notice, none go to WAN since WAN wouldn't have a v6 address on it.
+
+You would have to add a couple of rules on your wan-local ruleset to
+allow protocol 41 in.
+
+Something like:
+
+```none
+rule 400 {
+  action accept
+  destination {
+    address 172.16.10.1
+  }
+  log enable
+  protocol 41
+  source {
+    address ip.of.tunnel.broker
+  }
+}
+```
author	Yuriy Andamasov <yuriy@vyos.io>	2026-05-06 23:24:45 +0300
committer	Yuriy Andamasov <yuriy@vyos.io>	2026-05-06 23:24:45 +0300
commit	89f86b481456437f3e9f16895e7408fe460de3f3 (patch)
tree	f1bb09b203d56234c4518e6ab2d7fa5ca8610dec /docs/configexamples
parent	6ce9145fa101e623c61f009c9cf5bb75a8a4a108 (diff)
parent	7cf51e1c2901f6d1b01e9bff194f7188bc29e417 (diff)
download	vyos-documentation-89f86b481456437f3e9f16895e7408fe460de3f3.tar.gz vyos-documentation-89f86b481456437f3e9f16895e7408fe460de3f3.zip